1 00:00:00,410 --> 00:00:03,490 [Music] 2 00:00:06,000 --> 00:00:08,960 hello everyone I'm Vince Kenny and this 3 00:00:08,960 --> 00:00:13,400 is a presentation titled cyber crime 4 00:00:13,400 --> 00:00:16,160 Incorporated so a little bit about 5 00:00:16,160 --> 00:00:18,640 myself I'm a computer scientist with the 6 00:00:18,640 --> 00:00:21,199 Salt Lake City division of the FBI I've 7 00:00:21,199 --> 00:00:25,439 been there for about eight years now and 8 00:00:25,439 --> 00:00:27,359 over that span of time i' I've really 9 00:00:27,359 --> 00:00:30,279 seen this this ecosystem of cyber crime 10 00:00:30,279 --> 00:00:32,640 really grow an awful lot and and we'll 11 00:00:32,640 --> 00:00:34,320 talk a little bit more about that 12 00:00:34,320 --> 00:00:36,920 throughout this presentation but um it's 13 00:00:36,920 --> 00:00:38,760 always really exciting to come to St con 14 00:00:38,760 --> 00:00:40,160 this is my third time presenting here at 15 00:00:40,160 --> 00:00:42,800 St con um this I I've attended this 16 00:00:42,800 --> 00:00:45,480 since 2015 so it's really great and I'm 17 00:00:45,480 --> 00:00:47,840 and I'm excited to be back 18 00:00:47,840 --> 00:00:50,680 again all right let's dive into it so 19 00:00:50,680 --> 00:00:53,280 the role of cyber security in the 20 00:00:53,280 --> 00:00:56,399 federal government um if I you know if 21 00:00:56,399 --> 00:00:58,199 you think of sort of the breakdown and 22 00:00:58,199 --> 00:00:59,680 the make of it there's kind of three 23 00:00:59,680 --> 00:01:02,079 different different chunks so to speak 24 00:01:02,079 --> 00:01:05,799 there is the DHS there is the doj and 25 00:01:05,799 --> 00:01:09,040 there is the dod and the way I kind of 26 00:01:09,040 --> 00:01:11,479 analyze it is if you think of cyber 27 00:01:11,479 --> 00:01:13,840 crime or a cyber incident is kind of 28 00:01:13,840 --> 00:01:17,200 like a fire uh the DHS they are sort of 29 00:01:17,200 --> 00:01:19,240 like the fire department their their job 30 00:01:19,240 --> 00:01:21,720 is to not only help put out the fire but 31 00:01:21,720 --> 00:01:23,759 they actually set up the the fire safety 32 00:01:23,759 --> 00:01:25,439 codes and they they will work with 33 00:01:25,439 --> 00:01:27,119 companies to try and prevent the fire 34 00:01:27,119 --> 00:01:29,320 from being started but also be there to 35 00:01:29,320 --> 00:01:32,119 help uh remediate sort of that 36 00:01:32,119 --> 00:01:35,360 fire uh while the doj well if there's a 37 00:01:35,360 --> 00:01:37,520 fire that's been started often times we 38 00:01:37,520 --> 00:01:39,759 come in is as the police because we're 39 00:01:39,759 --> 00:01:41,840 looking for the arson who started that 40 00:01:41,840 --> 00:01:43,840 fire so we come in and we collect 41 00:01:43,840 --> 00:01:46,040 evidence and we try and Target that 42 00:01:46,040 --> 00:01:49,000 arson that bad guy that started the fire 43 00:01:49,000 --> 00:01:50,880 and then the dod well that's the 44 00:01:50,880 --> 00:01:54,159 military so if the fire was started by a 45 00:01:54,159 --> 00:01:56,920 missile from another another country 46 00:01:56,920 --> 00:01:58,200 well the military is going to get 47 00:01:58,200 --> 00:02:00,280 involved and uh and that's that's the 48 00:02:00,280 --> 00:02:01,799 piece that they'll focus on is that 49 00:02:01,799 --> 00:02:03,560 foreign 50 00:02:03,560 --> 00:02:07,119 influence as far as the makeup of a u 51 00:02:07,119 --> 00:02:09,919 FBI cyber task force there are actually 52 00:02:09,919 --> 00:02:11,720 a lot of different positions that go 53 00:02:11,720 --> 00:02:14,560 into a task force itself obviously there 54 00:02:14,560 --> 00:02:16,920 are special agents they are the the case 55 00:02:16,920 --> 00:02:19,239 leads they manage the cases they work 56 00:02:19,239 --> 00:02:21,200 with the victims and they're ultimately 57 00:02:21,200 --> 00:02:22,959 the guys who are you know tightening the 58 00:02:22,959 --> 00:02:24,800 screws on on the bad guys to try and 59 00:02:24,800 --> 00:02:27,480 arrest them and uh and put charges on 60 00:02:27,480 --> 00:02:30,360 them there are also task force offic ERS 61 00:02:30,360 --> 00:02:32,800 so we work with a lot of local Partners 62 00:02:32,800 --> 00:02:35,000 who uh are really effective at being 63 00:02:35,000 --> 00:02:37,040 able to go after different things that 64 00:02:37,040 --> 00:02:39,000 might be cumbersome at the federal level 65 00:02:39,000 --> 00:02:40,599 we'll leverage that that local 66 00:02:40,599 --> 00:02:42,720 partnership there are also intelligence 67 00:02:42,720 --> 00:02:45,200 analysts so their job is to sort of see 68 00:02:45,200 --> 00:02:46,720 the bigger picture and connect the 69 00:02:46,720 --> 00:02:48,280 different dots and then there are a 70 00:02:48,280 --> 00:02:49,959 handful of different sort of technical 71 00:02:49,959 --> 00:02:52,480 analysis roles whether it be a computer 72 00:02:52,480 --> 00:02:54,879 scientist a data analyst a digital 73 00:02:54,879 --> 00:02:57,000 operation specialist staff operation 74 00:02:57,000 --> 00:02:59,040 Specialist or an operation support 75 00:02:59,040 --> 00:03:00,680 technician 76 00:03:00,680 --> 00:03:03,200 so as I mentioned we rely very very 77 00:03:03,200 --> 00:03:06,840 heavily on Partnerships so we not only 78 00:03:06,840 --> 00:03:08,680 operate as sort of a federal entity but 79 00:03:08,680 --> 00:03:10,720 we also have a number of folks from the 80 00:03:10,720 --> 00:03:12,799 Utah Department of Public Safety that 81 00:03:12,799 --> 00:03:14,560 work with us and they're incredibly 82 00:03:14,560 --> 00:03:17,319 valuable members to that cyber Squad