101: Lotería

JACK: When I was a teenager living at home with my dad, it always felt like he was invading my
privacy. He would do things like open and read the mail that I got, or he would go
into my room when I wasn’t there. He says he was picking up trash or collecting dirty cups,
but I always suspected he was going through my things for some reason. [MUSIC] Sometimes he’d
barge into my room when I was there, too, and I didn’t like that. What if he saw me
doing something on my computer that I didn’t want him to see? So, I set up an early warning
system so I would know when he was coming. I would sometimes put sheets of newspaper just
outside my door. I’d arrange it in such a way that he’d have to step on it to get to my door,
and the crinkle of the newspaper would tip me off that someone’s coming. This worked for a while,
especially just hearing him complain ah, there’s newspaper all over the floor; what’s going on out
here? That way, I would know he’s coming in. But one day, he decided to be tricky.
He wanted to come in my room but didn’t want to make noise with the newspaper,
so he came up to my door very slowly and quietly, and gently picked up the newspaper
so that it didn’t make a single crinkle noise. With the early warning system deactivated,
he opened my door and came right in. I was sitting on my bed reading one of my
schoolbooks. I was baffled that he didn’t trip my alarm and I asked dad, how did you get in
without the newspaper making noises? He held up the paper to show me he had picked it up,
and he said I’m always two steps ahead of you. Glad to see you’re doing homework, and left. Well,
little did he know that I was four steps ahead. I had wired a proximity sensor up to my door that
he didn’t know about, and if someone came up to the door, a little light would blink in my room,
letting me know that someone’s getting close. When he came up to get the newspaper, I saw the
little light blink. I was playing games on my computer and I turned the monitor off, grabbed
a schoolbook and jumped in bed, and acted like I was reading. This is what you have to do sometimes
to catch someone in the act. Two steps ahead isn’t enough. Sometimes you need to be four steps ahead.
(INTRO:) [INTRO MUSIC] These are true stories from the dark side of
the internet. I’m Jack Rhysider. This is Darknet Diaries. [INTO MUSIC ENDS]
JACK: [MUSIC]
Content warning; there are multiple swear words in this episode. If you’d rather not
hear bad language, you’ve been warned. Okay, so you don’t want your real name.
OS: No.
JACK: Okay, so we’ll just make up – we’ll just make up something; Frank or Tim or…
OS: I don’t know. Like, I’ll fucking do a random name generator. Let’s see what that says.
How about that?
JACK: Yeah.
OS: We’ll let the ether tell us what it should be. Let’s call it Owl Stalker.
JACK: Wait a minute. What kind of name generator are you…? It’s like a video game name generator?
OS: Basically, yeah, dude.
JACK: Owl Stalker?
OS: Yeah, why the fuck not?
JACK: Alright, I tried to use that name,
but I just can’t bring myself to call him Owl Stalker this whole episode,
so I’m just going to abbreviate his name to O-S and call him Os for short.
OS: Yeah, just from a background perspective of early days, I used to run around in the warez
scene as a wares administrator and a rooter, and also a crypto encryption cracker for games
in disk. So, some of the largest groups that are out there, I was actually not only hosting
for the zero-day drops of the warez scene, but also producing zero-day for the warez scene.
JACK: Ah, the old warez scene in the 90s. Warez is short for softwares, but it specifically means
pirated software. [MUSIC] Warez groups would buy software, whether a video game or an app,
and then crack it so that you wouldn’t need a license or a serial key for it to run,
and then distribute it for anyone to download and use free of charge. In the warez scene of the 90s,
you could download pretty much any popular game or app without paying for it. Today,
that’s kind of gone away since apps and games require internet connections for them to run,
but this was the 90s where internet wasn’t that fast, and this was also a time before
torrenting was a thing. So, he was on IRC, the Internet Relay Chat, and was setting up
servers to be the place to go when you wanted to download the pirated software. But he wasn’t
always distributing pirated software. When he got his first gateway computer,
he wasn’t sure what to do with it, [00:05:00] but then a friend told him to check out IRC,
where he can meet others. So, he figured out how to get into chat rooms to see what was there.
OS: My nice baud modem decided to dial-up a pop-on. The first ten minutes that I’m in,
I actually get popped. I had to rebuild my computer all the way from the ground
up and at that time, it was all floppy disks to build the system,
and I vowed to never let that happen again. I was pissed.
