Up next in 10
In August 1991, a crowd pulled down the statue of the founder of the Soviet secret police. The statue fell in under an hour. The machine behind it took a little longer.
This is the story of what happened to half a million intelligence officers when the state they served stopped existing — and how their tradecraft was auctioned, repackaged, and eventually rebuilt into something the world had never seen: a criminal organisation that runs on encryption, crypto-laundering and zero-day exploits, protected by the same states that publicly hunt it.
From a peeling apartment in Saint Petersburg where one man robbed a New York bank without leaving his chair, to bulletproof hosting empires, to the ransomware crews that shut down a US fuel pipeline and crippled a national health service — this documentary traces how state intelligence and organised cybercrime stopped being two separate worlds.
Built on court records, indictments, declassified files and published reporting. Where the record is uncertain, we say so.
⏱️ CHAPTERS
00:00 The statue falls — Lubyanka Square, 1991
00:57 Half a million officers, no state
06:02 Saint Petersburg, 1994: the first digital bank heist
15:10 Bulletproof hosting: territory you can't raid
16:05 McColo and the day global spam dropped by two thirds
18:05 The Russian Business Network
19:12 Avalanche: crime as infrastructure
22:34 Inside the FSB's Information Security Center
23:15 The Yahoo indictment: officers and hackers, same payroll
26:16 Treason trials behind closed doors
29:30 Evil Corp, the Lamborghini, and the $5M reward
Show More Show Less View Video Transcript
0:00
Lubyanka Square, Moscow, August the
0:03
22nd,
0:05
1991.
0:07
The statue came down at night with ropes
0:10
and a crowd. Felix Dzerzhinsky,
0:14
the founder of the Soviet secret police,
0:18
had watched over the square for 33
0:21
years. That night, the crowd pulled him
0:25
from his pedestal, and the soldiers
0:28
stationed behind him did nothing.
0:31
Behind the empty pedestal stood the
0:34
building the world called the Lubyanka,
0:37
headquarters of the KGB,
0:40
the largest intelligence machine on
0:42
Earth.
0:43
The statue fell in less than an hour.
0:46
The machine took a little longer. This
0:49
account draws on court records,
0:51
declassified files, published reporting.
0:55
Where uncertain, we say so.
0:58
To understand what happened next, hold
1:02
that image for a moment. The KGB of the
1:06
late Soviet Union employed, by most
1:08
estimates, close to half a million
1:12
people, including
1:14
border troops, signals intelligence, and
1:17
a foreign espionage service that reached
1:19
into every capital in the world.
1:22
In December of 1991,
1:26
the state those people served ceased to
1:29
exist. The agency was split into pieces,
1:33
a foreign intelligence service, an
1:35
internal security service, a
1:38
communications intelligence service, and
1:41
the pieces were smaller, poorer, and
1:43
suddenly
1:45
unsure whose orders they answered to.
1:48
Tens of thousands of officers and
1:51
analysts walked out of the machine in
1:53
the first years after the collapse.
1:56
Some retired, some vanished into the new
2:00
economy.
2:01
The rest, no one counted them.
2:05
That was the problem.
2:09
Almost immediately, the tradecraft went
2:12
on the market. The men who had spent
2:15
their careers inside the KGB's special
2:18
services did not disappear. They formed
2:22
security firms. They ran private armies.
2:25
They sold protection, surveillance, and
2:28
information. The same products
2:31
repackaged for the new economy.
2:34
Even the elite units, the Alpha Group,
2:37
the Vympel Detachment, were reorganized
2:41
and their veterans drifted into the
2:43
private world. In the Russia of the
2:46
1990s,
2:47
the surest customers were the men the
2:50
state now called criminals.
2:52
Journalists who covered the period
2:55
described the same scene in city after
2:58
city.
2:59
Former officers selling their skills to
3:01
the very networks the state had once
3:04
hunted. The line between guarding the
3:07
state and guarding its enemies dissolved
3:11
and nobody moved to redraw it. The
3:13
collapse did not destroy the tradecraft.
3:17
It auctioned it.
3:19
Wiretapping became a commodity you could
3:22
buy by the week. Dossiers changed hands
3:25
the way invoices did. The men who had
3:28
once read the mail of an entire country
3:31
began reading the mail of anyone who
3:34
could pay.
3:35
Those who documented the exodus agree on
3:38
one detail.
3:40
The most dangerous cargo carried out of
3:42
the collapse was never written down.
3:46
Access codes,
3:48
Interception methods, the architecture
3:51
of state systems held in memory by men
3:55
no registry could track.
3:58
What the archives cannot fully show is
4:00
the scale, the point at which individual
4:03
betrayal became an economy.
4:06
But the pattern in retrospect is
4:09
unmistakable. The skills did not vanish
4:12
with the state. They were rented out in
4:15
pieces to whoever needed them most. One
4:19
former officer who later ran a private
4:22
security firm in Moscow
4:24
and who spoke to journalists years
4:27
afterward on condition that his name
4:30
never appear in print, described those
4:33
years in words to this effect.
