Your Spotify Account Might Be Laundering Dirty Money đ” Darknet Diaries Ep. 171: Melody Fraud
Jack Rhysider
0:00 JACK: Iâve always like the idea of fake it âtil you make it,
0:02 where you act like someone you want to be until you become them.
0:06 This sometimes comes with imposter syndrome,
0:09 but I think the antidote to that is just more experience.
0:12 But how do you go from being a total beginner to confidently doing something?
0:16 I often turn to the book store to help me there.
0:19 But you know a book thatâs always bothered me?
0:22 Itâs those For Dummies books,
0:23 like the C Programming For Dummies, or The Complete Idiotâs Guide.
0:26 Even if I donât have a clue where to start,
0:30 I would never buy one of those books because
0:32 I donât consider myself a dummy or an idiot,
0:34 because I want to fake it âtil I make it,
0:36 and I donât want to fake being a dummy.
0:37 I want to be a great programmer.
0:38 So, A Dummyâs Guide to Programming is not the direction I want to be going.
0:42 I think what those books fail to do is they seem to target who you are now,
0:47 not what you want to become, and that was their failure, at least for me.
0:51 Iâve bought tons of how-to books, but I will never buy one of those books.
0:55 To me, the key to success is in the aspiration.
0:59 I would instantly buy books that were titled How to Be an Amazing C Programmer,
1:04 because that is what I want to become.
1:07 The book could contain the exact same words as the other book,
1:10 that C Programming For Dummies,
1:12 but it would have an entirely different impact on me.
1:15 Every time I saw the title,
1:16 Iâd feel like Iâm becoming more and more like the person I want to be,
1:20 an amazing programmer, and that would give me that false sense of greatness,
1:25 which is exactly what itâs like to fake it âtil you make it.
1:28 Because itâs not about who you are today;
1:30 itâs about who you aspire to be tomorrow.
1:33 Itâs about embracing the journey of transformation
1:36 and allowing your actions to shape your destiny.
1:38 So go ahead and fake it.
1:40 You can lie to yourself if you want,
1:43 because sometimes the greatest lies are the ones
1:49 that propel us towards our truest selves.
1:54 [Intro music] These are stories from the dark side of the internet.
2:00 Iâm Jack Rhysider.
2:03 This is Darknet Diaries.
2:18 JACK: Today Iâm talking with Andrew.
2:21 ANDREW: Yeah, Iâm Andrew Batey.
2:22 JACK: Andrew has a really unique job that I canât wait to ask him about.
2:26 But first we should learn about how he got there.
2:28 ANDREW: So, I started on Facebook when it was still EDU-based,
2:31 and then I was one of the first fifty beta
2:34 advertisers on Twitter and learning to kind of misuse their system.
2:39 JACK: [Music] Misuse their system.
2:41 These systems are huge and complex; algorithms,
2:44 likes, follows, and a whole ad network.
2:47 He wondered if he could manipulate any of that to his benefit.
2:51 ANDREW: The same thing with YouTube.
2:52 You used to be able to break anything into the front page of YouTube,
2:55 and I guess I quickly became the guy that you
2:58 would go to if you wanted to sort ofâŠlike gray hat, black hats, and stuff.
3:02 JACK: Gray hat and black hat and white hat, letâs talk about that.
3:05 Thatâs gonna come up a lot in this episode, and weâll start with white hat.
3:09 White hat is doing something thatâs 100% legal and safe,
3:13 such as hacking your own computer.
3:15 Nobody is gonna come arrest you for that.
3:18 Black hat is doing something thatâs illegal,
3:20 such as hacking your exâs lawyer to see what theyâre plotting against you.
3:25 Gray hat is somewhere in-between.
3:27 Maybe itâs technically not legal,
3:29 but youâre hacking into something only for research, but not to cause harm.
3:34 But these terms also apply to marketers,
3:36 someone who follows the rules such as paying for ads the normal way.
3:41 Thatâs a white-hat marketer.
3:43 But someone who uses bots, for instance,
3:45 to artificially create a bunch of five-star reviews for something,
3:49 that would be a black-hat marketer in my opinion,
3:51 because they are lying and cheating
3:53 with their so-called marketing and run the risk
3:55 of being thrown off the very platform that theyâre trying to grow on.
3:59 At least, this is what I think these terms mean going into this episode,
4:03 but my definitions might change as we go further.
4:05 So, in my opinion, Andrew was a black-hat marketer.
4:08 He was trying to promote certain products or people
4:11 by tricking people or systems to artificially inflate somethingâs popularity.
4:16 ANDREW: My favorite thing at the time was like-jacking.
4:18 It was a weird time period because it was before fan pages.
4:22 So, initially when Facebook first launched,
4:24 you could only friend-request somebody, and there was a 5,000-person limit.
4:27 What you used to do is you would hide the requestâ Friend Request button,
4:31 or when fan pages launched, the fan Follow button,
4:35 but you would hide it in the pixels.
4:37 I donât know if youâve come across that.
4:39 JACK: Yeah, I have.
4:39 People who want to become popular on social media might do it,
4:42 like an up-and-coming band who wants as many likes and follows as possible.
4:46 If others think youâre good, then youâre probably good.
4:48 So, you might show up in more peopleâs feeds because of that, too.
4:51 Facebook made it so you could add a Like button anywhere you wanted,
4:54 like on your own web page or blog.
4:56 But if you were sneaky, you could trick people to clicking on that Like
5:01 button when they didnât know they were clicking it.
5:03 Thatâs what click-jacking is, or like-jacking.
5:05 ANDREW: In our case we ended up using
5:08 it a lot on video or photo-sharing websites.
5:11 So, when people were clicking Next or going through video or photo carousels,
5:16 every time they were clickingâ we sort of trained our users to double-click.
5:21 We started buying these websites that were high-volume websites.
5:24 Then eventually we started doing web development
5:26 for other sites and then putting these in there.
5:29 What would happen wasâ our hypothesis was
5:31 that people did not log out of their Facebook.
5:34 Itâs cached in their browser.
5:35 So, what we would do is just hide that pixel inside of other websites.
5:41 [Music] So, we could drive millions of fans to things.
5:45 JACK: Man, how clever; they bought a popular video and photo-sharing site,
5:51 and as the users clicked Next or Play, it wasnât the Next button.
5:54 It was the Facebook Like button.
5:56 The users had to click twice because the first one was just liking the photo,
6:00 and then the second was going to the next photo.
6:02 So, what Andrew would do is heâd advertise that he
6:05 can get your Facebook page 5,000 followers and thousands of likes,
6:08 and people would buy his service to promote their bands,
6:12 and heâd artificially grow someoneâs Facebook account.
6:15 ANDREW: So, thatâs kind of where we started a lot.
6:17 Another thing we did in the early days was kind of an ad arbitrage.
6:20 At the time, for example, when you charge an advertiser,
6:24 they cared about time on site and sort of CPMs,
6:27 but they didnât care that much about
6:29 the actual click-through or engagement with the ads.
6:31 They just werenât aware.
6:33 I know that seems obvious now, but back in the 2000s,
6:36 no one really knew that those were
6:39 metrics to look at, like traditional advertisers.
6:41 So, what we would do is we had these high-traffic-volume websites and we would,
6:46 for example, have a $5 CPM, letâs say.
6:49 But we could buy traffic for like, a dollar.
6:52 So, we would blend enough garbage traffic in that we
6:55 didnât really ruin our overall time on site or user stats,
6:59 but we would be able to sort of print money.
7:03 JACK: Oh.
7:03 So, heâd sell ads on his website but then pay fake visitors to click it,
7:09 making it look like a lot of people clicked that ad,
7:11 and then he would just collect the money for it.
7:14 But really, it was just paid traffic.
7:17 Huh.
7:17 ANDREW: Another one that we did that was
7:19 really interesting at the time was around YouTube.
7:21 So, we figured out that you could
7:23 basicallyâ there were these pop-under ads back then,
7:26 and you couldâ most people recognized them
7:30 from the penis-enlargement ads and things like that; youâd
7:34 click out of a website and there would
7:36 be the annoying little open browser underneath it.
7:38 We would load it with YouTube videos on mute,
7:41 and we were able to rack up hundreds
7:44 of thousands of plays to a YouTube video quickly.
7:47 If we could get 300,000 to 400,000 views quietly in the background,
7:53 we could basically break into the algorithm on the front page.
7:56 Back then, people would go to the front
7:58 page of YouTube to see what was trending.
8:00 So, we would be able to break a bunch
8:02 of different content pieces onto the front page of YouTube.
8:05 At that point they had to sink or swim.
8:07 You basically had to have good content that people liked or not,
8:10 but pretty quickly it was evident;
8:12 you either went viral or you were trash and you were removed quite quickly.
8:15 So, we could get you there, but the question was whether or not youâd stick.
8:19 JACK: Jeesh.
8:20 Now, see, to me, this is all black-hat marketing.
8:23 You arenât bringing real customers to your site or video page.
8:27 Instead, itâs all fake.
8:28 Itâs not quite bots; itâs real people clicking things,
8:31 but theyâre tricked into clicking things
8:33 and they donât know theyâre clicking it.
8:35 The stuff theyâre viewing is invisible to them,
8:38 but itâs playing in the background.
8:40 So, I call this black-hat marketing because if YouTube found
8:43 out that you manipulated your way to the front page, theyâd probably ban you.
