BBW25 - Day 1 - Sovereignty vs. Safety: Digital & Physical Security for Crypto

And while we continue to wait on the federal level, there is obviously still more that we can do at the state and local level to advance projects. We have uh a number of community organizations. I do want to recognize the Rhode Island Blockchain Association, the Boston Blockchain Association. Uh we've done some cool stuff here in Quinsey that you can look up. We were the first municipality in the country to offer a municipal bond on blockchain, which is a very interesting use case that we want to continue to proliferate around this country.

Well, strap in folks. We've got a very interesting panel coming on privacy and security, especially around digital digital and physical information. Um, I'm going to welcome to the stage Nor Beers, who's the CISO of Gayscale is going to moderate this conversation along with Paul Hatcher, the CEO of Mel Herszog, and my dear friend Alec Harris, the CEO of HavenX. Please join me in welcoming them to the stage. All right, thank you.

Welcome everybody. So, we're gonna talk about a topic that's really near and dear to my heart that I spend a lot of time on uh in the course of my dayto-day. Um and um that is this crossover between the digital threat and the physical threat. You know, as the crypto industry matures, um so too are the attacks and the sorts of uh tactics that attackers are using in order to um gain access to crypto funds. And um you know, it's not fishing links anymore.

It's now we're seeing crossover into physical threat, kidnappings, extortion attempts. Um and that trail of digital breadcrumbs that we all leave behind is what's fueling it. And so I'm really excited to be here with Alec and Paul who spend all of their time thinking about um you know how to minimize these things, how to get how to recover back from these sorts of attacks. Um and so we're going to go through a little bit of how this works, what what causes it, why is it so topical right now. Um and what you can do to prevent uh and respond and recover from these sorts of attacks sort of as we go forward.

Um do you guys want to give just a little bit about your backgrounds before we get started though?

Sure.

Yeah. So Alec Harris, CEO at Haven X. Uh and as discussed. So, we're much more on the digital side of this, which might be the leadup to a some kind of digital event, a cyber event, or potentially the leadup to what becomes a physical attack, right? And what we've found through our work, and about 70% of our revenue comes from clients in the crypto space.

And we've been doing this since 2017 in the space. We've seen first of all the maturation and the increase in sophistication that is occurring both as the potential reward for these attacks goes up but also as the industry the the adversarial industry actually matures as well. So our industry is maturing and the bad guys are maturing too. And so what what we're thinking about is what is discoverable about someone that would lead them to potentially be a better target than someone else. And the obvious things are, you know, can you find their phone number?

Can you find their address? Are they speaking publicly about self-custody? Do they reflect uh having significant wealth? Like these are obvious indicators and there can be less obvious indicators like is their Straa app revealing where they go running, right? Uh are they checking in at places that maybe are cyclical in their pattern of life?

Like things that paint a digital pattern of life that could eventually project where you are physically, right? And so what we're thinking about is can you do that in such a way that doesn't acrew risk to you or your family? And if so, how? How can you lead a public life? How can you still be an executive at a company that puts you on podcasts that has you at conferences, but also still feel assured and secured in your own personal security?

And is there an interplay between that and the corporate side, which you know, we'll argue as yes. Uh so that's our side of this and let Paul speak to his. Well, hey everybody. Uh, can you guys hear me over there? All right, it's a little bit quiet.

Um, my intro is gonna be a little bit shorter than that. That was really good. Yeah, just a little bit. Uh, my name is Paul Hatcher. I I lead the team at Maril Herzog.

Maril Herzog is a crisis response firm that specializes in complex human risk. A little bit about myself, I have 24 plus years experience in the risk and crisis response space. Uh, in that kind of in between the US military, um, other government agencies in the private sector about and a half years operational boots on the ground experience Middle East Africa and about four years in Latin America. And one of the things that we specialize in is that we sit on the back of insurance policies as the crisis response firm for things like kidnappings, extortion, uh unlawful, illegal, malicious detention. So I'll kind of bring the physical side into the conversation today.

