Ep.

33 Throwing Bricks for $$$: Violence-as-a-Service Comes of Age

DINA TEMPLE-RASTON: So there’s this thing called SIM swapping.

And at its most basic level, it involves a hacker taking over someone’s mobile phone
number which allows them to steal passwords, take over multi-factor authentication, and
drain crypto currency accounts.

The people who are good at it, literally make millions.

TEMPLE-RASTON:: Do you have like, a plan,when you won't do this anymore, is there a
certain amount of money you'll get to…

YUKI: I think about nine figs.

TEMPLE-RASTON: Really? And how close are you?

YUKI: Really far. Nine figs that's a hundred million dollars, right? That's a few more years at
least.

TEMPLE-RASTON: That’s Yuki, he’s big in the SIM swapping community.

TEMPLE-RASTON: Is it right to think of SIM swappers ss as being younger people or do I

misunderstand that

YUKI: That is very accurate, by the way, a lot of SIM swaps are actually like 13 to like 18.

TEMPLE-RASTON: Yuki is a little older than that.

But most SIM swappers are teenagers, which is a large part of the problem.

If you have a bunch of adolescents – breaking the law, with tons of cash and time to burn.

It isn’t too surprising that things would get a little violent and a little weird.

[MUSIC]

TEMPLE-RASTON: But I’m not sure anyone really expected for it to get this wild:
FADE: I say, what you need done? He says, I just need you to throw a brick through his
window.

GOTTI: Shootings, firebombings….

FROG: I mean the worst one we’ve probably done [LAUGHS]was kidnap someone.

YUKI: And like, if I had to come to it like killings, which has come to that, but I'll speak on
that later.

TEMPLE-RASTON: I’m Dina Temple-Raston and this is Click Here, a podcast about all things
cyber and intelligence.

Today, we talk to the SIM swappers behind a new phenomenon known as

violence-as-a-service.

It’s become the acceptable way to settle scores in the SIM swapper community.

Doxing or defacing websites, they told us, just doesn’t send enough of a message.

They need to go bigger, so they are throwing molotov cocktails or slashing tires of their
rivals instead.

Trouble is – it is getting more popular and commonplace and is bound to affect the rest of
us.

DETECTIVE HALE: I think it's fair to say that it's an issue and it's not going away anytime
soon.

TEMPLE-RASTON: Stay with us.

[BREAK]

TEMPLE-RASTON: The story that brought violence-as-service into the spotlight was the
arrest of a 21-year-old in New Jersey back in August.

His name is Patrick McGovern-Allen and he was pretty well known in SIM Swapping circles.
His alias was Tongue – as in inside your mouth.

And up until recently, he was living with his grandparents in Egg Harbor Township, New
Jersey.

He worked at a local restaurant called A Touch of Italy.

That is until the FBI arrested him this summer, accusing him of taking part in some
violence-as-a-service operations.

Patrick’s arrest was first reported in “Krebs on Security.”

And he appears to be one of the first people to be arrested for this kind of score-settling
cyber-meets-real-world-crime.

Turns out, he’s good friends with this guy.

JOHN GOTTI: I'm John Gotti.

TEMPLE-RASTON: Not that John Gotti.

GOTTI: Uh, it's like my alias. Uh, nobody knows like my real name, obviously. So I'm not
gonna bring that out there

TEMPLE-RASTON: John Gotti is a fellow SIM swapper. And he’s co-owner of a group that’s
dedicated to brickings and other violence-for-hire.

TEMPLE-RASTON: Did you know Patrick McGovern-Allen? His name was Tongue.

GOTTI: I did. I do. I do. I do. That's my boy

TEMPLE-RASTON: Patrick was a member of a SIM swapping group Gotti founded called FNM.

Gotti showed us a screenshot of its ownership page to prove he really was who he said he
was.

TEMPLE-RASTON: Did you know him only virtually or did you know him, know him?
GOTTI: Um, It is possible that we've encountered each other two or three times IRL.

TEMPLE-RASTON: Okay. And what was he like?

GOTTI: He was a chill dude. Uh, I don't, I don't really know how to explain the guy. He was,
he was a bit off, but he was, he was a chill dude. He was honorable

TEMPLE-RASTON: meaning if he said he was gonna do something, he did it.