8:47 But I also think if you have a bunch of fake followers,
8:50 then thatâs not real marketing, either.
8:52 Thatâs cheating and lying and manipulating.
8:53 [To Andrew] Now, when you say âweâ, what was thisâ where is âweâ?
8:56 ANDREW: I had a couple partners that we did this with.
8:59 JACK: Was this like a black-hat marketing firm?
9:02 ANDREW: You know, that term wasnât really a thing then.
9:05 I would say we all considered it marketing, but we didnâtâ I mean, yes,
9:10 itâs black hat, but I wouldnât say that thatâs
9:13 what we visualized it as at the time.
9:16 At the time we really felt like we were just a marketing firm using
9:20 all the possible channels we could to give a brand an opportunity to take off.
9:25 What I got known for at the time wasâ we launched an artist on Facebook,
9:33 and he had no label, no major label, nothing.
9:38 He was found at a bonfire in Nantucket.
9:40 So, it was kind of like an interesting thing.
9:43 When we went to the labels back then and tried
9:46 to convince them that you could use Facebook to launch an artist,
9:49 everyone laughed at us and said Facebookâs for kids.
9:52 We have a website.
9:53 We do e-mail lists.
9:54 We do paid marketing.
9:56 This isnât part of our mix.
9:57 No one believed it was possible until we did it.
10:00 Then after we did it, everyone wanted to pay us to do it.
10:04 The hardest thing was trying to continue to perform,
10:08 because thenâ everyone that finds a vein
10:11 that worksâ everyone starts copying you, and then you have to find a new way.
10:15 Itâs like youâre constantly on a treadmill for finding new,
10:18 innovative ways that you can break an artist or that you can just get attention.
10:23 I think from our view, thatâs the art of marketing.
10:26 Itâs lessâ it doesnâtâ I think for a lot of us
10:30 it doesnât feel like black hat âcause weâre just using
10:32 a technique or a tool that might only last for two
10:35 months or three months until we have to find something else,
10:38 and we all safeguard it.
10:39 When we learn something, we donât tell people.
10:40 So, when we learned about like-jacking, which was the hypothesis we had,
10:44 we definitely didnât tell anybody because we didnât want anyone copying us.
10:47 We didnât want people to know how we could drive a million fans to something,
10:51 and they were all real fans.
10:53 So, it was just kind of aâ I think in that view, itâs just a different era.
10:59 I would also say that no one even called it social media marketing.
11:03 At the time there was digital marketing.
11:05 New media was a term.
11:07 There wasnât even a term forâ growth-hacking wasnât even a term.
11:10 No one even used the word âgrowth-hackingâ.
11:13 It just was not a thing at that moment.
11:15 So, it is interesting to see how the whole thing has evolved.
11:18 I do think that if you asked us point
11:22 blank is what youâre doing violating terms and services,
11:25 for sure we would have lied and told youâ we would have told you no.
11:30 But we all knewâ we werenât drinking the Kool-Aid.
11:33 Everyone in the company knew we were violating terms and services.
11:37 I think the thing we thought was, who cares?
11:40 If a real user likes what we have to do, like what weâre presenting themâ weâre
11:46 not faking the genuine product market fit.
11:49 Weâre just trying to get in front of those eyeballs
11:52 and see if we are a product market fit.
11:54 JACK: That was a stretch as well,
11:57 but I agree with you that I think a good marketing campaign is
12:01 one that actuallyâ âcause I think most people are like, I hate marketers.
12:05 I hate ads.
12:06 I hate all this stuff.
12:07 But do you?
12:08 When a product lands in front of you and itâs
12:10 the perfect thingâ itâs your new favorite song and youâre like,
12:13 holy cow, I canât believe I just found this, then you donât hate it, right?
12:18 ANDREW: Totally.
12:18 JACK: So, if you can match that person who needs this product with this thing,
12:24 and that is a marketing move that youâve done, then that is fantastic marketing.
12:28 I thinkâ I wish thatâs how all marketing was,
12:31 was to actually find the person who needs it and thenâ and focus on them.
12:35 Unfortunately marketing has a lot of wasted eyeballs looking at it.
12:38 ANDREW: For sure.
12:40 JACK: Thatâs a lot of wasted money.
12:40 ANDREW: Even back then,
12:42 I remember seeing this thing in probably 2011, I feel like,
12:45 where there was this report that came out in an advertising researcher
12:50 port that only 8% of people who saw an ad online were real.
12:55 It was just technically a machine
12:58 connecting with another machine presenting the ad,
13:01 but there wasnât a real person on the other end.
13:04 That was fifteen years ago.
13:06 I can only imagine how much worse itâs gotten.
13:09 JACK: Yeah.
13:10 When you were doing this black-hat stuff,
13:13 did you have any success stories of people
13:16 that you made or products that you launched well,
13:20 and just huge success with these techniques?
13:23 ANDREW: Yeah.
13:24 I donât want to throw them under the bus, but we definitely did win a lot.
13:29 We took a brand in action sports that was like,
13:31 seventeenth in their spot and moved them to like, third in the market.
13:35 Weâ and what was crazy is at the time you start doing these big activations.
13:40 So, when you start winning, all the big brands pile in.
13:43 All of a sudden they all want to do a collaboration or some deal with you.
13:47 So, you end up doing really big brand partnerships or brand collaborations
13:50 with really established companies once they all perceive you as the winner.
13:55 So, the snowball sort of takes off,
13:58 and then it becomes less black hat and more traditional
14:02 project management and release schedules and just creative, less like hacking.
14:08 JACK: Yeah.
14:08 So, one sports brand went from seventeenth to third.
14:11 What else?
14:12 ANDREW: Yeah.
14:12 We had a musician that we launched that went number-one iTunes,
14:15 number-seven billboard with no label.
14:17 JACK: Okay, number-one iTunes, number seven, is that fake numbers?
14:21 Is that fake numbers or�
14:23 ANDREW: No, those are real numbers.
14:25 Thatâs the crazy part.
14:25 Thatâs what Iâm saying;
14:26 I donât feel like it was black hat because we got in front of all the people.
14:30 We got in front of people who decided they really loved this artist.
14:34 Because they really loved that artistâ
14:37 and we sort of had an eighteen-month plan.
14:40 So, as we were building this artist with all these techniques,
14:43 we were providing them with content to get them
14:45 more and more hooked and engaged with the artist.
14:48 When we released that artistâs EP, that artist went number one over everybody.
14:54 I remember we beat DJ Catalan, as an example.
14:57 We beat everybody.
14:58 No one could believe it.
15:00 We were called out.
15:01 People thought we had faked the numbers.
15:02 We didnât fake anything.
15:03 It was all real.
15:05 We just sort of met the consumer at the pointâ we were
15:10 in front of the consumer at the right moment when they quote,
15:14 unquote âdiscovered this artistâ and then thought they really liked it.
15:17 So, again, the techniques allowed us to engage
15:20 and have a real product market fit.
15:22 But the techniques we used were definitely not approved.
15:25 JACK: Yeah, I mean, Iâmâ when I first started this podcast I was like,
15:30 alright, letâs market it.
15:31 You start noticing some of these black-hat marketing techniques.
15:34 I had to really sit and look at myself in the mirror and be like,
15:38 am I a guy who is going to cheat my way to success?
15:41 Like, fake it âtil you make it.
15:43 I had a long debate about it.
15:44 Iâm like, no, Iâm a hacker;
15:46 of course Iâm gonna use every trick in the book, right?
15:48 This is great.
15:49 Letâs try it all.
15:49 Then I was like, no, this is not honest.
15:52 This is unethical and all that sort of stuff.
15:54 So, I landedâ this is funny; I landed on no black-hat marketing,
15:59 but Iâm totally for guerrilla marketing, which is unsanctioned marketing, right?
16:04 So, if I go to a conference and thereâs
16:06 an empty booth where a vendor didnât show up, I might sit down at that booth,
16:11 put a little banner up that says⊠ANDREW: I love that.
16:13 JACK: âŠhey, this is Darknet Diaries, and I didnât pay $10,000 for that booth.
16:17 Until the people come and say, hey, is thisâ did you pay for this booth?
16:20 No.
16:20 Okay, well, get out.
16:21 Alright, cool.
16:22 So, Iâll put stickers on places⊠ANDREW: Thatâs amazing.
16:24 JACK: âŠthat arenât supposed to be stickers and all kinds of stuff like that.
16:28 So, thatâs what it is, guerrilla marketing.
16:29 ANDREW: No, I agree.
16:30 I think thatâs definitelyâ and I have some examples.
16:33 Like, we launched an app in 2013 called Hater App.
16:36 It was Instagram for everything you hate.
16:38 Our logo was a giant thumbs down.
16:40 We wentâ I neverâ we went to South by Southwest and we
16:43 just started putting stickers on peopleâs backs as they were walking,
16:46 and there was thousands of people walking around with these stickers.
16:49 It wentâ we got so many downloads.
16:52 The downside was we had built this thing totally crappy
16:56 just to see if it would work as an MVP,
16:59 and it wentâ we had hundreds of thousands of downloads overnight,
17:03 and the app was not functional.
17:05 It was a complete mess.
17:06 But it was such an interesting moment where I remember doing
17:09 interviews withâ we did interviews with Wall Street Journal and everyone.
17:13 It was like a huge story at the time âcause
17:17 we basically did this guerrilla approach and it kinda worked.
