If you're living on Mars, there is no equivalent to the Van Allen Belt, which protects us from the sun's radiation here on Earth.

Right.

You don't have that on Mars. And one of the things they were saying is, if you have a little Mars buggy, you may actually want to use your poop as a layer of protection around the Mars buggy, because it helps.

I think you should just roll in it, Clue, and walk around.

Smashing Security, episode 183: Mammals, Game Shows, And a surprise from eBay with Carole Theriault and Graham Cluley. Hello, hello, and welcome to Smashing Security episode 183. My name's Graham Cluley.

And I'm Carole Theriault.

Hello, Carole.

Hello, Graham.

We are joined this week by a marvellous returning guest. It's the one, the only Maria Varmazis.

Yes. Yeah.

I bet there's no one else with that name.

There's—

In the whole world.

I think there's at least one or two. One of them's my aunt and the other one's my cousin.

Oh, I was gonna say you're definitely the coolest, but now I can't even say that. No, they're both lovely.

Exactly.

Yeah, if they're family, they gotta be lovely.

True.

Carole, what is coming up on the show this week?

First, thanks to this week's sponsors, MetaCompliance and LastPass. Their support helps us give you this show for free. Now on today's show, Graham tells us who the ballerina tracing app has been sharing user info with. Maria tells us a wicked story of cyberstalking at eBay's HQ. And I look how a teeny tiny mistake on social can lead to a ginormous consequence. All this and much more coming up on this episode of Smashing Security.

Now, chums, chums, I want to take you back in time. In fact, it's possible that neither of you are aware of the phenomenon known as Noel Edmonds.

Deal or No Deal?

Yes. So, so he has been on British television for 30 or 40 years. He used to be a radio disc jockey.

He did a

He did a Saturday night show in the early 1990s called Noel's House Party.

That's right. That's right.

He's famous for an accomplice who was a big pink spotted blobby monster called Mr. Blobby. It was a strange TV show.

Friday night show,

I've heard of Mr. Blobby. I don't know why.

a Friday night party show. It's a total rip-off from the French Barbapapa.

Oh, yes, it does look like that.

100%. But anyway, whatever.

Anyway.

I'm lost.

Noel Edmonds is the sidekick of Mr. Blobby. And the basic concept of this show, Noel's House Party, in the early 1990s was they lived in Crinkley Bottom, and various things happened. It turned out to be a really popular show for some years. It was a very high-rated show, and then it sort of had this demise, and it got taken off air and the rest of it. But one of the segments on the show was a section called NTV, for Noel's TV, I think is what it stood for. And what the show would do was he would sit in his chair, and he'd say, right, he said, we're gonna do something a bit fun now. And he would click his fingers, and the picture would change from him in the studio at the BBC, live, to one of the viewers' houses up and down the country.

Okay, they could do that in the '40s, Graham.

I know, but what they were doing, Carole, was they weren't just going to a live broadcast, a live stream as it was, from someone's house. They were doing it without that person's prior knowledge.

No.

So you could be watching the show, and you'd obviously been set up by your wife or your partner or whatever it was.

Ex-wife.

Maybe. Who would have let the BBC in earlier in the day, and they'd have set up little secret cameras, and they'd go click, and you'd be there live. And it was a moment of pure fear if you were watching television at that point, because you'd always be terrified that Noel Edmonds would be cutting straight to you.

What, it goes live? It goes live to your house?

Yes, it went live to your house and you were broadcast up and down the country.

There you are picking your teeth and suddenly—

Or worse, possibly.

Or worse.

Yes.

I said teeth.

Is it secret cameras in the house? Or is it a cameraman that you don't see that he's posing as a pot plant or something?

No, no, no.

There were secret cameras. And then I guess whoever had allowed the BBC in, they'd open the front door and allow a proper cameraman in as well. But yes, basically there were secret cameras and it flicked over to you and it was— The basic concept of this segment of the show was the shock of people, and then they'd get them to do a stunt or something or a dance routine.

No wonder divorce went up so highly in the '90s.

There was a lot of that in the '90s with those kinds of surprise, you're on camera type shows. And I don't know, how did that not fall afoul of wiretap laws?

One of the famous victims of this was a chap called Chris Evans, who went on to host a number of TV shows here in the UK, including the revamped Top Gear after Jeremy Clarkson. It's interesting you said divorce, because his wife of the time set up that. You can watch it on YouTube, what happened with him. Rumour has it he wasn't very impressed.

That's a trust thing, yeah.

And then he got divorced quite soon afterwards.

Called it.

Now, the reason why I'm talking about Noel's House Party in this NTV stunt is that there is now a TV show in Bahrain called Are You at Home? And what they do—

Do they use a webcam and just hack into it and ta-da?

Well, what they do is they use your smartphone a few times during the course of the day, they will switch live to 5, 10 people up and down the country, asking them if they are at home. And all of these people are people who have installed Bahrain's coronavirus tracing app.