4:36
>> We were trained to be invisible. After
4:39
the collapse, we discovered that
4:42
invisibility had a price and everyone
4:46
wanted to buy it.
4:49
>> The officer did not say he regretted it.
4:52
That was not the kind of thing men like
4:55
him said.
4:56
But he said something else. He said the
4:59
state had created a generation of
5:01
specialists who knew every secret of the
5:04
old world and owed nothing to the new
5:07
one. The cost of that auction was not
5:10
paid all at once. All at once, nothing
5:14
ever is.
5:15
It was paid in small, ordinary
5:17
transactions. A tapped telephone here, a
5:21
stolen file there, a bodyguard service
5:24
that protected a dealer one year and his
5:27
killer the next.
5:29
By the mid-90s, the mafia of the old
5:32
Soviet world had absorbed the methods of
5:35
the state it had outlived. Informers,
5:38
surveillance,
5:40
disinformation,
5:42
the classic craft now in service of the
5:45
classic racket.
5:47
And in one particular city, the
5:49
machine's final gift was about to be
5:52
delivered to a man who had never carried
5:55
a weapon.
6:00
St. Petersburg,
6:02
1994.
6:04
The city that had fed the Soviet state's
6:07
research machine was now a city of empty
6:10
factories and open markets.
6:13
And in a gray apartment at the end of a
6:16
telephone line,
6:17
a young computer specialist was about to
6:20
do something no one had ever done
6:23
before.
6:24
He was not an intelligence officer. He
6:27
was not a gangster.
6:29
He had simply learned, in the last years
6:32
of the state system, how to make a
6:34
machine do what its owners did not
6:36
expect. His name was Vladimir Levin.
6:41
And in less than a year, he would become
6:43
the first man to rob a major bank
6:46
without leaving his apartment. Here is
6:48
what is known about the apartment.
6:51
It stood in St. Petersburg in the
6:54
mid-90s
6:55
among buildings that had not been
6:57
painted since the state ran out of
6:59
paint.
7:01
Levin was a biochemist by training, a
7:03
computer specialist who had worked
7:05
inside the state's own research system
7:08
before it collapsed.
7:10
Investigators would later describe him
7:13
as quiet, precise, and patient, the
7:16
qualities of a laboratory scientist.
7:20
What he was doing with those qualities,
7:22
no one knew.
7:24
For months, he dialed into the telephone
7:27
lines that connected Citibank in New
7:29
York to its largest corporate customers.
7:32
And the system answered. Consider the
7:35
two ends of that line.
7:38
One end, the most guarded financial
7:41
systems on Earth in the glass towers of
7:44
New York. The other, an apartment with
7:47
peeling wallpaper, a modem, and a man
7:50
trained inside a dying state.
7:53
The entire history of digital crime fits
7:56
in the space between those two rooms.
7:59
The method, as investigators later
8:02
reconstructed it, was less like a heist
8:06
and more like a key left in a lock.
8:09
Citibank's customers called in to manage
8:12
their accounts, moving money with
8:14
account numbers and passwords spoken
8:17
over the line.
8:18
listened, then used what he heard.
8:22
Between June and August of 1994, on at
8:25
least 18 occasions, money moved out of
8:28
accounts at Citibank in New York into
8:32
accounts controlled by his accomplices
8:34
in Finland, the United States, the
8:37
Netherlands, Germany, and Israel. The
8:41
total,
8:42
roughly 10 million dollars in transfer
8:45
requests. The amount actually withdrawn,
8:49
about 400,000.
8:51
The rest was frozen by the time the bank
8:54
understood what was happening. But, the
8:57
damage was already measured in something
9:00
more expensive than money, fear.
9:06
Inside Citibank, the first reaction was
9:09
disbelief. A bank that moved billions
9:12
every day could not be robbed through a
9:15
telephone. That was the assumption, and
9:18
the assumption had a hole in it the size
9:21
of a man in an apartment in St.
9:23
Petersburg. The trail began with the
9:26
phone records.
9:28
Federal agents and Russian investigators
9:31
followed the calls from the bank's lines
9:33
across the Atlantic through the
9:36
switching equipment, and finally to an
9:39
apartment block on the far side of the
9:41
city.
9:42
The evidence scene is unglamorous.
9:46
A stack of call records, a map of
9:48
numbers and names.
9:50
But for the FBI, the case was a
9:53
landmark. The criminal had committed the
9:55
crime
9:56
and had never once left his chair. An
9:59
investigator who worked the case and who
10:02
later described the operation in
10:04
interviews, recalled the strangest
10:07
detail in words to this effect.
10:10
>> Everyone expected a gang, guns, dark
10:14
rooms, boxes of cash. We found one man
10:17
and a telephone bill.
10:20
His
10:21
>> The investigator paused.
10:24
>> That bill was the most expensive
10:26
telephone bill any of us had ever seen.
10:29
>> When agents finally entered the
10:32
apartment, they found a computer, a
10:35
modem, and nothing that looked like a
10:37
crime,
10:39
which the investigator said was the
10:41
point.
10:43
The arrest, when it came, happened far
10:47
from St. Petersburg.
