The Cyber Behavioral Profiler with Cameron Malin

Erin Dietrick: Welcome to SpyCast, the official podcast of the International Spy Museum. I'm Erin Dietrick, and your host is Dr. Andrew Hammond. Every week, we explore some aspect of the past, present, or future of intelligence and espionage. If you enjoy this week's show, please consider leaving us a five star review. Coming up next on SpyCast.

Cameron Malin: Oftentimes, when we think of dark personality characteristics like psychopaths or narcissists, sadists or machiavellians, we tend to think of violent criminals, but through the work that we did in the CBAC, and they continue to do now, there's a really rich understanding of how these aversive personality constructs exist in cyber and counterintelligence offenders. [ Music ]

Erin Dietrick: Fans of Criminal minds, Mindhunter, and Silence of the Lambs, we think you might enjoy this week's episode. You've watched the movies, you've seen the TV shows, and now, it's time to learn about the real deal, the FBI's Behavioral Analysis Unit. And who better to take us through this world than this week's guest, Cameron Malin, the creator and founder of the FBI's Cyber Behavioral Analysis Center? After his over 20-year career with the FBI, Cameron, continued to use the skills he learned in Behavioral Analysis in the private sector, founding the company, Modus Cyberandi, a particularly clever name for a fascinating line of work. In this week's episode, Cameron and Andrew discuss the origins of behavioral profiling, applying behavioral profiling to counterintelligence and cyber threats, nature versus nurture in criminal behavior, and the future of deception in cyber warfare. The original podcast on intelligence since 2006, we are SpyCast. Now, sit back, relax, and enjoy the show. [ Background noise ]

Andrew Hammond: Well, it's a pleasure to speak to you, Cameron. Thanks ever so much for taking the time to talk to us.

Cameron Malin: It's a pleasure to be here, Andrew. Thanks so much for inviting me on.

Andrew Hammond: So, I think- I think the obvious place to start is at the top, what is behavioral profiling. I feel like everybody that listens to this is going to have an idea of what it is, but that idea is probably disproportionately influenced by watching movies and TV shows. So, from someone that actually did it, what is behavioral profiling?

Cameron Malin: Yeah, it's a good question. There's a lot of names for this too. Some may refer it to psychological profiling or criminal profiling. It's formerly known now- now as criminal investigative analysis. And at its basic precept, it's an investigative technique to identify the major personality, behavioral, and psychological characteristics of an offender based upon the crimes that he or she has committed.

Andrew Hammond: Just if we can break that down, what's the behavioral part? What does that mean? So, we can discuss profiling in a second, but what does behavioral mean?

Cameron Malin: So, this is, the behavioral aspect is assessing the way in which an individual acts, and that is cognition, it's emotion, it's a myriad of psychological and emotional and motivational and belief characteristics that the person has. So, when we talk about psychological characteristics, it's a myriad of different things. It could be personality, attitudes, values, beliefs, motivations, self-concept, culture. And the idea there is, from the behavior, you're inferring facts about that during an investigation or you're interpreting those things from patterns that are evident in crime scene behavior.

Andrew Hammond: It must be quite hard to go on a date with this kind of skillset, is it not?

Cameron Malin: Yeah. I mean, it's- it's -- my wife is actually a behavioral profiler too, so I guess it takes two profilers to get along. I don't know.

Andrew Hammond: Okay. Do- do you find it difficult to turn off when you're- when you're meeting people or- or, I don't know, if you have a kid that's introducing their partner to you or something?

Cameron Malin: It- it- it- it really is. It is. You get a lot of training, you get a lot of experience. And it's like anything else, Andrew, once you have that knowledge and once you're so used to using those techniques, it's very hard to just fundamentally turn those things off and not make observations and then, behind those observations, make an assessment. Which isn't to say that everyone I'm talking to or anyone I encounter I'm- I'm assessing them, but you're going to pick up things, you're going to be very observant and it is hard to turn off. I think that's a fair way of describing it.

Andrew Hammond: And what is the profiling part of this? So, we've spoke about behavioral, what's profiling?

Cameron Malin: Yeah, no, that's a good- a good question and it's an important question because, I think when people hear the word profiling, it can have a negative connotation, like sort of like stereotyping, and that's not the case at all. This is- on a basic level, this is developing the behavioral personality and biographical characteristics of an unknown offender, is the traditional way you'd look at it. At a deeper level, this is the process, this is the systematic analysis of an offender's behaviors, their decision-making processes, their emotional responses, and their psychological characteristics. And so, you use these things to help predict how an unknown offender may act in a certain situation or a known offender if you're- you're assessing them for a different reason. And it can provide insights into their personality, their mental state, and their- their underlying motivations, which is often a big part of what we're asked to assess. This- also, Andrew, I think it's- it's important to bring up a couple of concepts with the- the notion of profiling. Oftentimes, you hear inductive or deductive reasoning or profiling. And so, there- in- in behavioral profiling, there is both an inductive profiling process, which is essentially a bottom-down, where you're looking at statistics or research, probabilistic knowledge or your anecdotal information. That's gathered over the years. And the BAU does a lot of research. And you may apply those things and- and start coming up with some general hypotheses and then, you may use deductive profiling, which is more of a top-down process where you're- you're using this type of analysis in the context of a case. And so, those are different processes. It's both a bottom-up and a top-down approach. It's not one or the other. I think, historically, people have looked at behavioral profiling and said, "Well, is it inductive or deductive?" It's both. It's both of those things.