17:19 I guess to your point, I always viewed the stuff I did onlineâ I mean,
17:25 maybe Iâm just justifying it now.
17:27 Like, hindsight, I have revisionist history.
17:29 But I remember really feeling like the things we were doing online was
17:33 the guerrilla version of what we did in person for these types of techniques.
17:39 JACK: Something I noticed on the podcast world is that people
17:42 can fake their way to the top on Apple Podcast charts,
17:46 but most of them fall off a cliff
17:48 as soon as they stop paying their black-hat marketer.
17:50 ANDREW: Totally.
17:50 So, I have anâ thereâs an artist I know who I
17:53 wonât throw under the bus who is a major artist now.
17:56 They were up for a Grammy, a bunch of things.
18:00 Their entire first album was fake.
18:03 JACK: Okay, I know who youâre talking about.
18:05 Check this out.
18:06 I saw this article last week.
18:08 Spotify accuses Drake of forging billions of fraudulent streams.
18:12 ANDREW: Thatâs not who I was talking about, but thatâs also interesting.
18:21 JACK: [Music] Okay, so thatâs what Andrew was busy doing for a while.
18:23 He was living in Los Angeles,
18:24 and he wasnât just doing black-hat marketing and launching peopleâs careers,
18:28 but also building websites and tech companies and buying and selling them.
18:32 He was solidly tuned into the internet and saw it in a way that not many did.
18:37 One of his friends is Morgan, and they liked going to football games together.
18:40 ANDREW: Back in the day we had tickets to the LA Rams.
18:43 So, we would go to the games every week, everyâ eight times a year or whatever.
18:47 Weâd go to the games all together.
18:49 We had ten seats together.
18:50 So, it was Morgan, me,
18:52 and a bunch of music exec guys that we had known just randomly together.
18:56 So, anyway, weâre there all the time,
18:58 and aroundâ I was everyoneâs weird crypto friend.
19:00 I started mining in 2011 and sort of been
19:04 really interested in technology and how it could be used.
19:09 But anyone who goes back to that day will understand,
19:12 anyone who was in this thingâ maybe you were in it back thenâ
19:15 but it was weird because pure tech people really didnât like blockchain people.
19:19 There was this weirdâ if you were a crypto guy,
19:24 you kinda got the scarlet letter put on you when it came to tech,
19:28 and it wasâ it really did feel like at the moment,
19:32 if people found out you were the crypto guy,
19:34 that you would just get pigeon-holed and lose opportunities.
19:37 So, I was very careful to keep building
19:39 tech and keep the blockchain crypto stuff entirely separate.
19:42 Around 2017, that sort of whole world merged together.
19:46 All of a sudden, interâ people in suits started showing up to crypto events,
19:51 and next thing you know, bankers are around and everyoneâs talking about
19:55 how it could be used for enterprise.
19:56 It really felt like the industry collided.
19:59 The music people came to us and said, hey,
20:02 could you use blockchain to track the number of times songs are played?
20:07 The reason is, until today, even, the streaming services give the labels a CSD
20:13 that says Snoop Dogg, 100 million plays.
20:17 No one actuallyâ thereâs no receipts behind that.
20:20 Itâs literally just a cell; the artistâs name,
20:23 and the next cell over, number of plays for the month.
20:27 Thereâs no receipts for usage.
20:29 Usage is the number-one driver to how
20:31 much money you should be making every month,
20:33 so itâs really weird thereâs no receipts there.
20:35 So, the way that it typically worked when streaming took off,
20:38 the music industry just adopted what theyâd always done for physical,
20:41 and that was always an audit period after three years.
20:45 So, every three years they go and audit the partner.
20:48 To do a usage audit, though,
20:50 a forensic audit, not where Iâm trapping the contract,
20:52 not where Iâm trapping revenue coming in, but how
20:55 many times the song was actually played,
20:56 that could take them up to two years to complete.
20:59 So, youâre talking about five years later
21:02 figuring out that five years ago you should
21:04 have been paid a million more dollars
21:06 for this artist and $2 million for that artist, and that adds up to a lot.
21:10 But all that moneyâs been paid out.
21:12 So, you donât have this ability to sort of recapture
21:14 that money from the streaming services âcause itâs gone.
21:16 So, they came to us and said, we believe blockchain could be a solution.
21:20 Youâre our weird crypto friend that also understands music,
21:23 and we trust your whole team here.
21:25 Morgan, my co-founder,
21:26 had been a lobbyist on behalf of a lot of the majors for copyright protection,
21:31 extending copyright law,
21:32 and Poria was a really gifted machine-learning AI engineer,
21:36 but at the time we were doing a lot of crypto stuff together.
21:39 So, they said, we believe your team could solve this.
21:41 Will you build a real-time tracking tool?
21:44 The question we were trying to answer at the time
21:47 was how many times is every song actually played?
21:49 Because you canât rely on the CSVs to justâ that they hand over.
21:52 Theyâre always wrong.
21:53 What we learned from the offline audits,
21:55 where they pulled the usage logs in fifty different audits,
21:58 was on average anywhere between 20% and 31% discrepancy, always under-counted.
22:03 So, imagine youâre perpetually being paid 20%
22:06 to 30% less than you thought you should have.
22:09 That is where we started,
22:10 and we built one of the fastest blockchains in the world.
22:13 At the time we did 10 million transactions
22:15 per second per region in a private permission chain.
22:18 We have over forty patents in seven countries filed,
22:22 probably thirty-something issued.
22:23 We built this technology.
22:26 When we went live is when we accidentally discovered fraud.
22:31 JACK: This discover would ultimately make
22:33 him abandon this very blockchain company
22:35 that he just built and take his life in a whole new direction.
22:39 Weâre gonna take a quick ad-break here,
22:41 but stay with us because youâll never believe the fraud he discovered.
22:48 So, Andrew and his co-founders Morgan and Poria built
22:52 a tool to track how many times a song is played.
22:55 Since the music labels wanted him to do it, they were also helping him get
22:59 in touch with these music-streaming services to try
23:02 to work out a way for Andrew to see the real-time streaming data they had.
23:06 So, they made deals with these streaming platforms that they were able to see
23:10 the play counts for the few music labels that they were dealing with.
23:13 Their goal was simply to count the plays and make
23:16 sure the artist got paid for what was played.
23:18 But little did they know, [music] counting plays was not accurate at all.
23:23 ANDREW: We started seeing these weird clusters of users,
23:27 like 8,000 users playing the exact same
23:29 sequence of songs sixty-three times on a Sunday,
23:33 or users suddenly getting play counts
23:35 in seventeen different countries in the same week.
23:37 Like, how is that even possible?
23:39 So, we started noticing these discrepancies,
23:41 and we went back to the labels and the streaming services and said,
23:44 we think you have a fraud problem.
23:46 If weâre supposed to be the leader or the trusted source of truth of how
23:51 many times a song is played and weâre just telling you a song was played,
23:54 weâre not actually telling you the intent behind
23:56 the play and if it should still be counted.
23:58 You canât actually pay this out because thereâs
24:00 a bunch of fraud happening here that should be removed.
24:03 So, until we can solve the fraud problem, we donât think we can solve audit.
24:09 That was the summary we came to after two and a half years,
24:12 and it was a real challenging moment for the company because it was like,
24:16 youâve been building this entire tool believing this is the one problem,
24:19 and then you get there and realizeâ someone said, hold my beer,
24:23 and you have a totally different problem you
24:25 have to solve with a completely different skill set.
24:28 JACK: Iâm still shocked at the point that the streaming
24:31 services didnât have this capability to detect this sort of thing.
24:35 In the podcast world we have the IAB, which is aâ itâs actually a certifiable
24:41 way of measuring metrics for podcast listens, and they have a whole list.
24:46 Theyâre like, okay, if a user starts
24:48 on their phone and then switches to their computer,
24:51 is that considered two listens or one?
24:53 They have to download for over a minute
24:55 before they can actually be considered a listen.
24:58 If itâs streaming on the watch,
25:01 the watch does things to grab MP3s very differently than how a computer might.
25:06 So, it looks like 500 listens when you come in from a watch,
25:10 so you have to adjust for that sort of thing.
25:12 Thereâsâ you can look it up, how to measure podcasts,
25:16 which is very complex and complicated downloads.
25:19 I just canât imagine these bigger streaming
25:22 services not wanting to have accurate download numbers,
25:25 especially with paying before that.
25:27 They must have had a whole team of people trying to figure this out,
25:31 and youâre saying, no, they didnât.
25:32 It was you that figured it out.
25:34 ANDREW: No, they didnât.
25:36 At the time major streaming servicesâ enter your streaming serviceâ
25:39 had less than half of a person dealing with this.
25:42 It was probably some data scientist,
25:44 and they were mostly using rules-based anomaly detection.
25:46 So like, did a song get played more times than literally possible?
25:50 Like, did someone play a song 10,000 times this week?
25:54 JACK: Well, thatâs really eye-opening andâ itâs hard
25:58 to believe because when youâre dealing with money,
26:01 you have to pay accurately, andâ crazy.
26:05 Like I said, IAB is a certifiable thing.
26:08 You can actually pay them to come audit your monitoring,
26:11 your statistics, and theyâll confirm it,
26:13 and then sponsors will be more likely to pay those numbers âcause you could say,
26:18 no, itâs been confirmed that weâre IAB-certified.