10:49
In March of 1995,
10:52
Levin flew to London and was taken off
10:55
the plane at Heathrow Airport by British
10:58
police acting on an American request.
11:02
He fought extradition for more than 2
11:05
years.
11:06
In January of 1998,
11:09
he pleaded
11:11
guilty in a federal court in New York to
11:14
conspiring to defraud Citibank. Four
11:18
accomplices had already pleaded guilty
11:22
before him.
11:24
In February of that year, the judge
11:28
sentenced him to 36 months in prison
11:32
and ordered him to repay the bank
11:34
roughly $240,000.
11:39
The story, as it was told at the time,
11:42
made him famous.
11:43
The part of the story that mattered came
11:46
later. A security researcher who studied
11:49
the case in the years that followed put
11:52
it plainly.
11:54
Words to this effect:
11:57
>> Levin was a warning the industry refused
12:00
to read correctly. The lesson was not
12:03
that he was brilliant. The lesson was
12:06
that he was ordinary.
12:08
>> Ordinary.
12:10
And remote.
12:12
The newspapers had a simpler story to
12:15
tell. They called him a computer genius,
12:18
a phantom, the first of a new breed.
12:22
That breed had a name before long.
12:26
The Russian hacker.
12:28
It was a label that would follow an
12:30
entire generation of programmers around
12:33
the world, whether they had ever touched
12:36
a bank or not. Here is where the record
12:39
begins to argue with itself. Security
12:43
experts pointed out, almost immediately,
12:47
that Levin had not used the internet at
12:49
all. He had used telephone systems,
12:52
dialing in, listening, and
12:55
reconstructing codes from what he heard.
12:58
The first internet bank robbery, the
13:01
label that made the headlines, was by
13:04
this reading a mistake. It was not a
13:07
hack. It was a wiretap with a bank
13:10
attached.
13:12
The distinction matters because it
13:14
changes the story.
13:16
The first great digital bank heist was
13:18
not committed by a genius breaking
13:21
through walls. It was committed by a
13:24
patient man listening through a door
13:26
that had been left open.
13:28
Both versions of the story are true. The
13:31
files simply do not agree on which one
13:34
matters.
13:40
The strange part of this record is not
13:42
what Leven did. It is how ordinary the
13:46
method looks in hindsight.
13:49
Everything that would define the shadow
13:51
economy of the next 30 years was already
13:54
present in that apartment. Remote
13:57
access, stolen credentials, money moved
14:01
across borders, accomplices who never
14:04
met.
14:05
The tools changed. Encryption replaced
14:08
telephone lines. Cryptocurrency replaced
14:12
numbered accounts.
14:13
The shape of the crime did not change at
14:16
all.
14:22
Seda Bank fixed its systems and spent
14:25
years insisting, correctly, that
14:28
customer accounts had been protected.
14:32
The world moved on.
14:34
Leven served his time and disappeared
14:37
from the record.
14:38
But, the template did not disappear with
14:41
him.
14:42
Within a few years, the skills in that
14:45
apartment had migrated to the one place
14:48
they could not be traced, interrupted,
14:51
or closed. The internet itself.
14:55
And the internet, as it turned out, had
14:58
no central building and no address.
15:02
It had something better.
15:04
It had landlords.
15:06
Every mafia needs territory.
15:09
In the old world, territory was a
15:11
street, a port, a neighborhood, ground
15:14
you could walk on and defend.
15:17
In the new world, the mafia's territory
15:21
was a server that ignored complaints.
15:24
The industry even had a name for it.
15:27
Bulletproof hosting.
15:29
A bulletproof host is an internet
15:31
provider that does what no legitimate
15:34
provider will do. Keeps a client online
15:38
no matter what is said about them.
15:40
Abuse reports ignored. Take down
15:43
requests answered with silence.
15:46
You do not pay a bulletproof host to be
15:48
fast. You pay them to be blind.
15:52
It is the protection racket of the
15:54
internet. And in the 2000s, the racket
15:57
built an empire.
16:03
San Jose, California, November 2008.
16:08
In an unremarkable building, a small
16:11
hosting company called McColo was
16:14
quietly carrying what security
16:16
researchers believed to be a staggering
16:19
share of the world's spam.
16:22
Not the annoying kind. The criminal
16:24
kind. Phishing, malware, botnet command,
16:28
the plumbing of the global racket.
16:31
For years, complaints about McColo's
16:33
customers went nowhere. The company had
16:36
learned that the internet runs on
16:38
paperwork, and that paperwork can be
16:41
ignored.
16:42
Then, a reporter began pulling the
16:44
threads.
16:46
The takedown, when it came, was blunt.
16:49
The companies that supplied McColo's
16:52
connection to the internet cut it off.
16:55
Within hours, the volume of spam
16:57
crossing the planet dropped. By one
17:00
widely cited estimate, by roughly 2/3.
17:04
One building in San Jose
17:07
had been carrying a significant part of
17:10
the entire world's criminal mail.
17:16
A security researcher who tracked the
17:19
takedown at the time described what the
17:22
moment revealed. Words to this effect.