Andrew Hammond: So, you did this at the FBI, right?

Cameron Malin: Right. Exactly.

Andrew Hammond: So, what are the originators of behavioral profiling in the FBI because, this is probably one of the main places that people know it through, the pre- the police procedural shows and so forth where, you know, they bring in the FBI profiler to say X or Y? What are the sort of origins of this in the FBI?

Cameron Malin: Yeah. That's - that's a great question. And no doubt, the FBI has certainly been central and integral to modern behavioral profiling or this criminal investigative analysis process, but there are some notable people, I think are worth mentioning that your listeners would have some interest in and probably know about, but maybe didn't consider in this particular area. The first is Dr. Thomas Bond. And he was a- an English surgeon. And in 1867, he was assigned to the London Metropolitan Police. People know that often as the Scotland Yard. And in 1888, he was asked to look at the inquest into the Whitechapel Murders, so what's known as the Whitechapel Investigation. Some may know this as Jack the Ripper investigation. So, he was a surgeon. He was someone very steeped in psychology as well. And so, he looked into these respective victims known as the Canonical Five. He actually did the autopsy of Mary Jane Kelly, who was one of the Canonical Fives in that case, and he assessed the characteristics and the psychology of the person who may have done those murders. So, he's often considered one of the founding fathers of behavioral profiling or criminal profiling, as is another guy that was around in the late 1800s, in early 1900s, Hans Gross. And Hans Gross, he was an Austrian jurist and he was also a criminologist. He is often recognized as the founding father of profiling, which is weird because you can't have multiple founding fathers, but depending on the context of whom is deciding this or who the- who the opinion comes through. But he wrote a book in 1893. I have the third edition, I don't have a first, but it's called Criminal Investigations: A Practical Textbook. The original is in German and it was translated. Here, he really goes into a deep focus on human nature and the motives of a criminal. And he was a criminologist and a ju- a jurist, basically an investigative judge in Austria, but he really, really focused on human behavior. He's often considered a founding father of this discipline. And then, the last one in more modern times is Dr. James Brussel. And he was a psychiatrist and criminologist. He was oddly the assistant commissioner of the State Department of Mental Hygiene in New York City. But he was brought in on two very important cases where criminal profiling was used. The first, if people are familiar with George Metesky, or he's known as the Mad Bomber -- this was like a 17-year bombing spree in New York City from 1940 to 1957, Dr. Brussel interviewed him, he testified in his trial. And also, he assessed the Boston Strangler, Albert DeSalvo, who killed a bunch of women, 13 women in Greater Boston in the 1960s. And so, he really is considered one of the modern founders of criminal profiling because he did that very thing in those very central cases.

Andrew Hammond: So, it started out with regards to serial killers. Is that a fair statement?

Cameron Malin: Yeah. So, serial killers, certainly, when you look at- at those respective people, the- the- the three I just mentioned, in ter- in terms of the FBI, this started off in the late -- 1972 is the data that- that's- that's often used. This is because, this was the creation of what's known as the Behavioral Science Unit. It's now called the Behavioral Analysis Unit. We can talk about that later if you like. But originally, it was called the Behavioral Science Unit, or the- the BSU, and it was created in '72. And a lot of people often attribute the Behavioral Science Unit to John Douglas. And he is a very important person in the evolution of behavioral profiling, but it was originally created by two different agents, one guy, Howard Teten, and the other, Agent Patrick Mullany. Both of these were special agents. They came in in the late '60s. And Teten was teaching applied criminology at the Headquarters Building in DC starting in '69. The FBI Academy opens in 1972, Patrick Mullany comes in and they start creating this unit where they're applying these behavioral principles towards investigations. And it's in the late 1970s where John Douglas comes in, Robert Ressler, and then, a little bit later, a guy named Roy Hazelwood, very important. They start bringing their own piece to this, their own efforts of understanding what drives serial killers. And they would do what's called road shows. They would go out and they would provide consultation to police officers and law enforcement around the country. The other thing that they would do that was really important in this is, they would go to penitentiaries around the country and they would interview convicted serial killers to figure out how to predict future crimes and how to app- apprehend them faster. And Ressler himself is- is- is often credited for coming up with the term serial killer.

Andrew Hammond: And, you know, just going on to the FBI and behavioral profiling, can you help me just understand a more universal level like, how have the FBI contributed towards the development of behavioral profiling? Because, obviously, there's a lot of serious people there, there's been intensive training, I'm assuming the field has developed just like every other field. Like, help me understand the relationship between the FBI and behavioral profiling at a more universal level.