26:20 ANDREW: 100%.
26:21 âCause when Iâve done podcast advertising,
26:23 I always ask for the certs because I donât trust any of the numbers to be real.
26:28 So, I understand 100â âcause especially in the early days of podcasting,
26:33 I feel like it was just like reading tea leaves.
26:36 Nothing seemed to make sense.
26:37 JACK: So, this became Andrewâs pivot.
26:39 He was able to go to the music-streaming services and convince them,
26:42 look, you have some major fraud happening.
26:45 Hereâs proof.
26:45 They didnât believe him at first,
26:48 so he had to really show them how much fraud there was.
26:50 They eventually said, okay, instead of monitoring just those music labels
26:53 that youâre supposed to, [music] do you
26:54 mind looking at all our stream music and see what else you can discover?
26:58 That just snowballed.
26:59 One streaming provider turned into two, and he kept getting full,
27:04 unfetted download data from many online streaming platforms.
27:07 ANDREW: Yeah, weâre definitely the leader.
27:09 Weâre the market.
27:10 JACK: You are such a unique position.
27:13 I donât imagine there even being two companies
27:15 that have this access compared toâ youâre⊠ANDREW:
27:19 We have more data access than anyone in the music industry,
27:22 especially⊠JACK: No,
27:23 I meanâ I mean thereâs no other person like you whoâs measuring like that.
27:26 They donât say, oh yeah, letâs open this up to 500 companies to come
27:31 watch our stats and make sure that weâre accurate.
27:33 Youâre probably the only one for these companies.
27:35 ANDREW: We are the only one.
27:38 [Crosstalk] JACK: The competition here is zero for you.
27:40 ANDREW: Yeah, totally, 100%.
27:42 In a lot of ways we felt like we made the market.
27:46 âCause at the time, I remember going back
27:48 to the labels and the streaming services and saying,
27:50 I think you have a fraud problem.
27:53 Literally, they laughed at us.
27:55 Especially the major labels thought it was less than one percent.
27:59 Because keep in mind, their artists arenât cheating.
28:02 So, what they see as only their dataâ and theyâre like,
28:05 thereâs no anomalies here.
28:06 But to them it just looked like the independent market was growing.
28:09 I would actually argue that most
28:11 of the independent music growth has been from fraud,
28:14 not from true, independent market share increasing.
28:16 JACK: Okay.
28:17 Yeah, you gave me a taste of a few
28:20 of these things that you were noticing, right,
28:23 people playing things that are humanly impossible to play that much,
28:28 and a group of people playing in different regions all at the same time.
28:33 ANDREW: Yeah.
28:33 JACK: This suddenly sounds to meâ âcause I come from cybersecurity
28:37 worldâ this suddenly sounds to me like not exactly threat intelligence,
28:42 but yeah, it sounds like youâre looking at a security incident tool
28:49 and trying to build signatures to detect when thereâs a security incident.
28:54 Just the one that comes to mind for me is if I had fifty connections
29:00 from some office all go to the same
29:03 IP address somewhere from different computers internally, why did that happen?
29:07 There might be a botnet in our company that suddenly said,
29:12 oh, all phone home at the same time.
29:15 Get new instructions.
29:16 So, I would immediately flag those fifty computers to be like,
29:20 can someone do an antivirus on those to see whatâs going on here?
29:24 I was right.
29:25 There was a botnet on that computer.
29:28 So, I was like, okay,
29:30 weâve got a way to detect when a botnet happens just byâ how
29:34 in the world did this all happen in the same millisecond, right?
29:37 So, I imagine thatâs kinda the tools or the signatures.
29:40 How do you look at this?
29:42 ANDREW: 100%.
29:43 Weâre buildingâ we have probably close
29:46 to 700 models looking for different things, and itâs constantly changing.
29:49 [Music] So, to give you examples,
29:51 we found one where somebody had hacked a major artistâs delivery feed.
29:56 So, imagineâ itâs very common to have multiple registration numbers
29:59 for the same song because it may have been part of an album,
30:03 a single, a deluxe version.
30:05 It could have been done multiple times
30:07 with different people in the supply chain.
30:09 So, what ends up happening a lot of times is the streaming service
30:12 will concatenate that and pick one parent and a bunchâ child sort of numbers.
30:16 But that way theyâre all grouped together.
30:18 So, in this case, someone had hacked the feed,
30:21 put their version in, but the metadata for that, the pay,
30:24 was different than the actual label.
30:26 So, in this case it looks like the same song, it sounds like the same song,
30:31 has the same artwork as the same song,
30:33 but who the finance team pays is different.
30:36 They were able to promote their version
30:38 as the parent and then manipulate thoseâ the payouts.
30:42 So, in that case they stole millions
30:44 of dollars from that artist over an eight-month period.
30:47 When we found it, we found it by some
30:49 of the ways that they manipulated the streams.
30:51 Like, how do you become the parent to yourâ like,
30:53 why did this happen right at the beginning?
30:55 We found the manipulation early and then it stopped.
30:58 We were able to identify that there was
31:01 something wrong in their data because of their manipulation.
31:04 Then when we found that, we then built
31:07 a model to find other artists it happened to.
31:09 We found 1,700 other artists that had been hijacked
31:12 the same way over the course of a couple years.
31:16 So, again, theyâre constantly being creative.
31:19 Another one we found a little over a year
31:21 and a half ago was a device we had never seen.
31:24 So, why all of a sudden is this very
31:26 specific device running up a bunch of streams?
31:29 We would normally see whatâ for example,
31:32 the Android system youâre on, what the operating system,
31:34 what the device is, et cetera.
31:36 This is a device we had never seen.
31:38 It turned out it was owned by the Department of Corrections,
31:41 and someone had hacked the prison system and turned
31:44 all the prison tablets into a streaming farm.
31:47 JACK: Wow.
31:47 Tell me more about that.
31:49 How did that happen?
31:51 ANDREW: I donât know how they hacked it,
31:53 but the net effect was that they had turnedâ I think it was like,
31:58 400,000 devices into a streaming farm where
32:01 they were manipulating streams from streaming players.
32:04 So, I guessâ I didnât even know, to be honest, that prisoners had devices.
32:09 But in a lot of states they haveâ you
32:11 sort of pay I think by the minute or whatever.
32:14 You pay for these devices,
32:16 and thereâs a handful of applications that are approved.
32:19 It turns out most of them are run or slash-owned
32:21 by a private equity company or a couple private equity companies,
32:26 and someone had just simply hacked the devices and were able to use them
32:32 all in sort of a bot network that we hadnât expected at the time.
32:37 JACK: How did you spot that?
32:39 ANDREW: Because the device type was suddenly new and different.
32:41 We had neverâ âcause we get all these differentâ so, why all of a suddenâŠ?
32:46 In context it seems small, but we have all these types of community-clustering
32:50 techniques that are looking for different parameters and features.
32:53 So, letâs say that we get, I donât know, 500 fields.
32:56 Weâll getâ at this point now from streaming services, we get all kinds of stuff;
33:01 gyroscope, battery life, orientation of phone, everything youâve done in app.
33:04 Weâre catching a lot of different data, anonymized but individualâ but hashed.
33:09 JACK: The streaming service app is collecting
33:11 that and then youâre seeing that as well.
33:14 ANDREW: Weâre seeing an anonymized version,
33:16 generally hashed data so that we didnât have any PII ever.
33:19 But thatâsâ yes, weâre seeing all
33:21 of this stuff and then triangulating it and saying,
33:24 why are all these exactly the same?
33:26 Weâve never seen this unique device, so whatâs happening here?
33:30 Then it just turned out that that one
33:33 device is specifically made for the Department of Corrections,
33:36 and no one else buys it.
33:38 So, it leads you to sort of one vendor,
33:40 which then allows you to unravel the rest.
33:44 So, that was a very interesting case.
33:47 JACK: Then what do you do with that?
33:49 Do you say, okay streaming service,
33:50 hereâs a device type that we should just notâŠ?
33:53 ANDREW: We demonetize it all.
33:55 JACK: Yeah?
33:55 ANDREW: So we donât pay any of those streams now⊠JACK:
33:57 But you block thatâ I mean, not block, but you demonetize that device type.
34:01 You can do it that granular or�
34:04 ANDREW: Yeah, for sure.
34:05 We can say these donât get paid.
34:06 I mean, at the end of every month what
34:09 happens is we have three sort of primary checks.
34:11 We check daily to see what fraud weâre catching
34:14 so that it gets removed out of product-level stuff.
34:16 So, recommendation engines, algorithms, et cetera.
34:19 We sort of down-weight anything we see thatâs
34:23 fraudulent so we donât make the problem worse.
34:25 The second thing we do is we do weekly updates for charts,
34:28 so if we see anything on the charting side,
34:31 we willâ youâre allowed to update the charts weekly.
34:34 So, weâll update the charting information.
34:36 Thatâs way less common, âcause again,
34:39 most big artists arenât cheating, at least from the streaming side.
34:42 But again, we sort of just safeguard that.
34:44 Then the last one, which is the real one, is the money payout.
34:47 So, at the end of theâ at the end
34:50 of every month we do the check for the entire month.
34:53 âCause thereâs stuff weâll catch, right?
34:55 The really obvious fraud weâll catch day one.
34:57 But thereâs some fraud that takes us a longâ you need more
35:00 of a longitudinal view to see how theyâre interacting over the course of a week,
35:04 two weeks, three weeks.
