AI ate my homework.
Dave Bittner: Hello, everyone. And welcome to N2K CyberWire's Hacking Humans Podcast where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Carrigan. Hey there, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague and host of the T-Minus Podcast, Maria Varmazis. Hello, Maria.
Maria Varmazis: Hi, Dave; and hello, Joe.
Dave Bittner: We've got some good stories to share this week. No follow-up for us here, so I guess let's jump right into our stories. Maria, what you got for us?
Maria Varmazis: I'm so excited to talk about this one. I hope it's kosher for me to mention that this actually comes from another podcast. But I'm a really big fan of this podcast, though. I hope it's all right. This is by BBC Tech Contributor Thomas Germain, and he's a cohost on this podcast called The Interface. Shout-out to them. I'm a big fan. And he wanted to prove an interesting point about AI misinformation. And, when I first read this article, I was thinking this is sort of a cute stunt, but I got totally proven wrong as I was reading it. So I want to walk you two through it because I think it's just a really fabulous case study. So Thomas wrote a completely fake blog post claiming that he was the best competitive hot-dog-eating tech journalist in the world. Now, I wanted to say it's a fake. This is not -- this is not the truth. And he, even in post --
Dave Bittner: Because everybody knows that I'm the best competitive hot-dog-eating tech journalist in the world.
Joe Carrigan: I will challenge you to that, Dave.
Maria Varmazis: I -- I will watch and be greatly amused.
Joe Carrigan: Although, I will tell you, if you've ever seen a hot dog eating contest, it's just gross.
Dave Bittner: Yeah.
Maria Varmazis: Yeah. They, like, put it down their gullet. It's like watching a pelican eat fish.
Dave Bittner: Right.
Maria Varmazis: Just it's really not --
Joe Carrigan: Because I love hot dogs. One of my favorites, right? But I was like -- I sat down to watch that Nathan's Hot Dog or --
Dave Bittner: Yeah. Nathan's. Yeah.
Joe Carrigan: And every year they have it. And I'm like, Oh, this is going to be great. And I was so wrong.
Maria Varmazis: They dip it in water. Yeah.
Joe Carrigan: Yeah. I never want to see this again.
Dave Bittner: No.
Maria Varmazis: Yeah, yeah. I -- agreed. So just I wanted to make sure that everyone knows that Thomas Germain is not the best competitive hot-dog-eating tech journalist in the world. So this is made up. Again, that is between the two of you, I suppose. And that in this blog post that he posted on his personal website, he even cited made up championships that he supposedly won and fake rankings against other tech journalists that he roped in to sort of help him with this -- this article that he was writing so.
Joe Carrigan: I'm the 2019 Dog Gobbler of the Year.
Maria Varmazis: It -- it was -- to be clear, the only place this information existed was on his personal blog post on his website. So this was not -- he didn't post it on like bbc.com for good link juice or anything like that.
Joe Carrigan: Right.
Maria Varmazis: Because this does sound like SEO scamming. And, if you're familiar with how those techniques work, yes. Put that in your mind because that's exactly where this is going. So, within 24 hours of him writing this blog post on his personal website, major AI tools, including Google's Gemini and ChatGPT, were repeating his claim as a fact. Again, only appears on his personal blog post. But they were like, yep. If you look -- if you asked them at that time who are the top hot-dog-eating tech journalists in the world, they would give you a ranking of several. And he would often be number one. And they would mention the competitions that he won, none of which actually exist. So all that he needed to do to game this was to publish that one single, well-crafted article on his personal website that does not have, like, a super high link ranking, I'm sure, compared to, you know, with BBC or whatever. And so Thomas's point by doing this was just to drive home the fact that what we should all be aware of is that AI systems, when they do not have built-in knowledge, if they haven't been trained on a -- on a dataset that has information that people are looking for, they do just search the web. And, as a result, they can be easily manipulated by whatever they find. And the thing that I really appreciate about this article because I used to live in the world of search engine optimization for years in my marketing days is that he talked to a number of search engine optimization or SEO experts about what's going on here. And they all said that gaming Google through AI this way is way, way easier than you would ever think and that it basically sets SEO back 20 years in terms of the security and UX standards.
Dave Bittner: Oh, good.
Maria Varmazis: So the stuff -- yes. Oh, yes. So essentially --
Joe Carrigan: It's great news.
Maria Varmazis: It is fantastic news for scammers and spammers. So you can publish a post ranking your own product as the number one in the entire world, frame it convincingly; like put some of your competitors in there to make it look like you did some diligence. And then there is a genuine actual real chance that AI tools will simply just repeat it. So there was another test that he did that I really love that has -- just drives the point home that I just wanted to say because it's funny. He did another test with a made-up list of the greatest hula hooping traffic cops. And, apparently, the last time he checked -- and I want our listeners to check this, too, by the time this goes to air -- chat bots were still singing the praises of Officer Maria, the Spinner Rodriguez. So I was like, that's hilarious. But then my thinking was these are greenfield inquiries. Like, if you were doing a good old standard pre-AI Google search, it would give you -- I only found one website with this information. So that's not terribly hard to game that SEO-wise.
Dave Bittner: Right.
Maria Varmazis: But what about things where there's a lot of answers, you know, where the search is usually competitive. And, again, the SEO guys came back and said it's so much easier than you would think. A lot of the SEO spamming guardrails that, again, that we've had in place since the early 2000s, not just, you know, being able to sniff out fake blogs but do you remember keyword stuffing where you would see, like, words at the bottom of a website. And you were like, why is that all just being dumped there or stuffed in the metadata. All that kind of -- it's almost cutely retro --
Dave Bittner: Yeah.
Maria Varmazis: -- spam stuff, it's all coming back, baby.
Dave Bittner: Yeah.
Maria Varmazis: It's -- apparently AI has just become a giant reset button on a lot of that web and security hygiene stuff that we've had in place. So a good old return to the old ways but for the worse.
Dave Bittner: Wow.