Okay.

And so what happens is if you install Be Aware Bahrain, it actually ties in with a Bahraini television programme. And this was mandatory, by the way. So you had to install this. And so they could flip live over to you on television, ask you, are you at home? Get you to prove it by basically turning on your camera or whatever. And that would mean you could win 1,000 Bahraini dinars, which is about $2,500, if you were staying at home.

So is this a coronavirus thing?

Yes.

So the Be Aware Bahrain is a coronavirus tracing app, which is trying to track—

And were they trying to say— were they trying to catch people out? Ooh, you were in the park and you should have been in your house. No money for you.

Yeah, what if you're at someone else's house? How do they know it's not your—

You lose a hand.

Exactly. You can have your legs chopped off.

Well, who wants to be in your house? That's not socially distanced.

So this is all part of their attempt to get people to stay at home, socially isolate themselves. Program hosts call up the potential winners live on air using phone numbers provided to the Bahraini TV company by the government agency.

Okay, so is the Bahraini— it's a hard word for me to say— Bahraini TV run by the government as well?

Oh yes.

So basically they just had to hand it from one government agency to the other.

Yeah, I think basically nothing happens in Bahrain without the Bahraini government's permission. It's that kind of—

Are you thinking this would be good for the UK or the US? Is that why you're bringing it up?

Well, I think how marvellous that they are introducing some Noel Edmonds-inspired fun into what could be quite a miserable time staying at home.

Well, you have the Facebook Portal actually, so this could be a fun time for you.

No, it's, you know, as we all know, it got eaten by the dog.

No, not yours. Yours is still working.

Yes, but it's not plugged in.

Maybe you should give Noel a call. Maybe he'd want to, you know, revive it.

Now, participation in the TV draw was mandatory. It's now apparently— you can now opt out inside the app from participating in the TV show. But now, do you know who has ruined all of this fun?

Do you think this is fun?

It's the killjoys at Amnesty International.

Oh, the bastards.

The well-known killjoys at Amnesty.

I know. Every time you want to have a bit of fun—

They tell you that it's a human rights violation. The bastards.

Exactly. They've kicked up a great big fuss, not only about the Bahraini app, but also the one in Kuwait, which is called Shlonik. And also Norway's—

Shlonik the hedgehog?

Smitty Stop. They say that they're intrusive, invasive, and they collect sensitive data using this centralized approach of theirs.

Which the government in the UK has been considering until very recently.

That's right. The argument of Amnesty International is that it's not necessary, of course, to have an app that continually, as the Bahraini app does, for instance, collects your GPS location and uploads it to a central database tracking your movements in real time.

In the United States, we just call that Facebook.

So I wonder, Graham, actually, if they even had a choice in installing it. I imagine it was probably installed by the providers directly onto each of the handsets.

No, I don't think it is actually in this case. They are directing people to the government's official app store. Initially, I thought, hello, what's—

The government's official app store?

I went there, 'cause I had that same thought as you. In fact, when you go there, it just links you to the iTunes and the Google Play place. So we could install this app as well, I suspect.

Oh, can I be on that show? Oh my god. I could use $2,600. It's more than I got from the US.

But you do have to give them your equivalent to your Social Security number, which again is another piece of—

Your banking details so they can wire that cheque to you.

Right. So they are tracing people's GPS location in real time. And, you know, so what? There's a global pandemic going on. This is a fun TV show. I think Amnesty International needs to get a sense of humor. Stop grumbling. Okay. Okay. Qatar's app, for instance, Ehteraz, I believe it's called Ehteraz. That was a mandatory app. Everyone was told to install it, and that had a vulnerability which exposed details of more than 1 million people. It's now been fixed, but allowed people to access highly sensitive personal information— name, national ID numbers, health status, blah blah blah. Norway's app, following the meddling of Amnesty International, that has been suspended following these privacy concerns. But Bahrain, I was able to visit a website where they are publishing individuals' health statuses, their nationalities, their age, their gender, their travel history. Doesn't have their names, but these are all suspected COVID-19 patients.

You can piece that together so easily. You don't need a name. Yeah, it's not hard.

Well, yeah, and I think South Korea is doing something similar where they're actually listing out everybody who's there. And remember, we had Brian Klaas on who was basically advocating that, look, this is a pandemic. Is privacy really important during a pandemic? And there seems to be a split even in the technology sector as to whose side everyone is on.

So how much confidence do we have that these apps are going to be closed down and stop tracking people once the pandemic calms down? Or will everyone love this idea of Mr. Blobby coming to visit them in their Bahraini TV set that they want it to carry on?

The irony is that it'll calm down because people are using apps like this, right, in order to stay away from people that are infected or to be able to tell people that they have been infected and keep people indoors. So there's a real interesting catch-22 here. Right? You want to use the app to stay safe, but then you're also giving away all your private information.