JACK: This is what started him down a tour of the dark side. He was already fascinated with what
computers could do, and so when his computer got hit with a virus, it immediately fascinated him to
want to know more. He started asking around about how something like this could happen,
which led him eventually to these warez groups which were doing illegal things.
OS: So, I went and learned and trained and taught myself actually how to program. Then I actually
kinda just made a decision as I matured and I saw some of the other big groups really starting to
get taken down, like our peer groups in that warez scene starting to get hit really hard;
several friends of mine that, you know, I had met through the years of being in
that scene actually going to jail. I was like dude, I don’t want that to be me.
JACK: So, he decided to go in a totally new direction
in life. After being hunched over his PC for years, secluded in his bedroom,
he straightened his back and went outside, and started training.
SERGEANT: One, two, three, four, United States Marine Corps.
PRIVATES: One, two, three, four, United States Marine Corps.
OS: Alright, I chose the Marine Corps specifically ‘cause it was – I shopped around. All the other
branches had already built cyber-security units and were already in the process of
– they were one step ahead of where the Marine Corps was, and so I said you know what? I want
to go in the Marine Corps specifically for this. I walked into a recruiting station and said hey,
are you guys doing stuff with computers, to protect computers? It wasn’t even cyber-security,
right? That didn’t even have a name at that point. They were like hey, look,
we really don’t have a whole lot of options here. We’ll see how you
test. I tested really high on the entry level and was guaranteed to go into the
role that I played in the military which was the cyber-security side of the house, right?
SERGEANT: If I die in the combat zone…
PRIVATES: If I die in the combat zone…
SERGEANT: Hike me up and ship me home.
PRIVATES: Hike me up and ship me home.
JACK: The Marine Corps boot camp is thirteen weeks long, and it’s brutal. By the time you’re done,
you’ll be in the best shape of your life. There are no computers in boot camp. Instead,
you’re trained on how to be a killer. You learn to fight, you learn to use weapons,
you learn to overcome fear and any obstacle that might be in your way. I say all this
because it reminds me of a very specific scene in the movie Full Metal Jacket.
HARTMAN: Toejam!
TOEJAM: Sir, yes, sir!
HARTMAN: 0300; infantry.
JACK: The movie follows marines through boot camp and into the Vietnam war.
ADAMS: Sir, yes, sir!
HARTMAN: 0300, infantry.
JACK: When they’re finished with boot camp, that’s when they’re assigned their occupation.
ADAMS: Sir, yes, sir!
HARTMAN: 1800; engineer. You go out and find mines. Cowboy!
COWBOY: Sir, yes, sir!
HARTMAN: 0300; infantry. Taylor!
JACK: Then, one guy stands out; Joker.
HARTMAN: Joker!
JOKER: Sir, yes, sir!
HARTMAN: 4212; basic military journalism. You gotta be shitting me,
Joker. You think you’re Mickey Spillane? You think you’re some kind of fucking writer?
JOKER: Sir, I wrote for my high school newspaper, sir.
HARTMAN: Jesus H. Christ. You’re not a writer. You’re a killer.
JOKER: A killer; yes, sir!
OS: [MUSIC] I didn’t think about the fact that the Marine Corps is this elite military and
they’re trained to do nothing but kill, right? That’s literally all they are. I looked at it
more as a means to an end, to go get the hands-on experience, right, from the government and really
get trained up on government capabilities. That’s kinda how I looked at it, then I hit boot camp
and went oh fuck, what did I do? Got stripped of everything that I was and rebuilt to who I am to
some degree today, right? But how did I come back and go into that computing side of it? I mean,
that was my end goal. I set a goal prior to going in and I made agreements with the Marine Corps
that I would be provided that. Well, of course, now, later on, I’m realizing how lucky I was,
because there are no guarantees. When you sign a contract with the government, whatever, military
or any other freaking government service, you’re not guaranteed a damn thing, and particularly
with the military, right? But how I transitioned back in out of that fighting mentality – I mean,
I always kept it with me, right, because we were trained to fight first. But what was really cool
is that [00:10:00] we were the ones that were defining how to fight with digital aspects first.
JACK: So, were you doing mostly offensive or defense, forensics, incident response?
OS: So, I did both. It just really depended on where I was and what I was doing. When I was
typically not in a forward-deployed state, then it was defensive. Even in a deployed state, we would
do defensive forensic stuff, you know, working with our signals intelligence or intelligence
professionals as well. We would take and consume that. They would bring us physical devices,
like I said, chip off-type stuff, like where we would actually go desolder chips on a board
and actually analyze it at that level, but then also offensive kind of stuff.