35:05 Thereâs all kinds of cases, for example,
35:07 that when we first started we would catch that no longer happens anymore.
35:10 So, in the early days, Iâm guessing his engineers were lazy.
35:14 Or, itâs just easyâ like, how do you deal with checking for anomaly detections
35:21 for months where they have different days of the month?
35:24 So, what we oftenâ or, you know,
35:26 they have twenty-nine days, twenty-eight days, thirty days, thirty-one days.
35:28 So, a lot of times what they would do
35:29 at the end of the month is pull the first twenty-eight days.
35:32 I donât know how fraudsters figured this out,
35:34 but starting on Day 29, they would jam all their bots.
35:38 So, youâd see massive numbers; 29, 30, 31.
35:41 So, they would end up getting a large percentage of the pro rata pool,
35:45 but they only ran their fraud at the end
35:48 to sort of get away from whatever was being checked,
35:51 âcause a lot of the anomaly-detection checks initially
35:54 in the early days were the first 28 days, just to simplify it.
35:58 So, again, we find all these weird sort of techniques that they would use,
36:03 and we would shut them down or demonetize them.
36:06 In some cases the streaming services,
36:08 when we returned the data back, they take action.
36:11 So, sometimes the streaming service will decide to completely remove
36:14 all the content and just say this is all fraudulent.
36:17 So, in this case, for example, really obvious stuff.
36:20 So, less than a hundred real users have streamed this.
36:24 99.99% of all of their streams, historically, are from fake accounts.
36:28 You know, maybe they have less than a total of 2,000 streams total.
36:35 Whatever it is, theyâre gonna have these rule sets we have
36:38 in place to make sure itâs only the worst of the worst fraud,
36:41 and then weâllâ the streaming service will just straight
36:43 remove that content or take it off the platform entirely.
36:47 That seems to be incredibly effective because the fraudsters realize theyâre
36:51 caught and they just stop on that or go to different services.
36:55 So, I think our approach has been lessâ Iâm
36:57 not naive enough to believe weâll always stop fraud.
37:00 I think historically you can look at all fraud and say thatâs never the case.
37:04 Thereâs always going to be smart
37:05 people and theyâre gonna try different techniques.
37:07 But I think we can make it so difficult that they just go to other industries.
37:13 JACK: [Music] Itâs so interesting for me to listen to him talk,
37:15 because this isnât a cybersecurity story,
37:18 yet everything heâs saying is exactly what happens in cybersecurity land.
37:22 You set up monitoring tools, you build rules to detect problems,
37:26 and then you make it harder for people to exploit those things again.
37:30 They did it all from scratch.
37:31 We all know in cybersecurity you can never stop hackers,
37:34 but what you want to do is make it so
37:37 hard for them that they move on to an easier target.
37:39 Thatâs something Iâve heard again and again,
37:41 yet thatâs what heâs doing in this world.
37:43 Some people always reach out to me and complain that when
37:46 I do an episode thatâs not cybersecurity-related that they get upset.
37:50 But listen, this show is about the dark side of the internet.
37:54 To me, that encapsulates way more than just cybersecurity.
37:57 Itâs about all the hidden stuff that you never see or experience.
38:02 I want to shine a light on that shady,
38:05 dark, gritty, underground aspect of our digital life.
38:08 The fraud and the manipulation of algorithms, the websites and technology,
38:12 the people who abuse it, and of course, hacking in cybersecurity, too.
38:17 [To Andrew] I was trying to find a link I had a long time ago.
38:22 There was aâ Iâve actually seen many Reddit posts where people are saying,
38:27 hey, whatâs up with my Spotify account?
38:29 It suddenly shows that Iâve played a whole bunch
38:31 of these artists that Iâve never even heard of much less played.
38:35 I donât understand why my Spotify is showing that Iâve
38:38 played these, and itâs recommending all this other stuff.
38:40 ANDREW: Account takeovers.
38:41 Thatâs a huge percentage of what we see now.
38:44 If you think aboutâ youâre in cyber, so imagine itâs a giant arrow back to you.
38:48 If all of your bots look the same, itâs easy to cluster them.
38:52 If theyâre behaving the same way, itâs easy to cluster them.
38:55 If they are all streaming one artist specifically,
38:58 itâs like a giant arrow back to that artist.
39:01 If theyâre all streaming from one distributor,
39:03 itâs a giant arrow back to the distributor.
39:04 So, you need to hide the needle in the haystack,
39:07 and the easiest way today to do that, or what weâveâ Iâd say
39:11 for the last three years put a lot of R&D in to catch, is account takeovers.
39:15 So, theyâll log in as you, play a song five or six times, and then leave.
39:19 Then all of this stuff you do naturally just hides whatever they did.
39:23 So, they donât have to create that.
39:25 They donât need to make differences.
39:27 You donât need to program in artificial changes in your bots.
39:32 You just basically log in as somebody,
39:34 play five streams, and hope they donât notice.
39:36 I would say that thatâs really common these days.
39:38 Thatâs the number-one growth area for fraud that we catch,
39:41 is account takeovers in general, or adding devices to family plans.
39:45 So, weâll see a device thatâs an IOS thatâs legit,
39:48 a Tesla thatâs legit, and then an Android thatâs all fraud.
39:52 JACK: Wow.
39:53 Okay, so, what I donât understand is how theyâre taking over the accounts.
39:56 You say itâs one of the biggest things youâre seeing.
39:59 How are they getting so many Spotify accounts or whatever streaming service?
40:02 ANDREW: So, thereâs a couple ways.
40:05 The simplistic ways areâ 90% of internet log-ins
40:09 are just people trying different data-breached passwords and usernames.
40:12 I would say that most streaming services are
40:15 not high on peopleâs priority list for protecting.
40:18 Soâ and thereâs a sort of product question about how much friction
40:23 do you add into a service to make it difficult for users,
40:27 âcause it hinders growth, right?
40:29 So, I think thereâs an interesting friction
40:32 point there between how secure do you
40:34 make a streaming service on the user end and how much do they actually care,
40:38 and do they really care if your account that was
40:40 used to play a song ten or twenty times?
40:42 I donât think theyâre realizing how much damage it does in aggregate.
40:45 So, thereâs that issue, I would say.
40:48 I mean, youâve been onâ your whole series is called Darknet Diaries.
40:53 You get on the darknet and download these accounts quite easily.
40:57 I think at one point, to prove a point,
41:00 we went on and downloaded and showed people,
41:03 some executives, that I could get 100,000
41:05 accounts on every single streaming service immediately.
41:08 It gives you the independentâ the infection date and the last log-in date.
41:12 You can even getâ if they have malware on the actual device,
41:15 you can even get all of the browsing history, too.
41:19 So, if you want to warm up the IP before you use it,
41:22 you can kind of mimic their behavior before you log in.
41:25 Thereâs lots of this stuff existing.
41:27 Thereâs also an API that we found in the darknet
41:31 where they own tens of millions of these accounts,
41:34 and they will spin them up for you.
41:37 So, you basically tell them the parameters of the types of plays you need,
41:41 and they make sure that no single account is overused or indexed too hard,
41:45 and they actually create the fraud for you.
41:49 [Music] So, it is a fully professionalized,
41:53 industrialized supply chain for fraud at this point.
41:57 JACK: Wow.
41:59 Seriously, wow.
42:00 Heâs shown streaming service execs that he
42:05 can get 100,000 accounts on their platform instantly,
42:09 because after a data breach thereâs communities of people who will parse through
42:13 those usernames in the data breach
42:15 and pluck out all the streaming service accounts,
42:18 or even try to use those usernames and passwords
42:20 on a streaming service to see if they reuse passwords.
42:22 From that, they build the giant list of users for each streaming service,
42:28 and that list is valuable because if you can manipulate the streams,
42:32 then you can get paid by these streaming services.
42:35 Iâm just astonished because when I hear how bad the problem is like
42:40 this and how easy it is for people to get access to our stuff,
42:45 itâs like a cold, wet slap in my face.
42:48 I kinda go through this process again and again when making the show.
42:51 At the beginning of this episode Iâm like,
42:53 ooh, these are some interesting techniques.
42:55 Maybe Iâll try one of these on my show.
42:57 But by this point of the story,
42:59 Iâm so mad that these companies arenât protecting our data and itâs just exposed
43:03 on the dark web only for fraudsters to use
43:05 to make money for themselves off my account.
43:08 Because itâs our data; itâs not some nameless victim out there.
43:12 Itâs yours and mine that these people are gaining from.
43:15 Iâve done this show long enough to know that there
43:18 is no way from keeping our data from getting leaked,
43:22 which makes me black-pilled, right?
43:24 Like, okay, Iâm giving up.
43:25 Oh well, my dataâs out there.
43:27 I might as well just assume I have no privacy
43:30 anymore because itâs out there like, all over the place.
43:34 I just totally give up protecting myself.
43:37 But I donât like feeling hopeless.
43:40 Iâm not someone who gives up forever.
43:43 Iâm an optimist.
43:44 Iâm a fighter, and I donât mind hard work.
43:47 So, then I get this surge of ideas,
43:50 and it makes me white-pilled, because then I realize, wait a minute,
43:53 whoâs the ding-dong who told them my address and gave them
43:56 my password and username and telephone number and all that stuff?
43:59 I am.
43:59 Hell no.