17:27
>> We always imagined the criminal internet
17:30
as something hidden. McColo showed us it
17:34
was just a hosting company with a policy
17:36
of looking the other way.
17:39
>> The researcher paused and added,
17:42
"The most dangerous part of the criminal
17:44
internet is not the encryption.
17:47
It is the paperwork. Everything runs on
17:50
companies that refuse to read it.
17:53
McColo was gone by the end of the week.
17:57
The customers were not. They simply
17:59
moved and took their lesson with them.
18:02
Their next stop was a name that became a
18:04
legend inside security circles. The
18:08
Russian Business Network, known by its
18:10
initials, the RBN.
18:13
The network was registered around 2006
18:17
in St. Petersburg and for several years
18:20
it operated as a kind of dark city
18:23
inside the internet, hosting malware,
18:26
phishing, stolen card shops, and worse.
18:30
When researchers at the security firm
18:32
iDefense published a study of it in
18:35
2007,
18:37
they described something that looked
18:39
less like a company and more like a
18:42
neighborhood. A neighborhood with no
18:44
police.
18:46
The RBN was never fully dismantled. It
18:49
fragmented, evolved, and seeded the next
18:53
generation.
18:54
But, its real contribution was
18:57
architectural.
18:59
It proved that the entire criminal
19:01
internet could be organized around a
19:03
single principle.
19:05
A server that never asks questions. By
19:09
2009,
19:11
that principle had been industrialized.
19:14
The operation that came to define it was
19:16
called Avalanche, a network built to do
19:19
one thing,
19:21
keep criminal infrastructure online,
19:23
hidden, and interchangeable.
19:26
Avalanche used a technique called fast
19:28
flux, constantly changing the addresses
19:31
that pointed to its servers, so that no
19:34
single location could be seized, traced,
19:37
or shut down.
19:39
The malware families that ran on it read
19:42
like a ledger of the era's digital
19:44
rackets,
19:46
the Citadel banking Trojan, the VM Zeus
19:49
family, the Tesla Crypt ransomware, and
19:52
others. For 7 years, investigators
19:56
tracked it.
19:57
The scale they eventually uncovered
20:00
would be measured in millions of
20:02
infected computers, and in damage that
20:05
Europol estimated at hundreds of
20:08
millions of euros worldwide. On the 1st
20:11
of December, 2016,
20:14
the network was taken down in a
20:16
coordinated operation spanning more than
20:19
30 countries.
20:21
Five arrests,
20:23
37 premises searched, 39 servers seized,
20:27
and more than 800,000 internet domains
20:30
seized, blocked, or taken over. The
20:33
largest operation of its kind ever
20:35
conducted.
20:37
An investigator who worked on the
20:38
takedown remembered the moment in The
20:41
Hague, words to this effect,
20:44
>> "We had spent years watching them
20:46
rebuild after every blow. This time, we
20:50
took the ground they stood on."
20:52
>> The investigator did not claim victory.
20:56
>> "They will rebuild again. They always
20:58
do."
20:59
>> The infrastructure, in other words, was
21:02
not the target. The infrastructure was
21:05
the business model, and the business
21:08
model had survived.
21:11
Here is the part of the story that the
21:13
takedown reports did not emphasize.
21:17
The same bulletproof networks that
21:20
carried criminal malware were also
21:22
carrying the work of intelligence
21:24
agencies. Researchers mapping the
21:27
infrastructure of state-sponsored
21:29
hacking repeatedly found it running on
21:32
the same providers, the same registrars,
21:36
the same indifference, sometimes the
21:38
same servers.
21:40
The clean division, criminals on one
21:43
side, states on the other, was a public
21:46
fiction.
21:48
The criminal cloud and the state cloud
21:51
shared the same walls.
21:53
And by 2017,
21:56
the walls had begun to open.
22:00
Takedown one provider and the network
22:03
moves within days.
22:05
The McColo takedown proved it. The
22:07
Avalanche takedown proved it again.
22:10
By then,
22:12
investigators on both sides of the
22:14
Atlantic had started asking a different
22:17
question. Not where the servers were,
22:20
but who was protecting them.
22:23
The answer, when it finally surfaced,
22:26
was not a company.
22:28
It was a state. Moscow,
22:31
2016.
22:34
Inside the FSB, Russia's internal
22:37
security service, stood a unit most of
22:40
the world had never heard of. The
22:43
Information Security Center.
22:46
Its official job was to monitor and to
22:48
fight the country's cyber threats. The
22:51
state's hackers were its enemy.
22:54
Officially, that was the story.
22:57
By 2016,
23:00
American investigators had begun to
23:03
assemble evidence that some of those
23:06
enemies were not enemies at all.
23:10
They were employees. Case that opened
23:12
the door was Yahoo.
23:14
In early 2014,
23:17
hackers broke into the company systems
23:19
and eventually gained access to
23:21
information from more than 500 million
23:24
accounts.
23:26
It was at the time one of the largest
23:29
data thefts ever disclosed.
23:32
The American indictment that followed in
23:34
March of 2017
23:37
named four men.