So you think this is all right, Carole?

No, I just think you keep saying when we get back to normal. I think this is the new normal. I think having the tracing app, I think of this for the next few years, right? Apps and distance and social distancing is not something that's going to go away, I think, anytime soon. But hey, you guys both called me out when I said a billion people were in lockdown. You both thought I was hilarious. So what do I know? What do I know?

Well, I mean, I would be perhaps more comfortable with an app if there was crystal clear criteria about what was happening with the data that's being collected and how they're going to completely expunge it when this is over. And also what over means, because if they're we'll keep it indefinitely or until a point when we see fit, I mean, that means that they can just keep it going forever. That's how a lot of stuff, at least in US law, tends to get grandfathered in. Well, we'll keep this going while the war on terror is continuing. And 20 years later, here we are. It's basically become permanent.

So I remember, I don't know if this is still the case now because things change so quickly, but last I heard the NHS were wanting to keep the data that they were collecting in the UK for 20 years in order to be able to track it throughout the generation. So from a medical standpoint, I get that. From a privacy standpoint and understanding the systems that we have, particularly in our governmentally funded systems, it's a very big worry.

Yeah, I wish I felt like there was a person or organization I could say, you know what, I trust them with this data and I understand that this is for the public good and for my own good, and I'll let them have access to this. But I don't trust anybody. I have no reason to trust anyone because it's been proven countless times and we've talked about it so many times here, all these data breaches and nobody has good data stewardship, even with the best intentions. So I just— there's nobody I feel like I can trust.

And that sucks. Maria, Maria, you can trust me.

I don't even trust you.

Why don't you send me a little SMS every time you bump into somebody or you go out into the garden? Keep me updated. Maybe set up a webcam in your house, right? I'll keep an eye while you're sleeping. I'll keep an eye on your house.

Oh my God.

See if you're being burgled.

Not creepy at all, Graham.

Not creepy?

Not creepy. No, yeah, that sounds great. Love it.

Thanks, Graham. Maybe that's what we need to do. Every time we think, is it creepy that the government is doing this thing, then think, well, what if it were him specifically?

What if it was Graham? Specifically replacing that for you.

Not creepy at all.

Everything's off the table. Trust no one.

Maria, what have you got for us this week?

I have a little local news here from the spirit of America, AKA Massachusetts, my home state. This story just broke, and I feel like I could just read the press release from the U.S. Department of Justice and that would be fine because it is. Yeah. So this story is about a cyberstalking campaign against a middle-aged couple that lives in the nondescript Massachusetts suburban town of Natick, where I've been. I go shopping there. My husband works there.

Oh, right.

Nothing of importance really happens in towns like this in Massachusetts.

Okay.

And this campaign involves 6 former eBay executives and employees who are now facing federal charges against them for a truly heinous chain of events that includes not just sending harassing messages and items to the house of this Natick couple, but also doxing them, sending pornography to the neighbors in their name, putting up fake Craigslist events to their house, and also traveling from California to Massachusetts to actually bug the Natick couple's car.

Hang on. Sorry. Yes. Too much. So you're saying—

And that's not even all of them.

There are some people who were working at eBay, presumably no longer working at eBay.

No longer, yes.

Who took it upon themselves to target a couple of people in this town near you.

Correct.

Right?

Yes.

And so they began to send them unpleasant things through the post, like pornography. But then they went on a road trip from Los Angeles to Massachusetts.

Yes.

And that's not— To bug the house?

Correct. And I mean, I'm just thinking that's a 5-hour flight and, you know, a couple hundred bucks. They wanted to actually break into their garage and bug the cars of this couple. And the whole reason— I mean, nothing can justify this, just to be clear. But in the minds of these people— I don't want to sound, oh, the Native folks deserve this. No. The thing that set off Team eBay was this Native couple runs an e-commerce newsletter, and it's been circulating all over Reddit and the local forums. I've been there. It is basically straight out of 2002 trade publication. I'm sure you both remember what those are. Trade publications where the websites look like they're straight out of the early dot-com eras. And I guess they had published a story in August about eBay and some compensation scandal that was going on at the time.

Right.

And that alone was enough to spark all this at eBay. That was it. That literally was it.

But why would people who work at eBay feel so personally driven to take action against this? So you've had a bit of bad publicity or something?

It was a bit of bad publicity. And as of 19 hours ago, I just read a story that apparently the former CEO of eBay left a month after this all started because he played a role in all this as well. So former CEO, CEO Devin Wenig. I do not want to get sued. So maybe. But allegedly, allegedly was involved in this. This or left because of this. And apparently he was involved in, quote, inappropriate conduct in this whole cyberstalking investigation.

So what happened? So imagine—

Graham, babe, you haven't changed your tone once since we've done every single—

That is the correct reaction to this story because it's just bonkers from beginning to end.