JACK: How long did you spend in there?
OS: I spent five years active duty, long enough to realize that I made
a really freaking awesome and terrible decision all in one.
JACK: Why was it awesome and terrible?
OS: Well, it was awesome because I got to go do some really cool
shit and learn a lot of really cool shit, and it sucked because – I mean,
again, go talk to a marine; you hate it while you’re in and you love it while you’re out,
right? The life of a marine is not – it’s not an easy life, man. It’s not at all.
JACK: But this experience really did level up his understanding of computers, and specifically
cyber-security. So, with this experience and know-how, he landed a job at a consulting company.
OS: They were doing forensics and other cyber-security kinda stuff,
right? This is early 2010s, just to give perspective of timeframe here.
I got cherry-picked by an individual to come into this consulting firm.
JACK: They had him start by doing digital forensics; analyzing an infected computer
to try to understand more about the malware, looking for clues in a network or system that
showed signs of intrusion, stuff like that. But they also had him doing some attack-type work too,
where he would be assigned to try to get into a computer or a website or a network to test
how secure it was. He did that for a while, but then he got a new assignment. [MUSIC] The
government of Puerto Rico hired this consulting agency to come do some work.
HOST: 18 degrees above the Equator at that sweet
spot where the Atlantic embraces the Caribbean is the island of Puerto Rico.
OS: In Puerto Rico, they sold the work and they were like okay, cool. We need to staff
resources. Hey, do you have availability? Cool. Welcome to this project. That’s just
kinda how it goes. In consulting firms, you get assigned to projects, right? It was sold to me
as – initially that we were going down there to do IT operas – like, operational improvements.
JACK: What he was told was that for this project, him and a team would go down, audit the network,
evaluate it, and see if there were any areas to improve to make the network more secure. Okay,
so you pack your bags, you head out. How long did you think you were gonna be there?
OS: That’s a hilarious question. I realistically thought that I was only gonna be there for
maybe two to three weeks tops. We were gonna come in, evaluate their technical capabilities and
look at like okay, cool, you got this 1970s IBM mainframe. You might want to update that, right?
JACK: Little did he know, he would be staying there much longer than a few weeks. He arrives
in Puerto Rico, and all goes as planned for a while. He sees what’s there and yeah,
there are areas for them to improve the network to make it easier to maintain, get work done, and be
more secure. So, he’s writing up all his findings and giving them suggestions on how to improve.
OS: Then the next thing I know, we’re in the middle of a meeting with the governor
of Puerto Rico and he’s like, I love the work that you guys have going on and that
you’ve done for us. I have a problem. He goes, we are losing millions and millions
of dollars a month through the lottery of Puerto Rico, and we don’t know how.
JACK: [MUSIC] Now, to begin with, the governor of Puerto Rico is the highest person who has
executive authority there, so the fact that they got to meet with the governor was pretty
interesting. But this is a unique challenge, huh? To help figure out how they’re losing millions of
dollars through their state lottery. Os was intrigued by this problem, but he wasn’t sure
where to start. He had to learn and get familiar with how the lottery system worked. The lottery
had weekly drawings. [00:15:00] The drawings themselves were physically done live on TV,
not electronic like how some lotteries are. A bunch of balls go into a drum, and then they
draw one ball out at a time, showing the camera, and that’s how the winning numbers are announced.
People would buy lottery tickets at special places that sold them,
and if your numbers matched the numbers drawn, you win money. You don’t have to match all the balls,
though. Even a partial match, like if your ticket contained three out of the five numbers,
you also won. This Puerto Rico lottery is a big deal. It’s been running since 1934 and is ran by
the Department of Treasury. Of course, a lottery is set up to generate revenue for the government,
since the amount of the payoffs is never more than the amount of money generated
through ticket sales. But in this case, the payouts were more than the ticket sales;
a lot more. Millions of dollars were being lost in the lottery.
OS: We regrouped as a team and said hey, let’s think through this. What are all the possible
reasons behind it? Maybe systems aren’t just communicating and updating fast enough because
the network connectivity between Building A and Building B is absolutely horrible.
Maybe some clerical error in their systems, like their – we’re talking, you know, as we started
to do our IT analysis, they were still running Windows 95 on some systems in the early 2010s,
right? It’s like, hm, okay, so maybe you’re just – your processes aren’t that good.