23:39
Two were hackers with long criminal
23:41
records.
23:42
Alexsey Belan, who had been on the FBI's
23:46
most wanted cyber list, and Karim
23:48
Baratov, a young man living in Canada.
23:53
And two were officers of the FSB.
23:56
Dmitry Dokuchaev and his superior, Igor
24:01
Sushchin.
24:02
According to the indictment, the
24:04
officers protected, directed,
24:08
facilitated, and paid the hackers.
24:12
The state, in other words, was not
24:14
hunting them. It was running them.
24:21
Washington,
24:23
March the 15th, 2017.
24:27
The indictment, a dry document, as
24:31
indictments are, entered the public
24:34
record like a weapon.
24:36
It was the first time the United States
24:38
had charged serving Russian intelligence
24:41
officers with hacking.
24:43
The targets it described were not only
24:46
ordinary users. The indictment alleged
24:49
the conspirators had used the stolen
24:51
data to reach into the accounts of
24:54
Russian journalists and American
24:56
officials. The purpose was not money
24:59
alone. It was intelligence gathered in
25:02
part by a man the FSB was nominally
25:05
supposed to arrest. Prosecutors
25:08
summarized the arrangement in four
25:11
words, protection in exchange for
25:14
capability.
25:15
The rest of the story would not fit on a
25:18
charging document. An investigator who
25:21
worked on the case described the
25:23
reaction inside the American side words
25:27
to this effect.
25:29
>> For years we told the world these were
25:31
two separate worlds, intelligence and
25:34
crime. The Yahoo case is where the two
25:37
worlds turned out to be one building.
25:41
>> The investigator added words to this
25:44
effect.
25:45
>> Belyan was a wanted man in every
25:48
jurisdiction that mattered. He was still
25:51
working for the state. That is not a
25:53
coincidence. That is a contract.
25:56
>> Nobody, the investigator said, expected
26:00
Moscow to answer for it.
26:02
Moscow did answer, but not in the way
26:06
Washington expected. In the winter of
26:10
2016,
26:12
months before the American indictment
26:15
was made public,
26:17
Russian authorities
26:20
arrested their own.
26:22
Sergey Mikhailov, the deputy head of the
26:25
very FSB unit that was supposed to
26:29
police hackers, was taken into custody
26:33
along with his subordinates, including
26:36
Dmitry Dokuchayev,
26:39
the officer named in the American case.
26:43
The charges were treason.
26:45
In February of 2019,
26:48
after a closed trial, Mikhailov was
26:52
sentenced to 22 years in a penal colony.
26:55
A former employee of the security firm
26:58
Kaspersky, Ruslan Stoyanov, received 14.
27:03
The details of the case remain
27:05
classified.
27:07
But the lesson was visible anyway.
27:10
The state gives immunity with one hand
27:14
and handcuffs with the other.
27:16
And it decides alone which hand you
27:19
meet. A former intelligence officer who
27:22
worked inside the Russian security
27:24
services in those years,
27:27
and who spoke to journalists on
27:29
condition of anonymity, described the
27:32
arrangement as those inside it
27:34
understood it. Words to this effect.
27:38
>> The state does not employ the hackers.
27:42
It never has. That would be too clean,
27:46
too visible, too easy to answer for. It
27:50
lets them operate and it watches.
27:54
>> He paused and added, "When the state
27:57
needs something done, it does not call
27:59
them. They call it. They always know the
28:02
number."
28:03
The officer was not cynical about this.
28:07
He was matter-of-fact.
28:09
>> In our trade, deniability is not a lie.
28:14
It is a design.
28:16
>> By the middle of the 2010s,
28:20
the pattern was hard to miss.
28:23
In June of 2016,
28:26
Russian police announced the arrests of
28:28
dozens of members of a hacking gang
28:31
called Lurk, a group accused of stealing
28:35
hundreds of millions of rubles from
28:38
Russian banks.
28:39
The arrests were real. The bank accounts
28:42
were real.
28:43
But the reporting around them kept
28:46
pointing somewhere stranger.
28:49
That some of the arrested hackers had
28:52
been approached years earlier by state
28:55
recruiters.
28:57
The claims were never proven in public.
29:00
The files were never opened.
29:03
Former insiders repeated the same story
29:06
in interviews.
29:08
The state did not need to recruit
29:11
hackers. It needed them to believe they
29:14
were free.
29:15
A hacker who believes he is a criminal
29:18
will work harder, ask less, and never
29:21
ask for a pension. In December of 2019,
29:26
Washington went further than it ever had
29:29
before.
29:31
The Treasury Department and the Justice
29:33
Department moved together against a
29:36
group that called itself Evil Corp,
29:40
operators of malware that had stolen, by
29:43
the indictment's estimate, more than a
29:46
hundred million dollars from companies
29:50
and individuals around the world.
29:53
The group's leader, Maksim Yakubets,
29:56
drove a Lamborghini and used the
29:58
nickname Aqua.
30:00
He also, according to the Treasury,
30:03
worked for the FSB,
30:06
tasked, in the official language, to
30:09
work on projects for the Russian state.