Yeah, perfect. So we've all seen in the news the increased incident of kidnappings, attacks, um extortion attempts. What do you guys think is driving it now specifically for crypto? Just the change that's happened over the last few years. Um, and if you want to speak to the tactics that you're seeing as well, that'd be great.

No, you start.

Yeah,

you wanted to speak more. Yeah.

Yeah. Um, well, I think there's a multitude of things that are really leading to it. One is awareness. Anytime when we have, you know, a price surge or we come out of a bare market or we have, you know, greater global adoption, obviously, there's awareness around it. There's also a perception that anybody who is in crypto either in crypto or blockchain development or they got into crypto early on that they're rich.

Um the other thing is that cyber people or I'm not cyber crypto people or people involved in crypto are very easy targets. They're loud and what I mean by that is not their voice but everybody's talking about how they're going to change the world. How blockchain technology is going to change the world. How Bitcoin is going to become the global reserve currency. Everybody is constantly projecting what they do, how they're going to change the world, both online and in person.

And because of that, they're very easy targets. Um, another thing attributing to it, I think, is probably uh either a belief or in sometimes reality that there is a level of anonymity that comes with paying, you know, either ransoms or extortion payments in crypto, uh, true or not. Um, I have a couple of things if you guys don't mind me kind of running down. Cool. uh a little bit more as we get into it.

Also, the ability to instantly transfer large sums of money or wealth instantly with no kind of seemingly inter intermediaries. Um what that's done is that it has driven criminals to conduct much more violent attacks against individuals. So, we're seeing what people are calling wrench attacks. So if it's you know co-founder of Ledger in France having a finger removed um if it is the you know the Soho House of Horrors uh case in New York City we are watching criminals um who are kind of immature in what we would normally deal with in a kidnapping identify target attack and get very aggressive very quickly. And the third thing which I think is most relevant probably to the conversation about the like the so what do we actually need to worry about is people in the space is the location.

Typically when we talk about kidnappings I mean this isn't something new. There's 20 to 30,000 of them around the world. Modern day KFR kind of started you know way back in 1874 moving forward. There's kidnappings taking place everywhere but typically it's around you know Mexico, Nigeria, Somalia, South Africa. These attacks that we're seeing are taking place in Australia, France, Canada, the US.

So now where we typically when we thought about kidnapping or you know illegal detentions, we were worried about these hot spots when we're traveling abroad, now we have to worry about it at home, when we're traveling from the office to the gym, from the gym home in our daily pattern of life. So I don't think that there's kind of been a time that's more relevant um for crypto and kind of crypto extortion kidnapping.

Well, Alec, how do you see attackers actually building that profile of life?

Yeah, so I think all of us are aware to some extent that there is a digital sprawl of information that is populated about us or that we populate about ourselves. And and what this means is that a capable and motivated adversary with maybe some access to money and some access to skills can do very sophisticated triage of targeting. And so what they can do is they can assess possible net worth. They can figure out digital pattern of life. They can find what we would call selectors or targeting factors that are like PII, phone numbers, addresses, uh you know, known associates, residential locations, all of these things that then can be aggregated into a targeting package for assessment, right?

And so you would look at someone and a very easy way to do this is okay, let's go on Twitter and see the first time they posted about crypto. If it was nine years ago, I'm going to put them in a better bucket than someone who just posted for the first time two years ago. And then I'm going to go find where they live and I'm gonna look at their residence and I'm going to look and see if they own their house outright. Another great indicator of wealth. And then I'm going to start looking at other indications like the cars they own, the people they associate with, if they social post on social media about travel, and I will look at their public statements if they have any, and try to assess whether they're someone like who maybe works with Nora where there's a very low probability that they self custody or if they're like a true Bitcoin believer foaming at the mouth, has a Traor in the backyard for sure, right?

And then I'm going to take that person who tweeted nine years ago who has a Traor at the house, who lives in the right zip code. I'm gonna figure out how to target them. And it's not that hard. Uh and I know that because we reverse engineer that and it takes a little bit of time, but it could be done very readily, right? And so the inverse of that is also true.