Cameron Malin: Yeah. So, as I mentioned, the Behavioral Science Unit was created and it eventually evolved. There was a lot of different training, a lot of different people with really steeped backgrounds in psychology came into the unit. There was an effort to create what's called a three-legged stool, which is the consultative work, research, and then training, using these to inform each other, to continue to get better in the unit, to get more fidelity on pysch- psychology concepts and the application in assessing criminals. And over time, this evolved. It got bigger, more units were created. Eventually, in 1985, the Behavioral Science Unit became known what's know- as it is now, as the Behavioral Analysis Unit. And this expanded. From 1985, you had this- this Congressionally mandated National Center for the Analysis of Violent Crime. There were different units. There was Crimes Against Children, there was a unit that was focused on terrorism, there was a unit focused on crimes against adult victim. And through these teams that got a lot of experience, a lot of training and a lot of collaborative analysis, these cases are assessed as teams with profilers over and over, more experience, more training, more research. These things all feed each other to become better and better and better. And what the BAU is known for is providing a lot of training to local, state, and federal law enforcement and bringing those folks in and giving them a background in this, and sort of creating more folks that are steeped in this space.

Andrew Hammond: And just- just briefly, can you tell me a little bit more about the training? So, we're going to on go to discuss your time doing this line of work and- and the- and the line of work that you've done within, but can you tell me a little bit more about how one becomes a behavioral profiler for the FBI?

Cameron Malin: Sure. Yeah. It's a- it's a very competitive place to go. And in a bit, I suppose, it would be helpful to break down what exactly the BAU is. It's actually a bunch of subunits that have their own specialties. It's known as the BAU, but it's actually BAUs because of the number that there are there. But to- to get in, it's quite competitive. Typically, you're- first, you're a special agent. You're going to be doing your field work. You might go to different headquarters units or whatever your specialty is and then you have to put in to one of the units. And it could be that you're someone who specializes in crimes against adults, it could be that you're somebody who specializes in cyber, you apply to become part of that unit. It's very competitive. There's interview processes. But once you get in, if you're selected, there's a very immersive level of training, months and months of -- it's colloquially known as Phase 1 Training where you're classroom-based training. There are some field trips to other places where you're learning from specialists. But you're getting immersive deep training in different areas of psychology, emotion, sociology, abnormal psychology from experts all around the world. A lot of times, you could say this is like a second FBI Academy because, certainly, you go through an academy to become a special agent. But to become a profiler, it's this whole other aspect of training that goes on for approximately four months, give or take. And from there, you become a generalist. So, you're not certified until you go through a very rigorous protocol. You're going to be rotating between units, carrying cases in another unit, becoming a lead profiler on a violation that you may not be going to that unit, but you have to do -- say, if you're cyber, but you might have to do a case in the threat assessment side of the house. You may have to go over and, you know, you have to do cases in every unit until you go through this very rigorous protocol. It's an accredited process, and the certification is- is a rigorous training protocol to get through to get certified.

Andrew Hammond: And how long is that- that final phase?

Cameron Malin: I think in- in total, Andrew, it's- it's generally seen as two years. Some people try to do a harder sprint to get through it, but ultimately, if you were to average it out, it takes someone between 18 months and two years to get certified, sometimes a little bit longer.

Andrew Hammond: So, when you were doing your training, for example, you would go on to the threat -- you would- you- so you would be a cyber specialist, but you would do some time with the criminal profiling and threat assessment and so forth?

Cameron Malin: Yes, exactly. So, even though I knew I was going to a home unit that I would be -- you know, for my career, I would be assessing cyber, I was having to carry cases and be embedded for my period of time, required in different units to carry cases and help out with consultations in that unit. So, I was assigned a crimes against adult case and I would rotate over a crimes against children, then over to the Behavioral Threat Assessment Center, or the BTAC, which is BAU1, go over there and do a terrorism case or a threat assessment case. So, yeah, you have to be a generalist. You have to -- a good profiler is someone who understands people and isn't just somebody who is in a- a very linear niche of what they can do and they -- but once they get out of that space, they can't assess people. You have to be able to assess people. And that's the- the point of that rotation.

Andrew Hammond: And just for our listeners, when you said you have to be a field agent and spend some time in the field, this is, essentially you have to be a "regular" FBI agent first, you have to do time in counterintelligence or counter-terrorism or criminal work or- or something along those lines and then you can apply to a different unit?