GOTTI: Yeah.

TEMPLE-RASTON: But SIM swappers we talked to told us Patrick was a little bit reckless.

Like the time two years ago that he drove his Lexus into a building.

DTR: He did drive a car into a house.

GOTTI: He did, he did. it is what it is. Some people do things sometimes without meaning to,
you know, accidents happen.

FADE: I mean, he crashed the car into a building for no reason just cause he felt like it.

TEMPLE-RASTON: This is a SIM swapper who goes by the name Fade.

He knew Patrick too.

FADE: I knew him for a while. We weren't like super close or whatever, but I knew him.
He had like a few brain cells missing, but that’s about it,

TEMPLE-RASTON: Fade told us Patrick was so reckless, he wasn’t surprised when the FBI
rolled up on him back in August.

He said everyone in the community was expecting him to get arrested.

FADE: It's like a family, everyone knows what's going on.

TEMPLE-RASTON: Patrick is suspected of taking part in two separate violence-as-a-service
jobs in Pennsylvania.

A firebombing and then a shooting a few weeks later.

FADE: I mean, every one of Patrick's friends knew he was gonna get arrested. Patrick knew
himself He was gonna get arrested. I mean, you know, it, weren't no secret, but Patrick
didn't have much choice.

TEMPLE-RASTON: The criminal complaint against Patrick made clear that his operational
security wasn’t top notch.

For one thing, he put the proof videos of the shooting on both Discord – a kind of
messaging platform for gamers and on Telegram – an encrypted communications app.

This is one of the videos he posted.

[SOUND FROM VIDEO]

DETECTIVE HALE: It looks like there's two males wearing all black face masks.

TEMPLE-RASTON: This is Detective David Hale. He is with the Criminal Investigations Unit in
the Westtown East Goshen Police Department.

He’s one of the investigators in the case and this is him describing a proof video Patrick is
allegedly linked to.

HALE: An individual flashes, a handgun, uh, semi automatic pistol, um, he walks up to the
front window. He's probably about 20 feet away from the window. And then unloads eight
consecutive shots within, you know, a second or two.

VIDEO: You ready? Mhm. Justin Active was here.

TEMPLE-RASTON: And they shout something. See if you can make out what they say.

VIDEO: [GUNSHOTS] Justin Active was here!

TEMPLE-RASTON: They are saying Justin Active was here.

Justin OR ActivE is another SIM swapper in the community.

We talked to him by text and he said Patrick was targeting him.

In the criminal complaint against Patrick, the FBI said the shooter was wearing an Air
Jordan Hoodie, a dark balaclava, and semi-rimless glasses.

Patrick, the FBI says in the complaint, wears dark semi-rimless glasses, just like the guy in
the video.

The firebombing — which had happened a few weeks earlier — wasn’t exactly stealth either.

The video shows two suspects in front of the house.

One is wearing a red and black lumberjack shirt.

The camera focuses on a bottle of Mad Dog 20/20 grape wine.

It’s stuffed with a cloth fuse and they are trying to light it

VIDEO: Light it, light it.

TEMPLE-RASTON: Light it, light it, they say.

The Molotov cocktail bounces off the window frame and sets the front of the house on fire.

The video shows them starting to run and then it ends abruptly.

According to the FBI, the people inside the house called 911 and said that something was
thrown at the house just before a fire started.

They told the police that they heard male voices outside, and there was some laughing just
before they heard a loud noise and smelled smoke.

That video was posted on Discord too.

Discord’s trust and safety department found chats from someone named Tongue that
seemed to be taking responsibility for both operations.

They gave those to the FBI.

Details about those are in the criminal complaint against Patrick too.

And now he’s sitting in a Pennsylvania prison awaiting trial accused of being one of the
early adopters of violence-as-a-service.

We tried to reach out to Patrick but couldn’t get a response from the Bureau of Prisons by
press time.

When we come back, violence-as-a-service operations get organized.

YUKI: If you were even like around on that community, you would hear about a lot of people
getting bricked, their houses shot up.

TEMPLE-RASTON: Stay with us.

[BREAK]

YUKI : Pat was an idiot.

TEMPLE-RASTON: This is Yuki again, and by Pat he means Patrick McGovern-Allen, the guy
we were talking about before.