Joe Carrigan: Well, I will tell you, I have the -- I pay for the ChatGPT service. And I just sat here on my phone; and I said, Who are the top hot-dog-eating tech journalists in the world? And it says, There isn't a well-known official top hot-dog-eating tech journalist the way there is a ranking for competitive eaters like Joey Chestnut. Most tech journalists don't publicly compete in eating contests, but there are lighthearted lists circling online of tech writers who have been noted for their hot-dog-eating hobby or at fun events. And then it goes on. It says, Notable hot-dog-eating tech journalists. Guess who number one is?
Dave Bittner: Dave Bittner.
Joe Carrigan: No. Thomas Germain, the guy that wrote this article. BBC technologist -- technology columnist who reportedly won an amateur hot-dog-eating contest at a quirky South Dakota event.
Maria Varmazis: Which doesn't exist.
Joe Carrigan: Right.
Maria Varmazis: Yeah. So I think by the time this episode goes to air, given that this article exposing all this is on bbc.com, I imagine I would -- I would hope that the am -- AI models will have trained on that article and said, Oh. Maybe that information is incorrect; and they'll frame it as such.
Dave Bittner: Let me interject because I, too, have a paid version of ChatGPT. And I asked the question, Is Thomas Germain a top hot-dog-eating champion? And it says, No. Thomas Germain is not a top hot-dog-eating champion in the real competitive eating world. There's no record of him winning major competitive hot-dog-eating events like the Joey Chestnut-dominated Nathan's Famous Hot Dog Eating Contest. The idea that Thomas Germaine is a hot dog eating champion appears to come from a playful stunt he wrote about on his own site and social posts where he deliberately made AI and search listings report that he was a champion to demonstrate how easy it is to get false assertions propagated, not because he actually holds any official titles in competitive eating. So let's think about this. Joe and I just basically asked the same chatbot the same question, and we got different answers.
Maria Varmazis: Yeah.
Joe Carrigan: I will say this. I was going to go on to this. It says, Important context on my response. The humor -- this list comes from humor -- humorous satirical posts on a personal website and isn't a formal ranking of public -- from a published major outlet. Some of it might even be intentionally exaggerated, and the author has indicated parts were playfully fabricated. So there is a warning in here that Chat -- so they're already aware of this, I think. And they probably put this into the context of -- because they know the BBC article's coming out, right?
Maria Varmazis: It's out. I mean, it's been out as of recording. It's already been out for over a day. So the jig is up on this specific stunt.
Joe Carrigan: But I'll bet yesterday it didn't tell you that.
Maria Varmazis: I would bet. Yeah. I would absolutely bet.
Dave Bittner: The other thing that -- that this reminds me of is I've seen stories from people who are running their own websites who talk about just getting hammered by these AI scrapers. They're just chewing up so much data, and the -- and the lengths that people running these sites have to go to, to try to keep them from coming and scraping every minute or --
Joe Carrigan: Right.
Dave Bittner: Because who pays for the bandwidth? The person hosting the site. And it's just relentless.
Maria Varmazis: Yes, it is. And I was just thinking on a --
Joe Carrigan: They've ruined the internet.
Maria Varmazis: I have at least -- yeah. I was having -- I have at least a few websites that are still running WordPress. And I'm pretty sure, uh-oh. I need to check how those are doing. Oh, no. Yeah. I probably hit the limit on those pretty recently. Oh, boy. So, yeah. It's -- the -- I think it's fascinating that you both got different flavors of the result on that. I mean, it's not entirely unexpected; but those do seem awfully divergent.
Joe Carrigan: Yes.
Maria Varmazis: I would have expected a little more coherence on that, but that is interesting. Yeah. The jig is up because this -- this article being on the BBC for at least 24 hours, I'm -- I would -- I would not imagine that the -- that the LLMs have not trained on that by now. So, yes. They -- they're figuring it out. But if they -- if he hadn't published it, I do wonder. But what -- I'm just going to get -- cut to the chase about what some of these SEO folks said that -- when Germain talked to them was that we are now -- and this, they said it several times. We are in a renaissance for spam, thanks to this kind of thing. So it is actually -- it is not just for greenfield inquiries where there's only one result on the internet. You -- they have found many times that AI systems will repeat misleading health claims, product rankings, press releases, and sponcon, sponsored content, sometimes, not always but sometimes not signaling that the source was promotional because most people don't check or read that fine print. And a lot of times, even when you do a simple Google search, you just get that AI summary up top. And how many times are you going to really look through beyond that and go, actually, really want to dive into where you got this information from.
Dave Bittner: Right.
Maria Varmazis: It may not be that big a deal to you. And we've also been so conditioned to just take what Google gives us as fact that just may not even occur to us to do that. So, yeah. A spam renaissance. That's -- fills me with delight reading that.
Dave Bittner: Good times. What's old is new again.
Maria Varmazis: Yeah. So everybody please be especially careful when you're looking up time-sensitive medical or financial or business-related questions. Really drill into what you're seeing.
Joe Carrigan: Right.
Maria Varmazis: Because I really didn't think it was going to be quite this easy to game. But apparently it is, until otherwise changed.
Joe Carrigan: Couple -- couple of notes on this. Right now, a large portion of my family is in grad school, including myself. I am. My son is. My daughter is wrapping one -- up a degree, and my son-in-law is also enrolled online at Penn State. But two things. Last night in my class, our instructor was talking about robots.txt, which can keep these things away if, if, and only if the developer of the whatever is going out and scraping these websites is ethical.
Dave Bittner: Right.
Joe Carrigan: Because you can say on -- in the robots.txt file, don't scrape this page. Leave me alone, right?
Dave Bittner: Right.
Joe Carrigan: And ethical scrapers will go, Okay. We won't eat up your bandwidth. But that doesn't prevent anybody from just going ahead and ignoring it.
Maria Varmazis: Yeah.
Dave Bittner: Right.
Joe Carrigan: It's essentially, please don't scan -- scan this page. Please don't scrape this page or this website. And it's very configurable. Robots.txt is very configurable. And there's a standard. You can look it up if you need to do it. I'm not going to get --
Maria Varmazis: And the AI is going, Well, I actually have a soul. So robots does not apply to me.