Cameron Malin: Exactly, Andrew. Yeah, that's exactly, it is, you graduate from the FBI Academy, you're assigned to your field office as a special agent where you do investigations. And to your point, it could be counterintelligence, criminal, gangs, cyber, counter-terrorism. There's- there's so many different squads and violations the FBI has jurisdiction to investigate and be a part of, task forces. So, you do that work. And- and the average time before you're even considered competitive to get into the BAU, there are some exceptions in either direction. Some people applied very late in their career, maybe 15 years in. I've seen, you know, people come in later. Then, there's some people that come in, say, six to 10 years, but those people, you know, really have to have a storied background and have demonstrated some pretty exemplary work to be competitive. [ Background noise ]

Andrew Hammond: So- so, the time that you have to put in at the FBI as a field agent and then the training, all the different stages of the training, you could be talking the best part of 10 years?

Cameron Malin: Yeah. I was exactly around 10 years when I put in. That is a very, very common amount of time.

Andrew Hammond: Wow. And I'm sure this is a question that you get asked all the time, but please indulge me. So, what do movies like the Silence of the Lambs or Manhunter get most wrong about behavioral profiling? Or, do you start, you know, swearing at the TV when these types of things come on or? Yeah. Help me understand what your take is on these types of movies.

Cameron Malin: So, those are really interesting shows. They're- they're cinematic productions and they're going to make things a little more exciting and traumatic at the expense of realism. But there are two central things that, when I see those shows, particularly, let's use the Manhunter Red Dragon or the Silence of the Lambs, is the big two that you've referred to, there's two things right off the bat that make these kind of unrealistic, but again, they're fun to watch. Let's use Manhunter Red Dragon. In that one, what's pretty unrealistic is the protagonist, Will Graham, he's retired and he's asked to come out of retirement to help with the Tooth Fairy case. That just doesn't happen. When you retire from the FBI as a special agent, it's a whole process. It's a whole administrative process, and you're not just called to come back in sort of at a whim to help out on a case. It's a very unusual thing. If anything, someone else will inherit the case and the case lives on through whoever the new profile or investigator is assigned to it. So, that's very unusual. And the same thing goes with Silence of the Lambs. If you look at that- that movie, Clarice Starling was a new agent trainee at the academy. She's not even a special agent yet and, all of a sudden, she's doing profiling work, which, again, great movie, I think it's called classic, people love it, but that is not very realistic at all. And the other thing that is -- from these movies that's kind of funny is, ultimately if you look at the premise of these movies, the profilers are seeking behavioral consultation from Hannibal Lecter. And so, profilers don't seek consultative advice from a serial killer. There is a lot of research that's been done from speaking to serial killers going back all the way to the 1980s, and interviewing them and learning from them, but there's a very stringent interview institutional review board, or IRB, that applies these. So, you're not going over to a serial killer and asking them to help you consult and get their advice on how to best catch or understand the behavior on a different case. Those- those aspects are- are pretty unusual and don't- don't really stand up to realism too well, but they're fun to watch.

Andrew Hammond: So, you're not going to get like a local police department who are like, "Let's bring in the FBI's behavioral analysis people," and they're like, "Well, we can't help you, but we have a homicidal maniac who can let us go and talk to him?" That doesn't happen?

Cameron Malin: That's the best, that's -- honestly, Andrew, that's the best way of describing why it's- it's- it's unrealistic. But look, let's- let's face it, you know, some of the best scenes from those movies are when they're consulting Hannibal Lecter. He's a really central character, and Anthony Hopkins did a great job in those movies.

Andrew Hammond: And just help me understand the- the different-- the different units, the BAUs rather than the BAU. So, we've got the- the serial killers, which is well known, but there's also one for counterintelligence and then there are some others. Can you tell me what they are?

Cameron Malin: Yes. That's a really good question and one that, I guess, is a little understated when- when people think of the BAU because it's referred to as the- the BAU. That is a very common way that it's described. But it is. It's a number of units. It's in a larger section known as IOSS and then there's a National Center for the Analysis of Violent Crime that houses these five Behavioral Analysis Units. BAU1 is also known as the Behavioral Threat Assessment Center. And this is a multi-agency, national-level, multidisciplinary group that focuses on the prevention of terrorism and targeted violence through behavioral analysis. A fantastic group. Does a lot of cutting edge work for active shooters and other types of violent crime and targeted violence. BAU2, which is where I was, that is the Cyber Behavioral Analysis Center. The Counterintelligence Unit or the Counterintelligence Program, it's known as the Behavioral Analysis Program where the BAP is managed out of that unit. And I can describe that further in a moment as it sounds like you want to look at that a little deeper. BAU3 is Crimes Against Child Victims. BAU4 is Crimes Against Adult Victims. It also has what's known as the Violent Criminal Apprehension Program or- or ViCAP. When people think of BAU, they usually think of BAU4, because that's where Silence of the Lambs and, you know, The Red Dragon and those types of things, Criminal Minds, they all relate to that unit. And then, lastly, BAU5, which used to be BSU or Behavioral Science Unit, got subsumed into the BAU in around 2015. And this is where there's program management, there's strategy, there's research and instruction. So, those folks over there help manage aspects of the other units. That's not an operational unit, that's more of a research program management strategy.

Andrew Hammond: And since we are an intelligence podcast and an intelligence museum, it would be interesting for our listeners to know a little bit more about the counterintelligence aspect of that.

