Your Spotify Account Might Be Laundering Dirty Money 🎵 Darknet Diaries Ep. 171: Melody Fraud

0:00 JACK: I’ve always like the idea of fake it ‘til you make it,

0:02 where you act like someone you want to be until you become them.

0:06 This sometimes comes with imposter syndrome,

0:09 but I think the antidote to that is just more experience.

0:12 But how do you go from being a total beginner to confidently doing something?

0:16 I often turn to the book store to help me there.

0:19 But you know a book that’s always bothered me?

0:22 It’s those For Dummies books,

0:23 like the C Programming For Dummies, or The Complete Idiot’s Guide.

0:26 Even if I don’t have a clue where to start,

0:30 I would never buy one of those books because

0:32 I don’t consider myself a dummy or an idiot,

0:34 because I want to fake it ‘til I make it,

0:36 and I don’t want to fake being a dummy.

0:37 I want to be a great programmer.

0:38 So, A Dummy’s Guide to Programming is not the direction I want to be going.

0:42 I think what those books fail to do is they seem to target who you are now,

0:47 not what you want to become, and that was their failure, at least for me.

0:51 I’ve bought tons of how-to books, but I will never buy one of those books.

0:55 To me, the key to success is in the aspiration.

0:59 I would instantly buy books that were titled How to Be an Amazing C Programmer,

1:04 because that is what I want to become.

1:07 The book could contain the exact same words as the other book,

1:10 that C Programming For Dummies,

1:12 but it would have an entirely different impact on me.

1:15 Every time I saw the title,

1:16 I’d feel like I’m becoming more and more like the person I want to be,

1:20 an amazing programmer, and that would give me that false sense of greatness,

1:25 which is exactly what it’s like to fake it ‘til you make it.

1:28 Because it’s not about who you are today;

1:30 it’s about who you aspire to be tomorrow.

1:33 It’s about embracing the journey of transformation

1:36 and allowing your actions to shape your destiny.

1:38 So go ahead and fake it.

1:40 You can lie to yourself if you want,

1:43 because sometimes the greatest lies are the ones

1:49 that propel us towards our truest selves.

1:54 [Intro music] These are stories from the dark side of the internet.

2:00 I’m Jack Rhysider.

2:03 This is Darknet Diaries.

2:18 JACK: Today I’m talking with Andrew.

2:21 ANDREW: Yeah, I’m Andrew Batey.

2:22 JACK: Andrew has a really unique job that I can’t wait to ask him about.

2:26 But first we should learn about how he got there.

2:28 ANDREW: So, I started on Facebook when it was still EDU-based,

2:31 and then I was one of the first fifty beta

2:34 advertisers on Twitter and learning to kind of misuse their system.

2:39 JACK: [Music] Misuse their system.

2:41 These systems are huge and complex; algorithms,

2:44 likes, follows, and a whole ad network.

2:47 He wondered if he could manipulate any of that to his benefit.

2:51 ANDREW: The same thing with YouTube.

2:52 You used to be able to break anything into the front page of YouTube,

2:55 and I guess I quickly became the guy that you

2:58 would go to if you wanted to sort of…like gray hat, black hats, and stuff.

3:02 JACK: Gray hat and black hat and white hat, let’s talk about that.

3:05 That’s gonna come up a lot in this episode, and we’ll start with white hat.

3:09 White hat is doing something that’s 100% legal and safe,

3:13 such as hacking your own computer.

3:15 Nobody is gonna come arrest you for that.

3:18 Black hat is doing something that’s illegal,

3:20 such as hacking your ex’s lawyer to see what they’re plotting against you.

3:25 Gray hat is somewhere in-between.

3:27 Maybe it’s technically not legal,

3:29 but you’re hacking into something only for research, but not to cause harm.

3:34 But these terms also apply to marketers,

3:36 someone who follows the rules such as paying for ads the normal way.

3:41 That’s a white-hat marketer.

3:43 But someone who uses bots, for instance,

3:45 to artificially create a bunch of five-star reviews for something,

3:49 that would be a black-hat marketer in my opinion,

3:51 because they are lying and cheating

3:53 with their so-called marketing and run the risk

3:55 of being thrown off the very platform that they’re trying to grow on.

3:59 At least, this is what I think these terms mean going into this episode,

4:03 but my definitions might change as we go further.

4:05 So, in my opinion, Andrew was a black-hat marketer.

4:08 He was trying to promote certain products or people

4:11 by tricking people or systems to artificially inflate something’s popularity.

4:16 ANDREW: My favorite thing at the time was like-jacking.

4:18 It was a weird time period because it was before fan pages.

4:22 So, initially when Facebook first launched,

4:24 you could only friend-request somebody, and there was a 5,000-person limit.

4:27 What you used to do is you would hide the request— Friend Request button,

4:31 or when fan pages launched, the fan Follow button,

4:35 but you would hide it in the pixels.

4:37 I don’t know if you’ve come across that.

4:39 JACK: Yeah, I have.

4:39 People who want to become popular on social media might do it,

4:42 like an up-and-coming band who wants as many likes and follows as possible.

4:46 If others think you’re good, then you’re probably good.

4:48 So, you might show up in more people’s feeds because of that, too.

4:51 Facebook made it so you could add a Like button anywhere you wanted,

4:54 like on your own web page or blog.

4:56 But if you were sneaky, you could trick people to clicking on that Like

5:01 button when they didn’t know they were clicking it.

5:03 That’s what click-jacking is, or like-jacking.

5:05 ANDREW: In our case we ended up using

5:08 it a lot on video or photo-sharing websites.

5:11 So, when people were clicking Next or going through video or photo carousels,

5:16 every time they were clicking— we sort of trained our users to double-click.

5:21 We started buying these websites that were high-volume websites.

5:24 Then eventually we started doing web development

5:26 for other sites and then putting these in there.

5:29 What would happen was— our hypothesis was

5:31 that people did not log out of their Facebook.

5:34 It’s cached in their browser.

5:35 So, what we would do is just hide that pixel inside of other websites.

5:41 [Music] So, we could drive millions of fans to things.

5:45 JACK: Man, how clever; they bought a popular video and photo-sharing site,

5:51 and as the users clicked Next or Play, it wasn’t the Next button.

5:54 It was the Facebook Like button.

5:56 The users had to click twice because the first one was just liking the photo,

6:00 and then the second was going to the next photo.

6:02 So, what Andrew would do is he’d advertise that he

6:05 can get your Facebook page 5,000 followers and thousands of likes,

6:08 and people would buy his service to promote their bands,

6:12 and he’d artificially grow someone’s Facebook account.

6:15 ANDREW: So, that’s kind of where we started a lot.

6:17 Another thing we did in the early days was kind of an ad arbitrage.

6:20 At the time, for example, when you charge an advertiser,

6:24 they cared about time on site and sort of CPMs,

6:27 but they didn’t care that much about

6:29 the actual click-through or engagement with the ads.

6:31 They just weren’t aware.

6:33 I know that seems obvious now, but back in the 2000s,

6:36 no one really knew that those were

6:39 metrics to look at, like traditional advertisers.

6:41 So, what we would do is we had these high-traffic-volume websites and we would,

6:46 for example, have a $5 CPM, let’s say.

6:49 But we could buy traffic for like, a dollar.

6:52 So, we would blend enough garbage traffic in that we

6:55 didn’t really ruin our overall time on site or user stats,

6:59 but we would be able to sort of print money.

7:03 JACK: Oh.

7:03 So, he’d sell ads on his website but then pay fake visitors to click it,

7:09 making it look like a lot of people clicked that ad,

7:11 and then he would just collect the money for it.

7:14 But really, it was just paid traffic.

7:17 Huh.

7:17 ANDREW: Another one that we did that was

7:19 really interesting at the time was around YouTube.

7:21 So, we figured out that you could

7:23 basically— there were these pop-under ads back then,

7:26 and you could— most people recognized them

7:30 from the penis-enlargement ads and things like that; you’d

7:34 click out of a website and there would

7:36 be the annoying little open browser underneath it.

7:38 We would load it with YouTube videos on mute,

7:41 and we were able to rack up hundreds

7:44 of thousands of plays to a YouTube video quickly.

7:47 If we could get 300,000 to 400,000 views quietly in the background,

7:53 we could basically break into the algorithm on the front page.

7:56 Back then, people would go to the front

7:58 page of YouTube to see what was trending.

8:00 So, we would be able to break a bunch

8:02 of different content pieces onto the front page of YouTube.

8:05 At that point they had to sink or swim.

8:07 You basically had to have good content that people liked or not,

8:10 but pretty quickly it was evident;

8:12 you either went viral or you were trash and you were removed quite quickly.

8:15 So, we could get you there, but the question was whether or not you’d stick.

8:19 JACK: Jeesh.

8:20 Now, see, to me, this is all black-hat marketing.

8:23 You aren’t bringing real customers to your site or video page.

8:27 Instead, it’s all fake.

8:28 It’s not quite bots; it’s real people clicking things,

8:31 but they’re tricked into clicking things

8:33 and they don’t know they’re clicking it.

8:35 The stuff they’re viewing is invisible to them,

8:38 but it’s playing in the background.

8:40 So, I call this black-hat marketing because if YouTube found

8:43 out that you manipulated your way to the front page, they’d probably ban you.