So what happens? There you are. You've got a lovely little job at eBay. And then your boss comes in.

Have you read this blog? They're saying asshole shit about us. I guess I'm imagining that.

And the other person says, I know what to do, boss. I'll send some pornography through the post to them. In fact, why don't we bug their—

Well, no, no, no. It didn't start with porn. It was a pig's head mask. And they tried to send a fetal pig and a bunch of live bugs. They tried it. They started just sending nasty stuff to them. But get this, the folks, the two of the main folks implicated in this were the former director of safety and security and the former director of global resiliency, and a bunch of the lower-level folks were basically all on the security team. So this was folks with knowledge of how to prevent this kind of stuff weaponizing it and using it against a target. That's the thing that gets me is these are folks who all should know better at the very least, but they knew how well to do this because they stop it in theory all the time.

I just don't understand how they didn't think the couple that was being targeted and getting things—

I'm just reading now, a bloody pig mask, bloody pig So to the cops' credit, they actually took this seriously. Although I imagine if some middle-aged folks go, hey, eBay's stalking me and sending me harassing shit, you'd be like, okay, yeah, all right, yeah, that sounds really plausible. Like, why would a huge company like that bother with this blog out of Natick? Like, who cares? Like, why would they care? I still can't believe that they did. But so when this couple started going to the cops, the cops took it seriously. And then eBay, the folks that were implicated in this eBay they started pretending they were on the couple's side going, yeah, we heard about this harassment that's happening against you. mask, off the live coverage. We're going to do everything in our power to help you out. And then they tried to pull the same shit with the cops. And then I guess the cops' questions started getting a little too probing and the former eBay folks started thinking, oh, I think the cops are on to us. So the team also started trying to figure out who they could frame for this crime to get— so the cops allegedly, allegedly, allegedly, so the cops would be thrown off their trail. So every time I thought there was a twist and turn to the story that I had heard, it just keeps going.

I just can't get over a box of cockroaches.

Sorry.

I've just opened a tab on eBay and you can buy a severed bloody pig head mask. £12.97.

I think they bought it through Amazon, though. That's the thing. Oh, yes.

They didn't have enough profits at eBay. So it's like, look, just buy some of your friends some gifts.

Right?

So they just thought box of live cockroaches is cool, a funeral wreath is cool, they'll love it.

Who buys a funeral wreath on eBay?

Well, not only a funeral wreath, but they also sent books about getting over the death of your spouse. And remember, this is a married couple they were doing this to, so it was basically a death threat, repeated death threats against these folks.

I know, we make light, it's scary as shit actually.

Yeah, I mean, can you imagine? I mean, I just keep putting myself in their place going, if you have this shit coming towards your house, and again, your neighbors are receiving nasty pornography in your name, quote unquote, accidentally. Someone's putting on Craigslist ads saying swingers and singles come knock on our door anytime, you know, stuff like that. And you'd be like, who's doing this to me? Why are they doing this? And then you start thinking maybe it's eBay.

Okay, well, yeah, you just wouldn't think that, would you?

Can you imagine, Graham, if I called you with this situation right now and let's say I just—

You're off your meds.

I'm like, I really think it's eBay. And you'd be— You would just not believe me ever.

No.

Nobody would, yeah.

If you'd said Uber, then I'd have believed it. But if it's eBay— But this is the thing, right? They're sending all these crazy things through the post. But they also travelled there to conduct covert surveillance of this couple. It seems.

They're just obviously dicktards.

They even had documents in the car when they were travelling to Massachusetts to say that they were investigating persons of interest who are threatening eBay executives. So they made up all sorts of stories to try and cover their trails. It's just— Unbelievable. They put so much work into this over a basically rinky-dink newsletter. I just don't understand.

And for legal reasons, let's just say there's probably a completely legitimate reason why a big multinational company would do something like this, which is utterly reasonable. Right?

Yeah, so, so surely they just

Right. Yeah, I'm sure there's something that could justify this.

called the cops and said, uh,

No, there's absolutely nothing that could justify this. What kind of culture did they have, slash do they have, did they have, please don't sue me, that would allow a whole team of people to think that this was appropriate behavior and nobody stopped them?

we're being targeted here.

What's going on there?

Yeah, I know. Yeah, there's a mackerel in their waters.

Yeah, for real. I'm just imagining being the corporate lawyer saying, so the FBI came to us with this story. This cannot be real. Oh shit, it is. Oh shit.

There must be more to this. Is there any suggestion that maybe this couple might have done something other than write a few unpleasant articles?

None whatsoever. Honestly, none. I mean, and according to the Department of Justice, this is going to get each of these folks that were implicated in this at least 5 years in prison, at least, with fines up to $250,000. I don't understand why they would do something using their powers for evil and not good. And it's just— why would they think this was worth it?