44:00 No more am I telling these companies my real name or phone number.
44:04 Iâm not going to reuse passwords or even reuse e-mail addresses anymore.
44:07 Itâs a war out there,
44:09 and Iâve got to take care of my own data since no one else will.
44:15 Okay, anyway, the name of the company that Andrew co-founded was
44:18 called Beatdapp in order to analyze music streams to detect fraud.
44:22 He abandoned the original idea of using
44:24 the blockchain to help these labels get paid properly, and he focus on this now,
44:28 pretty much entirely working for streaming services now.
44:31 [To Andrew] Yeah, well, I guess what Iâm wondering is you almost need
44:35 a black-hat person who knows that, the cheating industry,
44:38 whoâs been there, to actually sit down and look
44:41 for theseâ to look for things you havenât found yet, right?
44:44 To find new signatures.
44:45 ANDREW: Totally agree.
44:47 I think Iâm that guy, probably.
44:49 Yeah.
44:50 You know, the music industry often said Iâm their hacker now.
44:55 Iâve switched sides.
44:56 I think the side-switching is mostly industries.
44:59 I would say theâ for me, the difference is that users no longer have to actually
45:05 engage with the content for that artist to get paid.
45:08 What I did back in the day I really believe was in service of the artist.
45:14 If the artist is good, the people will listen, consume, and adopt it.
45:19 If the artist is not, they will let you know right away that itâs trash.
45:23 I think that has changed in a sense that you
45:26 can be a trash artist that manipulates lots of streams
45:29 and gets paid without actually being good or having real
45:33 users or being able to sell ten tickets to an event.
45:38 So, I just think theyâre now stealing from other artists.
45:42 JACK: Yeah.
45:43 So, youâre saying itâs now more of a financially-driven thing and not so
45:48 much a letâs try to market this person and get them to break out.
45:52 But I push back at you because you did that ad arbitrage where youâre like, hey,
45:57 we could print money by charging this much CPM
46:00 and then actually just paying for somebody to come here.
46:04 So, you were financially driven in some aspects, as well.
46:08 It wasnât always, oh, letâs just market someone.
46:10 ANDREW: I regret that, and thank god that the Statute of Limitations has passed,
46:15 âcause it was definitely not my proudest moment, for sure.
46:18 JACK: What I didnât realize is that musicians
46:21 donât get paid per stream on these platforms.
46:24 Instead, they get paid a percentage of what
46:26 advertising revenue came in for that month,
46:28 which means fraudsters are stealing money from real artists.
46:32 ANDREW: Okay, so, the way the music industry works is
46:34 that thereâs oneâ Iâm gonna simplify this âcause itâs little more nuanced,
46:38 but generally speaking thereâs one pool of capital.
46:41 Every month a streaming service makes
46:43 money from advertising revenue and subscription fees.
46:46 Now, this money goes into one pot,
46:48 and itâs paid out every month based on play count.
46:51 So, if youâre a artist and you makeâ you did, letâs say, 100,000 streams,
46:57 and that streaming service did a million total streams that month,
47:01 you get 10% of that pot.
47:03 You get your percentage of streams for the whole entireâ of the whole,
47:08 entire streaming ecosystem youâre in of the revenue.
47:11 So, itâs a performance pro rata.
47:14 What happens is you could release a song in November
47:18 and do a million streams and get paid $3,000, and thatâs correct.
47:23 You could release the same song and do
47:26 a million streams in February and get paid,
47:29 I donât know, $500, and that could also be correct.
47:33 The reason the numbers could be different is that month the advertising
47:37 might be smaller because theyâd spentâ especially as February or January,
47:40 they had spent a bunch of money for Black Friday and holidays,
47:43 and advertisers werenât spending as much in January, February.
47:46 You could have less subscribers.
47:48 You could also have had a major release.
47:51 So, say Taylor Swift released a track or an album,
47:54 and all of a sudden the majority of streams are going to Taylor Swift,
47:58 then your pro rata goes down.
48:00 So, you could actually have wildly different amounts of money you make
48:04 for the same general performance because itâs
48:07 a performance base relative to the entire industry.
48:09 So, if you do one of ten streams, you get 10%.
48:11 If you do one of twenty streams, you get 5%, and so on.
48:15 So, why that matters and how you steal is that fraudsters will
48:19 load millions of songs onto streaming
48:21 services as if theyâre independent artists.
48:23 [Music] Theyâll create different independent artistsâ names,
48:26 different independent artist labels,
48:27 theyâll put them in different parts of the world
48:30 so it just looks like theyâre from different people,
48:32 different regions, different companies.
48:34 They will load those direct do-it-yourself,
48:37 like DIY to streaming services through distributors.
48:40 So, the distributor is an aggregator who, if youâre an independent artist,
48:44 you upload to like a DistroKid or a TuneCore or a Symphonic or whatever,
48:48 and they basically put all the data together and all
48:51 the pieces together and upload it to the streaming services for you.
48:54 So, they do it in one shop for you.
48:56 So, instead of you going and uploading
48:58 to a hundred different streaming services,
48:59 you go to this one provider and they aggregate it
49:01 and put it on to all the stores for you.
49:03 So, these fraudsters will create fake artists, fake labels,
49:06 theyâll use fifteen or twenty different distributors so
49:10 thereâs not one point of failure, theyâll uploadâ so,
49:13 theyâll get millions of songs onto streaming services, and then hereâs the key;
49:18 they will play a bunch of these songs small amounts of times.
49:20 They do not want to get noticed.
49:22 You donât want an artist that charts thatâs not real.
49:25 You want to generate 1,000, 3,000, 4,000 streams,
49:29 but you donât actuallyâ no one notices the song with 3,000 plays.
49:34 So, if you create a small number of streams across a large number of artists,
49:38 then your aggregate pro rata,
49:40 the amount that you actually have of all of the pools for that month,
49:45 can dramatically increase, âcause youâre stealing pennies.
49:49 Itâs basically like Office Space.
49:51 Youâre stealing pennies from all of these different artists.
49:54 They just donât realize it.
49:55 But in aggregate itâs a large amount of money.
49:57 So, the way that it works today is
49:59 about $3 billion worth is stolen from real artists,
50:02 because itâs going to people that are not real artists.
50:05 JACK: Wow, $3 billion is going
50:08 to fraudsters who are manipulating these streaming platforms.
50:11 Thatâs incredible.
50:12 Itâs apparently very profitable to go through
50:15 all this process of making tons of songs and getting someone else to play
50:20 those songs across hundreds of thousands of accounts.
50:22 It seems like a lot of work, but man, itâs really paying off for them.
50:27 If itâs paying off, then that means itâs only gonna grow.
50:30 [To Andrew] So, a few times youâve made myâ the hair
50:35 on my neck stand up whenâ âcause Iâm a big privacy advocate, right?
50:39 Iâm crazy into it.
50:40 Iâm a freak about it.
50:42 So, youâve talked about some of the metrics youâre getting
50:46 from some of these apps such as gyroscope and battery life.
50:50 As a privacy person, I donât understand why I needâ you need to get
50:55 my gyroscope information in order to just let me play a song.
50:58 But on the other side,
51:00 when I went to actually take ads out on some of these platforms to say, hey,
51:05 market a legitimate ad on the platform, theyâll ask you,
51:09 hey, when do you want someone to listen to this ad?
51:11 Do you want them to listen while theyâre working out,
51:14 while theyâre having sex, when theyâre making dinner?
51:16 Iâm like, how the heck do you know when someone is making dinner?
51:19 What is going on here?
51:21 So, the amount of information that these streaming
51:24 platforms have on us is crazy.
51:27 I donât know what question I have,
51:29 but it justâ like I said, it makes my hair stand up.
51:32 ANDREW: I agree, but I would say for us, just know that in most cases they treat
51:37 that data like it is the most importantâ I mean,
51:40 they treat itâ having come from healthcare in the previous company,
51:44 they treated it at a level way higher than healthcare,
51:47 like crazy, like HIPAA compliant times ten.
51:50 They are insane with this data.
51:52 They hash everything.
51:54 Theyâre very particular about how it gets to us, how it gets back.
51:57 We get security audited.
51:58 We have an entire internal security team.
52:00 It isâ itâs partitioned in lots of ways so even if you get to one piece,
52:04 you canât get to the rest.
52:06 We are insane because they make us be insane with it.
52:10 Again, at the end of the quarter, youâre like, itâs just streaming data.
52:14 But people are stealing $3 billion a year.
52:17 So, thatâs a massive amount of money that is
52:21 going sometimes to people like terrorist organizations and organized crime,
52:26 not some kid in a basement.
52:28 So, the argument also is I think that thereâs some
52:32 large-level implications for where this money goes and what happens,
52:36 but I will say that the streaming service side treats
52:39 that dataâ whether or not you want them to have it,
52:42 they treat it like itâs very, very important.
52:45 Iâve never come across a streaming service that casually allows data.
52:49 Even then, when we decide exactly what
52:51 fields we need from different streaming services,
52:53 we then reject the rest of the fields.
52:55 We take the least amount that we need to do our job once weâve built the models,
52:59 and then if we built a new model or find a new thing that we need to do,
53:02 we re-ingest that data and build again.
53:05 But we donât typically just sit on all this stuff,
53:08 even if itâs anonymized, because we just donât want it.