8:47 But I also think if you have a bunch of fake followers,

8:50 then that’s not real marketing, either.

8:52 That’s cheating and lying and manipulating.

8:53 [To Andrew] Now, when you say ‘we’, what was this— where is ‘we’?

8:56 ANDREW: I had a couple partners that we did this with.

8:59 JACK: Was this like a black-hat marketing firm?

9:02 ANDREW: You know, that term wasn’t really a thing then.

9:05 I would say we all considered it marketing, but we didn’t— I mean, yes,

9:10 it’s black hat, but I wouldn’t say that that’s

9:13 what we visualized it as at the time.

9:16 At the time we really felt like we were just a marketing firm using

9:20 all the possible channels we could to give a brand an opportunity to take off.

9:25 What I got known for at the time was— we launched an artist on Facebook,

9:33 and he had no label, no major label, nothing.

9:38 He was found at a bonfire in Nantucket.

9:40 So, it was kind of like an interesting thing.

9:43 When we went to the labels back then and tried

9:46 to convince them that you could use Facebook to launch an artist,

9:49 everyone laughed at us and said Facebook’s for kids.

9:52 We have a website.

9:53 We do e-mail lists.

9:54 We do paid marketing.

9:56 This isn’t part of our mix.

9:57 No one believed it was possible until we did it.

10:00 Then after we did it, everyone wanted to pay us to do it.

10:04 The hardest thing was trying to continue to perform,

10:08 because then— everyone that finds a vein

10:11 that works— everyone starts copying you, and then you have to find a new way.

10:15 It’s like you’re constantly on a treadmill for finding new,

10:18 innovative ways that you can break an artist or that you can just get attention.

10:23 I think from our view, that’s the art of marketing.

10:26 It’s less— it doesn’t— I think for a lot of us

10:30 it doesn’t feel like black hat ‘cause we’re just using

10:32 a technique or a tool that might only last for two

10:35 months or three months until we have to find something else,

10:38 and we all safeguard it.

10:39 When we learn something, we don’t tell people.

10:40 So, when we learned about like-jacking, which was the hypothesis we had,

10:44 we definitely didn’t tell anybody because we didn’t want anyone copying us.

10:47 We didn’t want people to know how we could drive a million fans to something,

10:51 and they were all real fans.

10:53 So, it was just kind of a— I think in that view, it’s just a different era.

10:59 I would also say that no one even called it social media marketing.

11:03 At the time there was digital marketing.

11:05 New media was a term.

11:07 There wasn’t even a term for— growth-hacking wasn’t even a term.

11:10 No one even used the word ‘growth-hacking’.

11:13 It just was not a thing at that moment.

11:15 So, it is interesting to see how the whole thing has evolved.

11:18 I do think that if you asked us point

11:22 blank is what you’re doing violating terms and services,

11:25 for sure we would have lied and told you— we would have told you no.

11:30 But we all knew— we weren’t drinking the Kool-Aid.

11:33 Everyone in the company knew we were violating terms and services.

11:37 I think the thing we thought was, who cares?

11:40 If a real user likes what we have to do, like what we’re presenting them— we’re

11:46 not faking the genuine product market fit.

11:49 We’re just trying to get in front of those eyeballs

11:52 and see if we are a product market fit.

11:54 JACK: That was a stretch as well,

11:57 but I agree with you that I think a good marketing campaign is

12:01 one that actually— ‘cause I think most people are like, I hate marketers.

12:05 I hate ads.

12:06 I hate all this stuff.

12:07 But do you?

12:08 When a product lands in front of you and it’s

12:10 the perfect thing— it’s your new favorite song and you’re like,

12:13 holy cow, I can’t believe I just found this, then you don’t hate it, right?

12:18 ANDREW: Totally.

12:18 JACK: So, if you can match that person who needs this product with this thing,

12:24 and that is a marketing move that you’ve done, then that is fantastic marketing.

12:28 I think— I wish that’s how all marketing was,

12:31 was to actually find the person who needs it and then— and focus on them.

12:35 Unfortunately marketing has a lot of wasted eyeballs looking at it.

12:38 ANDREW: For sure.

12:40 JACK: That’s a lot of wasted money.

12:40 ANDREW: Even back then,

12:42 I remember seeing this thing in probably 2011, I feel like,

12:45 where there was this report that came out in an advertising researcher

12:50 port that only 8% of people who saw an ad online were real.

12:55 It was just technically a machine

12:58 connecting with another machine presenting the ad,

13:01 but there wasn’t a real person on the other end.

13:04 That was fifteen years ago.

13:06 I can only imagine how much worse it’s gotten.

13:09 JACK: Yeah.

13:10 When you were doing this black-hat stuff,

13:13 did you have any success stories of people

13:16 that you made or products that you launched well,

13:20 and just huge success with these techniques?

13:23 ANDREW: Yeah.

13:24 I don’t want to throw them under the bus, but we definitely did win a lot.

13:29 We took a brand in action sports that was like,

13:31 seventeenth in their spot and moved them to like, third in the market.

13:35 We— and what was crazy is at the time you start doing these big activations.

13:40 So, when you start winning, all the big brands pile in.

13:43 All of a sudden they all want to do a collaboration or some deal with you.

13:47 So, you end up doing really big brand partnerships or brand collaborations

13:50 with really established companies once they all perceive you as the winner.

13:55 So, the snowball sort of takes off,

13:58 and then it becomes less black hat and more traditional

14:02 project management and release schedules and just creative, less like hacking.

14:08 JACK: Yeah.

14:08 So, one sports brand went from seventeenth to third.

14:11 What else?

14:12 ANDREW: Yeah.

14:12 We had a musician that we launched that went number-one iTunes,

14:15 number-seven billboard with no label.

14:17 JACK: Okay, number-one iTunes, number seven, is that fake numbers?

14:21 Is that fake numbers or…?

14:23 ANDREW: No, those are real numbers.

14:25 That’s the crazy part.

14:25 That’s what I’m saying;

14:26 I don’t feel like it was black hat because we got in front of all the people.

14:30 We got in front of people who decided they really loved this artist.

14:34 Because they really loved that artist—

14:37 and we sort of had an eighteen-month plan.

14:40 So, as we were building this artist with all these techniques,

14:43 we were providing them with content to get them

14:45 more and more hooked and engaged with the artist.

14:48 When we released that artist’s EP, that artist went number one over everybody.

14:54 I remember we beat DJ Catalan, as an example.

14:57 We beat everybody.

14:58 No one could believe it.

15:00 We were called out.

15:01 People thought we had faked the numbers.

15:02 We didn’t fake anything.

15:03 It was all real.

15:05 We just sort of met the consumer at the point— we were

15:10 in front of the consumer at the right moment when they quote,

15:14 unquote “discovered this artist” and then thought they really liked it.

15:17 So, again, the techniques allowed us to engage

15:20 and have a real product market fit.

15:22 But the techniques we used were definitely not approved.

15:25 JACK: Yeah, I mean, I’m— when I first started this podcast I was like,

15:30 alright, let’s market it.

15:31 You start noticing some of these black-hat marketing techniques.

15:34 I had to really sit and look at myself in the mirror and be like,

15:38 am I a guy who is going to cheat my way to success?

15:41 Like, fake it ‘til you make it.

15:43 I had a long debate about it.

15:44 I’m like, no, I’m a hacker;

15:46 of course I’m gonna use every trick in the book, right?

15:48 This is great.

15:49 Let’s try it all.

15:49 Then I was like, no, this is not honest.

15:52 This is unethical and all that sort of stuff.

15:54 So, I landed— this is funny; I landed on no black-hat marketing,

15:59 but I’m totally for guerrilla marketing, which is unsanctioned marketing, right?

16:04 So, if I go to a conference and there’s

16:06 an empty booth where a vendor didn’t show up, I might sit down at that booth,

16:11 put a little banner up that says… ANDREW: I love that.

16:13 JACK: …hey, this is Darknet Diaries, and I didn’t pay $10,000 for that booth.

16:17 Until the people come and say, hey, is this— did you pay for this booth?

16:20 No.

16:20 Okay, well, get out.

16:21 Alright, cool.

16:22 So, I’ll put stickers on places… ANDREW: That’s amazing.

16:24 JACK: …that aren’t supposed to be stickers and all kinds of stuff like that.

16:28 So, that’s what it is, guerrilla marketing.

16:29 ANDREW: No, I agree.

16:30 I think that’s definitely— and I have some examples.

16:33 Like, we launched an app in 2013 called Hater App.

16:36 It was Instagram for everything you hate.

16:38 Our logo was a giant thumbs down.

16:40 We went— I never— we went to South by Southwest and we

16:43 just started putting stickers on people’s backs as they were walking,

16:46 and there was thousands of people walking around with these stickers.

16:49 It went— we got so many downloads.

16:52 The downside was we had built this thing totally crappy

16:56 just to see if it would work as an MVP,

16:59 and it went— we had hundreds of thousands of downloads overnight,

17:03 and the app was not functional.

17:05 It was a complete mess.

17:06 But it was such an interesting moment where I remember doing

17:09 interviews with— we did interviews with Wall Street Journal and everyone.

17:13 It was like a huge story at the time ‘cause

17:17 we basically did this guerrilla approach and it kinda worked.