30:13
The reward offered for his arrest, five
30:16
million dollars, the largest ever
30:19
offered for a cybercriminal.
30:21
The indictment made the arrangement
30:24
explicit.
30:25
The state that pretended not to know the
30:28
gang was the state that used the gang.
30:31
In the old world, the state paid spies
30:35
to infiltrate the mafia.
30:37
In the new world, it leased the mafia to
30:41
do what it no longer wanted to be seen
30:44
doing itself.
30:45
The logic was perfect and perfectly
30:48
deniable.
30:49
If the hackers were criminals, the state
30:52
could arrest them.
30:53
Or not.
30:55
At its convenience. If they were caught,
30:58
they were private actors beyond state
31:01
control. If they succeeded, the state
31:04
collected the information, the chaos, or
31:07
the pressure without a single signature
31:10
on a single document.
31:12
It was the oldest trick in the
31:14
intelligence trade applied to the newest
31:18
machines on Earth.
31:20
And the machine did not care.
31:27
By the end of the 2010s,
31:30
the shadow protocol was complete. The
31:33
criminals provided capability, the state
31:36
provided protection, both provided
31:38
denial. The deal was never written down.
31:42
No one signed it. No one could.
31:46
Which is exactly why it could never be
31:49
denied. And why in 2021,
31:52
the entire structure was about to be
31:55
tested in public. In 2021,
31:58
the shadow economy came into the open
32:01
because it had become too big to hide.
32:05
Ransomware. Software that locks a
32:07
victim's data and sells back the key had
32:11
transformed from a nuisance into an
32:13
industry.
32:15
The structure was the mafia's own.
32:18
A core group builds the weapon then
32:20
rents it to affiliates, crews who do the
32:23
breaking in and split the profits. The
32:26
old family franchise rebuilt on
32:29
encryption.
32:30
The numbers were beginning to look like
32:32
a state budget. In the first 6 months of
32:35
2021 alone, financial institutions
32:39
reported more than half a billion
32:42
dollars in suspected ransom payments,
32:45
more than the entire previous year.
32:47
And the industry had a brand. On the 7th
32:50
of May, 2021,
32:53
a group calling itself DarkSide broke
32:55
into the networks of Colonial Pipeline.
32:59
The company that carries roughly 45% of
33:02
the fuel used along the Eastern Seaboard
33:05
of the United States. Colonial shut the
33:08
pipeline down. The shutdown lasted days.
33:12
The effect was immediate and visible.
33:15
Gas stations closed, prices climbed, and
33:19
along the Eastern coast, drivers queued
33:22
for fuel in scenes that looked more like
33:25
a blackout than a computer problem.
33:28
The ransom demand was paid, 4.4 million
33:32
dollars in Bitcoin.
33:35
DarkSide, for its part, posted a
33:37
statement insisting it was apolitical,
33:40
that it only wanted money, that it was a
33:42
business.
33:44
It was, in that sense, completely
33:46
honest. On the 8th of June, 2021,
33:51
the chief executive of Colonial
33:54
Pipeline, Joseph Blount, sat before a
33:57
committee of the United States Senate.
34:00
He had authorized the payment. He did
34:03
not hide it.
34:05
To the senators, he said,
34:07
>> "I made the decision to pay, and I made
34:10
the decision to keep the information
34:12
about the payment as confidential as
34:15
possible."
34:16
>> Then, he added,
34:18
>> "It was the hardest decision I've made
34:20
in my 39 years in the energy industry."
34:24
>> The committee room went quiet. The kind
34:27
of quiet that happens when a powerful
34:30
man admits
34:32
that a criminal network held his company
34:35
and his country hostage in exchange for
34:39
digital coins. The story did not end
34:42
with the payment.
34:43
A month later the FBI announced it had
34:47
recovered more than two million dollars
34:50
of the ransom, 2.3 million in
34:53
cryptocurrency
34:55
after following the digital money as it
34:58
moved.
34:59
It was the first time American
35:02
authorities had publicly clawed back a
35:05
ransom in the new currency of the
35:08
underworld.
35:10
And in November of 2021
35:12
the State Department offered 10 million
35:16
dollars for information about the
35:18
leaders of DarkSide.
35:20
The group had already evaporated. Its
35:23
site gone, its members scattered.
35:26
But the money trail was the revelation.
35:30
The ransom economy, it turned out, was
35:33
not untraceable.
35:35
It was just fast.
35:37
By then the largest of the ransom houses
35:40
had already overreached.
35:43
In July of 2021, the group REvil
35:46
attacked the software company Kaseya and
35:49
through it as many as 1,500 businesses
35:52
around the world in a single stroke. The
35:55
demand was staggering, 70 million
35:59
dollars. One of the largest ransom
36:01
demands ever made public.
36:03
Then the group did something strange. It
36:06
published an open letter to the former
36:09
American president offering a deal,
36:12
apologizing. Public performance of a
36:15
criminal organization that believed it
36:18
had become too valuable to touch.
36:21
It was wrong. By the end of the year one
36:25
member had been arrested in Ukraine at
36:28
Washington's request.