53:11 So, again, my point is I feel theyâve been very responsible with it,
53:15 if that makes you feel any better, even though they havenât.
53:18 JACK: You said terrorist organizations?
53:22 ANDREW: [Music] Yeah.
53:22 Imagine that you could move money
53:24 through a streaming platform without anyone noticing.
53:26 So, what you do is you take dollars, you turn it into crypto at crypto ATMs,
53:32 you pay the streaming farm operators in cryptocurrency
53:34 to stream a certain amount of songs.
53:37 Those songs are owned by different entities globally.
53:39 So, quite literally you could move money
53:42 from Colombia to Doha through the streaming service.
53:44 Itâll all be washed and clean through the streaming services themselves,
53:50 directly funding terrorist activity.
53:53 JACK: So, the artist that theyâre playing is
53:57 an artist that theyâre controlling because theyâre getting paid⊠ANDREW:
54:00 Theyâre making fake artists.
54:02 Theyâre putting fake artistsâ names up.
54:04 Theyâre taking music thatâs not theirs.
54:06 So, they might hack, for example, Dropbox accounts.
54:09 âCause you figure one out of every
54:11 hundred songs typically an artist releasesâ so
54:15 thereâs a huge back catalog of artist
54:17 songs that have never actually been distributed,
54:19 and when theyâre distributed is when theyâre fingerprinted.
54:21 So, a lot of these donât have fingerprints.
54:23 So, if you upload them and thereâs no fingerprint,
54:26 the streaming service and the distributor feels that you are
54:28 the rightful owner of that song âcause theyâve never seen it before.
54:31 So, now you can take old songs that have never been digitized,
54:36 make them your own, and then manipulate the stream.
54:38 So, the first step is just getting the music.
54:41 The second step is manipulating the streams so you get paid.
54:43 If you were a terrorist organization and you build all this infrastructure,
54:47 you might have literally letâs say thirty different music label entities
54:52 around the world all using different distributors with, I donât know,
54:55 a hundred quote, unquote âindependent artistsâ in each,
54:58 and then youâre going to just run small numbers of streams
55:01 to those on a hundred different streaming services and slowly get paid.
55:05 But that money will be clean and end up from one
55:08 location to another without you ever having to actually transport the cash.
55:12 JACK: You think thatâsâŠ?
55:14 I mean, looking at those numbers,
55:16 how much cash do you think theyâre transporting?
55:18 80�
55:19 ANDREW: Hundreds of millions of dollars.
55:21 JACK: Well, I was gonna guess a percentage here, right?
55:25 So like, if I have $100 million and I say
55:28 I need to transfer this, 80% of it makes it?
55:31 ANDREW: Oh, percentage-wise of the dollar?
55:34 Like 40% to 50%.
55:35 JACK: Yeah, âcause itâs notâ see,
55:38 this isâ theyâre losing a ton of money onâ in the transfer, then.
55:40 ANDREW: But itâs better than leaving it in cash.
55:43 Honestly, thatâs what typicallyâ how do you move this much cash?
55:46 Theyâre gonna pay someone to wash their money regardless, sometimes 20%, 25%.
55:50 Theyâre gonna pay a large amount of money anyway.
55:52 Then they still need to move that money and sort of pay taxes
55:55 on that money when it ends upâ you end up losing a lot anyway.
55:58 So your other approach is just to hide it somewhere or keep
56:01 it as cash and find other fronts to move it through.
56:04 It actually ends up that over the last ten years,
56:07 the music industry, as it was growing so fast,
56:10 was a really opportunistic place to hide
56:14 or wash money because no one was watching it.
56:20 JACK: Now I think Iâve come full circle on you saying you were gray hat,
56:24 because I was saying to myself,
56:26 if youâre breaking the terms of service, itâs black hat.
56:28 Now Iâm like, wait a minute, if youâre breaking the law, thatâs black hat.
56:32 This is different than terms of service.
56:34 ANDREW: Yeah, thatâs how I feel, you know?
56:36 I didnât break laws.
56:37 I just definitely didnât agree that I wasnât allowed to do something.
56:41 JACK: Yeah, and now itâs getting crazy,
56:43 where hundreds of millions of dollars are being sent fromâ from who?
56:48 Whoâs involved in this?
56:49 ANDREW: Well, imagine any kind of illicit activity;
56:51 you can move the money to your partners.
56:53 You can sendâ how we potentially caught one,
56:57 for example, is youâd see the exact same percentageâ like,
57:00 letâs say that you have a million users all playing music.
57:03 Iâm just gonna use Colombia as an example.
57:06 But theyâreâ the beneficialâ if you think about
57:08 who the artists are thatâs benefiting from those plays,
57:10 it would be abnormalâ in one case,
57:12 for example, where we sawâ Iâll give youâ I donât
57:15 know the exact numbers so Iâm gonna give you examples here;
57:17 like 12% always in a Hong Kong entity, and 30% in a Canadian entity,
57:22 and 40% in a Middle-Eastern entity,
57:24 and, you know, maybe another 10% somewhere else.
57:27 So, if all the numbers of streams are changing every
57:31 month but the beneficial owner percentage is exactly the same,
57:34 it looks as if someoneâs moving money from one
57:38 location to another location through these other entities.
57:42 JACK: So, the moving part is that theyâre
57:45 paying bots or listening to a stream⊠ANDREW: Yeah,
57:48 theyâre paying a streaming farm to create the streams whether
57:50 theyâre doing it through account takeovers or bots or whatever,
57:52 but the end result is theyâve uploaded as owners under these different
57:56 entities all of these fake artists that have songs on the streaming services.
58:01 Thereâs roughly a hundred streaming services globally.
58:03 So, theyâre uploading it onto all these streaming services and theyâre telling
58:07 these streaming farms to go play those songs across all the services.
58:12 JACK: Then the person who owns that account is getting paid for their streams,
58:18 and then the money is arriving to where they need to send it.
58:21 ANDREW: Yeah, exactly, because now the streaming service thinks, oh,
58:24 XYZ label in Hong Kong had X percentage of the total streams.
58:28 We have to pay them out.
58:29 So, it gets paid to the distributor and paid to them, and they just get paid.
58:33 JACK: This is one of those stories that I feel like
58:36 the floor has dropped out in my head, of like, oh yeah,
58:39 we haveâ I have a good understanding of how money laundering happens
58:44 and how things get sent here and there and how you clean money.
58:47 But then when you hear about stories like this where, oh yeah,
58:50 theyâre using a streaming service to launder money and send it across the globe,
58:54 suddenly my headâs like,
58:55 well, you could do that with buying and selling things on the Steam marketplace
59:00 or Roblox accounts or any other marketplace
59:03 that has money shifted here and there.
59:05 This isnât even a straightforward likeâ here,
59:07 Iâm buying something from another user.
59:09 This is, oh, theyâll pay us for streams.
59:11 If we can get the streams, then we can get paid.
59:15 Itâs such a roundabout way ofâ a convoluted way to launder
59:18 money that itâs blowing my mind and it just makes
59:21 me think that every single place that has money going
59:24 in and out is probably getting hit with something like this.
59:27 ANDREW: 100% agree.
59:28 I think the more convoluted, the better for them,
59:31 âcause itâs so much harder for the average
59:33 person to understand how the money moves.
59:34 JACK: âCause I mean, even something like Twitter isâ you get
59:37 paid for how much engagement you have, right?
59:40 So, you could totally⊠ANDREW: Oh, yeah.
59:42 Any of these engagement-based activities, especially in Web3,
59:46 anything at the timeâ a couple years ago
59:48 there was this big push with treasury tokens.
59:50 So, youâd get paid every time people interacted with you
59:53 on social five platforms or any of these game 5 stuff.
59:57 You could manipulate all of this stuff and then get the tokens,
59:59 take it to market, and sell it.
1:00:01 JACK: Itâs crazy to me that thereâs a dark web
1:00:03 API that has access to millions of online streaming accounts,
1:00:06 and if you feed it money, you can get all your songs played a bunch.
1:00:12 I bet whoever runs that hates Andrew.
1:00:14 ANDREW: I mean, Iâve had a couple of them
1:00:17 do crazy stuff like reaching out or say things.
1:00:20 But I would say that generallyâ we were talking onceâ
1:00:24 our lawyer for the company is this guy named Jim Trustee.
1:00:27 He was the former Chief of Organized Crime for the DOJ.
1:00:31 He told me once that the good news
1:00:33 is they donât typically shoot the border guards.
1:00:35 Itâs kind of a gentlemanâs sport.
1:00:37 So, I would say that most of them just
1:00:40 changed their tactics and changed the way they behaved.
1:00:43 I also think the industry has progressed.
1:00:46 In the early days there was some real trepidation or fear around what happens,
1:00:50 âcause weâre just a handful of people that know whatâs going on here.
1:00:53 I would say now every single streaming
1:00:56 service has a trust and safety department.
1:00:58 Every single stream label has a fraud trust and safety person.
1:01:02 So, the industry has changed over the last three years
1:01:05 in a way that I would say I feel less scared about.
1:01:08 Like, if you did something to me or my co-founders,
1:01:11 itâs not going away at this point.
1:01:13 The catâs out of the bag.
1:01:14 But I would say there was a real moment in the early 2021,
1:01:18 2022 where we were actually very concerned about what happens if⊠JACK:
1:01:22 Yeah, I mean, especially if youâve got cartels
1:01:25 that are moving money in big ways and youâre like,
1:01:28 okay, letâs put a stop to these guys.