17:19 I guess to your point, I always viewed the stuff I did online— I mean,

17:25 maybe I’m just justifying it now.

17:27 Like, hindsight, I have revisionist history.

17:29 But I remember really feeling like the things we were doing online was

17:33 the guerrilla version of what we did in person for these types of techniques.

17:39 JACK: Something I noticed on the podcast world is that people

17:42 can fake their way to the top on Apple Podcast charts,

17:46 but most of them fall off a cliff

17:48 as soon as they stop paying their black-hat marketer.

17:50 ANDREW: Totally.

17:50 So, I have an— there’s an artist I know who I

17:53 won’t throw under the bus who is a major artist now.

17:56 They were up for a Grammy, a bunch of things.

18:00 Their entire first album was fake.

18:03 JACK: Okay, I know who you’re talking about.

18:05 Check this out.

18:06 I saw this article last week.

18:08 Spotify accuses Drake of forging billions of fraudulent streams.

18:12 ANDREW: That’s not who I was talking about, but that’s also interesting.

18:21 JACK: [Music] Okay, so that’s what Andrew was busy doing for a while.

18:23 He was living in Los Angeles,

18:24 and he wasn’t just doing black-hat marketing and launching people’s careers,

18:28 but also building websites and tech companies and buying and selling them.

18:32 He was solidly tuned into the internet and saw it in a way that not many did.

18:37 One of his friends is Morgan, and they liked going to football games together.

18:40 ANDREW: Back in the day we had tickets to the LA Rams.

18:43 So, we would go to the games every week, every— eight times a year or whatever.

18:47 We’d go to the games all together.

18:49 We had ten seats together.

18:50 So, it was Morgan, me,

18:52 and a bunch of music exec guys that we had known just randomly together.

18:56 So, anyway, we’re there all the time,

18:58 and around— I was everyone’s weird crypto friend.

19:00 I started mining in 2011 and sort of been

19:04 really interested in technology and how it could be used.

19:09 But anyone who goes back to that day will understand,

19:12 anyone who was in this thing— maybe you were in it back then—

19:15 but it was weird because pure tech people really didn’t like blockchain people.

19:19 There was this weird— if you were a crypto guy,

19:24 you kinda got the scarlet letter put on you when it came to tech,

19:28 and it was— it really did feel like at the moment,

19:32 if people found out you were the crypto guy,

19:34 that you would just get pigeon-holed and lose opportunities.

19:37 So, I was very careful to keep building

19:39 tech and keep the blockchain crypto stuff entirely separate.

19:42 Around 2017, that sort of whole world merged together.

19:46 All of a sudden, inter— people in suits started showing up to crypto events,

19:51 and next thing you know, bankers are around and everyone’s talking about

19:55 how it could be used for enterprise.

19:56 It really felt like the industry collided.

19:59 The music people came to us and said, hey,

20:02 could you use blockchain to track the number of times songs are played?

20:07 The reason is, until today, even, the streaming services give the labels a CSD

20:13 that says Snoop Dogg, 100 million plays.

20:17 No one actually— there’s no receipts behind that.

20:20 It’s literally just a cell; the artist’s name,

20:23 and the next cell over, number of plays for the month.

20:27 There’s no receipts for usage.

20:29 Usage is the number-one driver to how

20:31 much money you should be making every month,

20:33 so it’s really weird there’s no receipts there.

20:35 So, the way that it typically worked when streaming took off,

20:38 the music industry just adopted what they’d always done for physical,

20:41 and that was always an audit period after three years.

20:45 So, every three years they go and audit the partner.

20:48 To do a usage audit, though,

20:50 a forensic audit, not where I’m trapping the contract,

20:52 not where I’m trapping revenue coming in, but how

20:55 many times the song was actually played,

20:56 that could take them up to two years to complete.

20:59 So, you’re talking about five years later

21:02 figuring out that five years ago you should

21:04 have been paid a million more dollars

21:06 for this artist and $2 million for that artist, and that adds up to a lot.

21:10 But all that money’s been paid out.

21:12 So, you don’t have this ability to sort of recapture

21:14 that money from the streaming services ‘cause it’s gone.

21:16 So, they came to us and said, we believe blockchain could be a solution.

21:20 You’re our weird crypto friend that also understands music,

21:23 and we trust your whole team here.

21:25 Morgan, my co-founder,

21:26 had been a lobbyist on behalf of a lot of the majors for copyright protection,

21:31 extending copyright law,

21:32 and Poria was a really gifted machine-learning AI engineer,

21:36 but at the time we were doing a lot of crypto stuff together.

21:39 So, they said, we believe your team could solve this.

21:41 Will you build a real-time tracking tool?

21:44 The question we were trying to answer at the time

21:47 was how many times is every song actually played?

21:49 Because you can’t rely on the CSVs to just— that they hand over.

21:52 They’re always wrong.

21:53 What we learned from the offline audits,

21:55 where they pulled the usage logs in fifty different audits,

21:58 was on average anywhere between 20% and 31% discrepancy, always under-counted.

22:03 So, imagine you’re perpetually being paid 20%

22:06 to 30% less than you thought you should have.

22:09 That is where we started,

22:10 and we built one of the fastest blockchains in the world.

22:13 At the time we did 10 million transactions

22:15 per second per region in a private permission chain.

22:18 We have over forty patents in seven countries filed,

22:22 probably thirty-something issued.

22:23 We built this technology.

22:26 When we went live is when we accidentally discovered fraud.

22:31 JACK: This discover would ultimately make

22:33 him abandon this very blockchain company

22:35 that he just built and take his life in a whole new direction.

22:39 We’re gonna take a quick ad-break here,

22:41 but stay with us because you’ll never believe the fraud he discovered.

22:48 So, Andrew and his co-founders Morgan and Poria built

22:52 a tool to track how many times a song is played.

22:55 Since the music labels wanted him to do it, they were also helping him get

22:59 in touch with these music-streaming services to try

23:02 to work out a way for Andrew to see the real-time streaming data they had.

23:06 So, they made deals with these streaming platforms that they were able to see

23:10 the play counts for the few music labels that they were dealing with.

23:13 Their goal was simply to count the plays and make

23:16 sure the artist got paid for what was played.

23:18 But little did they know, [music] counting plays was not accurate at all.

23:23 ANDREW: We started seeing these weird clusters of users,

23:27 like 8,000 users playing the exact same

23:29 sequence of songs sixty-three times on a Sunday,

23:33 or users suddenly getting play counts

23:35 in seventeen different countries in the same week.

23:37 Like, how is that even possible?

23:39 So, we started noticing these discrepancies,

23:41 and we went back to the labels and the streaming services and said,

23:44 we think you have a fraud problem.

23:46 If we’re supposed to be the leader or the trusted source of truth of how

23:51 many times a song is played and we’re just telling you a song was played,

23:54 we’re not actually telling you the intent behind

23:56 the play and if it should still be counted.

23:58 You can’t actually pay this out because there’s

24:00 a bunch of fraud happening here that should be removed.

24:03 So, until we can solve the fraud problem, we don’t think we can solve audit.

24:09 That was the summary we came to after two and a half years,

24:12 and it was a real challenging moment for the company because it was like,

24:16 you’ve been building this entire tool believing this is the one problem,

24:19 and then you get there and realize— someone said, hold my beer,

24:23 and you have a totally different problem you

24:25 have to solve with a completely different skill set.

24:28 JACK: I’m still shocked at the point that the streaming

24:31 services didn’t have this capability to detect this sort of thing.

24:35 In the podcast world we have the IAB, which is a— it’s actually a certifiable

24:41 way of measuring metrics for podcast listens, and they have a whole list.

24:46 They’re like, okay, if a user starts

24:48 on their phone and then switches to their computer,

24:51 is that considered two listens or one?

24:53 They have to download for over a minute

24:55 before they can actually be considered a listen.

24:58 If it’s streaming on the watch,

25:01 the watch does things to grab MP3s very differently than how a computer might.

25:06 So, it looks like 500 listens when you come in from a watch,

25:10 so you have to adjust for that sort of thing.

25:12 There’s— you can look it up, how to measure podcasts,

25:16 which is very complex and complicated downloads.

25:19 I just can’t imagine these bigger streaming

25:22 services not wanting to have accurate download numbers,

25:25 especially with paying before that.

25:27 They must have had a whole team of people trying to figure this out,

25:31 and you’re saying, no, they didn’t.

25:32 It was you that figured it out.

25:34 ANDREW: No, they didn’t.

25:36 At the time major streaming services— enter your streaming service—

25:39 had less than half of a person dealing with this.

25:42 It was probably some data scientist,

25:44 and they were mostly using rules-based anomaly detection.

25:46 So like, did a song get played more times than literally possible?

25:50 Like, did someone play a song 10,000 times this week?

25:54 JACK: Well, that’s really eye-opening and— it’s hard

25:58 to believe because when you’re dealing with money,

26:01 you have to pay accurately, and— crazy.

26:05 Like I said, IAB is a certifiable thing.

26:08 You can actually pay them to come audit your monitoring,

26:11 your statistics, and they’ll confirm it,

26:13 and then sponsors will be more likely to pay those numbers ‘cause you could say,

26:18 no, it’s been confirmed that we’re IAB-certified.