We'll talk a little about that, too.

Yeah. Going through that practice of reverse engineering and see how seeing how vulnerable you are, your company is to these sorts of tactics is a really good technique to figure out, you know, what should I be doing to protect myself better? What's your favorite OSENT uh OSENT technique that people are using that maybe folks aren't thinking about is a really effective way to track them and build pattern of life?

Yeah, so for sure for us it's uh so there's a category of OSENT or open source intelligence called adtech. Uh, and what that is is there is little signifiers on your phone or other devices that are frequently collecting geoloccational information from your device and they're selling it into advertising marketplaces. And ostensibly that's to find out like if you shop at Whole Foods and you recently visit a Mercedes dealership, what kind of ad you should be served up versus someone in a different signature. But if you buy that information and you overlay it on map data, you can actually see where someone has gone historically. And But once I've done that targeting that I just described, then I'm going to go grab that data and just find a good location for a kidnapping.

It is literally that simple. And we've seen very strong evidence that this is actually occurring in some of these things, these kidnappings we've seen in the news.

Go ahead.

Just add on that really quick. If you haven't worked with ADTE before, it has probably a 48 hour delay on the realtime data packets. But this is commercially available to anybody. anybody can actually purchase these adtech data packets in blocks to be able to utilize for the purpose of selling to the consumers who are moving through their markets. Um, but if you can, as Alex said, you know, identify a basic pattern of life, a resident, a school, a couple of key indicators, if you don't know the actual device, um, information, you can take somebody who is essentially pretty anonymous to you, pick out a couple of factors from PII that you can spend $7 online for from spokio.

com or something else without having to actually, you know, have access with PI access to databases and utilize that data. And like Alex said, you know, overlay and build out that P to start determing where you can carry out those TS, but it is it is cheap and cost effective if you're going after a larger target and literally anybody can do it.

So just to add to that, so typically it's a 48 hour delay, but if you're high enough in that brokerage stack, you can get it down to a 30 minute delay, right? Which is basically near real time data on where you are.

So it's not that hard to get all this data. What's a good what are good indicators um to know that somebody is under surveillance, is already being targeted? What should they look for?

Um well, physically I guess there's a couple of different things to talk about there. Um I'm going to back up actually if it's okay and just talk about a little bit more. Alec got into the targeting cycle and I think it'll actually play into the detection to understand what we're looking at when we're trying to prepare people to identify surveillance um you know or somebody else who's trying to gather intelligence on you. So if we look at any sort of criminal planning cycle or or terrorist planning cycle a lot of those are natural cycles that people do uh to down select targets and figure out how we're going to attack this. Right?

even if you're a common robber looking the house. So you have the kind of the preliminary uh down selective targets. So we're going hey I want to commit a crime um here are all my potential targets looking for the soft targets like like Alex said there's an initial discovery phase which is that surveillance phase digital like Alex was talking about then there is a down select from there. So once they've down selected the individual target and they're like I'm going to kidnap that person or I'm going to you know do a cyber extortion of that person whatever harm, harassment or embarrassment you're going to do to that individual then the surveillance cycle starts again and that is both digital and physical surveillance and the physical starts to come into play because they are looking for vulnerabilities and times to actually carry out the attack. So, what we're trying to accomplish as we get into the surveillance on both the digital side and the physical side is one to be able to remove all of your information, right?

All your digital information from online as much as you can or obfuscate that information. I'll let Alec get into that. But the digital side, right, we want to be able to prevent individuals harden you as a target from targeting you in the first place. Now if you are down selected and you do become a target that's when it moves to the physical side. Now what we want to do is be able to identify in the field when somebody's actually surveilling us so we can report it forward so it can either be mitigated or managed prior to right.

So we're trying to a present ourselves from ever being a target online and then b we want to make sure that while we're out we're picking it up. Now into your question, picking up surveillance is a skill set, right? Like this is something and and it'll go into some of the prevention things on the situational awareness side. A lot of it is about being aware of your surroundings, right? Um a simple thing because literally we give a two-day like in-person course with a former person from the CIA who walks you through like, hey, this is what it's like to be on the ground and here's what you want to be looking for.