Cameron Malin: Of course. So, the counterintelligence component is known as the- the Behavioral Analysis Program. And this has a really interesting origin because it's not a- in a- a Behavioral Analysis Unit. It was originated in the late- late 1990s in the National Security Branch, Counterintelligence Division. And it operated there for many, many years. It was- it's different. The training's different. It's a collateral duty, meaning, these are not people assigned as profilers, these are people who are special agents in the field and has a collateral duty because of their experience. In national security and counterintelligence cases, they consult on these to understand assets, they- to understand potential espionage, insider threat kind of counterintelligence matters. And eventually, whether it's confusion or just lack of resources, eventually, this became part of the BAUs. So, this was in 2013. It was brought over. It stays as the BAP. So, the Behavioral Analysis Program, which does the counterintelligence assessment with the operators being in the field, is program managed out of BAU2. And the program manager gets the incoming cases and then finds the team of special agents in the field who go out and do the deployment to work on the case. It's sort of the opposite model of the BAU where the case comes in and the profilers in the unit do the assessment and work as a team. But the way that it was born in the 1990s and the way that it's always run is that sort of opposite model because, it wasn't born through the BAU, or the Behavioral Science Unit, it sort of has kept that original formation.

Andrew Hammond: I think this is the point where we- we should move on to your baby, so to speak. So, the Cyber Behavioral Analysis Center, you founded it. Tell us a little bit more about that, when was it set up, why? Tell us about the origins and the- and he early evolution of it, please.

Cameron Malin: Sure, Andrew. So, this- this was created in the fall of 2012. And prior to this, over the years, in the BAUs, there were some efforts to stand up a cyber component, but there just wasn't any tractions -- any traction and those- those groups didn't last. So, when I came to the BAU in the beginning of 2012, there- there was no cyber component. I was in the field when I came to the BAUs. Initially, I was in Los Angeles field office, as I mentioned, for 10 years as a special agent on a cyber squad. And I was selected for the BAU at the end of 2011 and, specifically, BAU1 because, again, there was no cyber component. And I came in under BAU1, which is the- the Behavioral Threat Assessment Center. When I arrived in January, this is when we were getting ready for our- our Phase 1 Program, that educational training to become a profiler. Let's say, the spring of 2012, I was fortunate enough to be asked to help create the cyber component, which became the Cyber Behavioral Analysis Center, or which is known as the CBAC. And this was formally rolled out during a reorganization that happened in the fall of 2012. So, what ended up with those numbers I mentioned of all the different units, which can be sometimes confusing, the CBAC became part of BAU2. And at the time when it was created, during that reorganization, this consisted of the CBAC, but it also consisted of the Behavioral Threat Assessment Center. So, those two centers, those co-centers, worked together in BAU2. And then, eventually, around 2015/2016, it became its own unit. So, BAU2 became the Cyber Behavioral Analysis Center and also had that BAP program as a management piece and then the threat assessment component was brought back into BAU1.

Andrew Hammond: So, initially, I was thinking that maybe this was set up because of the Snowden leaks and the Chelsea Manning leaks, but that- that comes in -- I think that's 2013 or 2014, if I remember correctly, so. So, this is actually set up before those leaks?

Cameron Malin: Yes. Yeah. It was in existence before both of those cases. It is interesting that the leaptivism type matters really became central and very salient in 2013, 2014. But you're correct, yeah, this was stood up in 2012. The thoughts behind it were already percolating in springtime. That's when I, you know, was having those initial conversations like, "Are you up for standing up and, you know, coming up with how this would look and feel." And that was in spring of- of 2012. So, yeah.

Andrew Hammond: And how many people were in it initially and- and where is it now?

Cameron Malin: Oh, this is- this is a great question. It was a very small group when we were created. It initially started with three people. There were myself and another behavioral profiler and a crime analyst. So, it was three of us. And it was that subunit or center along with the Behavioral Threat Assessment Center, which had been pretty robust by that point. That was, I think, formally created in the early 2000s after 9/11. And so, you know, at that point, the- the Behavioral Threat Assessment Center, or the BTAC, was a pretty large group, a very experienced group, whereas, we were nascent, so there were just a few of us. And slowly, but surely, that evolved to the point now where the CBAC currently staffs between 13 to 15 people, whether it's profilers, there's crime analysts, operational psychologists, and computer scientists. So, it has definitely evolved and grown over the years of its existence.

Andrew Hammond: And what are the boundaries of it, Cam- Cameron? Like- like, is it purely domestic, does it- does it do international work? Is it only people inside government? Is it people in industry as well? Just help me understand what the remit is.

Cameron Malin: Yeah. Certainly, we- you know, the- the CBAC looks at insider threats, but the majority of cases are cyber threat actors, and it could be criminal or nation state, national security cases that are responsible for conducting cyber attacks from outside. And because cyber is ubiquitous, and we're seeing it in- from so many different nation states and criminals around the world, this is a global thing. So, the investigations in many senses are- are global. There can be domestic offenders, for sure, or maybe they're co-conspirators with people around the world, but that's sort of the interesting and beautiful thing about cyber, is it is ubiquitous, it's very interesting and it's- it spans the globe.