26:20 ANDREW: 100%.

26:21 ‘Cause when I’ve done podcast advertising,

26:23 I always ask for the certs because I don’t trust any of the numbers to be real.

26:28 So, I understand 100— ‘cause especially in the early days of podcasting,

26:33 I feel like it was just like reading tea leaves.

26:36 Nothing seemed to make sense.

26:37 JACK: So, this became Andrew’s pivot.

26:39 He was able to go to the music-streaming services and convince them,

26:42 look, you have some major fraud happening.

26:45 Here’s proof.

26:45 They didn’t believe him at first,

26:48 so he had to really show them how much fraud there was.

26:50 They eventually said, okay, instead of monitoring just those music labels

26:53 that you’re supposed to, [music] do you

26:54 mind looking at all our stream music and see what else you can discover?

26:58 That just snowballed.

26:59 One streaming provider turned into two, and he kept getting full,

27:04 unfetted download data from many online streaming platforms.

27:07 ANDREW: Yeah, we’re definitely the leader.

27:09 We’re the market.

27:10 JACK: You are such a unique position.

27:13 I don’t imagine there even being two companies

27:15 that have this access compared to— you’re… ANDREW:

27:19 We have more data access than anyone in the music industry,

27:22 especially… JACK: No,

27:23 I mean— I mean there’s no other person like you who’s measuring like that.

27:26 They don’t say, oh yeah, let’s open this up to 500 companies to come

27:31 watch our stats and make sure that we’re accurate.

27:33 You’re probably the only one for these companies.

27:35 ANDREW: We are the only one.

27:38 [Crosstalk] JACK: The competition here is zero for you.

27:40 ANDREW: Yeah, totally, 100%.

27:42 In a lot of ways we felt like we made the market.

27:46 ‘Cause at the time, I remember going back

27:48 to the labels and the streaming services and saying,

27:50 I think you have a fraud problem.

27:53 Literally, they laughed at us.

27:55 Especially the major labels thought it was less than one percent.

27:59 Because keep in mind, their artists aren’t cheating.

28:02 So, what they see as only their data— and they’re like,

28:05 there’s no anomalies here.

28:06 But to them it just looked like the independent market was growing.

28:09 I would actually argue that most

28:11 of the independent music growth has been from fraud,

28:14 not from true, independent market share increasing.

28:16 JACK: Okay.

28:17 Yeah, you gave me a taste of a few

28:20 of these things that you were noticing, right,

28:23 people playing things that are humanly impossible to play that much,

28:28 and a group of people playing in different regions all at the same time.

28:33 ANDREW: Yeah.

28:33 JACK: This suddenly sounds to me— ‘cause I come from cybersecurity

28:37 world— this suddenly sounds to me like not exactly threat intelligence,

28:42 but yeah, it sounds like you’re looking at a security incident tool

28:49 and trying to build signatures to detect when there’s a security incident.

28:54 Just the one that comes to mind for me is if I had fifty connections

29:00 from some office all go to the same

29:03 IP address somewhere from different computers internally, why did that happen?

29:07 There might be a botnet in our company that suddenly said,

29:12 oh, all phone home at the same time.

29:15 Get new instructions.

29:16 So, I would immediately flag those fifty computers to be like,

29:20 can someone do an antivirus on those to see what’s going on here?

29:24 I was right.

29:25 There was a botnet on that computer.

29:28 So, I was like, okay,

29:30 we’ve got a way to detect when a botnet happens just by— how

29:34 in the world did this all happen in the same millisecond, right?

29:37 So, I imagine that’s kinda the tools or the signatures.

29:40 How do you look at this?

29:42 ANDREW: 100%.

29:43 We’re building— we have probably close

29:46 to 700 models looking for different things, and it’s constantly changing.

29:49 [Music] So, to give you examples,

29:51 we found one where somebody had hacked a major artist’s delivery feed.

29:56 So, imagine— it’s very common to have multiple registration numbers

29:59 for the same song because it may have been part of an album,

30:03 a single, a deluxe version.

30:05 It could have been done multiple times

30:07 with different people in the supply chain.

30:09 So, what ends up happening a lot of times is the streaming service

30:12 will concatenate that and pick one parent and a bunch— child sort of numbers.

30:16 But that way they’re all grouped together.

30:18 So, in this case, someone had hacked the feed,

30:21 put their version in, but the metadata for that, the pay,

30:24 was different than the actual label.

30:26 So, in this case it looks like the same song, it sounds like the same song,

30:31 has the same artwork as the same song,

30:33 but who the finance team pays is different.

30:36 They were able to promote their version

30:38 as the parent and then manipulate those— the payouts.

30:42 So, in that case they stole millions

30:44 of dollars from that artist over an eight-month period.

30:47 When we found it, we found it by some

30:49 of the ways that they manipulated the streams.

30:51 Like, how do you become the parent to your— like,

30:53 why did this happen right at the beginning?

30:55 We found the manipulation early and then it stopped.

30:58 We were able to identify that there was

31:01 something wrong in their data because of their manipulation.

31:04 Then when we found that, we then built

31:07 a model to find other artists it happened to.

31:09 We found 1,700 other artists that had been hijacked

31:12 the same way over the course of a couple years.

31:16 So, again, they’re constantly being creative.

31:19 Another one we found a little over a year

31:21 and a half ago was a device we had never seen.

31:24 So, why all of a sudden is this very

31:26 specific device running up a bunch of streams?

31:29 We would normally see what— for example,

31:32 the Android system you’re on, what the operating system,

31:34 what the device is, et cetera.

31:36 This is a device we had never seen.

31:38 It turned out it was owned by the Department of Corrections,

31:41 and someone had hacked the prison system and turned

31:44 all the prison tablets into a streaming farm.

31:47 JACK: Wow.

31:47 Tell me more about that.

31:49 How did that happen?

31:51 ANDREW: I don’t know how they hacked it,

31:53 but the net effect was that they had turned— I think it was like,

31:58 400,000 devices into a streaming farm where

32:01 they were manipulating streams from streaming players.

32:04 So, I guess— I didn’t even know, to be honest, that prisoners had devices.

32:09 But in a lot of states they have— you

32:11 sort of pay I think by the minute or whatever.

32:14 You pay for these devices,

32:16 and there’s a handful of applications that are approved.

32:19 It turns out most of them are run or slash-owned

32:21 by a private equity company or a couple private equity companies,

32:26 and someone had just simply hacked the devices and were able to use them

32:32 all in sort of a bot network that we hadn’t expected at the time.

32:37 JACK: How did you spot that?

32:39 ANDREW: Because the device type was suddenly new and different.

32:41 We had never— ‘cause we get all these different— so, why all of a sudden…?

32:46 In context it seems small, but we have all these types of community-clustering

32:50 techniques that are looking for different parameters and features.

32:53 So, let’s say that we get, I don’t know, 500 fields.

32:56 We’ll get— at this point now from streaming services, we get all kinds of stuff;

33:01 gyroscope, battery life, orientation of phone, everything you’ve done in app.

33:04 We’re catching a lot of different data, anonymized but individual— but hashed.

33:09 JACK: The streaming service app is collecting

33:11 that and then you’re seeing that as well.

33:14 ANDREW: We’re seeing an anonymized version,

33:16 generally hashed data so that we didn’t have any PII ever.

33:19 But that’s— yes, we’re seeing all

33:21 of this stuff and then triangulating it and saying,

33:24 why are all these exactly the same?

33:26 We’ve never seen this unique device, so what’s happening here?

33:30 Then it just turned out that that one

33:33 device is specifically made for the Department of Corrections,

33:36 and no one else buys it.

33:38 So, it leads you to sort of one vendor,

33:40 which then allows you to unravel the rest.

33:44 So, that was a very interesting case.

33:47 JACK: Then what do you do with that?

33:49 Do you say, okay streaming service,

33:50 here’s a device type that we should just not…?

33:53 ANDREW: We demonetize it all.

33:55 JACK: Yeah?

33:55 ANDREW: So we don’t pay any of those streams now… JACK:

33:57 But you block that— I mean, not block, but you demonetize that device type.

34:01 You can do it that granular or…?

34:04 ANDREW: Yeah, for sure.

34:05 We can say these don’t get paid.

34:06 I mean, at the end of every month what

34:09 happens is we have three sort of primary checks.

34:11 We check daily to see what fraud we’re catching

34:14 so that it gets removed out of product-level stuff.

34:16 So, recommendation engines, algorithms, et cetera.

34:19 We sort of down-weight anything we see that’s

34:23 fraudulent so we don’t make the problem worse.

34:25 The second thing we do is we do weekly updates for charts,

34:28 so if we see anything on the charting side,

34:31 we will— you’re allowed to update the charts weekly.

34:34 So, we’ll update the charting information.

34:36 That’s way less common, ‘cause again,

34:39 most big artists aren’t cheating, at least from the streaming side.

34:42 But again, we sort of just safeguard that.

34:44 Then the last one, which is the real one, is the money payout.

34:47 So, at the end of the— at the end

34:50 of every month we do the check for the entire month.

34:53 ‘Cause there’s stuff we’ll catch, right?

34:55 The really obvious fraud we’ll catch day one.