But there's a really simple thing I always tell people. I call it the rule of three from an old job I used to have. So if you see the same person three times over probably a twoe period and it's not the person at the grocery store who's checking you out, it's not the dog walker who lives in your neighborhood, but it feels like an uncommon sort of encounter, you should report that, right? Anything that kind of feels uncommon. But as far as physical surveillance, um if somebody's well trained or you have a well-trained team, they shouldn't be able to pick you up.

But so I mean really just being cognizant of where you are, your surroundings, the people who are there. But the only way to really get good at this is to put it into practice, get training, and actually go out and put it into practice in your daily life until it becomes a habit.

Well, yeah. So, let's let's back up and go into some of those prevention um and sort of early detection mechanisms that people can should be aware of and use because I think then we'll get into response. But the some of the early things that you could be doing to make it less likely that you're targeted to be deterring attacks in the first place are the best investment that you can make, right? So, you're not in that position of having to know that you're under surveillance before something bad happens.

Yeah. And so we have this phrase that we borrowed from someone which is we want all of our clients to be abort mission criteria which is we're not trying to say that the adversary is not going to do something but we want to say that you're the best lit house on the block and they're just going to move on somewhere else. And that's honestly the best posture you can have. And so how to do that right be hard to find. So that means that a you don't overshare your information but b the information that's out there where it can be removed remove it where it can be offiscated.

obiscate it, you know, use

that obiscation a little bit. Yeah.

Yeah. So, so you can actually engage in disinformation yourself, right? It is not illegal in America to lie about your name, to lie about where you live. Obviously, not to the government, right? But, uh, otherwise, like you don't need to self-report information that puts you in a target set.

Uh, and frequently because we're, you know, a high trust society, we do that. And it's actually a skill to learn to not do that. And so, what that means is if someone asks you for your address, there has to be a real reason they need it. And that it can't be a mailbox uh and that you can't get away with using some kind of mail relay service that would maybe move it to your house, right? There's ways to get around this.

Uh the same thing with your phone number, right? Your cell phone number doesn't have to be the primary number that you give to people. There's tons of burner apps out there. Uh and then the third thing is when you're in the situation where you absolutely have to share information, right? Like if you're filing a tax return, right?

I'm not saying we're not advising any kind of crimes here, but in those manage those documents very carefully, right? Like th your address, your phone number, those documents that have to be disclosed. Make sure that you're not putting them at risk by being like lazy with them digitally or not shredding documents at home that should be shredded, right? And if you do those basic things, this is not advanced stuff, you're actually already in that abort mission criteria category. And then there's plenty of stuff you can dive deep on, but I would start there.

Hey, Alec, really quick. What's the best way to get disinformation into the interwebs?

It takes time, right? So, as much time as it takes to get true information out there, it takes disinformation. And so, the way you might do it, right, is uh if you go and sign up for, say you're interested in information about a cruise, I guarantee you that information is going to be resold. So, just put your name in a different address and a different phone number in Carnival Cruise Lines website and that information will populate. And you do that over and over.

You buy magazines going to different addresses. You just start percolating out information that eventually will acrue making it look like you live somewhere else. It's not going to do it overnight, but within six months or a year, there will be a trail of disinformation around you.

And the hope with that, just to make it clear, is that if I'm doing the down selection and I'm the criminal actor who's looking to commit the crime when I start to do my really cheap digital research, as opposed to having like three residences that were all actually yours that are associated with your credit headers, um, you know, some information from either telephone bills or credit card bills or your actual mortgage. I'm actually now getting 20 25 different residences kind of all around the same area. You're just too much of a pain in the ass for me to deal with. Excuse my language. So, I'm just going to bypass you like Alex said, abort mission criteria and just go to the easier target.