um 83 00:03:17,319 --> 00:03:20,080 but we're also always constantly growing 84 00:03:20,080 --> 00:03:22,239 uh Salt Lake City in general works with 85 00:03:22,239 --> 00:03:24,360 a lot of local and state Partners but 86 00:03:24,360 --> 00:03:26,080 different divisions uh around the 87 00:03:26,080 --> 00:03:27,959 country they might be working with Air 88 00:03:27,959 --> 00:03:29,920 Force OSI they might be working with 89 00:03:29,920 --> 00:03:32,640 different types of federal 90 00:03:32,640 --> 00:03:35,799 entities and the FBI's cyber criminal 91 00:03:35,799 --> 00:03:38,200 Focus so a cyber squad's kind of split 92 00:03:38,200 --> 00:03:40,040 up into two different veins it has the 93 00:03:40,040 --> 00:03:42,280 Cyber National Security track which is 94 00:03:42,280 --> 00:03:44,760 FOC focused primarily on nation states 95 00:03:44,760 --> 00:03:47,280 that are doing the attacks but then also 96 00:03:47,280 --> 00:03:50,400 this the um the FBI has the sort of the 97 00:03:50,400 --> 00:03:52,480 criminal Focus which is just general 98 00:03:52,480 --> 00:03:54,720 criminal actors that are trying to uh 99 00:03:54,720 --> 00:03:56,799 commit these cyber crimes and in 100 00:03:56,799 --> 00:03:58,560 particular really over the past couple 101 00:03:58,560 --> 00:04:01,159 of years uh the FBI has tried very very 102 00:04:01,159 --> 00:04:03,920 hard to focus on identifying those 103 00:04:03,920 --> 00:04:07,159 Supply chains and identifying disrupting 104 00:04:07,159 --> 00:04:09,560 those different key services that make 105 00:04:09,560 --> 00:04:12,720 that ecosyst ecosystem run so you may 106 00:04:12,720 --> 00:04:15,640 have seen some kind of high high-profile 107 00:04:15,640 --> 00:04:18,160 cyber uh cases that have come out in the 108 00:04:18,160 --> 00:04:20,000 news whether that be the quack bot 109 00:04:20,000 --> 00:04:22,720 botnet or the Genesis Marketplace or 110 00:04:22,720 --> 00:04:24,320 various other different ransomware 111 00:04:24,320 --> 00:04:26,880 campaigns often times those different 112 00:04:26,880 --> 00:04:28,960 pieces sort of play a role in this 113 00:04:28,960 --> 00:04:31,400 ecosystem 114 00:04:31,400 --> 00:04:33,320 okay so for without further Ado we will 115 00:04:33,320 --> 00:04:36,039 go ahead and pivot into the main topic 116 00:04:36,039 --> 00:04:39,160 of this discussion which is organized 117 00:04:39,160 --> 00:04:41,560 crime um at the end of the day this 118 00:04:41,560 --> 00:04:44,039 presentation is to kind of just show a 119 00:04:44,039 --> 00:04:46,639 lot of the similarities that go into 120 00:04:46,639 --> 00:04:48,639 organized crime in general whether you 121 00:04:48,639 --> 00:04:51,800 are dealing with cocaine industry or or 122 00:04:51,800 --> 00:04:54,039 or um cartels that that sort of deal 123 00:04:54,039 --> 00:04:56,919 with drugs or cyber criminals and in 124 00:04:56,919 --> 00:04:58,880 particular I'm going to be talking about 125 00:04:58,880 --> 00:05:02,199 two uh very interesting uh cyber or 126 00:05:02,199 --> 00:05:04,800 rather criminal Enterprises that is the 127 00:05:04,800 --> 00:05:08,520 Cali cartel of the 1980s and the 1990s 128 00:05:08,520 --> 00:05:12,680 and the Conti group of the 129 00:05:13,960 --> 00:05:16,320 2020s all right so let's start with a 130 00:05:16,320 --> 00:05:20,160 Cal uh C cartel so full disclaimer uh 131 00:05:20,160 --> 00:05:22,759 probably half of my research on C cartel 132 00:05:22,759 --> 00:05:24,960 came from that Netflix series narcos so 133 00:05:24,960 --> 00:05:27,960 if you really want a very very detailed 134 00:05:27,960 --> 00:05:30,919 very good analysis of the C cartel I 135 00:05:30,919 --> 00:05:32,639 would definitely recommend watching that 136 00:05:32,639 --> 00:05:35,120 series but just kind of a general 137 00:05:35,120 --> 00:05:38,440 introduction um the C cartel often times 138 00:05:38,440 --> 00:05:40,960 the leadership would call themselves The 139 00:05:40,960 --> 00:05:44,280 Los caberos D Cali so the gentleman of C 140 00:05:44,280 --> 00:05:46,840 uh of Cali and that's because they kind 141 00:05:46,840 --> 00:05:49,240 of operated more like businessmen rather 142 00:05:49,240 --> 00:05:52,600 than street thugs and um that was 143 00:05:52,600 --> 00:05:55,360 comprised of uh the Rodriguez Brothers 144 00:05:55,360 --> 00:05:56,880 and the Santa Cruz 145 00:05:56,880 --> 00:05:59,520 family so their foundations well 146 00:05:59,520 --> 00:06:01,479 actually kind of how they got their seed 147 00:06:01,479 --> 00:06:04,120 money in a way is They carried out a 148 00:06:04,120 --> 00:06:06,280 rather high-profile criminal kidnapping 149 00:06:06,280 --> 00:06:09,280 called Las chus which was basically the 150 00:06:09,280 --> 00:06:14,080 kidnapping of um of an individual out of 151 00:06:14,080 --> 00:06:16,440 Switzerland uh and and they were able to 152 00:06:16,440 --> 00:06:18,360 Ransom this individual for 153 00:06:18,360 --> 00:06:21,360 $700,000 so that was their seed money to 154 00:06:21,360 --> 00:06:23,599 get their their Enterprise uh up and 155 00:06:23,599 --> 00:06:25,479 running and then they shifted very 156 00:06:25,479 --> 00:06:26,960 quickly into the drug trafficking 157 00:06:26,960 --> 00:06:29,520 business because obviously that business 158 00:06:29,520 --> 00:06:32,199 had a much higher profit margin and and 159 00:06:32,199 --> 00:06:34,639 they could really put those skills of 160 00:06:34,639 --> 00:06:36,880 running businesses uh in place to this 161 00:06:36,880 --> 00:06:38,919 drug trafficking business and then 162 00:06:38,919 --> 00:06:41,000 another very key component of the Cali 163 00:06:41,000 --> 00:06:43,800 