34:57 But there’s some fraud that takes us a long— you need more

35:00 of a longitudinal view to see how they’re interacting over the course of a week,

35:04 two weeks, three weeks.

35:05 There’s all kinds of cases, for example,

35:07 that when we first started we would catch that no longer happens anymore.

35:10 So, in the early days, I’m guessing his engineers were lazy.

35:14 Or, it’s just easy— like, how do you deal with checking for anomaly detections

35:21 for months where they have different days of the month?

35:24 So, what we often— or, you know,

35:26 they have twenty-nine days, twenty-eight days, thirty days, thirty-one days.

35:28 So, a lot of times what they would do

35:29 at the end of the month is pull the first twenty-eight days.

35:32 I don’t know how fraudsters figured this out,

35:34 but starting on Day 29, they would jam all their bots.

35:38 So, you’d see massive numbers; 29, 30, 31.

35:41 So, they would end up getting a large percentage of the pro rata pool,

35:45 but they only ran their fraud at the end

35:48 to sort of get away from whatever was being checked,

35:51 ‘cause a lot of the anomaly-detection checks initially

35:54 in the early days were the first 28 days, just to simplify it.

35:58 So, again, we find all these weird sort of techniques that they would use,

36:03 and we would shut them down or demonetize them.

36:06 In some cases the streaming services,

36:08 when we returned the data back, they take action.

36:11 So, sometimes the streaming service will decide to completely remove

36:14 all the content and just say this is all fraudulent.

36:17 So, in this case, for example, really obvious stuff.

36:20 So, less than a hundred real users have streamed this.

36:24 99.99% of all of their streams, historically, are from fake accounts.

36:28 You know, maybe they have less than a total of 2,000 streams total.

36:35 Whatever it is, they’re gonna have these rule sets we have

36:38 in place to make sure it’s only the worst of the worst fraud,

36:41 and then we’ll— the streaming service will just straight

36:43 remove that content or take it off the platform entirely.

36:47 That seems to be incredibly effective because the fraudsters realize they’re

36:51 caught and they just stop on that or go to different services.

36:55 So, I think our approach has been less— I’m

36:57 not naive enough to believe we’ll always stop fraud.

37:00 I think historically you can look at all fraud and say that’s never the case.

37:04 There’s always going to be smart

37:05 people and they’re gonna try different techniques.

37:07 But I think we can make it so difficult that they just go to other industries.

37:13 JACK: [Music] It’s so interesting for me to listen to him talk,

37:15 because this isn’t a cybersecurity story,

37:18 yet everything he’s saying is exactly what happens in cybersecurity land.

37:22 You set up monitoring tools, you build rules to detect problems,

37:26 and then you make it harder for people to exploit those things again.

37:30 They did it all from scratch.

37:31 We all know in cybersecurity you can never stop hackers,

37:34 but what you want to do is make it so

37:37 hard for them that they move on to an easier target.

37:39 That’s something I’ve heard again and again,

37:41 yet that’s what he’s doing in this world.

37:43 Some people always reach out to me and complain that when

37:46 I do an episode that’s not cybersecurity-related that they get upset.

37:50 But listen, this show is about the dark side of the internet.

37:54 To me, that encapsulates way more than just cybersecurity.

37:57 It’s about all the hidden stuff that you never see or experience.

38:02 I want to shine a light on that shady,

38:05 dark, gritty, underground aspect of our digital life.

38:08 The fraud and the manipulation of algorithms, the websites and technology,

38:12 the people who abuse it, and of course, hacking in cybersecurity, too.

38:17 [To Andrew] I was trying to find a link I had a long time ago.

38:22 There was a— I’ve actually seen many Reddit posts where people are saying,

38:27 hey, what’s up with my Spotify account?

38:29 It suddenly shows that I’ve played a whole bunch

38:31 of these artists that I’ve never even heard of much less played.

38:35 I don’t understand why my Spotify is showing that I’ve

38:38 played these, and it’s recommending all this other stuff.

38:40 ANDREW: Account takeovers.

38:41 That’s a huge percentage of what we see now.

38:44 If you think about— you’re in cyber, so imagine it’s a giant arrow back to you.

38:48 If all of your bots look the same, it’s easy to cluster them.

38:52 If they’re behaving the same way, it’s easy to cluster them.

38:55 If they are all streaming one artist specifically,

38:58 it’s like a giant arrow back to that artist.

39:01 If they’re all streaming from one distributor,

39:03 it’s a giant arrow back to the distributor.

39:04 So, you need to hide the needle in the haystack,

39:07 and the easiest way today to do that, or what we’ve— I’d say

39:11 for the last three years put a lot of R&D in to catch, is account takeovers.

39:15 So, they’ll log in as you, play a song five or six times, and then leave.

39:19 Then all of this stuff you do naturally just hides whatever they did.

39:23 So, they don’t have to create that.

39:25 They don’t need to make differences.

39:27 You don’t need to program in artificial changes in your bots.

39:32 You just basically log in as somebody,

39:34 play five streams, and hope they don’t notice.

39:36 I would say that that’s really common these days.

39:38 That’s the number-one growth area for fraud that we catch,

39:41 is account takeovers in general, or adding devices to family plans.

39:45 So, we’ll see a device that’s an IOS that’s legit,

39:48 a Tesla that’s legit, and then an Android that’s all fraud.

39:52 JACK: Wow.

39:53 Okay, so, what I don’t understand is how they’re taking over the accounts.

39:56 You say it’s one of the biggest things you’re seeing.

39:59 How are they getting so many Spotify accounts or whatever streaming service?

40:02 ANDREW: So, there’s a couple ways.

40:05 The simplistic ways are— 90% of internet log-ins

40:09 are just people trying different data-breached passwords and usernames.

40:12 I would say that most streaming services are

40:15 not high on people’s priority list for protecting.

40:18 So— and there’s a sort of product question about how much friction

40:23 do you add into a service to make it difficult for users,

40:27 ‘cause it hinders growth, right?

40:29 So, I think there’s an interesting friction

40:32 point there between how secure do you

40:34 make a streaming service on the user end and how much do they actually care,

40:38 and do they really care if your account that was

40:40 used to play a song ten or twenty times?

40:42 I don’t think they’re realizing how much damage it does in aggregate.

40:45 So, there’s that issue, I would say.

40:48 I mean, you’ve been on— your whole series is called Darknet Diaries.

40:53 You get on the darknet and download these accounts quite easily.

40:57 I think at one point, to prove a point,

41:00 we went on and downloaded and showed people,

41:03 some executives, that I could get 100,000

41:05 accounts on every single streaming service immediately.

41:08 It gives you the independent— the infection date and the last log-in date.

41:12 You can even get— if they have malware on the actual device,

41:15 you can even get all of the browsing history, too.

41:19 So, if you want to warm up the IP before you use it,

41:22 you can kind of mimic their behavior before you log in.

41:25 There’s lots of this stuff existing.

41:27 There’s also an API that we found in the darknet

41:31 where they own tens of millions of these accounts,

41:34 and they will spin them up for you.

41:37 So, you basically tell them the parameters of the types of plays you need,

41:41 and they make sure that no single account is overused or indexed too hard,

41:45 and they actually create the fraud for you.

41:49 [Music] So, it is a fully professionalized,

41:53 industrialized supply chain for fraud at this point.

41:57 JACK: Wow.

41:59 Seriously, wow.

42:00 He’s shown streaming service execs that he

42:05 can get 100,000 accounts on their platform instantly,

42:09 because after a data breach there’s communities of people who will parse through

42:13 those usernames in the data breach

42:15 and pluck out all the streaming service accounts,

42:18 or even try to use those usernames and passwords

42:20 on a streaming service to see if they reuse passwords.

42:22 From that, they build the giant list of users for each streaming service,

42:28 and that list is valuable because if you can manipulate the streams,

42:32 then you can get paid by these streaming services.

42:35 I’m just astonished because when I hear how bad the problem is like

42:40 this and how easy it is for people to get access to our stuff,

42:45 it’s like a cold, wet slap in my face.

42:48 I kinda go through this process again and again when making the show.

42:51 At the beginning of this episode I’m like,

42:53 ooh, these are some interesting techniques.

42:55 Maybe I’ll try one of these on my show.

42:57 But by this point of the story,

42:59 I’m so mad that these companies aren’t protecting our data and it’s just exposed

43:03 on the dark web only for fraudsters to use

43:05 to make money for themselves off my account.

43:08 Because it’s our data; it’s not some nameless victim out there.

43:12 It’s yours and mine that these people are gaining from.

43:15 I’ve done this show long enough to know that there

43:18 is no way from keeping our data from getting leaked,

43:22 which makes me black-pilled, right?

43:24 Like, okay, I’m giving up.

43:25 Oh well, my data’s out there.

43:27 I might as well just assume I have no privacy

43:30 anymore because it’s out there like, all over the place.

43:34 I just totally give up protecting myself.

43:37 But I don’t like feeling hopeless.

43:40 I’m not someone who gives up forever.

43:43 I’m an optimist.

43:44 I’m a fighter, and I don’t mind hard work.

43:47 So, then I get this surge of ideas,

43:50 and it makes me white-pilled, because then I realize, wait a minute,

43:53 who’s the ding-dong who told them my address and gave them

43:56 my password and username and telephone number and all that stuff?