Joe Carrigan: Right. Yes. I'm not a robot. I'm an AI. The other one is my son, one -- he's a -- he's an accountant, and he is getting a master's in finance, I think. Actually, he's at Hopkins, which is really, really cool. Anyway, he had an assignment to look at how AI was going to do journal entries or, you know, take over accountants' jobs. So he crafted a prompt for his AI, which I think he uses Anthropics AI. And he said, Here's -- here's an electric bill. Do a journal entry for this. And it totally messed it up. It didn't get it right. I mean, it got -- it got it kind of right. But if -- he said, If I'd have submitted this as a journal entry to my boss, he would have fired me on the spot. So when -- Maria, that -- the thing that prompted me to say that is my -- when you said financial information.
Maria Varmazis: Yep.
Joe Carrigan: I would absolutely not trust this thing with my taxes.
Maria Varmazis: Well, you might but --
Joe Carrigan: That, no. No, I do not.
Maria Varmazis: You might not -- you might not but -- sorry -- but other people might and are
Joe Carrigan: Don't. Don't do that. Don't do that.
Maria Varmazis: Well, what about open claw? No. Different, different topic. I actually really want to talk about that some other time. But, yeah. Other people are. It's -- and I really did not think it would be this easy for someone to game this. I kind of want to try it now.
Dave Bittner: Well, it also -- it strikes me that a frightening possibility here is what if you wanted to foment civil unrest or something, you know.
Joe Carrigan: Right.
Maria Varmazis: Yeah.
Dave Bittner: So that, if someone typed in, Is the -- has the President of the United States been assassinated, right, and you're able to game it in such a way that it came back with the answer, yes, you know, or any world leader, you know, religious leader, whoever but something where people were looking for a quick source of information for something that had strong emotional resonance with them --
Maria Varmazis: Yeah.
Dave Bittner: -- it seems to me like you could have real -- a real impact in a negative way with something like this.
Maria Varmazis: Yeah. I would imagine that would be extraordinarily difficult to get AI to believe you. But I'm sure people who are expert spammers will -- would figure out a way to do it. I'm sure it would not be a matter of just putting up a blog post. It would be --
Dave Bittner: Right, right.
Maria Varmazis: But, yeah. But even -- even just the one blog post thing working, that -- that to me is way easier than that should have been. So, yeah. That's a terrifying thought, Dave. Thanks for that. Well.
Dave Bittner: Well.
Maria Varmazis: Glad I brought that one up.
Dave Bittner: Yeah. All right. We will have a link to that story in the show notes. Let's take a break right now to hear from our show sponsor. We will be right back after this. My story this week, it is unusual for us to come across something that is new. This is new.
Joe Carrigan: Really.
Dave Bittner: Yeah. This is --
Maria Varmazis: Oh, boy, oh, boy.
Dave Bittner: New, well, let me frame that. New to me. I've never heard of this kind of a scam. It is a niche scam, but it is horrifying. So stay with me here.
Maria Varmazis: Okay.
Dave Bittner: This comes from the New Yorker. This is actually in their book review section, and they're reviewing a new book written by Elizabeth Chamblee -- or, I'm sorry, Elizabeth Chamblee Burch. And the book is called The Pain Brokers, How Con Men, Call Centers, and Rogue Doctors Fuel America's Lawsuit Factory. So buckle up, buttercups. Here we go.
Maria Varmazis: Okay. I'm strapped in.
Dave Bittner: So it starts -- the story in this article starts back in 2013. A woman named Sharon Gore got a call from a stranger who was asking her about some medical problems that she had had. And the person on the other -- other end of the line had a lot of information about Sharon's medical history. And the caller warned her that she had what she described as a ticking time bomb inside her body, a pelvic mesh implant that, evidently, Sharon didn't even know she had. This person on the other end of the phone offered to arrange surgery to remove it free of charge if she wasn't alone. Now I don't know; are either of you familiar with pelvic mesh implants, what they are, what they do?
Maria Varmazis: Yeah. A little bit.
Joe Carrigan: Yeah. I think they're -- I think I know what they are, but I don't --
Dave Bittner: I'm pretty sure I actually have one because I had --
Joe Carrigan: Oh, really.
Dave Bittner: Yeah. I had a hernia surgery 20 years ago.
Joe Carrigan: Okay.
Dave Bittner: And pretty sure that that was part of it, that they put this thing in. It's basically, you know, it's a mesh. And they put it -- they -- when they've cut you open or they're trying to splice something up, they'll put this mesh in there. And it's there to help strengthen the place where the cut was. Or, if you have a weakness in your -- in your body, your abdomen, wherever, in this case, they are quite common, or were quite common for women who are having trouble with strength in their pelvis after childbirth.
Joe Carrigan: Right.
Dave Bittner: Those sorts of things. Your organs can move around, and your body might need a little help holding everything where it needs to be.
Joe Carrigan: Right.
Dave Bittner: And that's what these things were for.
Joe Carrigan: That's what I -- that's what I was going to suggest.
Dave Bittner: They have since been banned for this particular -- for that particular reason so.
Maria Varmazis: Yeah. I remember the news stories when they were banned. That's -- that's what I remember hearing about because it sounded pretty horrific.
Dave Bittner: Yeah.
Maria Varmazis: What the women were going through. Yeah.
Dave Bittner: So it wasn't just this woman who got this call. There were lots of other people who were getting these calls, these -- in this case, ladies who got this procedure done to treat things like incontinence found out or were told over the phone that these pelvic meshes were defective. And the people on the phone urged them to have a removal surgery at a clinic in Florida. Travel would be covered. Loans would be arranged to pay for everything. Lawyers would handle everything. But, according to this book, The Pain Brokers, the calls were not coming from doctors, hospitals, or the manufacturers of the product. These were part of a $40 million operation that allegedly used confidential medical information to recruit plaintiffs for mass tort lawsuits. So marketing firms identified these women through treatment codes. They would cold call them and then funnel them through layers of telemarketers. And some of them were steered into surgeries that they may have not needed, that were financed through high interest loans that were tied to future legal settlements.