cartel is their expansion into the US 164 00:06:43,800 --> 00:06:45,759 and in particular they were the kings of 165 00:06:45,759 --> 00:06:48,720 New York City so back in the the 70s and 166 00:06:48,720 --> 00:06:50,960 80s Miami was kind of the big hub for a 167 00:06:50,960 --> 00:06:53,039 lot of these these cartels where they 168 00:06:53,039 --> 00:06:55,280 would funnel drugs in and and things 169 00:06:55,280 --> 00:06:57,440 like that but C actually targeted New 170 00:06:57,440 --> 00:07:00,000 York City primarily to try and um 171 00:07:00,000 --> 00:07:04,599 facilitate that uh that type of business 172 00:07:04,840 --> 00:07:07,800 there okay so now let's pivot over to 173 00:07:07,800 --> 00:07:11,360 the cony group so similar in nature it's 174 00:07:11,360 --> 00:07:13,639 these individuals sort of a band of 175 00:07:13,639 --> 00:07:15,960 individuals who sort of came together 176 00:07:15,960 --> 00:07:17,919 and formed more or less this kti 177 00:07:17,919 --> 00:07:20,680 ransomware group so a number of these 178 00:07:20,680 --> 00:07:22,759 individuals came from different types of 179 00:07:22,759 --> 00:07:24,680 ransomware groups Beyond these two that 180 00:07:24,680 --> 00:07:27,000 I'm just sort of talking about but two 181 00:07:27,000 --> 00:07:29,360 very important ones that were uh connect 182 00:07:29,360 --> 00:07:31,800 Ed with the cony group or an evolution 183 00:07:31,800 --> 00:07:34,440 uh into the cony group are wizard spider 184 00:07:34,440 --> 00:07:37,160 so you might recognize that threat actor 185 00:07:37,160 --> 00:07:39,360 handle as the ones responsible for the 186 00:07:39,360 --> 00:07:42,039 trickbot botnet um and the trickbot 187 00:07:42,039 --> 00:07:44,639 malware distribution so that's you know 188 00:07:44,639 --> 00:07:46,240 more or less a group that is not 189 00:07:46,240 --> 00:07:48,120 necessarily doing ransomware but they 190 00:07:48,120 --> 00:07:50,120 are infecting various different 191 00:07:50,120 --> 00:07:52,599 computers around the world that is sort 192 00:07:52,599 --> 00:07:54,879 of the seed in the start uh of a 193 00:07:54,879 --> 00:07:57,599 ransomware campaign and then the second 194 00:07:57,599 --> 00:08:00,199 is the ryuk ransomware campaign so this 195 00:08:00,199 --> 00:08:02,840 is a campaign that started in early 196 00:08:02,840 --> 00:08:06,000 August 2018 and it's operated by Russian 197 00:08:06,000 --> 00:08:08,440 speaking individuals and so that evolved 198 00:08:08,440 --> 00:08:10,960 into the KY 199 00:08:10,960 --> 00:08:13,080 group okay so let's go ahead and talk a 200 00:08:13,080 --> 00:08:14,720 little bit about organizational 201 00:08:14,720 --> 00:08:17,400 structure so one of the things that was 202 00:08:17,400 --> 00:08:19,440 really interesting to sort of read and 203 00:08:19,440 --> 00:08:21,759 analyze about this Cony group is is they 204 00:08:21,759 --> 00:08:23,599 they went all out to structure their 205 00:08:23,599 --> 00:08:26,599 organization like a Fortune 500 company 206 00:08:26,599 --> 00:08:28,280 they did a whole bunch of work 207 00:08:28,280 --> 00:08:30,319 organizing their lead leadership that 208 00:08:30,319 --> 00:08:32,519 flowed down to the cocaine production 209 00:08:32,519 --> 00:08:34,279 that flowed down to the transportation 210 00:08:34,279 --> 00:08:36,679 and distribution and one of the things 211 00:08:36,679 --> 00:08:38,760 that kie was exceptionally good at was 212 00:08:38,760 --> 00:08:41,000 the money laundering component cuz these 213 00:08:41,000 --> 00:08:43,200 guys weren't from the streets they were 214 00:08:43,200 --> 00:08:45,519 from accounting backgrounds law 215 00:08:45,519 --> 00:08:47,320 backgrounds business backgrounds 216 00:08:47,320 --> 00:08:49,279 effectively so they did a really good 217 00:08:49,279 --> 00:08:51,920 job of money laundering and of course 218 00:08:51,920 --> 00:08:54,680 they also used their influence uh with 219 00:08:54,680 --> 00:08:56,440 all the money that they' received to be 220 00:08:56,440 --> 00:08:58,920 able to get the adequate security and 221 00:08:58,920 --> 00:09:00,880 also Al use corruption as a means to 222 00:09:00,880 --> 00:09:03,720 sort of facilitate their 223 00:09:03,720 --> 00:09:05,560 business now when we look at the 224 00:09:05,560 --> 00:09:08,120 formation of the kti group essentially 225 00:09:08,120 --> 00:09:10,800 kti is kind of this band of people that 226 00:09:10,800 --> 00:09:13,920 have sort of learned as time has gone on 227 00:09:13,920 --> 00:09:16,000 so a number of the individuals that sort 228 00:09:16,000 --> 00:09:18,680 of join the kti group cut their teeth so 229 00:09:18,680 --> 00:09:21,320 to speak just doing sort of the script 230 00:09:21,320 --> 00:09:23,200 kidding type of stuff and it's an 231 00:09:23,200 --> 00:09:25,920 evolved eventually over time into more 232 00:09:25,920 --> 00:09:27,800 and more and more sophisticated kind of 233 00:09:27,800 --> 00:09:30,680 attacks but in particular Ki was a 234 00:09:30,680 --> 00:09:33,760 business they had an HR department they 235 00:09:33,760 --> 00:09:36,079 had all different types of departments 236 00:09:36,079 --> 00:09:38,160 that you would see in a normal business 237 00:09:38,160 --> 00:09:40,720 in fact actually uh some thing that was 238 00:09:40,720 --> 00:09:42,040 kind of interesting that I read out of 239 00:09:42,040 --> 00:09:44,040 the kti leaks was some of the 240 00:09:44,040 --> 00:09:46,440 individuals kind of explained H my job's 241 00:09:46,440 --> 00:09:48,160 kind of boring it's it's sort of your 242 00:09:48,160 --> 00:09:50,680 typical cyber security job um that's 243 00:09:50,680 --> 00:09:52,040 