Maybe they haven’t done a reconciliation of their books in a long time, so hey,
let’s bring in our forensic accountants and have them go actually look at their numbers.
JACK: So, their forensic accountant looked through the ledger; how much was paid out and
how much was bought. Yeah, sure enough, millions of dollars more were paid out than were bought,
which means the lottery was losing money, which is not supposed to happen. The lottery
is set up to always generate money, not lose money. But these accountants couldn’t figure
out why. They did confirm that there were significant losses in the system,
but from their analysis, it looked like all of the money was just going
to legitimate winners, [MUSIC] and nothing suspicious at all. This mystery grew deeper.
OS: We then went and started at the very onset of the process. Like,
let’s go physically look at where the actual lottery balls are stored and how they’re stored.
JACK: Now, since this is the governor asking for help, they had all the clearances and
permission they needed to make a visit where the lottery is conducted. He got to get up
close and personal with the lottery balls themselves and analyze them.
OS: Yeah, I got to touch and examine the balls, dude. It was pretty fun.
JACK: The balls seemed fine. None of them were an odd weight or size that
would make them more or less likely to be drawn. It didn’t seem like that was the
problem. So, next, he looked around and asked…
OS: Who all has access to this? Alright, you got cameras, you got door badge access systems…
JACK: He was given the names of everyone who had access to the lottery equipment. Controls seemed
to be properly in place. Only a few people had access to the balls and drawing room.
OS: Then we start down the process of okay, so, day of or day before, what’s your process? Do
you have a reconciliation? Yep, all of these balls get moved – these racks of lottery balls
get moved over and get staged. They get counted again, they get allocated, they get signed off
on. There’s the huge accountability process pre-day. The same day of the lottery drawing,
they go through again first thing in the morning. They do a check-in at lunch and then right before
the actual drawing itself, they do another check and then they roll them out to the public view.
JACK: So, the public view is really TV. Every week, the drawing is done live,
broadcasted on their local TV channel. This is a big deal in Puerto Rico;
many tune in while holding their tickets to see if their numbers are drawn.
OS: We actually had the opportunity to walk out with the balls.
JACK: He means he was able to shadow and keep his eye on the lottery balls
at every step of the way between when he examined them and when they were drawn
on live TV. This way, nothing could be swapped or changed on his watch.
OS: [MUSIC] So, we walked the balls out to – with the actual employee. There was two employees that
were assigned to do nothing but manage the lottery balls. That’s it. That was their sole job. Day in,
day out, they would go in, do accountability, reconcile sheets, and basically count them,
make sure everything was good to go. The way that they sort them; it’s not like we
– how we see here in the United States, ours are, [00:20:00] where they’re these plastic
ping-pong balls. These are like little plastic beads – they’re a little bigger than a bead,
but they have a hole through the middle of them and they’re stored – instead of a plastic
container with locks on them, they’re stored – they slide the beads down a metal rod and each
rod held a certain number of lottery balls, and they would lock, each one of those. So,
it was like this gigantic wooden box with ten rows of these lottery balls in it with
ten locks on the front of it, right? So, they’re rudimentary but tamper-proof to some degree, but
they had full accountability day in and day out of them. Even more heightened on the day of drawing,
they had full accountability of the physical asset that – the lottery balls themselves.
Once they would actually go through, they would dump them into the hopper, and then it would
actually do the hopper draw. It would actually roll a ball down. There was a panel of employees
for the lottery of Puerto Rico that sat up front that that ball, when it came out – they started
from left to right – the first person on the left would get it, put the ball on the little – on the
actual tray. They would have the empty trays and they’d slide the ball down the little empty tray,
document on a piece of paper what the number was, and then they would continue to do that
for the entire drawing, and it would go all the way down. Then whenever they would fill
up an actual lottery ball holder, they would lock them up, they would hand them back to the
individual. They had chain of custody forms and all sorts of craziness. Then it would go – then
all of those paper sheets would actually go into a review room where there were four analysts that
would sit in a review room, and they had them – from start to finish, they had them in order.