So, that that's the purpose of the disinformation I think is a beautiful tactic for being able to like in those early stages make yourself not a target.

Yeah, there are plenty of targets out there. You don't need to be the easy one to hit, right? All right. So translate it though um the sorts of tactics into what a company or an institution that's trying to be more privacy conscious um and deterring these sorts of attacks what they might do for maybe their key executives the folks that are likely to be targeted.

Sure. So I can start on that. So I think it's actually interesting to posit that there's actually not that much of a distinction between your personal life and your corporate life when it comes to these security things. Right? So if you're being targeted because of your digital hygiene, that is easily going to translate into work risk.

Uh and so this is why sometimes at the enterprise level and certainly at corporate level, companies are doing data removal on behalf of their executives. They're doing opsec training on behalf of their executives. They're handing out company phones and company laptops and and cellular numbers, right? To separate out that corporate risk and the personal risk. But ultimately, if you're a personal risk, you're probably a corporate risk.

Uh and so what we see is generally companies are starting with the privacy stuff and the training stuff and then if you can do those two things you might escalate some other stuff that based on like idiosyncratic risk to that organization but the building blocks are really a great place to start.

I agree.

Thank you.

No I mean same thing you say within a corporation right individual risk translates to larger corporate risk. Make sure you have the proper policies and procedures in place. Make sure that you have proper effective actionable training in place. Um, and then ensure your risk to transfer it. So, there's insurance policies that kind of cover everything these days.

All right. So, we've gotten past prevention. Folks didn't do what they were supposed to do. We have an actual event. How do those unfold?

What are the common sort of life cycle of an attack?

On the kidnapping side,

yeah.

Um, so kidnappings, they can take a thousand different forms depending on where they are and and how they happen. I would say the majority of them start as a missing person. So we have an individual who typically is traveling not at home office and they don't report to work. Uh leadership if they have policies and procedures in place should have a crisis management team. They they start to make the determination hey this is concerning.

Are they sick? Why aren't they at work? Let's reach out to them. That missing person you you at that point reach down to the closest kind of point that you can local office or whoever else was traveling with them and you you do some factf finding. Did they go out drinking too late last night?

You know, why are they missing? Now, if that missing person doesn't show up and it turns into an abduction or we sub or we suspect it's an abduction, so prior to anybody actually calling and demanding a ransom, at that point, we want to spin up our crisis management team and actually start putting into play to prepare for the fact it might be an abduction. We start looking at local laws. We start looking at home nation laws, home host nation laws. What are the implications?

Do we have local communicators, people who would be talking uh to to hostage takers? You know, do we need to notify local law enforcement? Do we know need to notify the MC if it's abroad? So really, there is a process and I could go on for an hour about this, but there's a process that's put in place where we a try to determine what are the facts, right? Has an individual been taken, right?

If they have been taken, is it what I call a KFR? Is it a kidnap for ransom situation? And if it is, what are the necessary steps that we need to do to to start moving down that path. So our crisis management team should have uh you know somebody within the company who has decision-making authority. So they are the ultimate authority on going yes or no on what we do.

We should have crisis management teams you know family service officers who are getting ready to work with families. We should start training up the the voice of the communicator to talk to kidnappers. So, as we move through the process, if it ends up being not a missing person or an abduction or a murder, but an actual kidnapping, then we start preparing for that first negotiation. We start figuring out who do we need to work with? What law enforcement organizations do we work with?

Do we work with them? Local aid organizations, and let's prepare to receive that first call. And then we start putting in after the first call a negotiation strategy based off of the identifiers that we hear on that call. And so, that can be a long process. It can a slow process.

Average kidnapping globally lasts less than 10 days. Average payout is less than $30,000. They're much more rapid than people realize. It's not the days of the FARC in Columbia where they're lasting over a year. Um so the critical components of that are a to actually think about it before it takes place.