Maria, what is going on in your country? This is complete—

I thought—

Yeah, why don't you live in

Carole, how can you possibly top that?

I can't. I can't. Oh, I actually start with a fucking premise. a nirvana like us? That's how boring the story is going to be. So if information digitally lives forever, the idea that if something goes on the internet, how does it ever get really erased? But if something is on the internet and wrong, maybe they're accusing you personally of doing something wrong, illegal, awful, immoral, whatever. How the heck do you clear your name? How do you get your reputation back?

If you get canceled.

Yeah, well, I have a little story to illustrate this point that I saw last week. And I'm going to call this guy Bob Smith. Now, this is an alias. This is not his real name. And I'm going to explain at the end of my segment why I've chosen to do an alias. So Bob Smith, okay, busy marketing executive guy that lives, Graham, in the land of your favorite cookie, Maryland, in the States.

Okay. I don't think Maryland cookies have ever been anywhere near Maryland cookies.

Again with the Maryland cookies. It's the second time we've gone over this one.

Now this guy, he's about your age, Graham, about 50, right?

Show me.

But he likes keeping fit rather than going for dog walks. This guy keeps fit by doing the trails, biking the trails in the area. And the story kicks off with Bob getting a nasty message on LinkedIn, but he didn't know the person that sent it, so he just kind of assumed spam and ignored it. Then he gets another and another and another.

Delete LinkedIn. Delete LinkedIn.

Yeah. One message even says to him, the cops are coming to find you. More messages are now just kind of spiraling. And Bob is freaking out. I have no doubt in my mind, right? He has no idea what's going on. He checks Twitter, rarely uses his Twitter account. Twitter account's 10 years old, goes in maybe a few times a year.

Oh, I know the story's about you, isn't it?

I hope not. Listen, wait to hear how. So he gingerly checks out the mentions section and sees people are accusing him of assault, of being a racist. They've shared his pics. Someone even finds his home address and shares that online too. So these are messages like, "You assaulted a little girl and other innocents because of your political beliefs," and "You're such a piece of shit," and "You're a racist bitch," and blah, blah, blah. Okay, awful, right? And then he sees it. He sees this video online of a cyclist scaring the shit out of a few young folks who are trying to put up posters in Maryland supporting George Floyd.

Oh my God, I know this story! Yeah, okay, this is great. This is great, sorry, I'm so excited you're doing the story.

Okay. And the video was taken on trails where he bikes all the time. So I've put the video in the show notes so you guys can take a look at it on Twitter.

Yeah. Oh, I know this video.

And maybe you can describe it.

Oh yeah.

Describe it as you see it, Maria, if you're familiar with it.

I saw this story as it was going down on Twitter. It's basically your middle-aged man in Lycra who — I am married to one and I'm a middle-aged mom in Lycra, so — oh, he's pushing a little kid around. Yeah, he's pushing two girls around and he's grabbing them, actually grabbing their arms. And I think also using his bicycle as sort of to push them around too. Yeah, where is this perfect country? It's really very scary. Oh, it's New Zealand, apparently, according

Do you have the sound on?

to everything I keep reading.

He's screaming and, you know, they're Yeah, yeah. So that's the video, right? trying to go away, leave us alone. And you guys can go to our show notes to see the video if you haven't seen it. So the video circulates quickly, and anyone who sees it is outraged by the actions of the cyclist. So the cops get involved, and they encourage the community to help find the dickhead that accosted these three kids that were putting up flyers. Maryland Attorney General even tweets the video and he says, if anyone can identify this man, please let me know. Or maybe it was a picture, I'm not exactly sure. And 50,000 people retweeted that.

Yep.

The cops get involved. They say, "We are seeking the public's assistance in identifying the below individual in reference to an assault that took place this morning on the Capitol Crescent Trail. Please contact Detective Lopez with any information," phone numbers. That tweet was sent on June 2nd with 55,000 retweets, shared 55,000 times. The next tweet that comes is a correction. The cops got the date wrong.

Oh.

Right? The incident occurred yesterday morning on the 1st of June, not on the 2nd of June. And they issue a correction on Twitter right away, but the correction only got 2,000 shares, not 55,000 shares.

And that's an important distinction. Yep.

Why doesn't Twitter let you edit tweets? Right.

Well, Bob had been in that area on June 2nd but wasn't in that area June 1st, so he wasn't around when the assault took place. He was at home working that day. And it turns out, how did people find him? He was using the Strava app. This is an app that people record their rides. We've talked about it on the show several times.

And so he was using— and he realized that Strava had been sharing his information publicly, not just with his network of friends and followers.

And so they thought they had the smoking gun. They thought, we've got the evidence, this must have been the guy, we've got the digital trail. But unfortunately, they've got the wrong day.