1:01:30 I could see them being upset with you.
1:01:32 ANDREW: I mean, that was my concern, but again,
1:01:34 I think we sort ofâ whether or not it was naive at the time,
1:01:37 it was more like, oh, well, they donât normally shoot the border guards.
1:01:40 They just find a different way to move the money, you know?
1:01:43 JACK: Do you ever point the feds to someone and be like,
1:01:47 hey, these guys are breaking a lot of laws?
1:01:49 Like, I donât know, the dark web API or cartels moving money.
1:01:53 Weâve gotta report this to someone more than just the streaming service.
1:01:57 ANDREW: Yeah, in some cases when we find things that are
1:02:00 outside the data that is given to us in privacy,
1:02:03 then sure, we might tell people.
1:02:06 But generally speaking, we report the results back to the streaming
1:02:11 services and then they determineâ and the distributors,
1:02:14 for example, and the collection societies, right?
1:02:16 They determine then who toâ who they want
1:02:19 to work with on the governmentâs side to prosecute,
1:02:22 âcause thatâs typically a long road, three to five years,
1:02:26 sometimesâ especially in multiple countries youâve gotta deal
1:02:28 with Interpol and all kinds of different activities.
1:02:30 So, I thinkâ I would say thatâs an area thatâs emerging,
1:02:35 but we provide all the evidence that they need,
1:02:37 and then theyâ and help them package it to whoever agency theyâre going to.
1:02:42 But typically they are the ones that are the ones
1:02:45 actually determining whether or not theyâre gonna pursue it.
1:02:47 JACK: Okay, Iâm now changing my mind.
1:02:49 What Andrew did when he was younger I used to say was black-hat marketing,
1:02:53 but now Iâm gonna say he was doing gray-hat marketing.
1:02:56 Aside from the ad arbitrage stuff, all he did was violate the terms of use
1:03:00 on websites like Facebook and YouTube by artificially inflating the numbers.
1:03:04 Coming into this, I would have said thatâs black hat, but not now.
1:03:08 Now I think these cartels or terrorist organizations that are
1:03:11 moving hundreds of millions of dollars through these streaming platforms,
1:03:15 thatâs black-hat marketing.
1:03:16 Thatâs some real dark stuff.
1:03:19 Any time these streaming services have to call the authorities on someone,
1:03:23 thatâs what I think is black-hat marketing at this point.
1:03:27 I suppose because now that Iâve seen such an extreme side of this marketing,
1:03:32 Iâm no longer so judgmental about somebody having a bunch
1:03:35 of fake followers on their account to help them break out.
1:03:39 Because really, the fake followers and algorithm
1:03:41 manipulation can only go so far.
1:03:43 If theyâre a bad musician or whatever it is theyâre creating,
1:03:46 theyâll never take off no matter how many fake streams they get.
1:03:50 But if they are great and people really love them,
1:03:53 then that was just a growth-hacking technique to kick start their journey.
1:03:56 After they break out, thereâs no longer a need for all the fake followers.
1:04:00 You do run the risk of getting banned off those platforms,
1:04:03 so I donât recommend doing it.
1:04:06 But now that I think about it, banning users is really tricky,
1:04:11 because suppose Twitter has a way to detect when there are fake followers,
1:04:15 right, and they automatically ban someone if they
1:04:17 haveâ like 60% of their followers are fake.
1:04:20 Well, then imagine someone gets millions of fake followers to follow Elon,
1:04:24 and he gets kicked off for having a majority of fake followers following him.
1:04:27 You see, you can use these bans as a weapon
1:04:30 to get someone else banned that you donât like.
1:04:33 So, banning users for having a bunch of bots following them is really,
1:04:37 really tricky, and maybe you canât even do it.
1:04:41 [To Andrew] With all this information you have,
1:04:44 youâve gotta have probably some sort
1:04:45 of restriction on what youâre allowed to say,
1:04:47 because if there isâ you can see who the top artist of the day is.
1:04:51 You have so much data.
1:04:53 You could see how many streams are gettingâ and all this sort of stuff.
1:04:57 Magazines likeâ I donât know Pitchfork,
1:04:59 but whoever is the music industry magazines would love to know whoâs
1:05:04 the top streamer of the day or week or month or something like that.
1:05:09 A lot of the stuff is kept quiet.
1:05:11 We get to see some statistics of whatâ how many downloads a song has,
1:05:16 but we donât see very much of that.
1:05:20 You could have such an outstanding blog of like,
1:05:23 hereâs whatâs going on today, and people would just flock to it.
1:05:27 It would be huge, but youâre probably
1:05:28 not allowed to share that kind of information.
1:05:30 ANDREW: Itâs our core promise to all of our vendors.
1:05:32 Like, you give us your data; we do not monetize it in that way.
1:05:37 So, we provide you results back
1:05:39 as a true financial tool and a trust-and-safety tool.
1:05:42 We do not monetize it in any kind of marketing, any type of market reports.
1:05:49 We will not monetize the data they provide us.
1:05:51 They pay us an annual service fee so that we
1:05:54 arenât incentivized to find more fraud than there is.
1:05:56 If thereâs not a lot of fraud, we tell them.
1:05:58 If thereâs a lot of fraud, we tell them.
1:06:00 We are just the trusted source of truth,
1:06:02 but we do notâ we donât monetize that data in any way.
1:06:05 Yes, we could probably build a massive company,
1:06:07 but Iâm not sure they would trust us in the same way.
1:06:09 I think thatâs why a lot
1:06:10 of these marketing-level companies that do aggregate data,
1:06:13 they get very limited data sets because theyâ the biggest fear
1:06:16 for these services is the state of being public or going other places.
1:06:20 So, we are allowedâ we are privileged enough to handle it because weâve
1:06:28 built a large and strong level of trust with all of our partners,
1:06:32 and they know that we would never violate that trust.
1:06:35 JACK: Yeah, at first I was thinking as well of like, oh,
1:06:38 youâre saving all these streaming companies money by saying,
1:06:41 hey, donât pay these people âcause theyâre not doing it.
1:06:43 But nowâ but at the beginning you told me, no,
1:06:46 thereâs a big pool and a percentage goes out to whoever gets the streams.
1:06:50 So, I donât think youâre saving these streaming companies any money
1:06:53 at all because they have to pay out 100% every month or whatever.
1:06:57 ANDREW: Yeah.
1:06:58 JACK: Whether it goes to the right person or the wrong person⊠ANDREW:
1:07:00 Weâre a cost of doing business for them.
1:07:00 JACK: Okay.
1:07:01 ANDREW: Weâre a cost of doing business for them.
1:07:04 I would say in some cases they save money.
1:07:06 So, thereâsâ this is where it gets nuanced.
1:07:08 What Iâve been talking a lot about is whatâs called interactive streams,
1:07:11 where people get to choose what song they listen to.
1:07:14 But in cases where itâs non-interactiveâ think of it like
1:07:16 online radioâ they have to pay a set rate out.
1:07:19 Thereâs a rate card thatâs in.
1:07:21 So, when you remove the fraud from those, they actually do save money.
1:07:24 So, in some cases, in some areas theyâll save money,
1:07:28 but I would say generally across the board,
1:07:30 theyâre probably not not making money off of us if theyâre interactive.
1:07:35 So, if they offer a service where you get to choose
1:07:38 what you listen to, theyâre probably not making money off of us.
1:07:41 But they alsoâ if Iâm being honestâ donât want
1:07:44 to be the executive whoâs blocked for funding terrorism.
1:07:47 So, there is an existential risk.
1:07:50 Also, you figure the major labels are huge victims here.
1:07:56 Keep in mind, if youâre a major label,
1:07:58 you own and distribute probably over 80% of all revenue-generating content.
1:08:01 Not just all content but revenue-generating
1:08:04 content like royalties are coming primarily
1:08:06 from the major labels or the independent labels they distribute as a major.
1:08:10 So, when you look at it as a whole,
1:08:13 if youâre a streaming service and 80% of the things people are listening
1:08:16 to are controlled by these three parties
1:08:18 and theyâre saying weâre tired of being victims;
1:08:20 if you do not have a service like this, you cannot have our content,
1:08:23 it moves a lot of needles.
1:08:25 JACK: Wow.
1:08:25 Well, thisâ so much of this was so illuminating to me.
1:08:29 I did not know about this world much at all.
1:08:31 I told you what I do know, and it was a few things here and there,
1:08:35 but man, there was so much Iâve learned here.
1:08:37 Thanks so much for coming and telling me all this.
1:08:39 ANDREW: Yeah, thanks for having me on.
1:08:41 Itâs been really fun.
1:08:42 Again, I appreciate you making the time for me.
1:08:53 (Outro): [Outro music] This show is created by me,
1:08:55 the hashed brown Jack Rhysider.
1:08:56 Our editor is our friendly sysadmin Tristan Ledger,
1:08:58 mixing done by Proximity Sound,
1:09:00 and our intro music is by the mysterious Breakmaster Cylinder.
1:09:02 I donât know about you, but the next time someone makes fun of me
1:09:06 for the music I listen to, I have the perfect excuse;
1:09:10 oh no, my accountâs been hijacked!
1:09:11 It plays random stuff, I swear!
1:09:16 I canât stand this band.
1:09:20 You kidding me?
1:09:23 This is Darknet Diaries.