Andrew Hammond: So, could you just give us a couple of examples so that our listeners can understand that a little bit more, maybe one that's particularly memorable or meaningful or the craziest one? You- you choose a couple to- to help us understand the line of work.

Cameron Malin: Yeah. So, when I was in the unit, I- I had the privilege of working hundreds of cases. You're talking across 11 years. Interestingly, that 11 years, as I mentioned, cyber is ubiquitous, so certainly, I had the privilege of working cyber cases. But with other profilers in BAU4, BAU3, and BAU1, I had the chance to work on violent crime cases against adults and children and threat cases. Because a lot of this can be tricky with- with classification and- and also unadjudicated cases, I think it might be helpful to shape, you know, some of the things, how behavioral profiling was pushed forward with this and give some examples of what came out of these cases. The first, I think, that maybe people don't know about is something known as digital behavioral criminalistics. And this is where you start seeing and assessing human behavior out of digital artifacts and evidence sources. So, traditionally, people think of computer forensics or digital forensics. Digital behavioral criminalistics evolved out of cases that we worked such as, say, the North Korean attack against Sony Pictures or serial murder cases like Todd Kohlhepp out of South Carolina, who would keep women in a Conex container behind his house. This process of meaningfully uncovering and reconstructing offender behavior on a digital evidence evolved out of working these kinds of- of cases. And I would say, the- the other thing -- Andrew, the BAU2 and Cyber Behavioral Analysis Center in terms of the cases and its impact on the evolution of behavioral profiling, the other thing that I don't think the founders of the Behavioral Science Unit would've ever imagined is, it's not just looking at actual cyber attacks. I think that might've been interesting to them generally. I had a chance to meet Robert Ressler's daughter who was in the FBI, and- and she was, you know, really, really complimentary about how proud her father would've been about where we took what he conceptualized in- in the '70s and brought it to cyber. But we also applied this to things like cyber deception and influence and disinformation. So, it's taking what started out of violent crime and evolving that in a space where we're assessing influ- influence operations and in cognitive domain attacks, which is a really awesome extension of behavioral profiling. And I'd say, the last thing that came out of the work in the CBAC that- that continues in a meaningful way is a deeper understanding of dark personality facets in cyber and counterintelligence offenders. I think, oftentimes, when we think of dark personality characteristics like psychopaths or narcissists, sadists or machiavellians, we tend to think of violent criminals, but through the work that we did in the CBAC and they continue to do, now, there's a really rich understanding of how these aversive personality constructs exist in cyber and counterintelligence offenders. And from my time there, I had a chance to directly interview and assess cyber offenders and spies that had these characteristics and certainly had a chance to indirectly assess these folks as well. [ Background noise ]

Andrew Hammond: I mean, it's- it's- it's a question that I'm sure you'll be unable to answer because I don't think anyone can ever definitively answer it, but I'm just thinking about nature and nurture and agency and structure. Are these types -- whether it'd be a serial killer or a cyber offender or someone that's performed a violent act towards a child, which must be particulate of work, are these people, in your experience, made or are they created?

Cameron Malin: This is a great question. And I- I- I appreciate you asking that because that is actually one of the questions that Dr. James Brussel, I mentioned him -- he was the psychiatrist who assessed the Mad Bomber and the Boston Strangler, this was one of the questions he was asked back in the day on a radio program and he demured on that answer. I would say that it's both. Typically, when you see individuals with aversive characteristics that are doing things, people can commit crimes and they- they- they don't necessarily have to be bad people. There's all different reasons why people conduct and commit the acts that they do that the BAU would be involved. But for the really heinous things that you were describing, the- the really challenging serial offense cases, whether it's serial spies or serial murders, there's usually aspects of nature and nurture. From the- the nature standpoint, you would expect to see individuating personality and predisposition issues like personality characteristics, aversive, or personality disorders, it could be something unusual about their self-concept or how they see themselves, it could be their- their formation of attitudes, values, and beliefs, and their personality combined -- all those things combined. And then, from the nurture standpoint, it could be that their- their family history and their- their social relationships and interpersonal engagements have been very challenging, abusive, problematic in many ways. So, a lot of the- the individuals historically that have been studied or showcased, there's going to be elements of both. There are so many people that you and I and everyone listening know that have been through very difficult things in their lives, never go on to commit these kind of crimes. And so, it's usually a constellation of both nature and nurture. It's usually not one or the other per se.