Yeah, what's annoying about this is the cops put out— or whatever social media person working at the authorities puts out the tweet, gets a mistake, puts out his correction tweet, but somehow, as you say, Graham, can't tie them together, can't correct the tweet. And someone had located a record of his ride on June 2nd, and he matched it to the location where the assault took place, and then assumed, I don't know why they didn't just delete the tweet. you know, because the picture is like a white guy with aviator-style sunglasses, helmet obscuring much of his face again.

Delete the tweet.

Delete the tweet. Delete the tweet.

So, and here's the thing, why am I using the alias Bob Smith, right? Everyone else, all the press are using his name. Well, my issue is this, right?

Yeah, the children are being very brave and this man who's multiple times their

His name is already strewn across all social media and the press with his full name and the details of this assault. So his name is associated with that right now. If you put it in his real name, that's the— these are the first stories that are coming up.

age is acting like an actual toddler. And it's terrifying because he's much bigger

Let me try it right now. So Piers Morgan.

than them and should really know better, obviously.

So I kind of think since they've been found to have misidentified him and he's an innocent party on this, surely the media could go in and actually redact his name from these articles. Yeah, it's fine to have the name of the person who actually committed the crimes with these horrible things he did because, you know, deserves some, you know, public humiliation maybe, or whatever, whatever needs to happen. But someone who's completely innocent and wrongly accused, maybe his name shouldn't be in these papers at all because he doesn't have a huge online presence. So this is going to dominate everything.

Well, there's a bit of a wrinkle to that too. The person that was sort of originally thought to be the perp, his name was being circulated on Twitter like crazy. So he was— this guy was getting— I saw it when it was happening because I remember following the story with great interest because middle-aged man in Lycra is very much the world I am often in. And it's— and I get personally really, really angry when it's I see a cyclist doing something shitty and also it's a human being doing something shitty. The middle-aged man app of choice. So anyway, so I saw the guy, his name being circulated and it was his name, where he works, his photo, people were just doxing the shit out of this guy. I also use Strava, so I'm owning myself in that.

His home address.

Yeah, everything. His home address. And it was going around on Twitter. And I remember thinking to myself, I bet it's the wrong guy because the video of the dude, a lot of people look the same dressed like that. I mean, and lo and behold, it was the wrong guy. And this poor dude's— oh, I think he came— he updated his Twitter account saying, it's not me, it's not me.

Exactly. Now what is kind of interesting is the Attorney General did get in touch with him afterwards and said, look, I think I played a hand in actually causing a bit of this, so how can I help fix this? People that had emailed him calling him all kinds of trolly terms said, hey, sorry, I just got caught up in the mob. So there was a little bit of an awakening with some of the people that were involved in this afterwards, and they did reach out and apologize, which is good, right? Own your mistakes if you screw up. This is going to happen more and more, and when people get caught up in this, the media love the frenzy. I love the frenzy, I love the story, and I think it tells us something important, but I don't need to put his name in it, this innocent party who just got caught up in the beginning. So Bob Smith, there you go. The real Bob Smith's gonna hate me.

I'm sure he's used to it by now.

So have they identified the real person?

They did. They found him a few days later. He's been arrested. And it's not the same guy.

No, no, obviously.

We're going to have so many stories like this where people get doxxed and they're thought to be the perp and they're not. And it's just— there's no protections for this kind of thing right now, aside from just make sure you don't have any kind of internet presence. It's scary.

I don't know, it's just this mob mentality as well. It's like, if someone's been identified, pass it on to the cops or whatever, but you don't need hundreds of thousands of people to be dogpiling on.

Well, it's like, I'm helping, right? You know, you think you found the guy and you're like, the cops asked for help, dude, we're meting out justice by harassing the shit out of this person so maybe he gets a taste of his own medicine. It feels good, you get the dopamine hit.

Yeah, and maybe the person is making their own mind up of going, I've shared it with the cops, I've done my social responsibility, but I need to tell everybody else about the incident to watch out for this guy, or we need to find this guy. There's a lot of bad shit happening right now, Clue. People are not necessarily—

And so this guy, this guy who harassed these girls and ripped the piss off them, he was working for eBay, did you say?

No, nice tie-in. No, any Reddit user will remember when the Boston Marathon bombing happened. Yes, they doxxed the shit out of the wrong people. So ever since that happened, because I remember that too, I remember that going down, and that has made me very, very worried when I see it happening in real time now, because again, we almost always get it really wrong. Sometimes people get it right, but it doesn't matter. We usually get it wrong.

But the road to hell is paved with good intentions.

Here's proof. Amen. And mammals, don't be assholes.

The folks at MetaCompliance are fabulous, not only because they're sponsoring our podcast this week, but also because they're offering listeners a free Cybersecurity Awareness for Dummies book. In the guide, you will learn what cybersecurity awareness means for your organization, how to implement a cyber risk awareness campaign, the critical role of policies to establish safe baselines, how to maintain momentum and staff engagement, 10 cybersecurity awareness best practices, and oodles, oodles more. Grab a free copy of the Cybersecurity Awareness for Dummies book from MetaCompliance now at smashingsecurity.com/cyberaware. smashingsecurity.com/cyberaware.