what a number of these individuals just 244 00:09:52,040 --> 00:09:54,560 sort of felt they had a little piece uh 245 00:09:54,560 --> 00:09:56,440 in their cyber security 246 00:09:56,440 --> 00:09:59,160 Enterprise but this was comprised of 247 00:09:59,160 --> 00:10:00,519 various different types of technical 248 00:10:00,519 --> 00:10:03,640 positions whether it be a coder a tester 249 00:10:03,640 --> 00:10:08,000 an administrator a reverse engineer or a 250 00:10:08,360 --> 00:10:11,600 pentester now any good organization has 251 00:10:11,600 --> 00:10:14,680 a strong or a unique leader and so in 252 00:10:14,680 --> 00:10:16,720 the Kali cartel the leader was an 253 00:10:16,720 --> 00:10:19,720 individual named herberto Rodriguez and 254 00:10:19,720 --> 00:10:22,800 so herberto Rodriguez uh was a lawyer 255 00:10:22,800 --> 00:10:24,959 and he was very well known for his 256 00:10:24,959 --> 00:10:27,959 strategic uh Acumen uh in maintain and 257 00:10:27,959 --> 00:10:30,720 the ability to maintain low profile so 258 00:10:30,720 --> 00:10:32,120 that was kind of one of the fundamental 259 00:10:32,120 --> 00:10:35,279 difference from Pablo Escobar who 260 00:10:35,279 --> 00:10:37,519 maintained a really high profile is 261 00:10:37,519 --> 00:10:39,680 herberto really focused on trying to 262 00:10:39,680 --> 00:10:42,240 maintain a low profile and his nickname 263 00:10:42,240 --> 00:10:44,320 was the chess player he was always 264 00:10:44,320 --> 00:10:46,839 trying to think one or two moves ahead 265 00:10:46,839 --> 00:10:49,560 uh of his competition of the government 266 00:10:49,560 --> 00:10:53,160 of the US of his customers uh so he's 267 00:10:53,160 --> 00:10:55,040 played a very Central role in in 268 00:10:55,040 --> 00:10:57,440 organizing the structure of the Cali 269 00:10:57,440 --> 00:11:00,320 cartel and played a very Central role in 270 00:11:00,320 --> 00:11:02,200 trying to facilitate some of that drug 271 00:11:02,200 --> 00:11:06,079 money into legitimate businesses into 272 00:11:06,079 --> 00:11:09,079 Colombia now kti leadership like I said 273 00:11:09,079 --> 00:11:11,680 it takes a strong head on that snake to 274 00:11:11,680 --> 00:11:13,480 be able to make that leadership or make 275 00:11:13,480 --> 00:11:15,440 that organization work and their 276 00:11:15,440 --> 00:11:17,440 leadership was run by an individual 277 00:11:17,440 --> 00:11:21,079 monikered Stern so stern was uh was a 278 00:11:21,079 --> 00:11:24,200 well-known uh Russian cyber criminal uh 279 00:11:24,200 --> 00:11:26,920 also known as demon uh and he was very 280 00:11:26,920 --> 00:11:29,760 very very skilled uh in EXP experienced 281 00:11:29,760 --> 00:11:32,440 in in um you know cyber criminal types 282 00:11:32,440 --> 00:11:35,399 of campaigns so little is known publicly 283 00:11:35,399 --> 00:11:37,760 about uh Stern but it's believed that 284 00:11:37,760 --> 00:11:39,720 he's uh kind of in his early 30s and 285 00:11:39,720 --> 00:11:43,040 he's based out of Russia and so at the 286 00:11:43,040 --> 00:11:45,800 end of the day you know stern was was 287 00:11:45,800 --> 00:11:48,399 pretty well known as being a 288 00:11:48,399 --> 00:11:51,079 micromanager he he he would do as much 289 00:11:51,079 --> 00:11:54,200 as possible to really try to drill in 290 00:11:54,200 --> 00:11:56,240 and make sure that those campaigns were 291 00:11:56,240 --> 00:11:58,680 on time on budget and actually had a 292 00:11:58,680 --> 00:12:00,120 profit margin so that they would 293 00:12:00,120 --> 00:12:03,000 continue to sort of repeat that process 294 00:12:03,000 --> 00:12:05,240 and stern was pretty ruthless he you 295 00:12:05,240 --> 00:12:07,920 know I think really it goes to show that 296 00:12:07,920 --> 00:12:10,160 if you have a kind of a soft leader it 297 00:12:10,160 --> 00:12:12,959 will sort of flow down to uh softness on 298 00:12:12,959 --> 00:12:15,399 the ransomware campaign but Stern Stern 299 00:12:15,399 --> 00:12:17,839 really implemented a lot of very very uh 300 00:12:17,839 --> 00:12:21,880 malicious and and um and um you know 301 00:12:21,880 --> 00:12:23,680 tenacious type of attitude in his 302 00:12:23,680 --> 00:12:27,000 organized crime um 303 00:12:27,000 --> 00:12:29,040 organization then the criminal EOS 304 00:12:29,040 --> 00:12:31,160 system so this is obviously a really 305 00:12:31,160 --> 00:12:33,760 important component of just general 306 00:12:33,760 --> 00:12:36,199 crime in general is because uh that 307 00:12:36,199 --> 00:12:38,360 criminal ecos system really is where is 308 00:12:38,360 --> 00:12:40,519 the opportunity and where do people 309 00:12:40,519 --> 00:12:42,920 shift and try to actually move to 310 00:12:42,920 --> 00:12:45,320 capitalize on that opportunity and 311 00:12:45,320 --> 00:12:48,040 really for the the Kali cartel they had 312 00:12:48,040 --> 00:12:50,920 maintained this low profile and once 313 00:12:50,920 --> 00:12:53,240 Pablo escavar had been sort of taken 314 00:12:53,240 --> 00:12:56,120 down or been arrested um it was time for 315 00:12:56,120 --> 00:12:59,240 Kali to kind of move in and so that uh 316 00:12:59,240 --> 00:13:01,480 that downfall of Escobar created kind of 317 00:13:01,480 --> 00:13:04,399 a power vacuum where uh the Ki cartel 318 00:13:04,399 --> 00:13:06,480 was able to really expand and kind of 319 00:13:06,480 --> 00:13:09,880 move uh move further uh into their 320 00:13:09,880 --> 00:13:12,680 business you know they also uh took 321 00:13:12,680 --> 00:13:15,399 advantage of um various other different 322 00:13:15,399 --> 00:13:18,160 components of their business but one of 323 00:13:18,160 --> 00:13:21,000 