YUKI: He got caught and that doesn't happen to people who are smart and.

TEMPLE-RASTON: And careful.

YUKI: And careful. Yeah. I mean, you can be reckless and you can be smart and nothing will
happen, but he was just reckless and didn't care about any of it.

[MUSIC]

TEMPLE-RASTON: Yuki made violence-as-a-service more professional by creating an online

marketplace that solitics and offers up people willing to commit real life violent crime
He calls it BrickSquad and he says this is the first time he’s spoken to the press about it.

YUKI: BRICKSQUAD is the front lines. You can order to throw a Molotov at their house. Get
their house, like shot up, even get the person who's in the house robbed, you know, just a
bunch of other things.

YUKI: I started it as a side project and it's more like a supply to demand type of thing. You
know, like people really want to get back at their enemies online. So I just decided to hop in
on it and be like, you know, why not? Like, why not?

TEMPLE-RASTON: Well, there are lots of reasons why not.

As if to show just how open violence-as-a-service is becoming, Yuki set up a new website to
publicize BrickSquad last week.

And I went online to take a look at it, and the website actually is pretty basic:

It has Black background, red type, three simple columns.

The heading on the first reads: “weapon,” and it is followed by a short list: brick, molotov,
shooting, robbery, custom.

The second column has corresponding prices: two grand for a molotov, four for a shooting.

A link in the third column allows you to go ahead and order – though Yuki said Bricksquad
doesn’t really do its IRL business there.

YUKI: I only put up the website because I wanted to, you know, redirect people to the
telegram, add more attention to it, more accessibility, you know

TEMPLE-RASTON: Their Telegram channel doesn’t leave much to the imagination.

They offer a kind of match.com of violence: they put people together.

One ad asks if anyone can be in Sydney’s Hyde Park: Anyone who can be here on Sept 8th
around midday and wants to make a thousand dollars, DM me, it reads.
Houston, Florida, reads another, wanna brick a window for $500, let me know.

YUKI: Well, the prices actually vary. Normally the starting price would go like $5,000 to
shoot up a house, but not hurt anyone.

TEMPLE-RASTON: BrickSquad facilitates things.

They get the address, the instructions, and then hold money in escrow until the deed is
done.

BrickSquad typically acts as a middle man though sometimes, if a job is local, they will go
ahead and do it themselves.

This is a bricking video that Yuki appears to be in…

[SOUND FROM VIDEO]

TEMPLE-RASTON: When BrickSquad just facilitates a job, they take a cut for their trouble.

If this feels like something out of GoodFellas, there’s a good reason why.

All these brickings and arson and drivebys don’t exist in a vacuum.

They’re motivated by the same things that motivate most criminals in the real world: big
money and power, and striking fear in the hearts of anyone who crosses you.

YUKI: It's all business. If you wanna steal someone's money, there's a lot of consequences
from that.

TEMPLE-RASTON: You cross a guy in the SIM swapping community, he’ll hire someone to
make your life miserable.

And this may seem reminiscent of something that was popular about ten years ago.

Something called Swatting.

ABC NEWS: An apparent hoax had a home in Sarasota surrounded. Nearly three dozen
personnel responded to a situation thinking that a teenager killed his own family and then
threatened to blow up his home…

TEMPLE-RASTON: Young kids would call emergency services and get the police to send
SWAT teams to somebody’s house.

Just to intimidate and harass someone they didn’t like and it got people killed.

Detective Hale of the Goshen police department says violence-as-a-service is what swatting
has become.

HALE: I think swatting is becoming kind of old hat and now they're stepping it up to make it
a little bit more serious

[MUSIC]

TEMPLE-RASTON: In one sense, you could think of this as a thing that only affects cyber
criminals. Bad people doing bad things to other bad people.

But that’d be naive.

Once this violence moves into the real world and you’ve got people throwing bricks at a
house, it’s no longer just inside the SIM swapping community – no matter what Yuki and
Fade and Gotti say.

13 to 18 years old SIM swappers who have made a lot of money as underage cyber
criminals are the people who are ordering up these jobs.

And it wouldn’t be a stretch to think they’re probably living with their parents.

And their parents probably have no idea that their kids are somehow involved in this thing
called SIM swapping.

Detective Hale says families become casualties too.