B have um proof of life dockets on every one of your high-risisk employees. So you should have identifiers in that. You should know who the next ofkin is. uh you should know specific proof of life questions and what what I mean by proof of life they're are questions that only that individual would know they are not readily you know they can't be found through an online search um and then we need to make sure that if we can we have an insurance plan in place so there there's kidnap ransom extortion policies I'll try to hurry up here um and on the back side those policies are firms like ours so when and if something does happen. We are called in to integrate as advisors at both the crisis management team level, so at headquarters level and then in the field to walk you through all of the steps to help advise on what right looks like.

We we're not in control of it. We are simply advising on the steps you should and could be taking so you can make informed decisions.

So So I just told my wife if I'm ever missing just call Paul Hatcher and I gave her his number. Um I I want to throw one thing out to maybe you Nora. So when we're doing the digital targeting and and this is relevant for your world Paul we really want to know who has access to custody whether it's self custody you if you're a DAO or a dad or whatever you know who is perceived as having that access. And so part of the digital the reverse targeting is to try to obuscate that. But I I guess Nora for you on the corporate side like how do you think about custody and the perception of custody?

So, I think you just don't allow for key points of failure. I think um you know, some of these crypto technologies that have come out have given us so many good tools to spread out your risk, right? You shouldn't have one person that can move money. You shouldn't have two people that can move money. If you are holding lots of money for a company, the number of controls and people that should have to be a part of that um either on the initiator side, the approver side, the check side, etc.

before money moves um should be so high that the amount of collusion and control breaks that had happened should be incredibly unlikely. If you look at the recent hacks that we've seen, um there were easy single points of failure in every single one of them. Um they're not hard to design systems that have sufficient checks that you are unlikely to be targeted. Um it's just work. And I think a lot of times some of these companies that are getting hit are optimizing for um you know productivity, speed of transaction over the security of their assets.

Um and that's going to be true on the human side of this as well. Um you know we're very thoughtful about not introducing single points of failure or um into our mechanisms at all. And um that's not just the advice or the sort of rules that we follow internally at our company, but it's the same advice that we give every person who um works for us who's themselves invested in crypto. Just don't put yourself in that position. There's no reason to.

There's great technologies. Use multi-IG, right? Um have redundancy. Think about redundancy in the same um vein that you think about operability and um and the confidentiality and keeping your keys secret. Um, and if you think about that stuff ahead of time and how much you'd have to know and how hard it would be to be able to move or steal your money, um, you are probably already leagues and bounds ahead of other folks who are more likely to be targeted.

Um, and so to that end, um, what's the future look like? This has evolved really quickly just in the period of time that I've moved into crypto. Um, I remember saying when I started that mostly we had a phys a technical threat. It's not really traversing over into the physical and it is really quickly moved into that space. So what do you guys think over the next three to five years the evolution of this space is going to be?

I think on the digital side there's going to be a leaps and bounds advantages occurring to the adversaries because of the aggregation of data and the way the data can be parsed for relevance and and in bulk very quickly. So that's that's the bad side. I hope that that also results in a bunch of agentic tools that allow privacy to be accessible, you know, beyond the scope of people who have the money to pay for it, which is unfortunately kind of where we are. Um, and so like I see kind of like a arms race uh between what we can do on the personal empowerment side and what the adversaries can do. And I'm not ready to call it yet.

I'm not sure.

Not a lot on the physical side, honestly. Like there hasn't been there haven't been a lot of changes in the way that we deal with KFR or kidf ransoms. Um, The only thing that I've really seen in the space as a whole are the insurance policies that are becoming available which are giving access not only to expertise after an incident has has taken place but there are multiple triggers that are built in what we call left of incident. So they are mitigation triggers for malicious threats unlimited access to experts for risk questions. like there's so much now being built in to insurance policies that are truly becoming kind of a a forcing factor for what right can look like for organizations and individuals.

So I think we're going to see much more mature insurance policies the way that we have in the cyber space.

Great. All right. Cheers.

Thanks everybody. [Music] [Applause] Thank you guys very much. This is the real side of crypto that you're learning about. We're taking you on a journey today. So, we're going to take you down a deeper hole to learn more about crypto scams.

Uh, we have with