the major differences that was very very 324 00:13:21,000 --> 00:13:23,839 difference between Kali and Pablo is 325 00:13:23,839 --> 00:13:26,120 that Pablo used violence to move things 326 00:13:26,120 --> 00:13:30,000 forward kie used corruption so kie was 327 00:13:30,000 --> 00:13:32,680 very very very good at facilitating 328 00:13:32,680 --> 00:13:35,320 corruption at every single level uh of 329 00:13:35,320 --> 00:13:38,040 their their ecosystem to be able to move 330 00:13:38,040 --> 00:13:40,000 their business forward and then of 331 00:13:40,000 --> 00:13:42,279 course they oftentimes had various 332 00:13:42,279 --> 00:13:44,040 different sort of B legitimate 333 00:13:44,040 --> 00:13:46,000 businesses that they would pivot funds 334 00:13:46,000 --> 00:13:48,560 into and their eventual goal was to 335 00:13:48,560 --> 00:13:50,680 actually get out of the drug business 336 00:13:50,680 --> 00:13:54,560 and go into uh a real business but um of 337 00:13:54,560 --> 00:13:57,560 course that that didn't happen in the 338 00:13:57,560 --> 00:13:59,839 endend now now when we flip over and we 339 00:13:59,839 --> 00:14:02,680 look at the the the kti group so kti was 340 00:14:02,680 --> 00:14:06,480 started around the beginning is of 2020 341 00:14:06,480 --> 00:14:08,399 what happened in 342 00:14:08,399 --> 00:14:11,560 2020 Co exactly that was probably the 343 00:14:11,560 --> 00:14:14,839 biggest change in significant um 344 00:14:14,839 --> 00:14:17,519 dynamics of of kind of what happened for 345 00:14:17,519 --> 00:14:19,320 uh various different cyber crime 346 00:14:19,320 --> 00:14:22,199 organizations is Ki kind of rode that 347 00:14:22,199 --> 00:14:25,399 that ride of of being able to take um 348 00:14:25,399 --> 00:14:27,519 take advantage of the co pandemic and 349 00:14:27,519 --> 00:14:29,600 this big shift in in the use of 350 00:14:29,600 --> 00:14:32,360 Technology uh for people at home but 351 00:14:32,360 --> 00:14:34,320 another really interesting thing that 352 00:14:34,320 --> 00:14:36,279 actually made a huge big difference for 353 00:14:36,279 --> 00:14:38,399 kti and its Effectiveness to continue to 354 00:14:38,399 --> 00:14:42,160 run these big high-profile campaigns was 355 00:14:42,160 --> 00:14:43,959 uh the rise of 356 00:14:43,959 --> 00:14:46,680 cryptocurrencies so the Kali cartel they 357 00:14:46,680 --> 00:14:48,880 first got into the drug business through 358 00:14:48,880 --> 00:14:51,160 marijuana and they realized that 359 00:14:51,160 --> 00:14:53,279 marijuana didn't make enough money so 360 00:14:53,279 --> 00:14:55,720 then they shifted to cocaine one of the 361 00:14:55,720 --> 00:14:58,320 interesting things is that 5 10 years 362 00:14:58,320 --> 00:15:01,519 ago cryptocurrencies the value of it and 363 00:15:01,519 --> 00:15:03,959 the the common place of it uh was kind 364 00:15:03,959 --> 00:15:05,320 of like dealing in the marijuana 365 00:15:05,320 --> 00:15:08,120 business but come 2020 and especially 366 00:15:08,120 --> 00:15:11,720 2021 and 2022 the cryptocurrency 367 00:15:11,720 --> 00:15:13,519 industry and that component of it 368 00:15:13,519 --> 00:15:15,800 transformed ransomware from the 369 00:15:15,800 --> 00:15:17,480 marijuana industry into the cocaine 370 00:15:17,480 --> 00:15:20,199 industry uh it it really Rose the 371 00:15:20,199 --> 00:15:22,360 significant amount of u profits that 372 00:15:22,360 --> 00:15:24,240 could back be be made on these various 373 00:15:24,240 --> 00:15:26,399 different 374 00:15:26,399 --> 00:15:29,000 campaigns so like I mentioned the major 375 00:15:29,000 --> 00:15:30,920 difference really with Cali and and 376 00:15:30,920 --> 00:15:33,759 Pablo Escobar was that uh ability to 377 00:15:33,759 --> 00:15:36,720 translate violence into corruption and B 378 00:15:36,720 --> 00:15:38,880 they use that to their their um 379 00:15:38,880 --> 00:15:41,720 maximalist they they INF infiltrated 380 00:15:41,720 --> 00:15:44,160 various different sectors of uh the 381 00:15:44,160 --> 00:15:46,800 Colombian government whether it be um 382 00:15:46,800 --> 00:15:48,759 the Federal Columbia government law 383 00:15:48,759 --> 00:15:52,160 enforcement the military um paying off 384 00:15:52,160 --> 00:15:53,839 judges paying off various different 385 00:15:53,839 --> 00:15:56,000 individuals and so they had eyes and 386 00:15:56,000 --> 00:15:57,920 ears all over the place to be able to 387 00:15:57,920 --> 00:16:00,680 operate that business so really the the 388 00:16:00,680 --> 00:16:02,959 major thing that that they created was 389 00:16:02,959 --> 00:16:06,839 that safe haven so that safe haven isn't 390 00:16:06,839 --> 00:16:10,040 something that kti created but if a lot 391 00:16:10,040 --> 00:16:12,040 of these folks are in Russia that 392 00:16:12,040 --> 00:16:13,920 obviously created some interesting 393 00:16:13,920 --> 00:16:16,199 dynamics of being able to be in sort of 394 00:16:16,199 --> 00:16:18,800 a safe haven or in a Haven that was very 395 00:16:18,800 --> 00:16:21,000 difficult to try and prosecute or thwart 396 00:16:21,000 --> 00:16:22,800 these 397 00:16:22,800 --> 00:16:26,639 individuals and the rise of uh of kti so 398 00:16:26,639 --> 00:16:29,000 the major difference or really the major 399 00:16:29,000 --> 00:16:31,680 thing that Ki was uh was really getting 400 00:16:31,680 --> 00:16:34,440 into was this concept of big game 401 00:16:34,440 --> 00:16:38,399 hunting so kti really really made that 402 00:16:38,399 --> 00:16:41,600 component of ransomware uh really really 403 00:16:41,600 --> 00:16:43,839 uh show at the center stage was that 404 00:16:43,839 --> 00:16:46,120 they were able to