36:30
And on the 14th of January, 2022,
36:34
Russia's FSB announced that it had
36:37
arrested 14 members of REvil, raiding 25
36:42
addresses, seizing cryptocurrency, cash,
36:46
and 20 luxury cars bought with the
36:49
proceeds. The arrests were made, the FSB
36:53
said, at Washington's request.
36:56
Analysts were divided on what they
36:58
meant. A researcher who spent years
37:01
studying the group described the arrests
37:04
in careful, deliberate terms. Words to
37:08
this effect:
37:09
>> It was either the most effective
37:11
counterterrorism in a decade or the most
37:15
efficient public relations with the FSB.
37:19
The two are usually the same operation.
37:23
>> The researcher went on,
37:25
>> notice what they did not arrest. No one
37:28
who worked for the state, no one who
37:30
protected the group, only the criminals.
37:33
>> The message, the researcher said, was
37:36
aimed at two audiences at once. At
37:40
Washington to show action and at the
37:42
gangs to show who still held the lease.
37:46
Three weeks later, the second largest
37:50
ransom house collapsed from the inside.
37:54
In late February of 2022,
37:57
the group Conti, responsible for attacks
38:00
on hospitals and government agencies,
38:02
posted a message backing the Russian
38:05
invasion of Ukraine and threatening to
38:08
use all its resources against any state
38:11
that attacked Russia.
38:13
The response came from inside the group
38:16
itself.
38:17
A Ukrainian security researcher who had
38:20
spent time inside the organization's
38:22
chat rooms, leaked tens of thousands of
38:26
internal messages.
38:28
The chats covered 13 months of the
38:30
group's life, and they showed the new
38:32
mafia in its own words. Salaries,
38:36
organizational charts, negotiators
38:39
trained in scripts, a help desk, a human
38:42
resources department. Conti ran like a
38:45
corporation.
38:47
It felt like a family
38:49
with betrayal, suspicion, and money
38:52
fights leaking out in real time.
38:55
The victims of that corporation were not
38:58
abstractions.
39:00
In May of 2021, Conti struck the Health
39:03
Service of Ireland, the HSE.
39:06
And the attack crippled hospitals,
39:09
canceled appointments, and shut down the
39:12
systems that doctors needed to treat
39:14
patients for weeks.
39:16
In April of 2022,
39:19
the group hit Costa Rica so hard that
39:22
the government declared a national
39:24
emergency.
39:26
The ransomware mafia did not shoot
39:29
anyone. It did not need to.
39:32
It held the systems that keep people
39:34
alive and auctioned them back to the
39:37
people who needed them.
39:39
That was the new protection racket. No
39:42
enforcers on the street, just a
39:44
countdown, a wallet, and the knowledge
39:47
that someone, somewhere would pay.
39:54
The gangs, one by one, went down.
39:57
Conti disbanded. REvil was arrested.
40:01
DarkSide vanished.
40:03
And still the payments grew
40:05
because the ecosystem did not depend on
40:09
any one group. It depended on the
40:11
infrastructure, the immunity, the
40:13
laundering, the silence that had been
40:16
built around them.
40:18
They ran it like a company. They were
40:20
destroyed like a gang.
40:22
And the difference between those two
40:24
things was never the crime. It was the
40:28
protection.
40:30
The gangs could be taken down. The
40:32
ecosystem could not.
40:35
Because the ecosystem had a landlord.
40:40
Which brings us to the doctrine, the
40:42
oldest part of the story.
40:45
Every state that ever used a criminal
40:48
denied it. Kings denied their
40:50
privateers. Empires denied their
40:52
mercenaries. The Soviet Union denied its
40:55
agents.
40:57
The digital age did not invent
40:59
deniability. It perfected it.
41:03
Because in cyberspace, the state can
41:06
launch an attack that looks exactly like
41:08
a crime. And then point at the criminals
41:12
and ask with perfect composure, "How can
41:15
you prove it was us?"
41:18
The criminals, meanwhile, point back at
41:20
the state and ask the same question.
41:24
Plausible deniability is the
41:26
load-bearing wall of the entire shadow
41:29
protocol.
41:31
And twice in recent years, the wall has
41:34
shown its exact dimensions. In June of
41:36
2017,
41:38
a piece of software called NotPetya
41:41
swept through companies around the
41:42
world. It looked like ransomware. It
41:46
demanded payment. It behaved like a
41:49
crime.
41:50
But it was not a crime. It was a weapon.
41:54
A destructive program designed to erase
41:57
data disguised as a shakedown.
42:01
The attack, which spread from Ukraine
42:03
across Europe, the Americas, and Asia,
42:07
caused damage that analysts estimated at
42:10
roughly $10 billion. dollars. The
42:13
shipping giant Maersk, the drug maker
42:15
Merck, and the delivery firm FedEx lost
42:18
hundreds of millions each. In February
42:21
of 2018, the White House made the
42:24
attribution official.
42:26
The attack had been launched, it said,
42:28
by the Russian military. The most
42:30
destructive and costly cyber attack in
42:33
history, in the statement's words.