Andrew Hammond: It reminds me a little bit of the X-Files episode, I think it's Clyde Bruckman's final repose where there's this guy who, if he touches someone, he can tell what the future holds for them, how they're going to die, that type of thing. And he bumps into this bellhop in a hotel who happens to be a serial killer and the two of them sort of recognize each other and sit down in the hotel room and have a conversation. And the- the serial killer says to him, you know, "Why do I do the things that I do?" And he said -- the other guy says, "You just don't get it, son, do you? You do the things that you do because you're a homicidal maniac." You know, that's- that's the explanation.

Cameron Malin: I haven't seen that episode, but, yeah, I mean, you're- when you- when you're talking about people who don't feel and think the way we do, Andrew, you know, when you're talking about people with subclinical psychopathy and- and- and whether it's they're sadistic or narcissistic or Machiavellian, the way that they see the world and the way they feel or how -- on an interpersonal level, how they perceive others, those people become instruments. They don't -- they have callous disregard for others. They are seen as something to use and to get benefit from. And so, when you have those kinds of personality disorders, you- you act very differently, and how you talk to people is different. There's the thing that many of us would see. As profilers, when we were asked to do an interview strategy and when you're assessing the offender, you can tell the offender has antisocial personality disorder or psychopathy. And the type of rapport building that you would do, the types of things that might be normal to a- a person without those disorders is not going to register or resonate at all with someone who has psychopathy and antisocial personality disorder where that would not have any sort of connection with them.

Andrew Hammond: Wow. It's really fascinating. And is there like - is there like one book out there that you would recommend our listeners go to look at? So, we're going to discuss your book in a second, Deception in the Digital Age, but if someone just wanted to understand behavioral analysis more generally, is there a book that you would point them towards?

Cameron Malin: I don't know if there's- there's one book per se, but I would say that, if people are interested in maybe some of the darker aspects of personality that I was just describing and getting a better sense of assessing people, I would say Dr. Harris's Snakes in Suits is a good book to read. I would say, if you're interested in behavioral profiling and the origins and the evolution of it, certainly, John Douglas's Mindhunter is a fantastic book. There are more, I don't want to say clinical, but more pragmatic books that Roy Hazelwood and Robert Ressler have written, as well as John Douglas, that get into the more nuts and bolts of behavioral profiling. And then, anything that Dr. Reid Meloy, if you're familiar with him, he's a threat assessor, but he has written A Psychopathic Mind and other books that really dive into the darker characteristics of people.

Andrew Hammond: Wow. And tell us a little bit more about your book, which is quite fascinating. So, Deception in the Digital Age, I mean, it generates all kinds of questions. How's deception easier, how is it more difficult, the amount of people that you can deceive, et cetera. But just tell us like, at the broadest level, what's your- what's your book about and what's the takeaway?

Cameron Malin: Yeah. So, that book was authored in- in 2017. And that book is looking from the beginning of the book all the way through, starting from the psychology of deception to how it's used in influence across nation states, and then the- the future looks of deception. And it covers down on all these various aspects of how deception looks and feels in virtual spaces. I think that the psychology principles and the deception principles of that book are rock solid. But one thing I would say, and- and- and why I'm working on a newer book, is that, that book really didn't try to tackle artificial intelligence because that really wasn't a- a burgeoning space as we're seeing it now. Artificial intelligence has changed the landscape of how people's perception and sense-making can be manipulated. So, that book didn't really cover that in a meaningful way. To follow up to that book is the one I'm writing now. It's coming out in 2025. And that one is called Synthetic Media, Deepfakes, and Cyber Deception: Attacks, Analysis, and Defenses. And that is going to do a very deep treatment on how synthetic media and deepfakes are used to meaningfully shape perceptions and manipulate sense making. I would say, to the idea of it's easier and harder, Andrew, these are really good questions. To the idea of AI, I would say, it has made it easier for digital artifices, whether it's text-based things. You can use ChatGPT or even some of the more malicious versions like WormGPT that will help you write communications that are --, you know, back in the day, you'd hear, "Oh, we have to analyze the text. There's going to be misspellings, there's going to be this or that. It's going to be able to tell, you know, where the person's from." This has changed that fundamentally by using these AI platforms. The other thing is, synthetic media production, deepfake for video and- and audio and generated AI images, these can really deeply manipulate perceptions and beliefs of a target audience. And to me, the deepfakes and synthetic media are really game changing because you're able to shape entire narratives with these things and you're able -- whole cloth, able to fabricate what someone seemingly said or did that can change the way that people act or react to things. So, those are very, very powerful. I would say though that, those that are listening, and yourself as a scholar in the space, that deception does have its benefits in the real world. And with digital deception, you have this sort of primarily visual in 2D in audio, is what you're getting from digital, but there are some ways and perspectives through three-dimension in- in real world that can be leveraged over the internet. And some of the biggest ways, I would say, if I had to give examples, historically, when you look at some of Barton Whaley's work and what's known as the- the Bell and Whaley Ruse Matrix, there's different deceptions and ruses that are used. One is known as hidden fictions or hiding the false. And so, where you would see this mostly is things like from World War I such as a Haversack Ruse or an Operation Mincemeat where the soldier had information and plans of where an invasion was going to happen, but it was actually going to happen someplace else. So, you're hiding a false thing to make the adversary move forward on what appears to be a misfortune. It's very hard to do great Haversack Ruses, or what are known as hidden fictions, in a 2D visual and audio space. So, there are some harder things that you just can't do digitally as elegantly or as powerfully as some of the older ways that deception is used in the real world.