HALE: So it, it it's almost laughable that these people literally live in their parents'
basements and they're 19 20, 21, 22 years old. It's like the cliche. Right? And a lot of the
parents can't stand the fact that their kids live in their basements, cuz they are getting their
doors kicked in. Routinely. I mean, we, we, we had an individual who lived in our town that
she was swatted probably at least a half a dozen times over the course of a year. Um, other
individuals on the other receiving end, it's almost a weekly occurrence.

TEMPLE-RASTON: What makes this so hard to control is that most of the people throwing
bricks or shooting up a house are minors.

HALE: It's a criminal mischief, right. You know, it's a kid breaking a window. Guilty. I've done
it when I was a kid, you know, throwing an egg on mischief night.

TEMPLE-RASTON: But this is about more than mischief or punking someone you don’t like.

HALE: The intent behind it is a little bit more malice based. We're looking at a lot of people
beginning in their mid teens and it goes up until 20 21, 22.

TEMPLE-RASTON: Patrick was in his twenties, so prosecutors could try to get him on federal
charges.

The FBI is unlikely to charge a minor for throwing a brick.

So there is an aspect of invincibility that goes along with this and that could explain why it is
getting bigger and more commonplace.

HALE: Anything with minors complicates cuz adds an additional layer. Um, when it comes to
involving parents, it's kinda like bury your head in the sand situation, like not my daughter,
not my son. So you have to kind of get over that obstacle first.

TEMPLE-RASTON: And soon it won’t just be BrickSquad setting up a website that makes it
easier for people to order up a job.

Others will innovate too.

This isn’t just a phase and there appears to be no remorse about what they’re doing.

When we asked about that, to a man they said, hey, this is just part of the business.
Which means it is all escalating in such a way that even SIM swappers like Yuki are starting
to take unusual precautions.

YUKI: Okay, the thing is, I'm gonna tell you, I don't actually have a phone because, well,
yeah, I don't have a phone.

TEMPLE-RASTON: Is that because you know how easy it is to SIM swap?

YUKI: No comment.

This is Click Here.

TEMPLE-RASTON: And on the subject of young hackers, the ride-share giant Uber confirmed
last week that it was on the receiving end of a cybersecurity incident and allegedly a single
18-year-old hacker said he was responsible for the attack. He allegedly told a roster of cyber
security researchers how he did it. And then the hacker posted messages in Uber’s Slack
channel and listed some Uber databases and cloud services that he’d breached. He
allegedly ended his dispatch with the words “uberunderpaysdrives.”

TEMPLE-RASTON: The company later confirmed that it had been breached by a rather
infamous teenaged extortion group. They’re called Lapsus$. And they are thought to be an
underage hacker group mostly out of the UK.

Uber says it is working with the FBI and has “no evidence that the incident involved access
to sensitive user data (like trip history).” Screenshots leaked by the attacker, though,
suggest that Uber's systems may have been more deeply and thoroughly compromised
than first thought.

TEMPLE-RASTON: Gaming giant Rockstar – of Grand Theft Auto fame – confirmed on

Monday that a hacker broke into its systems and stole confidential internal data, including
footage from the next highly-anticipated installment of the Grand Theft series.

TEMPLE-RASTON: In statements posted to social media, Rockstar Games said it suffered a

network intrusion that allowed someone to access and download “confidential information
from our systems, including early development footage for the next Grand Theft Auto.”

TEMPLE-RASTON: And finally, the White House released guidance last week on how federal
agencies are to create a full inventory of the third-party software they use.
They have 90 days to provide the information to OMB. The rules do not apply to software
developed in-house. One of the core principles of the guidance is to figure out if third-party
software used best practices to develop their software.

TEMPLE-RASTON: Click Here is a production of The Record by Recorded Future. I’m Dina
Temple-Raston, your host, writer, and executive producer. Sean Powers is our senior
producer and marketing director, and Will Jarvis is our producer and helps with the writing.
Karen Duffin and Lu Olkowski are our editors. Darren Akron is our fact checker, and Ben
Levingston composes our original music, and other music is from Blue Dot Sessions. Kendra
Hanna is our intern.

And we want to hear from you. Please leave us a review and rating wherever you get your
podcasts. And you can connect with us at “ClickHereShow dot com.”

We’ll be back on Tuesday.