42:37
The disguise had held long enough.
42:40
The state had worn the criminal's mask,
42:42
and the mask, not the attack, was the
42:45
point. In December of 2020,
42:48
the same architecture was visible again.
42:52
But, this time, the state did not borrow
42:55
the criminal's tools. It used its own.
43:00
Hackers working for Russia's foreign
43:02
intelligence service broke into the
43:04
company SolarWinds
43:06
and hid their access inside a software
43:09
update, which was then downloaded in
43:13
good faith by thousands of organizations
43:16
around the world, including agencies of
43:20
the United States government.
43:22
The operation sat inside its victims for
43:26
months before it was found.
43:29
When Western governments finally
43:31
attributed it in early 2021,
43:34
they named the service openly.
43:37
The lesson was the same as NotPetya in
43:40
reverse. The state did not need the
43:43
mafia to be deniable. It could be
43:46
deniable alone.
43:48
But, the state and the mafia shared one
43:51
more thing. The infrastructure, the
43:53
method, and the silence.
43:56
In June of 2021 in Geneva, the two
44:01
presidents met.
44:03
The American president, we now know,
44:06
handed the Russian president a list of
44:08
16 critical infrastructure sectors,
44:11
pipelines, power grids, water systems,
44:14
and told him they were off-limits.
44:17
The Russian president replied publicly
44:20
that Russia had nothing to do with the
44:22
ransomware attacks, that the criminals
44:25
acted on their own, that his country was
44:28
ready to cooperate. The choreography was
44:31
perfect. Accusation without proof,
44:35
denial without detail, a handshake for
44:38
the cameras.
44:40
The most important exchange of that
44:42
summit happened in the room,
44:45
not on the stage.
44:47
And the public record of it, the part
44:49
the world was allowed to see, says
44:52
nothing at all about the real
44:53
arrangement.
45:02
Years later, two men who had lived
45:04
inside the system described it to
45:06
journalists, separately, on condition
45:09
that their names never appear, in words
45:13
to this effect. The first was an
45:16
investigator who had spent a decade
45:19
hunting the gangs.
45:21
>> We can name the unit. We can trace the
45:23
server. We can show you the money. What
45:26
we cannot name is the order. No order
45:29
was ever written.
45:31
>> The second was the former officer.
45:34
>> We have protected.
45:36
No.
45:37
That is the wrong word. The state does
45:41
not protect them. The state simply does
45:45
not see them. It is a very disciplined
45:48
kind of blindness.
45:50
>> The investigator nodded at that and
45:53
added,
45:54
>> "That is the system. No one lies. No one
45:57
confesses. The machine denies itself,
46:00
and everyone inside it is safe.
46:05
Then, both men said the same thing in
46:08
different words.
46:09
The question was not whether the state
46:12
controlled the gangs. The question was
46:15
why it had never needed to. In May of
46:18
2023,
46:20
the FBI announced that it had dismantled
46:23
one of the most advanced espionage
46:25
networks ever found, a system of
46:28
communication called Snake, run by
46:31
Russia's foreign intelligence service,
46:34
hidden inside computers around the world
46:37
for nearly two decades. The Bureau named
46:41
the operation Medusa.
46:43
The network was gone. The capability was
46:46
not.
46:48
And this is where the story returns to
46:50
where it began.
46:52
The statue of Dzerzhinsky,
46:54
pulled down in 1991,
46:57
was not destroyed. It was moved to a
47:01
park in Moscow built for fallen
47:04
monuments,
47:05
where it stands among the other statues
47:08
of the old order, toppled and silent.
47:13
The building behind the pedestal never
47:16
moved at all.
47:18
The machine did not die in 1991.
47:22
It changed address. The record of this
47:25
story closes with a question it cannot
47:29
answer.
47:30
Who runs who?
47:32
Are the gangs the state's contractors,
47:35
or the state's cover story? Is the
47:38
tolerance deliberate policy, or the
47:41
helplessness of an institution too weak
47:44
to control its own shadows? The archives
47:47
do not say. The indictments describe the
47:50
crimes, but not the orders. The
47:53
testimony describes the meetings, but
47:56
not the men who were not there.
47:58
In the intelligence world, the most
48:01
important document is the one that was
48:05
never written. That is not a metaphor.
48:08
It is a discipline.
48:10
The old machine is gone. The new one
48:13
runs on money, encryption, and the
48:16
careful art of looking away.
48:19
And somewhere
48:20
in a city that once taught the world the
48:23
trade, a young programmer is learning
48:26
that the state has room for exactly two
48:28
kinds of people, those it protects and
48:32
those it uses.
48:34
In June of 2021,
48:36
in a villa beside the lake in Geneva,
48:40
two men shook hands for the cameras. The
48:43
code did not stop for the handshake. It
48:46
was already moving from one address to
48:49
the next before the cameras finished
48:52
flashing.
48:53
Because in the shadow protocol, nothing
48:56
ends. It only changes address.
49:00
The statue fell in 1991.
49:03
The machine never left.
#Arts & Entertainment