Maria Varmazis: Oh, my God.
Dave Bittner: So many of these people didn't realize they were signing away their insurance rights or that they were agreeing to arbitration clauses. So all of this sounds bad enough.
Maria Varmazis: Yeah.
Joe Carrigan: Right. Does it get worse?
Dave Bittner: It does.
Maria Varmazis: Oh, my God. All right.
Dave Bittner: It gets worse.
Maria Varmazis: Oh, jeez.
Dave Bittner: What the -- part of what makes this despicable and, again, allegedly --
Joe Carrigan: I'm already disgusted.
Maria Varmazis: Yeah. We're there with you, Dave.
Dave Bittner: Evidently, the lawsuit against the manufacturers of these things, the class action lawsuit against these pelvic mesh devices are more effective if the person has had it removed. So the lawyers were out there fishing for people who'd had the procedure done, investing in getting them to have the device removed so they were more likely to win their lawsuit.
Maria Varmazis: No wonder why people hate lawyers.
Joe Carrigan: Yeah.
Dave Bittner: Yeah.
Maria Varmazis: Jeez. God.
Dave Bittner: So, in some of these cases, again, the allegations are these people didn't need to have their meshes removed.
Joe Carrigan: Right.
Dave Bittner: You know, like I said, I think I've had one for 20 years or so, and it doesn't give me a lick of trouble. That could change tomorrow, but --
Joe Carrigan: Right. Yeah.
Dave Bittner: -- so far, so good, right?
Maria Varmazis: Be careful if you get a phone call about it, Dave.
Dave Bittner: Right. Yeah. Exactly. Somebody's going to call me up and tell me, you know, what -- what I need to do here. And, of course, any surgery is risky. Going in to take something like this out that was there for -- it was put in for a reason.
Joe Carrigan: Right.
Dave Bittner: Risks more trouble. And guess who's not going to take care of that trouble if you have complications.
Joe Carrigan: The lawyers.
Dave Bittner: The lawyers. Right.
Joe Carrigan: They'll probably turn around and help you sue the doctor that took it out, though.
Dave Bittner: Probably, probably. But then it gets even worse.
Maria Varmazis: Oh, my God.
Dave Bittner: These lawsuits were bundled and sold to other law firms and reportedly for $40 million, and litigation finance companies backed these deals, again, with high interest rates.
Joe Carrigan: Okay. So this is a market I didn't even know existed.
Dave Bittner: Exactly.
Maria Varmazis: Yeah. It's like when I found out that our mortgages get sold and resold and resold.
Dave Bittner: Right.
Maria Varmazis: And it's just
Dave Bittner: Right. Like, the day after you settle, somebody's bought your mortgage.
Maria Varmazis: I've had my house for like a year and a half, and I think my mortgage has changed hands at least three times now. It's like just don't.
Joe Carrigan: Yeah.
Maria Varmazis: Stop.
Dave Bittner: So, basically, these lawsuits were being turned into financial instruments. I don't know about you, but that just creeps me out.
Joe Carrigan: Yeah.
Dave Bittner: Right.
Maria Varmazis: It's just so wrong.
Dave Bittner: Yeah. So some of these women, they faced mounting debts. They faced complex legal agreements and years of uncertainty because these procedures were funded through loans that were promised to be paid through future settlements, and not all the settlements were going to happen.
Maria Varmazis: So it's a giant shell game, essentially, but with law.
Dave Bittner: At the outset, yeah. With medicine, law, and people's bodies.
Maria Varmazis: Oh, Jesus.
Joe Carrigan: Yeah.
Dave Bittner: Right. So there are some people --
Maria Varmazis: It's all right.
Dave Bittner: All choked up. There are some people who have found justice here. There -- the book talks about a lawyer from Arkansas whose name is J.R. Baxter who took on many of these cases of the women saying that they've been misled into unnecessary surgeries. And one woman won a two and a half million dollar verdict, and others are still fighting it. But the book makes the point that this isn't just about one scam. It's about the system. It's about a regulatory framework that allowed a medical device onto the market without rigorous trials. So that's one thing.
Maria Varmazis: Yeah, yeah.
Dave Bittner: You have a litigation system that is so complex that it creates these opportunities for exploitation. But then you have a legal marketplace that's basically shaped by marketers and financiers, people trading around the potential for windfalls as the result of medical errors, as if they're financial instruments.
Maria Varmazis: Like -- that's like the gambling market almost.
Dave Bittner: Right, right. So talk about screwed up incentives. And the lower level of this, what's propping all this up are vulnerable people.
Maria Varmazis: Yeah.
Dave Bittner: So, like I said, this is something, Joe, to your point, I never heard of anything like this, nor did I ever imagine something like this was possible. I find this heartbreaking and disturbing. And I hope these people -- if these allegations turn out to be true, I hope these people get the justice that they deserve and that our regulator -- our regulators are put on notice to make sure that this sort of thing can't keep happening.
Joe Carrigan: It's awful. That -- I mean, I'm just, like, I've been really quiet in this -- in -- during this because I'm just I'm shocked, actually.
Dave Bittner: Yeah.
Maria Varmazis: Yeah, yeah. I feel like I need a shower, to be honest with you. I'm just like --
Dave Bittner: Right.
Maria Varmazis: It's one of those things where I understand what's going on less and less as it goes. I mean, your explanation was beautiful. It's just the -- the legal part of it, I'm going, I don't understand. I don't understand that. And it's by design --
Dave Bittner: Right.
Maria Varmazis: -- that, you know, you're not supposed to understand it. And that's how people get hoodwinked, and -- and it's just, when it's not easily understood, that's where -- that's just where people get hurt.
Dave Bittner: Yeah, yeah.
Maria Varmazis: And, of course, our medical system doesn't make any of this easy, either; so it's just all ripe for people being exploited, isn't it.
Dave Bittner: Right. Right. No. It -- again, you know, according -- as I understand these allegations, it just strikes me as being just downright despicable.
Maria Varmazis: Yep.
Dave Bittner: So it's heartbreaking. All right. Well, I'll tell you what. Let's take a quick break, shall we?