Andrew Hammond: Wow. And- and- and would it be fair to say that one of the wars of the future is going to be the war for reality, people trying to create narratives about the world and- and defining what is real and what is not real and the general public's very difficult task of trying to tell the difference sometimes?

Cameron Malin: Yeah. There -- we're already seeing evidence of that where you're seeing with disinformation and synthetic media and information operations, whether it's in political processes, in influencing elections, hybrid warfare that's being used by nation states. Being able to manipulate perceptions and cause, you know, your adversary to have erroneous sense making and decision making can change the course of conflicts. We're seeing that now, and I think we'll continue to see that as- as part of warfare in the future. And it is indeed a battle for reality.

Andrew Hammond: And what are you up to now, Cameron? What have you done since you left the FBI?

Cameron Malin: So, I- I'm really much continuing in the space of cyber behavioral profiling through a number of businesses, some focusing on deception and cognitive security. I have a company, Modus Cyberandi, which is a cyber behavioral profiling boutique firm that helps assess cyber attackers. The other business is known as Psychological Psyber Labs or Psyber Labs. And we have a- a SaaS platform known as a Deepfake Dashboard where we assess deepfakes through a psychological framework as well as a technical framework. And with these, I also help out with experts. There's a team of experts known as Equivoque, which is a diverse group with artists and magicians and mentalists and architects, and we help develop these very interesting cognitive security immersive experiences. And then, there's very pragmatic things that I do as well, Andrew, through behavioral profiling. It's very helpful. I help out on cases as an expert witness for Park Dietz and Associates and another group called Eagle Security, where we're able to take behavioral profiling and help out in- in matters where there's needed expertise.

Andrew Hammond: Wow. What an incredible and interesting career? And is there that you would -- any parting words of wisdom for our listeners on- on cybersecurity and keeping themselves safe and- and so forth?

Cameron Malin: Yeah, that's a great question. And I think there's some really great positives with this. First, I would say that cybersecurity is inextricable with cognitive security. It's a human thing. And, yes, like a lot of companies or organizations certainly have strong policies and protocols and tools and platforms, but ultimately, the cognitive security, the human aspect is critical and it's probably one of the most vulnerable elements in an organization. The other thing about that with the cognitive security part is, cyber security is a mindset. So, a lot of times, when we get these mandatory training things, I'm sure you get them as well, Andrew, most organizations will have these, it- it sometimes is perceived as something, you know, to- to be angry about or dread or an inconvenience, but it's important to be mindful and consistent with these security processes and- and have that mindset. See it more of a mindset and not be the weak link in the chain as a person versus it being a burden. And lastly, I think going back to something I said earlier with how the founding fathers of the BAUs, or the Behavioral Science Unit, when it was created would never have imagined this, I think we need to think about cybersecurity is- is not just hacking and malware and the things that are the obvious tangible or known weapons that are used in these, it includes mental malware. And I use mental malware sort of as a motif here, but we're talking about cyber influence, operations, and synthetic media, like I mentioned, deepfakes and disinformation. Things that can cause erroneous decision-making that are just as powerful, the impacts of that are just as problematic as what we consider traditional cyber attacks. And I think, people considering cyber within the lens of not just the technical ways it happens, but the mental ways it happens.

Andrew Hammond: Wow. This is -- this is great stuff. I like the idea of mental malware. And this has been a really great conversation. I've really enjoyed speaking to you.

Cameron Malin: Thank you so much, Andrew. It was a pleasure to be on. Thanks so much. [ Music ]

Erin Dietrick: Thanks for listening to this week's episode of SpyCast. Please follow us on Apple, Spotify, or wherever you get your podcasts. If you enjoy the show, please tell your friends and loved ones. Please also consider leaving us a five-star review. Coming up next week on SpyCast.

Male 1: I had been blogging for two years and I- I saw more and more people interested in open source investigation. So, I wanted a site where people could not only write articles and have them published, but also learn how to do open source investigation.

Erin Dietrick: If you have feedback, you can reach us by email at SpyCast at spymuseum.org or on X at INTLSpyCast. If you go to our page, the cyberwyre.com/podcasts/spycast, you can find links to further resources, detailed show notes, and full transcripts. I'm Erin Dietrick, and your host is Dr. Andrew Hammond. The rest of the team involved in the show is Mike Mincey, Memphis Vaughn III, Emily Coletta, Emily Rens, Afua Anokwa, Ariel Samuel, Elliott Peltzman, Tre Hester, and Jen Eiben. This show is brought to you from the home of the world's preeminent collection of intelligence and espionage related artifacts, the International Spy Museum. [ Music ]