really use that 405 00:16:46,120 --> 00:16:49,000 concept of going after big targets and 406 00:16:49,000 --> 00:16:51,560 going after complex cyber crime uh 407 00:16:51,560 --> 00:16:53,839 campaigns to be able to get large 408 00:16:53,839 --> 00:16:56,920 payouts and so they focused on targeting 409 00:16:56,920 --> 00:16:59,360 high value victims but but also victims 410 00:16:59,360 --> 00:17:01,399 that were in sort of a high press 411 00:17:01,399 --> 00:17:04,839 industry so uh whether it be you know 412 00:17:04,839 --> 00:17:06,720 governments whether it be hospitals 413 00:17:06,720 --> 00:17:09,039 whether it be sort of Emergency Services 414 00:17:09,039 --> 00:17:11,199 they would go after uh targets that 415 00:17:11,199 --> 00:17:13,280 could pay and targets that needed to pay 416 00:17:13,280 --> 00:17:15,760 soon but they also had a very effective 417 00:17:15,760 --> 00:17:18,199 kind of manner of being able to acquire 418 00:17:18,199 --> 00:17:20,839 and obtain sophisticated techniques and 419 00:17:20,839 --> 00:17:22,520 of course they use a lot of those 420 00:17:22,520 --> 00:17:24,280 different tactics that ransomware 421 00:17:24,280 --> 00:17:26,439 operators now use these days which is 422 00:17:26,439 --> 00:17:30,120 the double and triple extortion kind of 423 00:17:30,120 --> 00:17:32,960 methods however with all that Innovation 424 00:17:32,960 --> 00:17:35,960 and all that growth the Cali cartel and 425 00:17:35,960 --> 00:17:38,080 kti got started to get into the 426 00:17:38,080 --> 00:17:41,000 crosshairs of not only the US government 427 00:17:41,000 --> 00:17:43,280 but the world it became pretty apparent 428 00:17:43,280 --> 00:17:46,320 that c was the new king of cocaine uh in 429 00:17:46,320 --> 00:17:47,880 that New York Times article that I 430 00:17:47,880 --> 00:17:50,200 mentioned and so C actually suffered 431 00:17:50,200 --> 00:17:52,600 really in the early 90s uh a number of 432 00:17:52,600 --> 00:17:55,520 different setbacks through drug seizures 433 00:17:55,520 --> 00:17:56,760 um so in 434 00:17:56,760 --> 00:18:00,280 1991 um CI had kind of taken over a 435 00:18:00,280 --> 00:18:02,200 large percentage of the movement of 436 00:18:02,200 --> 00:18:04,640 drugs out of Colombia into the US and 437 00:18:04,640 --> 00:18:07,000 there was a major seizure that happened 438 00:18:07,000 --> 00:18:10,080 um called operation Cornerstone that uh 439 00:18:10,080 --> 00:18:11,600 they were the United States was able to 440 00:18:11,600 --> 00:18:15,240 seize 12,000 kg of cocaine but there 441 00:18:15,240 --> 00:18:16,760 were also subsequent seizures that 442 00:18:16,760 --> 00:18:19,320 happened in the Years uh leading up to 443 00:18:19,320 --> 00:18:21,280 that and uh a lot of those seizures 444 00:18:21,280 --> 00:18:23,840 created more stress and pain points in 445 00:18:23,840 --> 00:18:25,960 that organization and so those pain 446 00:18:25,960 --> 00:18:28,400 points often times for law enforcement 447 00:18:28,400 --> 00:18:30,559 our opportunity uh to be able to try and 448 00:18:30,559 --> 00:18:32,799 disrupt and take down those 449 00:18:32,799 --> 00:18:36,080 organizations so kti is no different 450 00:18:36,080 --> 00:18:38,600 they went after a range of big targets 451 00:18:38,600 --> 00:18:41,280 but even though Ki didn't necessarily I 452 00:18:41,280 --> 00:18:42,159 think there was actually some 453 00:18:42,159 --> 00:18:44,559 conversations that stern was having with 454 00:18:44,559 --> 00:18:47,559 some highlevel managers in kti angry 455 00:18:47,559 --> 00:18:49,400 that that uh some of the Affiliates were 456 00:18:49,400 --> 00:18:52,679 going after hospitals and going after uh 457 00:18:52,679 --> 00:18:55,120 various different critical services but 458 00:18:55,120 --> 00:18:57,000 even still they went after some big 459 00:18:57,000 --> 00:19:00,000 targets one was the Irish uh Health uh 460 00:19:00,000 --> 00:19:02,320 Service uh and the Irish Health Service 461 00:19:02,320 --> 00:19:04,320 basically suffered like a $600 million 462 00:19:04,320 --> 00:19:06,960 loss based off of that kti ransomware 463 00:19:06,960 --> 00:19:09,919 incident another major one was the fact 464 00:19:09,919 --> 00:19:12,600 that kti attacked the Costa Rican 465 00:19:12,600 --> 00:19:14,640 government and it disrupted government 466 00:19:14,640 --> 00:19:16,480 services and caused a number of 467 00:19:16,480 --> 00:19:19,080 different economic damage and then the 468 00:19:19,080 --> 00:19:20,760 next big thing that the US government 469 00:19:20,760 --> 00:19:23,240 put out is that we put out a basically a 470 00:19:23,240 --> 00:19:27,559 $10,000 reward on kti so we we tried to 471 00:19:27,559 --> 00:19:29,480 you know turn this script Mel Gibson 472 00:19:29,480 --> 00:19:31,360 style and say well how does it feel to 473 00:19:31,360 --> 00:19:33,880 be a $10 million lottery ticket um so 474 00:19:33,880 --> 00:19:37,640 the US put some heat on um on kti to be 475 00:19:37,640 --> 00:19:39,400 able to try and flip some of those 476 00:19:39,400 --> 00:19:41,400 Affiliates that maybe felt disgruntled 477 00:19:41,400 --> 00:19:43,440 or uh didn't feel like they were getting 478 00:19:43,440 --> 00:19:45,120 paid enough in theory they could flip 479 00:19:45,120 --> 00:19:47,960 and try to turn in kti 480 00:19:47,960 --> 00:19:50,840 leadership so the cracks started to form 481 00:19:50,840 --> 00:19:53,679 like I said the pressure started a build 482 00:19:53,679 --> 00:19:56,480 and in that pressure buildup both kti 483 00:19:56,480 --> 00:19:58,919 and C experienced the 484 00:19:58,919 --> 00:20:01,640 whistleblowers um so uh a major 485 00:20:01,640 --> 00:20:04,159 whistleblower in the in the Cali cartel 486 00:20:04,159 --> 00:20:08,559 was horse Jorge uh Salado so he was in 487 00:20:08,559 --> 00:20:12,840 charge of security for kti and he became 488 00:20:12,840 --> 00:20:15,720 uh growingly disillusioned with the kti 489 00:20:15,720 --> 00:20:18,400 cartel and wanted to Pivot to more 490 00:20:18,400 --> 00:20:20,480 legitimate businesses and felt he kept 491 00:20:20,480 --> 00:20:22,640 getting sucked back in and couldn't 492 00:20:22,640 --> 00:20:24,880 escape and there was a turning point 493 00:20:24,880 --> 00:20:27,120 where he felt his life and his family's 494 00:20:27,120 --> 00:20:29,480 life was threatened so he decided to 495 00:20:29,480 --> 00:20:31,919 flip completely and work with the DEA to 496 00:20:31,919 --> 00:20:35,480 try and take down the C 497 00:20:35,720 --> 00:20:38,840 cartel similar in nature um what 498 00:20:38,840 --> 00:20:42,080 happened to K uh Ki was the infamous Ki 499 00:20:42,080 --> 00:20:44,000 leaks how many people here remember when 500 00:20:44,000 --> 00:20:46,679 the KY leaks came out yeah so there were 501 00:20:46,679 --> 00:20:48,880 a really major leak that came out back 502 00:20:48,880 --> 00:20:51,559 in 2021 and it was basically from a 503 00:20:51,559 --> 00:20:54,640 former KY affiliate and a ky affiliate 504 00:20:54,640 --> 00:20:57,520 said screw you Ki here's everything 505 00:20:57,520 --> 00:20:59,679 that's associated with the kti business 506 00:20:59,679 --> 00:21:02,400 and my visibility and in fact actually 507 00:21:02,400 --> 00:21:05,280 those kti leaks really opened up this 508 00:21:05,280 --> 00:21:08,080 sort of the eyes of not just the US 509 00:21:08,080 --> 00:21:10,240 government but also just the general 510 00:21:10,240 --> 00:21:12,799 public into how one of these cyber crime 511 00:21:12,799 --> 00:21:15,840 organizations work because uh so much 512 00:21:15,840 --> 00:21:17,919 data especially chatting and just 513 00:21:17,919 --> 00:21:21,200 organizational data was leaked in uh in 514 00:21:21,200 --> 00:21:23,840 those kti 515 00:21:24,799 --> 00:21:29,400 leaks and now we move on to the fall so 516 00:21:29,400 --> 00:21:32,640 as as such there are a number of uh 517 00:21:32,640 --> 00:21:34,760 things that kind of went into the fall 518 00:21:34,760 --> 00:21:37,320 of the C cartel they tried very very 519 00:21:37,320 --> 00:21:39,120 hard to Pivot their business into 520 00:21:39,120 --> 00:21:41,600 legitimate businesses but unfortunately 521 00:21:41,600 --> 00:21:43,120 for them and fortunately for the US 522 00:21:43,120 --> 00:21:45,279 government we were able to arrest these 523 00:21:45,279 --> 00:21:48,640 individuals uh in 1995 the Rodriguez 524 00:21:48,640 --> 00:21:50,440 Brothers were arrested only a couple 525 00:21:50,440 --> 00:21:54,279 months um next to each other but um you 526 00:21:54,279 --> 00:21:56,679 know this was kind of a general victory 527 00:21:56,679 --> 00:21:58,520 of trying to take down some of these 528 00:21:58,520 --> 00:22:01,640 large organizations and even though the 529 00:22:01,640 --> 00:22:03,279 drug and the cocaine business still 530 00:22:03,279 --> 00:22:05,520 exists it doesn't quite exist in the 531 00:22:05,520 --> 00:22:08,120 same king of of cocaine and king of drug 532 00:22:08,120 --> 00:22:11,360 businesses as it did in years past it uh 533 00:22:11,360 --> 00:22:13,440 it has kind of moved into this sort of 534 00:22:13,440 --> 00:22:16,840 um you know unorganized type of space to 535 00:22:16,840 --> 00:22:17,919 some 536 00:22:17,919 --> 00:22:21,360 degree and kti well they also had a fall 537 00:22:21,360 --> 00:22:22,919 but actually the fall was somewhat of a 538 00:22:22,919 --> 00:22:26,440 self-inflicted fall so in uh February of 539 00:22:26,440 --> 00:22:30,640 20 uh February 25th of 2022 Russia 540 00:22:30,640 --> 00:22:33,720 invaded Ukraine a few weeks prior um and 541 00:22:33,720 --> 00:22:36,039 the kti group basically came in and they 542 00:22:36,039 --> 00:22:37,960 pledged allegiance to the Russian 543 00:22:37,960 --> 00:22:40,520 government so as I kind of mentioned in 544 00:22:40,520 --> 00:22:43,200 that earlier slide there is DHS there's 545 00:22:43,200 --> 00:22:47,039 doj and there's DOD well DHS and doj 546 00:22:47,039 --> 00:22:48,799 were looking at kti but once they 547 00:22:48,799 --> 00:22:50,120 pledged allegiance to the Russian 548 00:22:50,120 --> 00:22:52,840 government DOD started to get involved 549 00:22:52,840 --> 00:22:56,159 and that meant big trouble for kti so 550 00:22:56,159 --> 00:22:58,640 this you know effectively created 551 00:22:58,640 --> 00:23:00,880 um a bunch of different constraints that 552 00:23:00,880 --> 00:23:03,640 tied kti's hands many different ways uh 553 00:23:03,640 --> 00:23:05,480 of trying to pledge allegiance to a 554 00:23:05,480 --> 00:23:07,799 nation state group and trying to operate 555 00:23:07,799 --> 00:23:10,200 as a business 556 00:23:10,200 --> 00:23:12,799 effectively and this this sort of 557 00:23:12,799 --> 00:23:15,120 Allegiance basically led to the 558 00:23:15,120 --> 00:23:17,640 alienation of different Affiliates it 559 00:23:17,640 --> 00:23:20,000 made it difficult to recruit anybody and 560 00:23:20,000 --> 00:23:21,960 it made it difficult to continue to use 561 00:23:21,960 --> 00:23:23,960 some of their money laundering and some 562 00:23:23,960 --> 00:23:26,640 of their Cash Out techniques to continue 563 00:23:26,640 --> 00:23:30,360 that business forward so in May of 2022 564 00:23:30,360 --> 00:23:32,840 kti eventually shut down or at least so 565 00:23:32,840 --> 00:23:35,400 they say it more or less