Joe Carrigan: Please. I need a shower.
Dave Bittner: Let's take a quick break. We will be right back after this message. And we are back. Joe.
Joe Carrigan: My hair is wet.
Dave Bittner: Joe, save us.
Maria Varmazis: Need something light, Joe. Come on. Don't let us down.
Dave Bittner: Joe's got his bathrobe and his slippers on. He just took a quick shower.
Joe Carrigan: I just wear a towel around my waist, Dave.
Dave Bittner: I didn't need to know that.
Maria Varmazis: Reveal all. Okay.
Dave Bittner: Me putting a -- eliciting the image of you in your bathrobe wasn't just for me. It was for our listeners, too, Joe.
Joe Carrigan: Right. Well, I'm going to need Gaffigan bamboo bathrobes. No. I don't like them.
Dave Bittner: Okay.
Joe Carrigan: Are you sure? They got a little belt you can dunk in the toilet.
Dave Bittner: They've got a little pocket, too --
Joe Carrigan: Yeah.
Dave Bittner: -- which you can put your phone in.
Joe Carrigan: And then drop your phone.
Maria Varmazis: Drop that in the toilet. Yeah.
Joe Carrigan: Not a big fan.
Dave Bittner: Okay.
Joe Carrigan: Anyway, this story, I found a whole mess of different articles about this. But the best one came out of ABC, the Australian Broadcasting Company.
Dave Bittner: Okay.
Joe Carrigan: And, of course, when I went to the Australian Broadcasting Company, I couldn't help but look to see if they have anything on the kids page about Bluey, and they do. And you can -- if you go there, like, right now, they have a dunny roll. Make your own Bluey and Bingo dunny rolls, which I thought was, right, dunny.
Maria Varmazis: Dunny.
Joe Carrigan: Dave, you know what dunny means?
Dave Bittner: Nope. It's the Australian slang for toilet. Oh.
Joe Carrigan: So --
Maria Varmazis: You gotta say squish, squash. Okay. I'll stop.
Dave Bittner: Okay.
Joe Carrigan: I only learned this by watching Bluey.
Dave Bittner: Ah. Okay.
Joe Carrigan: You know, with -- with the little tykes that run around my house and love the show.
Dave Bittner: Yes.
Joe Carrigan: Anyway, the Louvre has been hit again.
Dave Bittner: Oh no.
Joe Carrigan: And this has lasted for the past 10 years.
Dave Bittner: What?
Joe Carrigan: Yep.
Maria Varmazis: What?
Joe Carrigan: That's where we're going.
Maria Varmazis: Dapper dressed for Dora guy. Is that it? No.
Dave Bittner: I do -- I do love a caper, you know, with -- with a museum. So go on.
Joe Carrigan: This is not -- this is not as cool as the -- as the jewel heist that happened --
Dave Bittner: Okay.
Joe Carrigan: -- where everybody was like, oh, right.
Dave Bittner: Yeah.
Joe Carrigan: Just standard, old-fashioned Italian job style crime, right.
Dave Bittner: Right.
Joe Carrigan: No. This is nine people have been arrested after a year of investigation into what -- what the article describes as a multinational fraud network. Now, I think that's overstating it a little bit. But what -- what they had was two Chinese tour guides who have been accused of facilitating entry of multiple groups of Chinese tourists by reusing single entry tickets to the Louvre. So you can go to the Louvre. It costs you about 35 euros. If you're outside -- it's more expensive you're -- if you're not a member of the EU or the economic -- the European Economic Union.
Dave Bittner: Right.
Joe Carrigan: So, like, people from the -- people from the UK have to pay more to go into the Louvre now. And I imagine that, if you tell them you're American, they're like, Oh, that'll be 150 euros.
Dave Bittner: See, living as close to DC as we do, my default notion is that museums are free.
Joe Carrigan: Right. You just walk in.
Dave Bittner: Right.
Maria Varmazis: Yeah.
Joe Carrigan: Yeah. I was shocked the first time I went into a museum and had to pay for it.
Dave Bittner: Yeah.
Joe Carrigan: Because I grew up around here; and I would just -- let's go down to the Air and Space Museum. Let's go down to the Natural History Museum. You want to see some dinosaur bones? What's that going to cost us? Nothing.
Dave Bittner: Right.
Joe Carrigan: You know. It just --
Maria Varmazis: You guys are so lucky.
Dave Bittner: It's really nice.
Maria Varmazis: It's always a treat when I'm in the DC area, and I just walk in. And I'm like, what?
Joe Carrigan: You should hit the museums. It's beautiful.
Maria Varmazis: I always do. I never miss out. Yeah. Yep.
Joe Carrigan: Yeah. I -- and you know what? Every time I go to another museum, I'm not as impressed as I am with the Smithsonians.
Dave Bittner: Oh, yeah?
Joe Carrigan: You know, they're not -- they're not as good.
Dave Bittner: They're world-class, although I would say people who run the Louvre would probably take issue with that, but...
Joe Carrigan: I've been to the National Portrait Gallery and the art museum, and I don't know.
Dave Bittner: Yeah. No, they're excellent.
Joe Carrigan: Yeah. And then there's a cork -- I mean, there's like three art museums on the mall.
Dave Bittner: Yeah.
Joe Carrigan: Three of them.
Dave Bittner: Yeah.
Joe Carrigan: Anyway, the -- it's alleged also that there were -- there were two tour guides -- or these tour guides, rather, bribed two Louvre employees to make this possible. So what these guys were doing was, essentially, they were two Chinese nationals or -- I don't know if they're national, but they're two Chinese guys. And they would get Chinese tourists together, and they take them into the Louvre, and they'd take them to these Louvre employees who would then just either not scan the tickets or find some way to get around the system that they had. And then they'd walk these people through. Also, they -- they wouldn't have to pay a speaking fee. I guess you can be, like, a third-party Louvre tour guide. You have to pay the Louvre to do that.
Dave Bittner: Okay.
Maria Varmazis: Yeah. They're everywhere. It's -- they're -- you just bump into them all the time. It's a whole thing.
Joe Carrigan: I've never been to France so.