43:59 I am.

43:59 Hell no.

44:00 No more am I telling these companies my real name or phone number.

44:04 I’m not going to reuse passwords or even reuse e-mail addresses anymore.

44:07 It’s a war out there,

44:09 and I’ve got to take care of my own data since no one else will.

44:15 Okay, anyway, the name of the company that Andrew co-founded was

44:18 called Beatdapp in order to analyze music streams to detect fraud.

44:22 He abandoned the original idea of using

44:24 the blockchain to help these labels get paid properly, and he focus on this now,

44:28 pretty much entirely working for streaming services now.

44:31 [To Andrew] Yeah, well, I guess what I’m wondering is you almost need

44:35 a black-hat person who knows that, the cheating industry,

44:38 who’s been there, to actually sit down and look

44:41 for these— to look for things you haven’t found yet, right?

44:44 To find new signatures.

44:45 ANDREW: Totally agree.

44:47 I think I’m that guy, probably.

44:49 Yeah.

44:50 You know, the music industry often said I’m their hacker now.

44:55 I’ve switched sides.

44:56 I think the side-switching is mostly industries.

44:59 I would say the— for me, the difference is that users no longer have to actually

45:05 engage with the content for that artist to get paid.

45:08 What I did back in the day I really believe was in service of the artist.

45:14 If the artist is good, the people will listen, consume, and adopt it.

45:19 If the artist is not, they will let you know right away that it’s trash.

45:23 I think that has changed in a sense that you

45:26 can be a trash artist that manipulates lots of streams

45:29 and gets paid without actually being good or having real

45:33 users or being able to sell ten tickets to an event.

45:38 So, I just think they’re now stealing from other artists.

45:42 JACK: Yeah.

45:43 So, you’re saying it’s now more of a financially-driven thing and not so

45:48 much a let’s try to market this person and get them to break out.

45:52 But I push back at you because you did that ad arbitrage where you’re like, hey,

45:57 we could print money by charging this much CPM

46:00 and then actually just paying for somebody to come here.

46:04 So, you were financially driven in some aspects, as well.

46:08 It wasn’t always, oh, let’s just market someone.

46:10 ANDREW: I regret that, and thank god that the Statute of Limitations has passed,

46:15 ‘cause it was definitely not my proudest moment, for sure.

46:18 JACK: What I didn’t realize is that musicians

46:21 don’t get paid per stream on these platforms.

46:24 Instead, they get paid a percentage of what

46:26 advertising revenue came in for that month,

46:28 which means fraudsters are stealing money from real artists.

46:32 ANDREW: Okay, so, the way the music industry works is

46:34 that there’s one— I’m gonna simplify this ‘cause it’s little more nuanced,

46:38 but generally speaking there’s one pool of capital.

46:41 Every month a streaming service makes

46:43 money from advertising revenue and subscription fees.

46:46 Now, this money goes into one pot,

46:48 and it’s paid out every month based on play count.

46:51 So, if you’re a artist and you make— you did, let’s say, 100,000 streams,

46:57 and that streaming service did a million total streams that month,

47:01 you get 10% of that pot.

47:03 You get your percentage of streams for the whole entire— of the whole,

47:08 entire streaming ecosystem you’re in of the revenue.

47:11 So, it’s a performance pro rata.

47:14 What happens is you could release a song in November

47:18 and do a million streams and get paid $3,000, and that’s correct.

47:23 You could release the same song and do

47:26 a million streams in February and get paid,

47:29 I don’t know, $500, and that could also be correct.

47:33 The reason the numbers could be different is that month the advertising

47:37 might be smaller because they’d spent— especially as February or January,

47:40 they had spent a bunch of money for Black Friday and holidays,

47:43 and advertisers weren’t spending as much in January, February.

47:46 You could have less subscribers.

47:48 You could also have had a major release.

47:51 So, say Taylor Swift released a track or an album,

47:54 and all of a sudden the majority of streams are going to Taylor Swift,

47:58 then your pro rata goes down.

48:00 So, you could actually have wildly different amounts of money you make

48:04 for the same general performance because it’s

48:07 a performance base relative to the entire industry.

48:09 So, if you do one of ten streams, you get 10%.

48:11 If you do one of twenty streams, you get 5%, and so on.

48:15 So, why that matters and how you steal is that fraudsters will

48:19 load millions of songs onto streaming

48:21 services as if they’re independent artists.

48:23 [Music] They’ll create different independent artists’ names,

48:26 different independent artist labels,

48:27 they’ll put them in different parts of the world

48:30 so it just looks like they’re from different people,

48:32 different regions, different companies.

48:34 They will load those direct do-it-yourself,

48:37 like DIY to streaming services through distributors.

48:40 So, the distributor is an aggregator who, if you’re an independent artist,

48:44 you upload to like a DistroKid or a TuneCore or a Symphonic or whatever,

48:48 and they basically put all the data together and all

48:51 the pieces together and upload it to the streaming services for you.

48:54 So, they do it in one shop for you.

48:56 So, instead of you going and uploading

48:58 to a hundred different streaming services,

48:59 you go to this one provider and they aggregate it

49:01 and put it on to all the stores for you.

49:03 So, these fraudsters will create fake artists, fake labels,

49:06 they’ll use fifteen or twenty different distributors so

49:10 there’s not one point of failure, they’ll upload— so,

49:13 they’ll get millions of songs onto streaming services, and then here’s the key;

49:18 they will play a bunch of these songs small amounts of times.

49:20 They do not want to get noticed.

49:22 You don’t want an artist that charts that’s not real.

49:25 You want to generate 1,000, 3,000, 4,000 streams,

49:29 but you don’t actually— no one notices the song with 3,000 plays.

49:34 So, if you create a small number of streams across a large number of artists,

49:38 then your aggregate pro rata,

49:40 the amount that you actually have of all of the pools for that month,

49:45 can dramatically increase, ‘cause you’re stealing pennies.

49:49 It’s basically like Office Space.

49:51 You’re stealing pennies from all of these different artists.

49:54 They just don’t realize it.

49:55 But in aggregate it’s a large amount of money.

49:57 So, the way that it works today is

49:59 about $3 billion worth is stolen from real artists,

50:02 because it’s going to people that are not real artists.

50:05 JACK: Wow, $3 billion is going

50:08 to fraudsters who are manipulating these streaming platforms.

50:11 That’s incredible.

50:12 It’s apparently very profitable to go through

50:15 all this process of making tons of songs and getting someone else to play

50:20 those songs across hundreds of thousands of accounts.

50:22 It seems like a lot of work, but man, it’s really paying off for them.

50:27 If it’s paying off, then that means it’s only gonna grow.

50:30 [To Andrew] So, a few times you’ve made my— the hair

50:35 on my neck stand up when— ‘cause I’m a big privacy advocate, right?

50:39 I’m crazy into it.

50:40 I’m a freak about it.

50:42 So, you’ve talked about some of the metrics you’re getting

50:46 from some of these apps such as gyroscope and battery life.

50:50 As a privacy person, I don’t understand why I need— you need to get

50:55 my gyroscope information in order to just let me play a song.

50:58 But on the other side,

51:00 when I went to actually take ads out on some of these platforms to say, hey,

51:05 market a legitimate ad on the platform, they’ll ask you,

51:09 hey, when do you want someone to listen to this ad?

51:11 Do you want them to listen while they’re working out,

51:14 while they’re having sex, when they’re making dinner?

51:16 I’m like, how the heck do you know when someone is making dinner?

51:19 What is going on here?

51:21 So, the amount of information that these streaming

51:24 platforms have on us is crazy.

51:27 I don’t know what question I have,

51:29 but it just— like I said, it makes my hair stand up.

51:32 ANDREW: I agree, but I would say for us, just know that in most cases they treat

51:37 that data like it is the most important— I mean,

51:40 they treat it— having come from healthcare in the previous company,

51:44 they treated it at a level way higher than healthcare,

51:47 like crazy, like HIPAA compliant times ten.

51:50 They are insane with this data.

51:52 They hash everything.

51:54 They’re very particular about how it gets to us, how it gets back.

51:57 We get security audited.

51:58 We have an entire internal security team.

52:00 It is— it’s partitioned in lots of ways so even if you get to one piece,

52:04 you can’t get to the rest.

52:06 We are insane because they make us be insane with it.

52:10 Again, at the end of the quarter, you’re like, it’s just streaming data.

52:14 But people are stealing $3 billion a year.

52:17 So, that’s a massive amount of money that is

52:21 going sometimes to people like terrorist organizations and organized crime,

52:26 not some kid in a basement.

52:28 So, the argument also is I think that there’s some

52:32 large-level implications for where this money goes and what happens,

52:36 but I will say that the streaming service side treats

52:39 that data— whether or not you want them to have it,

52:42 they treat it like it’s very, very important.

52:45 I’ve never come across a streaming service that casually allows data.

52:49 Even then, when we decide exactly what

52:51 fields we need from different streaming services,

52:53 we then reject the rest of the fields.

52:55 We take the least amount that we need to do our job once we’ve built the models,

52:59 and then if we built a new model or find a new thing that we need to do,

53:02 we re-ingest that data and build again.

53:05 But we don’t typically just sit on all this stuff,

53:08 even if it’s anonymized, because we just don’t want it.