disbanded I 566 00:23:35,400 --> 00:23:38,600 would say rather than shut down um and 567 00:23:38,600 --> 00:23:39,840 this was just kind of an interesting 568 00:23:39,840 --> 00:23:42,039 case study to sort of see they really 569 00:23:42,039 --> 00:23:44,440 Rose through the pandemic but something 570 00:23:44,440 --> 00:23:47,039 as dramatic as uh as just sort of you 571 00:23:47,039 --> 00:23:48,559 know pledging allegiance to a nation 572 00:23:48,559 --> 00:23:51,640 state transformed them from being uh a 573 00:23:51,640 --> 00:23:53,840 criminal Enterprise to being a nation 574 00:23:53,840 --> 00:23:56,440 state facilit facilitating Enterprise um 575 00:23:56,440 --> 00:23:58,039 the drug business had a very similar 576 00:23:58,039 --> 00:24:00,279 kind of thing that happened in the 80s 577 00:24:00,279 --> 00:24:02,200 uh' 7s and 80s where some drug 578 00:24:02,200 --> 00:24:03,919 organizations were working with 579 00:24:03,919 --> 00:24:06,200 communist uh Communists down in South 580 00:24:06,200 --> 00:24:08,120 America and that kicked off the 581 00:24:08,120 --> 00:24:12,559 military's response to try and stop drug 582 00:24:12,559 --> 00:24:15,039 organizations so in 583 00:24:15,039 --> 00:24:17,320 conclusion throughout this presentation 584 00:24:17,320 --> 00:24:19,279 you know I hope to just shed some light 585 00:24:19,279 --> 00:24:22,880 just on the similarities of kti and Kali 586 00:24:22,880 --> 00:24:25,320 I mean effectively they're two illicit 587 00:24:25,320 --> 00:24:27,240 businesses trying to make money they're 588 00:24:27,240 --> 00:24:29,799 financially motivated um and they're 589 00:24:29,799 --> 00:24:32,520 pretty similar but there's one major 590 00:24:32,520 --> 00:24:34,919 difference that gives me hope to try and 591 00:24:34,919 --> 00:24:37,159 disrupt some of these cyber crime 592 00:24:37,159 --> 00:24:39,520 organizations and it's that the victims 593 00:24:39,520 --> 00:24:43,440 of cie's product were willing customers 594 00:24:43,440 --> 00:24:46,039 yes drug addicts individuals taking 595 00:24:46,039 --> 00:24:48,880 these things are still victims it's 596 00:24:48,880 --> 00:24:51,039 still illegal activity but they are 597 00:24:51,039 --> 00:24:53,399 willing customers to try and get this 598 00:24:53,399 --> 00:24:56,080 type of uh this type of product however 599 00:24:56,080 --> 00:25:00,120 the victims of kti are repulsed by kti's 600 00:25:00,120 --> 00:25:02,679 product meaning that all those people 601 00:25:02,679 --> 00:25:04,159 all those companies that suffered these 602 00:25:04,159 --> 00:25:06,520 ransomware attacks obviously none of 603 00:25:06,520 --> 00:25:08,919 them wanted anything to do with any of 604 00:25:08,919 --> 00:25:11,880 this type of activity and so as a result 605 00:25:11,880 --> 00:25:14,399 I really think that our ability to try 606 00:25:14,399 --> 00:25:16,520 and disrupt this type of activity is 607 00:25:16,520 --> 00:25:18,600 strengthened by the fact that the 608 00:25:18,600 --> 00:25:21,640 victims want just as badly if not more 609 00:25:21,640 --> 00:25:23,679 so for us to try and disrupt and 610 00:25:23,679 --> 00:25:25,760 dismantle some of these organized crime 611 00:25:25,760 --> 00:25:28,080 groups but I think there's another 612 00:25:28,080 --> 00:25:30,720 second key weapon that the US government 613 00:25:30,720 --> 00:25:32,880 has in this fight against cyber 614 00:25:32,880 --> 00:25:34,360 organized 615 00:25:34,360 --> 00:25:38,520 crime and that's you all so one of the 616 00:25:38,520 --> 00:25:40,760 major differences that's just different 617 00:25:40,760 --> 00:25:43,760 from organized crime of the Colombian 618 00:25:43,760 --> 00:25:46,720 and the and the the cartels of the 1980s 619 00:25:46,720 --> 00:25:49,520 and '90s is that that was primarily a 620 00:25:49,520 --> 00:25:52,080 federal government initiative um there 621 00:25:52,080 --> 00:25:53,960 weren't a whole lot of private entities 622 00:25:53,960 --> 00:25:56,279 sort of doing this vigilante type of 623 00:25:56,279 --> 00:25:59,000 analysis but really in kind of the 624 00:25:59,000 --> 00:26:00,440 growth of these cyber crime 625 00:26:00,440 --> 00:26:02,679 organizations I cannot tell you how 626 00:26:02,679 --> 00:26:05,240 incredibly helpful it is to work with 627 00:26:05,240 --> 00:26:07,039 threat researchers to work with 628 00:26:07,039 --> 00:26:09,000 individuals that are reporting this 629 00:26:09,000 --> 00:26:11,520 information to the federal government to 630 00:26:11,520 --> 00:26:13,360 be able to try and make this disruption 631 00:26:13,360 --> 00:26:16,799 happen so if I were to take that analogy 632 00:26:16,799 --> 00:26:19,120 of the three legs of the federal 633 00:26:19,120 --> 00:26:23,320 government whether it be DHS DOD or the 634 00:26:23,320 --> 00:26:26,880 doj an invisible fourth stool or fourth 635 00:26:26,880 --> 00:26:30,840 leg is the US people so people of the 636 00:26:30,840 --> 00:26:33,039 United States have been able to help 637 00:26:33,039 --> 00:26:35,919 facilitate those three federal agencies 638 00:26:35,919 --> 00:26:37,760 to move 639 00:26:37,760 --> 00:26:40,200 forward so thank you that's all I have 640 00:26:40,200 --> 00:26:42,840 for cocaine Incorporated if you have any 641 00:26:42,840 --> 00:26:44,640 questions feel free to come up and talk 642 00:26:44,640 --> 00:26:46,480 to me I'd love to talk to you about 643 00:26:46,480 --> 00:26:48,320 anything that you have um that you're 644 00:26:48,320 --> 00:26:50,880 doing in this space or that you um you 645 00:26:50,880 --> 00:26:54,600 want to talk about thank you enjoy the 646 00:26:56,600 --> 00:26:59,600 conference