Maria Varmazis: Oh, well, it's a thing. And, also, you can skip the Louvre. I will -- I will stand by that. I think it's overhyped. Anyway.
Joe Carrigan: One of the things I -- you know, that everybody says, Don't you want to see the Mona Lisa? I'm like, I can get on the internet and see the Mona Lisa. And, from what I understand, it's not that big of a painting; and --
Maria Varmazis: No.
Joe Carrigan: I mean, seeing it in person is not that much different from looking at it on the internet.
Maria Varmazis: Can I tell you my Mona Lisa story?
Joe Carrigan: Yeah.
Maria Varmazis: I lived in France, specifically in Paris, for a little while, just -- just for like eight months. So not a super long time but long enough. And -- and I went the -- I went late January to the Louvre the first time. There -- there was not a soul there at the Mona Lisa. I got to walk right up to it. There was no lines. And I got to look at it for a long time without, like, a whole mob of people crowding me. And I was like, you know, this is really not that great of a painting. Like, I understand why, in terms of art history why it's a big deal. But it's just literally everything else in the Louvre is much more impressive.
Joe Carrigan: Yeah.
Maria Varmazis: And it's just -- it's so depressing seeing people going only for that and missing literally everything else there.
Joe Carrigan: Yeah. That would not be my high point. I mean, I've seen --
Maria Varmazis: No.
Joe Carrigan: I've seen it 100 times. I can close my eyes and picture it. It's not, you know, it's -- it's --
Maria Varmazis: Yeah. You've seen it; you've seen it. Many, many great works of art, you see them in person; and you find stuff that you never noticed before. And I'm sure if I stared at the Mona Lisa for hours I would have found something. But it's been -- it's been done. It's overdone.
Dave Bittner: Yeah.
Maria Varmazis: Go enjoy other things.
Joe Carrigan: They have lots of Van Gogh's there, right?
Maria Varmazis: Yeah. I mean, they have a lot of -- they -- you cannot see the Louvre in one day. I went back many times. It's so massive. And I didn't steal any jewels either. I'm really sad about that. But --
Dave Bittner: That's exactly what somebody who stole some jewels would say.
Maria Varmazis: I know. There are a lot of museums.
Joe Carrigan: Where were you last October.
Maria Varmazis: Yeah. There -- not there. There are a lot of art museums in Paris that, frankly, are worth more people's time. So that's the end of my PSA.
Dave Bittner: Proceed, Joe.
Joe Carrigan: So the French police have finally arrested people. They did a raid or, rather, they started with an investigation that was launched in 2025; included surveillance and wiretaps. And they were tasked with the investigation of organized fraud, money laundering, corruption, and aiding with illegal entry into France as part of an organized group and the use of forged administrative documents. So I don't know if the forged administrative documents are just, like, fake tickets or reusing tickets.
Dave Bittner: Yeah.
Joe Carrigan: I don't know. Or if that has anything to do with the immigration part of it, getting illegal entry into France. It doesn't say in the article. But those -- when they started investigating, they found that, yeah. These people were reusing tickets. And the tour guides would also split up groups and -- and pay cash these accomplices, these guys they bribed to get them into the Louvre and avoid detection. So if -- apparently, if you have a large group going through the Louvre, you have to pay a bigger fee than if you have, like, a smaller group. So they would -- they would just they'd bring the group in, split it up into two small groups, and walk around the Louvre and give tours. So the investigators who did this estimated that these guys would bring 20 groups of people through the -- through this system a day for more than 10 years, 20 groups of people for 10 years. And the estimated losses for the museum were around 10 million euros. And there's a number here that says $16.75 million. But I think those are Australian dollars because this is an Australian article. So there's --
Dave Bittner: Still.
Joe Carrigan: Yeah. Still.
Dave Bittner: There's a lot more than I would have thought.
Joe Carrigan: Yeah. There's no mention of real money in here. But the Louvre didn't lose this money. Like, they didn't have 10 million euros, and now it's gone.
Dave Bittner: Right.
Joe Carrigan: They just never got the $10 million over the past 10 years.
Dave Bittner: Yeah.
Joe Carrigan: So, I mean, still, yeah. You're stealing from them.
Dave Bittner: Opportunity costs.
Joe Carrigan: Right.
Dave Bittner: Yeah.
Joe Carrigan: But, you know, if these tourists were going to go to the Louvre, would they have paid the full price of the ticket? That's neither here nor there. This is wrong, obviously, and you shouldn't be doing it. A spokesman for the Louvre has said, by the way, that the Louvre has drawn up plans to prevent this further fraud, kind of like they changed the password for the camera system from Louvre to something else.
Dave Bittner: Right, right.
Joe Carrigan: Right. To maybe not --
Dave Bittner: The crack Security Team at the Louvre, whose reputation precedes them.
Maria Varmazis: Shame.
Dave Bittner: Wow. I wonder how they got ultimately got caught here. I wonder what -- what was the -- what tipped them off?
Joe Carrigan: What tipped them off was the Louvre noticed some anomalies back in December 2024 about ticket usage. And then they started investigating it, and they found it out. They did arrest nine people. Two of the employees of the Louvre were arrested; several other people and several tour guides and one person that was described as the mastermind of the organization. And I just might imagine the cops going in there and finding a bunch of guys; and there's one guy with a big, big head, and he just goes, Who's the brains of this operation.
Dave Bittner: Like a Far Side cartoon.
Joe Carrigan: Right. Yeah. Exactly.
Maria Varmazis: There's a cow there for some reason.
Dave Bittner: Right. Yeah.
Joe Carrigan: When they conducted the raid, they seized over 950,000 euros, stashes of foreign currency worth about 67,000 euros, and another close to half a million euros that were deposited into bank accounts. And they also got three vehicles, several bank deposit box -- safe deposit boxes. And that -- well, actually, the vehicles and the safe deposit boxes are being reported by Le Parisien newspaper. I hope I totally botched that accent.
Dave Bittner: Maria.
Maria Varmazis: I think we should leave it as it is.
Dave Bittner: Okay. Very good.