53:11 So, again, my point is I feel they’ve been very responsible with it,

53:15 if that makes you feel any better, even though they haven’t.

53:18 JACK: You said terrorist organizations?

53:22 ANDREW: [Music] Yeah.

53:22 Imagine that you could move money

53:24 through a streaming platform without anyone noticing.

53:26 So, what you do is you take dollars, you turn it into crypto at crypto ATMs,

53:32 you pay the streaming farm operators in cryptocurrency

53:34 to stream a certain amount of songs.

53:37 Those songs are owned by different entities globally.

53:39 So, quite literally you could move money

53:42 from Colombia to Doha through the streaming service.

53:44 It’ll all be washed and clean through the streaming services themselves,

53:50 directly funding terrorist activity.

53:53 JACK: So, the artist that they’re playing is

53:57 an artist that they’re controlling because they’re getting paid… ANDREW:

54:00 They’re making fake artists.

54:02 They’re putting fake artists’ names up.

54:04 They’re taking music that’s not theirs.

54:06 So, they might hack, for example, Dropbox accounts.

54:09 ‘Cause you figure one out of every

54:11 hundred songs typically an artist releases— so

54:15 there’s a huge back catalog of artist

54:17 songs that have never actually been distributed,

54:19 and when they’re distributed is when they’re fingerprinted.

54:21 So, a lot of these don’t have fingerprints.

54:23 So, if you upload them and there’s no fingerprint,

54:26 the streaming service and the distributor feels that you are

54:28 the rightful owner of that song ‘cause they’ve never seen it before.

54:31 So, now you can take old songs that have never been digitized,

54:36 make them your own, and then manipulate the stream.

54:38 So, the first step is just getting the music.

54:41 The second step is manipulating the streams so you get paid.

54:43 If you were a terrorist organization and you build all this infrastructure,

54:47 you might have literally let’s say thirty different music label entities

54:52 around the world all using different distributors with, I don’t know,

54:55 a hundred quote, unquote “independent artists” in each,

54:58 and then you’re going to just run small numbers of streams

55:01 to those on a hundred different streaming services and slowly get paid.

55:05 But that money will be clean and end up from one

55:08 location to another without you ever having to actually transport the cash.

55:12 JACK: You think that’s…?

55:14 I mean, looking at those numbers,

55:16 how much cash do you think they’re transporting?

55:18 80…?

55:19 ANDREW: Hundreds of millions of dollars.

55:21 JACK: Well, I was gonna guess a percentage here, right?

55:25 So like, if I have $100 million and I say

55:28 I need to transfer this, 80% of it makes it?

55:31 ANDREW: Oh, percentage-wise of the dollar?

55:34 Like 40% to 50%.

55:35 JACK: Yeah, ‘cause it’s not— see,

55:38 this is— they’re losing a ton of money on— in the transfer, then.

55:40 ANDREW: But it’s better than leaving it in cash.

55:43 Honestly, that’s what typically— how do you move this much cash?

55:46 They’re gonna pay someone to wash their money regardless, sometimes 20%, 25%.

55:50 They’re gonna pay a large amount of money anyway.

55:52 Then they still need to move that money and sort of pay taxes

55:55 on that money when it ends up— you end up losing a lot anyway.

55:58 So your other approach is just to hide it somewhere or keep

56:01 it as cash and find other fronts to move it through.

56:04 It actually ends up that over the last ten years,

56:07 the music industry, as it was growing so fast,

56:10 was a really opportunistic place to hide

56:14 or wash money because no one was watching it.

56:20 JACK: Now I think I’ve come full circle on you saying you were gray hat,

56:24 because I was saying to myself,

56:26 if you’re breaking the terms of service, it’s black hat.

56:28 Now I’m like, wait a minute, if you’re breaking the law, that’s black hat.

56:32 This is different than terms of service.

56:34 ANDREW: Yeah, that’s how I feel, you know?

56:36 I didn’t break laws.

56:37 I just definitely didn’t agree that I wasn’t allowed to do something.

56:41 JACK: Yeah, and now it’s getting crazy,

56:43 where hundreds of millions of dollars are being sent from— from who?

56:48 Who’s involved in this?

56:49 ANDREW: Well, imagine any kind of illicit activity;

56:51 you can move the money to your partners.

56:53 You can send— how we potentially caught one,

56:57 for example, is you’d see the exact same percentage— like,

57:00 let’s say that you have a million users all playing music.

57:03 I’m just gonna use Colombia as an example.

57:06 But they’re— the beneficial— if you think about

57:08 who the artists are that’s benefiting from those plays,

57:10 it would be abnormal— in one case,

57:12 for example, where we saw— I’ll give you— I don’t

57:15 know the exact numbers so I’m gonna give you examples here;

57:17 like 12% always in a Hong Kong entity, and 30% in a Canadian entity,

57:22 and 40% in a Middle-Eastern entity,

57:24 and, you know, maybe another 10% somewhere else.

57:27 So, if all the numbers of streams are changing every

57:31 month but the beneficial owner percentage is exactly the same,

57:34 it looks as if someone’s moving money from one

57:38 location to another location through these other entities.

57:42 JACK: So, the moving part is that they’re

57:45 paying bots or listening to a stream… ANDREW: Yeah,

57:48 they’re paying a streaming farm to create the streams whether

57:50 they’re doing it through account takeovers or bots or whatever,

57:52 but the end result is they’ve uploaded as owners under these different

57:56 entities all of these fake artists that have songs on the streaming services.

58:01 There’s roughly a hundred streaming services globally.

58:03 So, they’re uploading it onto all these streaming services and they’re telling

58:07 these streaming farms to go play those songs across all the services.

58:12 JACK: Then the person who owns that account is getting paid for their streams,

58:18 and then the money is arriving to where they need to send it.

58:21 ANDREW: Yeah, exactly, because now the streaming service thinks, oh,

58:24 XYZ label in Hong Kong had X percentage of the total streams.

58:28 We have to pay them out.

58:29 So, it gets paid to the distributor and paid to them, and they just get paid.

58:33 JACK: This is one of those stories that I feel like

58:36 the floor has dropped out in my head, of like, oh yeah,

58:39 we have— I have a good understanding of how money laundering happens

58:44 and how things get sent here and there and how you clean money.

58:47 But then when you hear about stories like this where, oh yeah,

58:50 they’re using a streaming service to launder money and send it across the globe,

58:54 suddenly my head’s like,

58:55 well, you could do that with buying and selling things on the Steam marketplace

59:00 or Roblox accounts or any other marketplace

59:03 that has money shifted here and there.

59:05 This isn’t even a straightforward like— here,

59:07 I’m buying something from another user.

59:09 This is, oh, they’ll pay us for streams.

59:11 If we can get the streams, then we can get paid.

59:15 It’s such a roundabout way of— a convoluted way to launder

59:18 money that it’s blowing my mind and it just makes

59:21 me think that every single place that has money going

59:24 in and out is probably getting hit with something like this.

59:27 ANDREW: 100% agree.

59:28 I think the more convoluted, the better for them,

59:31 ‘cause it’s so much harder for the average

59:33 person to understand how the money moves.

59:34 JACK: ‘Cause I mean, even something like Twitter is— you get

59:37 paid for how much engagement you have, right?

59:40 So, you could totally… ANDREW: Oh, yeah.

59:42 Any of these engagement-based activities, especially in Web3,

59:46 anything at the time— a couple years ago

59:48 there was this big push with treasury tokens.

59:50 So, you’d get paid every time people interacted with you

59:53 on social five platforms or any of these game 5 stuff.

59:57 You could manipulate all of this stuff and then get the tokens,

59:59 take it to market, and sell it.

1:00:01 JACK: It’s crazy to me that there’s a dark web

1:00:03 API that has access to millions of online streaming accounts,

1:00:06 and if you feed it money, you can get all your songs played a bunch.

1:00:12 I bet whoever runs that hates Andrew.

1:00:14 ANDREW: I mean, I’ve had a couple of them

1:00:17 do crazy stuff like reaching out or say things.

1:00:20 But I would say that generally— we were talking once—

1:00:24 our lawyer for the company is this guy named Jim Trustee.

1:00:27 He was the former Chief of Organized Crime for the DOJ.

1:00:31 He told me once that the good news

1:00:33 is they don’t typically shoot the border guards.

1:00:35 It’s kind of a gentleman’s sport.

1:00:37 So, I would say that most of them just

1:00:40 changed their tactics and changed the way they behaved.

1:00:43 I also think the industry has progressed.

1:00:46 In the early days there was some real trepidation or fear around what happens,

1:00:50 ‘cause we’re just a handful of people that know what’s going on here.

1:00:53 I would say now every single streaming

1:00:56 service has a trust and safety department.

1:00:58 Every single stream label has a fraud trust and safety person.

1:01:02 So, the industry has changed over the last three years

1:01:05 in a way that I would say I feel less scared about.

1:01:08 Like, if you did something to me or my co-founders,

1:01:11 it’s not going away at this point.

1:01:13 The cat’s out of the bag.

1:01:14 But I would say there was a real moment in the early 2021,

1:01:18 2022 where we were actually very concerned about what happens if… JACK:

1:01:22 Yeah, I mean, especially if you’ve got cartels

1:01:25 that are moving money in big ways and you’re like,

1:01:28 okay, let’s put a stop to these guys.