Are you having trouble remembering your plethora of passwords? Maybe it's time you look to get a password manager. LastPass, by LogMeIn is a password manager both for consumers and the enterprise. In a company, you get extras like central admin oversight, controlled shared access, automated user management, and everything is protected with multifactor authentication. Learn more at lastpass.com/smashingsecurity. Oh, and if you're a home user, LastPass is available for free. So check it out. lastpass.com/smashing. Back to the show.

And welcome back. And you join us on our favorite part of the show, the part of the show that we like to call Pick of the Week.

Pick of the Week.

Week of the Pick.

Wait, wait.

This is allowed.

Pick of the Week is the part of the show where everyone chooses something they like. Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish. Doesn't have to be security-related necessarily.

Better not be.

And my pick of the week is a TV show which I've been enjoying greatly. It is up on BBC iPlayer, and I don't have any clue as to whether it is available via other streaming services. Hopefully in time it will be. It is 6 episodes of about 20 minutes each, and it is called—

Called Staged. I can tell you're being coy.

It is called Staged. I wasn't Googling, I was just doing for—

Oh, I thought you were very—

I thought you were trying to buy time because you couldn't remember the name of it. Your voice did that kind of—

I'm leaving people on tenterhooks as to what I'm going to be talking about. Staged is the name of the TV show, and it stars former Doctor Who David Tennant, Michael Sheen, who's quite a hoot, Georgia Tennant, who is related in some fashion through marriage, I believe, to David Tennant and Anna Lundberg, who is Michael Sheen's wife as well. It is marvellous. The basic premise of the show is that there's a guy who wants to put on a theatre production. Unfortunately, a global pandemic has happened, and so what he said is that, how about we all get together on Zoom to rehearse the play so that we're ready when the pandemic's over to hit the stage on time? And so it's all about getting David Tennant and Michael Sheen to rehearse via Zoom. There's actually extremely little rehearsal which ever takes place, and it's very, very funny. The guy who's playing the director is actually also the writer and director of the TV show. His name is Simon Evans, and it's really well done.

I watched it at your recommendation on the weekend. We both loved it.

Yeah.

It's really funny. It does take bickertainment to a whole new level, or maybe not.

Bickertainment.

They're very quick and cute, and they've maximized their friendship for enjoyment for other people. It's really lovely.

It's been shot in their homes, and obviously, you know, there are people like their wives and things who appear, because they don't have to be socially distant from them. And you think it won't work. And you think when you're watching it, you think so much of this must be improvised. It's hard to work out how much of it was, and how much of it was actually scripted, but it is brilliantly acted by all.

Probably the same as our show Cluley. They've known each other forever. Some tiny bits are scripted.

That's it.

You guys have a script?

It's just off the cuff. Exactly, right? You have bullet points?

And there are also— I'm not going to ruin it— there are some surprise cameo appearances from other people along the way as well. I would really recommend it, and its name is Staged. Go and check it out if you can.

Yeah, I concur. Agree with Graham, so that's how good it is.

Wow, I gotta see this, and I need to be the dissenting voice and hate it.

You will love it.

You will love it. I know it totally sounds like my thing. I love it.

Maria, what is your pick of the week?

So I'm cheating a little bit. I have not read this pick of the week yet, but it's something that I have ordered for myself, and I'm looking forward to reading. It is a graphic novel by a friend of mine, so this is why I'm plugging it. It's called The Mars Challenge, and the author's name is Ali Wilgus, and the illustrator's name is Wyatt Yates, and it's a nonfiction graphic novel that is targeted for young adults. So it's meant for the high schooler in your life, but of course grown-ups can read it and it'll be delightful. I read novels at this grade all the time. It's just easy to read for me. It's about the unique challenges of human spaceflight and what it'll take to go to Mars. So it's extremely well researched, extremely in-depth, and it goes into a lot of the technical details of what it is actually going to take to get to the red planet. And Ali, I've known for a long time and is a very, very big space nerd and has worked with NASA. They know their stuff really well. And this book, I'm so excited to read it. And if you're a space nerd, I guarantee you'll enjoy it.

So, The Mars Challenge, that is a good pick. I watched a documentary with my son about what it would be like to live on Mars. And let me just show off some of my knowledge.

You guys going— He's friends with Elon and we're gonna hitch a ride.

One of the dangers they suggest is that if you're living on Mars, there is no equivalent to the Van Allen Belt, which protects us from the sun's radiation here on Earth. You don't have that on Mars. So you have to be careful about solar flares and things like this. And one of the things they were saying is if you have a little Mars buggy, you may actually want to use your poop as a layer of protection around the Mars buggy because it helps.

I think you should just roll in it, Clue, and walk around.