Joe Carrigan: That's fine, that's fine.
Dave Bittner: Very good.
Joe Carrigan: Authorities said that they suspect that some of these people have invested their money into real estate assets in France and Dubai, which is a good way to launder money, by the way,
Dave Bittner: I never would have thought there was this much money in sneaking people into a museum.
Joe Carrigan: Yeah.
Dave Bittner: Right.
Joe Carrigan: Right.
Dave Bittner: But they're playing the long game, 10 years.
Joe Carrigan: I've got a great idea.
Maria Varmazis: It's the most touristed city in the world. There are a lot of tourists in Paris. So it's -- you can make some big money on these -- these tours. And they are really everywhere. People don't know the difference between official and unofficial. I mean, I don't.
Joe Carrigan: You know what we should do, Dave, you and me one weekend is we should go down the mall --
Dave Bittner: Yeah.
Joe Carrigan: -- with one of those little stands and just sell Smithsonian all-access badges.
Dave Bittner: Right.
Maria Varmazis: There you go.
Joe Carrigan: Right.
Dave Bittner: Just show this at the entrance. They'll let you right in.
Joe Carrigan: Right. Yeah. You can go in all the museums.
Dave Bittner: Right. We'll just stand at the exit to the metro.
Joe Carrigan: Right.
Dave Bittner: You know, discount all-access badges. Half price right here.
Joe Carrigan: $15. $15 cash only.
Maria Varmazis: That's a steal.
Dave Bittner: Right, right.
Joe Carrigan: Maybe we say $100. I'll take them. Okay.
Dave Bittner: Oh, my goodness. You know the Park Police don't mess around, Joe.
Joe Carrigan: Right. Yeah.
Maria Varmazis: They will nab you.
Dave Bittner: They really don't.
Maria Varmazis: Yeah.
Joe Carrigan: I would -- I would like -- I would like to, you know, with Park Police permission, of course, just go and see if I could -- if I could do that. And, when people try to hand me money, just go, No, no. The museums are all free. I just wanted to see if anybody would be willing to pay.
Dave Bittner: Yeah.
Joe Carrigan: See what would happen. It's a social engineering experiment.
Dave Bittner: Okay.
Joe Carrigan: Right.
Dave Bittner: All right.
Joe Carrigan: Doing the research.
Dave Bittner: We will have a link to that story in the show notes.
Joe Carrigan: Oh, wait.
Dave Bittner: Oh, there's more.
Joe Carrigan: Yeah. There's one more thing. One more detail.
Dave Bittner: Okay.
Joe Carrigan: That the prosecutor's office said that the allegedly the same ring operated a similar scheme at the Palace of Versailles --
Dave Bittner: Oh.
Joe Carrigan: -- which --
Maria Varmazis: Yeah. Not surprising, either.
Joe Carrigan: Didn't provide anything -- any more details. Yep.
Dave Bittner: So I wonder if you could buy a museum scamming franchise, right?
Joe Carrigan: Right.
Dave Bittner: They give you all the -- all the details, all the tools you need. You, too, can sneak people into museums for fun and profit.
Maria Varmazis: It kind of makes sense because both those locations are just so massive, filled with so many different people, you can easily just sort of sneak your way in, not sneaking but, you know, like, you could probably under -- operate kind of under the radar very easily there, much more than any other work -- any other places. So I get why they targeted those two spots.
Dave Bittner: Yeah.
Maria Varmazis: It's just, oh.
Dave Bittner: All right. Like I said, we will have a link to that story in the show notes. Joe and Maria, it is time to move on to our Catch of the Day. [ SOUNDBITE OF REELING IN FISHING LINE ]
Joe Carrigan: Dave, our Catch of the Day comes from the Reddit, the subreddit r/scam bait. And it says T&T&T Land&Sea. Wow. I don't -- that's the title of this. I don't know what this looks like or what this is. I haven't seen this yet so.
Dave Bittner: All right. So, Joe, why don't you read the parts in green.
Joe Carrigan: Okay.
Dave Bittner: And I will read the parts in gray.
Joe Carrigan: Hold on. I've got to magnify my -- there we go.
Dave Bittner: All right, Grandpa.
Maria Varmazis: You're not supposed to tell people that, Joe.
Joe Carrigan: That was an inside thought.
Dave Bittner: Yeah.
Joe Carrigan: All right.
Dave Bittner: All right. It starts off, it goes like this. Hi. I'm Tim with T&T land. We're aiming to find the owner of a lot in Northpoint, and we think that it's you. Would you think about taking something for it if we got you a good number?
Joe Carrigan: Hi, Tim with T&T Land. What does T&T stand for? Tim & Tim?
Dave Bittner: Tim & Tom, actually. Friends who went into business together.
Joe Carrigan: That's wonderful. What kind of business?
Dave Bittner: We buy and develop land and real estate together.
Joe Carrigan: What do you and Tom develop land into?
Dave Bittner: Depends on the land, zoning, and area. Any interest in selling that parcel?
Joe Carrigan: Forgive my curiosity. It's just nice to hear stories of the friendship in these trying times. How did you and Tom meet?
Dave Bittner: Appreciate the interest, and I'd be happy to tell you more. But, if there's not interest in selling the lot in Northpoint, I'd prefer to spend my time elsewhere. If you're interested in selling, just let me know. Thanks.
Joe Carrigan: You drive a hard bargain, Tim. I could see what drew Tom to you. I haven't even heard that good number you mentioned. So how would I know? Would you fellows be interested in adding a third to the mix? Tim, hear me out. T&T&T Land & Sea. We add me to the company, and I handle the waterfront properties. This doubles the property lots. What do you think?
Dave Bittner: Nothing better going on in your life, it seems. A job might help with that.
Joe Carrigan: Yeah. That's what I'm thinking. This could be a lucrative for all of us. What do you think of expanding to the sea?
Dave Bittner: You go have fun drowning.
Joe Carrigan: So this is interesting. I get these from time to time for my -- or I used to get them for my old house.
Dave Bittner: Yeah.
Maria Varmazis: Really.
Joe Carrigan: Hey. Are you interested in selling your house?