1:01:30 I could see them being upset with you.

1:01:32 ANDREW: I mean, that was my concern, but again,

1:01:34 I think we sort of— whether or not it was naive at the time,

1:01:37 it was more like, oh, well, they don’t normally shoot the border guards.

1:01:40 They just find a different way to move the money, you know?

1:01:43 JACK: Do you ever point the feds to someone and be like,

1:01:47 hey, these guys are breaking a lot of laws?

1:01:49 Like, I don’t know, the dark web API or cartels moving money.

1:01:53 We’ve gotta report this to someone more than just the streaming service.

1:01:57 ANDREW: Yeah, in some cases when we find things that are

1:02:00 outside the data that is given to us in privacy,

1:02:03 then sure, we might tell people.

1:02:06 But generally speaking, we report the results back to the streaming

1:02:11 services and then they determine— and the distributors,

1:02:14 for example, and the collection societies, right?

1:02:16 They determine then who to— who they want

1:02:19 to work with on the government’s side to prosecute,

1:02:22 ‘cause that’s typically a long road, three to five years,

1:02:26 sometimes— especially in multiple countries you’ve gotta deal

1:02:28 with Interpol and all kinds of different activities.

1:02:30 So, I think— I would say that’s an area that’s emerging,

1:02:35 but we provide all the evidence that they need,

1:02:37 and then they— and help them package it to whoever agency they’re going to.

1:02:42 But typically they are the ones that are the ones

1:02:45 actually determining whether or not they’re gonna pursue it.

1:02:47 JACK: Okay, I’m now changing my mind.

1:02:49 What Andrew did when he was younger I used to say was black-hat marketing,

1:02:53 but now I’m gonna say he was doing gray-hat marketing.

1:02:56 Aside from the ad arbitrage stuff, all he did was violate the terms of use

1:03:00 on websites like Facebook and YouTube by artificially inflating the numbers.

1:03:04 Coming into this, I would have said that’s black hat, but not now.

1:03:08 Now I think these cartels or terrorist organizations that are

1:03:11 moving hundreds of millions of dollars through these streaming platforms,

1:03:15 that’s black-hat marketing.

1:03:16 That’s some real dark stuff.

1:03:19 Any time these streaming services have to call the authorities on someone,

1:03:23 that’s what I think is black-hat marketing at this point.

1:03:27 I suppose because now that I’ve seen such an extreme side of this marketing,

1:03:32 I’m no longer so judgmental about somebody having a bunch

1:03:35 of fake followers on their account to help them break out.

1:03:39 Because really, the fake followers and algorithm

1:03:41 manipulation can only go so far.

1:03:43 If they’re a bad musician or whatever it is they’re creating,

1:03:46 they’ll never take off no matter how many fake streams they get.

1:03:50 But if they are great and people really love them,

1:03:53 then that was just a growth-hacking technique to kick start their journey.

1:03:56 After they break out, there’s no longer a need for all the fake followers.

1:04:00 You do run the risk of getting banned off those platforms,

1:04:03 so I don’t recommend doing it.

1:04:06 But now that I think about it, banning users is really tricky,

1:04:11 because suppose Twitter has a way to detect when there are fake followers,

1:04:15 right, and they automatically ban someone if they

1:04:17 have— like 60% of their followers are fake.

1:04:20 Well, then imagine someone gets millions of fake followers to follow Elon,

1:04:24 and he gets kicked off for having a majority of fake followers following him.

1:04:27 You see, you can use these bans as a weapon

1:04:30 to get someone else banned that you don’t like.

1:04:33 So, banning users for having a bunch of bots following them is really,

1:04:37 really tricky, and maybe you can’t even do it.

1:04:41 [To Andrew] With all this information you have,

1:04:44 you’ve gotta have probably some sort

1:04:45 of restriction on what you’re allowed to say,

1:04:47 because if there is— you can see who the top artist of the day is.

1:04:51 You have so much data.

1:04:53 You could see how many streams are getting— and all this sort of stuff.

1:04:57 Magazines like— I don’t know Pitchfork,

1:04:59 but whoever is the music industry magazines would love to know who’s

1:05:04 the top streamer of the day or week or month or something like that.

1:05:09 A lot of the stuff is kept quiet.

1:05:11 We get to see some statistics of what— how many downloads a song has,

1:05:16 but we don’t see very much of that.

1:05:20 You could have such an outstanding blog of like,

1:05:23 here’s what’s going on today, and people would just flock to it.

1:05:27 It would be huge, but you’re probably

1:05:28 not allowed to share that kind of information.

1:05:30 ANDREW: It’s our core promise to all of our vendors.

1:05:32 Like, you give us your data; we do not monetize it in that way.

1:05:37 So, we provide you results back

1:05:39 as a true financial tool and a trust-and-safety tool.

1:05:42 We do not monetize it in any kind of marketing, any type of market reports.

1:05:49 We will not monetize the data they provide us.

1:05:51 They pay us an annual service fee so that we

1:05:54 aren’t incentivized to find more fraud than there is.

1:05:56 If there’s not a lot of fraud, we tell them.

1:05:58 If there’s a lot of fraud, we tell them.

1:06:00 We are just the trusted source of truth,

1:06:02 but we do not— we don’t monetize that data in any way.

1:06:05 Yes, we could probably build a massive company,

1:06:07 but I’m not sure they would trust us in the same way.

1:06:09 I think that’s why a lot

1:06:10 of these marketing-level companies that do aggregate data,

1:06:13 they get very limited data sets because they— the biggest fear

1:06:16 for these services is the state of being public or going other places.

1:06:20 So, we are allowed— we are privileged enough to handle it because we’ve

1:06:28 built a large and strong level of trust with all of our partners,

1:06:32 and they know that we would never violate that trust.

1:06:35 JACK: Yeah, at first I was thinking as well of like, oh,

1:06:38 you’re saving all these streaming companies money by saying,

1:06:41 hey, don’t pay these people ‘cause they’re not doing it.

1:06:43 But now— but at the beginning you told me, no,

1:06:46 there’s a big pool and a percentage goes out to whoever gets the streams.

1:06:50 So, I don’t think you’re saving these streaming companies any money

1:06:53 at all because they have to pay out 100% every month or whatever.

1:06:57 ANDREW: Yeah.

1:06:58 JACK: Whether it goes to the right person or the wrong person… ANDREW:

1:07:00 We’re a cost of doing business for them.

1:07:00 JACK: Okay.

1:07:01 ANDREW: We’re a cost of doing business for them.

1:07:04 I would say in some cases they save money.

1:07:06 So, there’s— this is where it gets nuanced.

1:07:08 What I’ve been talking a lot about is what’s called interactive streams,

1:07:11 where people get to choose what song they listen to.

1:07:14 But in cases where it’s non-interactive— think of it like

1:07:16 online radio— they have to pay a set rate out.

1:07:19 There’s a rate card that’s in.

1:07:21 So, when you remove the fraud from those, they actually do save money.

1:07:24 So, in some cases, in some areas they’ll save money,

1:07:28 but I would say generally across the board,

1:07:30 they’re probably not not making money off of us if they’re interactive.

1:07:35 So, if they offer a service where you get to choose

1:07:38 what you listen to, they’re probably not making money off of us.

1:07:41 But they also— if I’m being honest— don’t want

1:07:44 to be the executive who’s blocked for funding terrorism.

1:07:47 So, there is an existential risk.

1:07:50 Also, you figure the major labels are huge victims here.

1:07:56 Keep in mind, if you’re a major label,

1:07:58 you own and distribute probably over 80% of all revenue-generating content.

1:08:01 Not just all content but revenue-generating

1:08:04 content like royalties are coming primarily

1:08:06 from the major labels or the independent labels they distribute as a major.

1:08:10 So, when you look at it as a whole,

1:08:13 if you’re a streaming service and 80% of the things people are listening

1:08:16 to are controlled by these three parties

1:08:18 and they’re saying we’re tired of being victims;

1:08:20 if you do not have a service like this, you cannot have our content,

1:08:23 it moves a lot of needles.

1:08:25 JACK: Wow.

1:08:25 Well, this— so much of this was so illuminating to me.

1:08:29 I did not know about this world much at all.

1:08:31 I told you what I do know, and it was a few things here and there,

1:08:35 but man, there was so much I’ve learned here.

1:08:37 Thanks so much for coming and telling me all this.

1:08:39 ANDREW: Yeah, thanks for having me on.

1:08:41 It’s been really fun.

1:08:42 Again, I appreciate you making the time for me.

1:08:53 (Outro): [Outro music] This show is created by me,

1:08:55 the hashed brown Jack Rhysider.

1:08:56 Our editor is our friendly sysadmin Tristan Ledger,

1:08:58 mixing done by Proximity Sound,

1:09:00 and our intro music is by the mysterious Breakmaster Cylinder.

1:09:02 I don’t know about you, but the next time someone makes fun of me

1:09:06 for the music I listen to, I have the perfect excuse;

1:09:10 oh no, my account’s been hijacked!

1:09:11 It plays random stuff, I swear!

1:09:16 I can’t stand this band.

1:09:20 You kidding me?

1:09:23 This is Darknet Diaries.