I was like, how did this get so scatological so fast?

Anyway, I found it quite interesting because you might as well put— you want to reuse everything that you can, right? So anyway, the Mars Challenge by Alison Wilgus is your pick of the week. It is indeed. Please check it out. Marvelous. Crow, what's your pick of the week?

Pick of the week, right? We're all stuck at home, so it's hard. And I knew you were doing a TV show. I didn't know what you were doing, Ria. But I thought, why don't we have a quiz? I love a quiz.

I have no quizzes.

I know I have no friends to have quizzes with. This is a new quiz by The Observer called The Culture Quiz. And it's kind of good because there's no way you could probably get all of them, or maybe you can, right? There's about 10 questions a week. They put out a quiz every week. And I thought I'd ask you guys a few of them. See how cultured you are.

Oh no, you're asking an American this.

Question, question 1. Which painter impressed a Pope by drawing a perfect circle? And you have choices. Michelangelo, Giotto, or Leonardo da Vinci?

I'm gonna say Michelangelo.

I'm gonna go with Da Vinci.

No, it's Giotto. See, but you guys, it's okay, okay. But no, don't worry, now we go to Lady Gaga. Next question: which TV anthology series did Lady Gaga join in 2015? Oh, oh, American Horror Story, True Detective, or Unsolved?

American Horror Story.

Correct!

The crowd goes wild!

Wow.

Okay, one more. I'm just trying to find minutes. What was the subject of the first known painting? An animal, a human being, a bird? Oh, that's quite deep, that one.

Animal.

Yeah, the cave in France, right? Yeah, yeah, right. Correct.

In 2018, scientists discovered a painting more than 40,000 years old of an unknown animal in the cave of Lubang on the Indonesian island of Borneo. Oh, not France. There you go. So if you would like quizzes, there's a few of them up there. It's called the Culture Quiz. It's done by The Observer, but theguardian.com publish it. I will put all the links on our webpage for this episode on the Smashing Security website.

Whoa, whoa, whoa, I'm reading the link. You didn't do the one about Brian De Palma? You ask it, go for it. Okay, which of the following did not happen to Brian De Palma? 1, he stole a motorbike and was shot in the leg following a police chase. 2, he crashed a motorbike and lost one testicle and most of the skin from his buttock. 3, as a child, he stalked his father with a camera, hoping to find proof of his infidelity. How did you not— because I don't even know who it is. That's amazing.

Okay, I really want— I really want him to have been a child stalking his father.

Okay, which one are you gonna choose?

So which— which one did not happen to him? So I think, I think that one happened.

So the stole a motorbike, shortened leg is one. Crashed a motorbike, lost one testicle and most the skin from his ass.

No, his buttock.

His buttock. And as a child, he stalked his father with a camera hoping to find proof of his infidelity. Definitely did that.

I'm gonna say he didn't lose a testicle and most of his bum.

Okay, so correct, this happened to Jean-Luc Godard. I did not know that. There you go. So good old There you go. And you— well, I love that that happens in Godard. That's okay. That's amazing.

All right, cultural with Maria. Tell me if it's either Zardoz or it's buttocks of Jean-Luc Godard.

Jean-Luc Picard or Jean-Luc Godard?

Picard.

Did you say buttocks of Jean?

I bet he has a good— I bet he has very delicious, nice buttocks. Right, that's enough. Stop that.

It's still Twitter. That's where I'm sometimes at, trying not to stalk mammals who are being assholes on the internet. So @mvarmazis, that's me. So say hi.

And you can follow us on Twitter as well at Smashing Security, no G, Twitter and LastPass. And you can join us on our Smashing Security subreddit as well if you're on Reddit. And don't forget, if you want to be sure never to miss another episode, subscribe in your favorite podcast app such as Spotify, Apple Podcasts, or Pocket Casts.

And huge, huge thank you for listening and supporting us each week. We love you. Also, thank you to this week's Smashing Security sponsors, MetaCompliance and LastPass. Their support helps us give you this show for free. Check out smashingsecurity.com for past episodes, sponsorship details, and information on how to get in touch with us.

Until next time, cheerio, bye-bye, bye, see ya! Wouldn't wanna be a Jean-Luc Picard.

Can I tell you something funny that I did yesterday? I was at a social distance party yesterday with 4 people. Okay, one of the 4 people was aged 2, and we have a kind of a two-tiered lawn. He was on the top tier and I was on the bottom tier, and I sang, belted out Morrissey's The World Is Full of Crashing Boars to his absolute delight. Oh, he was thrilled to the point where his parents have asked if he can come over for an hour each week to have a singathon with me in the garden, which I've said totally during COVID totally.

Was Smiths related?

Well, yeah, maybe a bit of PJ Harvey. We'll see how it rolls.

That's awesome. Oh, that's adorable.

It's adorbs.

Adorbs.