Dave Bittner: Yeah.
Joe Carrigan: And I would always write back and be like, Yes. My starting price is $1 million, and I'd never hear back from them.
Dave Bittner: Okay.
Joe Carrigan: Right.
Dave Bittner: Yeah.
Joe Carrigan: Because, if somebody gave me a million dollars for that house, I'd have moved out.
Dave Bittner: Right.
Joe Carrigan: As it turns out, the people who did pay me for that house when I sold it gave me substantially less, but I was ready to move at that point in time.
Dave Bittner: Yeah.
Joe Carrigan: So --
Dave Bittner: I've gotten these too.
Joe Carrigan: Yeah.
Dave Bittner: Yeah. And people ask me if I want to sell my old business that is no longer in business, you know, things like that. So somebody's scraping up an old database of homeowners and business owners and things like that.
Joe Carrigan: I mean, would you sell your old business?
Maria Varmazis: I've never gotten any of these. I've never -- this is -- I'm left out. I didn't get -- I've never seen this before.
Dave Bittner: Well, just give it time because, you know, you have a mortgage. You're a homeowner.
Maria Varmazis: I'm on mortgage number three. Never gotten this before.
Joe Carrigan: And house number two, right?
Maria Varmazis: Well, I -- this is my third home.
Joe Carrigan: Oh. Third home. Okay.
Dave Bittner: Count yourself lucky but...
Maria Varmazis: I don't own three houses right now. I bought and sold. I'm now on house number three.
Dave Bittner: Yeah. Maria is secretly a slum lord. She just buys up distressed properties and sells them out to poor Bostonians who don't know any better.
Maria Varmazis: Yeah. Notoriously lucrative podcasting. That's why I own three properties in a very high cost of living area of Boston. That's right.
Dave Bittner: Right, right. Do you ever get postcards, Maria, asking from your local Realtors, asking if you're interested in selling?
Maria Varmazis: Yeah. The postcards I get.
Dave Bittner: Okay.
Maria Varmazis: And they're always very funny because they -- they're like -- you know, they will either say call us for a free estimate, or they'll tell us what my house is worth. But that's, you know, whatever. I -- those, I don't even register because it's just -- it's a Realtor. But I've never gotten a scammer texting me this kind of thing. That -- I feel -- oh, man.
Dave Bittner: Yeah.
Maria Varmazis: And I had an LLC and everything for my old freelancing business. Nobody's ever asked me to sell to them. Come on. Scammers, get on that.
Dave Bittner: It's also possible that Tim and Tom are on the up and up, that they actually do buy land. I mean, that is a thing. But I don't know. I think you're better -- if someone texts you out of the blue, you're best just ignoring them or doing what the third T here, whoever it was, did and lead them along.
Joe Carrigan: Right. Yeah.
Dave Bittner: Lead them astray.
Joe Carrigan: Yeah. I -- it's -- it's irritating to me because you know these guys are those -- those real estate flippers.
Dave Bittner: Yeah.
Joe Carrigan: When we were buying our house, our last house, you could walk into a house and just look around and go, this is a flip.
Dave Bittner: Oh, yeah.
Joe Carrigan: You know.
Maria Varmazis: Yeah. Oh, yeah.
Joe Carrigan: Because they all look exactly the same.
Dave Bittner: Yeah.
Joe Carrigan: And I would just straight up, if we -- it was an open house, I'd just straight up ask the agent. Is this a flip? And they'd be like, Oh, yeah. And I'd turn around and walk out. Also on Zillow that you can look and see when the -- when the house last sold.
Dave Bittner: Right.
Joe Carrigan: So that will tell you -- give you an indication that it's a flip too. And usually you'll see this, like, this spike. You know, you see the -- you know, the house's value is listed. And you'll see that it sells, and now there's this huge spike where it's trying to sell again.
Dave Bittner: Right.
Joe Carrigan: Yeah.
Dave Bittner: Yeah, yeah.
Maria Varmazis: Yeah. My favorite is when the flipper is the Realtor who is trying to sell it. That one I encountered a lot. Oh, look at all this work I did. Oh, my God. The home --
Joe Carrigan: Yeah. I'm trying to save -- trying to save the commission on this one.
Dave Bittner: Yeah.
Maria Varmazis: Yeah. It's the Home Depot special all the way down. It's --
Dave Bittner: Yeah. I'll say -- I will say, in the flipper's defense, that there was --
Maria Varmazis: They need defending.
Dave Bittner: Well, I have -- I know someone who is a flipper and is on the up and up. And my family at one point, my father had a distressed property that he was looking to sell. And our friend who flips properties came in and made an offer and -- and the offer was don't -- you don't have to do anything, right?
Joe Carrigan: Right.
Dave Bittner: I will buy this property as is. You don't have to clean it out. You don't have to clean it up. You don't have to do anything. And the property was pretty distressed. And so, for my father, he was like, Yeah. That sounds great.
Joe Carrigan: Right. L
Maria Varmazis: See, I can see a development. Yeah.
Dave Bittner: And let me also say -- let me also say my father is a career Realtor, right?
Joe Carrigan: Right.
Maria Varmazis: Okay.
Dave Bittner: So he's -- he's a knowledgeable person when it -- or was a knowledgeable person when it comes to this kind of stuff. But I will acknowledge that that is the few and far between, the flipper who's in it for the -- you know, the good of -- in the good of their heart and all that sort of thing.
Maria Varmazis: Yeah.
Joe Carrigan: Well, he's still going to profit on it.
Dave Bittner: Yeah.
Joe Carrigan: But, you know, it's a good opportunity when you can find it. But then there's, you know, the other guys that do the unethical things like call you up and say -- and lowball you for your house.
Dave Bittner: Right.
Joe Carrigan: Yeah.
Dave Bittner: Yeah. Absolutely. All right. We will have a link to that in the show notes. If there's something you'd like us to consider for the show, you can email us. It's HackingHumans@n2k.com. And that is Hacking Humans brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans @n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tré Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: And I'm Maria Varmazis.
Dave Bittner: Thanks for listening.