So, they would watch a video and pair up how the balls were inside of the actual metallic rack
and validate that yes, that’s correct; that’s the correct ball, that’s the correct drawing number,
et cetera, et cetera, et cetera, right? Then what – that would get them put into the computing
system for the lottery of Puerto Rico, and what would happen then is that would go back into a
database, and that database would then be shared with the government of Puerto Rico’s printing
group, and they would go do a print run of all of the winning numbers in the newspaper. Then they
would also take and actually do – on the news that night – a live notification. It’s published live;
the Puerto Rican lottery, you can watch it locally and national TV live, but then they do a recap on
the news like we do here in the United States to some degree. So, the physical security process
was fully sound. There was nothing that we could find that was amiss. It was like okay,
they’ve got accountability all the way through when they’re printing the numbers. We even
validated the numbers, right? We’re like, that’s right in the paper. Yep, it’s right on the news.
JACK: So, after analyzing the system, they felt like the physical security of the balls
and drawing process was fair and secure. Their next step was for them to follow the numbers.
Once the officials recorded the winning numbers, where do they go next? Well, another government
department handled the next part. See, there was one department in charge of the drawing,
and then there was another department in charge of the payouts. So, they went to the
payouts department and they found the systems where the winning numbers were entered. They
confirmed that the winning numbers did in fact match up with what was actually drawn. Next,
there is a database that gets updated. The database has a list of every single lottery
ticket purchased and what numbers that ticket had. The database takes the winning numbers
and updates all the tickets in the database to indicate if the ticket is a winner and how
much should be paid out. They go and meet with the team that manages this database.
OS: The database administrator goes, who are you and why are you here? Who’s
authorized you to be in here to audit me? I know how to do my job. Leave me alone,
and really was standoffish. I’m like hm, that’s a little odd.
JACK: That is a little odd, but when I was the admin of firewalls for a company,
I was very protective of them, myself. I, too, would ask for credentials of anyone
asking to see what’s inside, just to make sure. So, maybe this is fine.
OS: So, at that point, we’re like okay, we gotta look at the database system itself. So,
it’s a Db2 database and I’m like alright, that’s a pretty sound,
solid financial database. I mean, companies today still use it; highly transactional,
makes sense. [00:25:00] Go through, look at the security configurations and settings.
I didn’t know enough about it, so we hired a professional to come in that was specifically
a Db2 database administrator. He looks at it and he’s like dude, everything looks sound and solid.
JACK: The database administrator checked a few things, first seeing who has access,
and it was everyone who was supposed to have access; just the IT team who was responsible
for maintaining it. Nobody else. Next, he looked at the logic of how the database gets updated,
but that was fine. The tickets that should have been winners were updated properly, and
the tickets that were losers were shown to not pay out anything. So, this database looked fine. Next,
he went down to where people were buying lottery tickets and getting paid for their winnings.
OS: We audited that process, where individuals would go
cash in their lottery tickets. We went and audited several of those stations on the
island ‘cause they were specific locations. It’s not like you could go to any gas station. They had
very specific set up locations where you could go cash in your lottery ticket for winnings.
JACK: This, too, all looked just fine. Nothing strange or unusual here, either. [MUSIC] So,
him and the team looked again to see how much money was missing from the lottery while they
had watched the whole thing take place. Something strange happened; the lottery showed no losses for
the weeks that they were there investigating this and shadowing people and auditing the
payout stations and analyzing the databases. Huh, that’s odd. But that’s a clue in itself.
OS: That’s why we kinda saw a slow trickle when we first got to the island and were inside. Really,
we identified the hard stop was when we went and actually
had the interview and sat with the database team.
JACK: That was the same database team that was questioning him for being there,
so his hunch was that if this stopped happening once he started poking his nose in things,
then he thinks this might be an insider.
OS: So, we take this all back to the governor and we’re like man,
there – the only thing that this is pointing to – you’ve got an insider somewhere, and we don’t
know what it is. It’s on the digital element. The governor of Puerto Rico looks at me and the team
and goes, I know you’re here for security elements. Go do whatever you have to do
to figure this out. You are indemnified of anything – of any digital crime or
physical crime on the island to figure out how the hell I’m losing this money. I said,
can I get that in writing? He said, absolutely. So, to this date, I own an indemnification of
committing any crime on the island of Puerto Rico, which is pretty cool. I’m like, fuck yeah.
JACK: Now, by this point, he’s been there for over a month trying to figure this out. So,
while he thought he was only gonna be there a few weeks, he’s now flying into the island
every week and flying back home on the weekends. But now, he suspects someone inside the lottery
is doing something sneaky. But who? Stay with us because after the break, he goes four steps ahead.
Os has examined every aspect of the network and found nothing that would suggest the lottery is
losing money. He has confirmed that before he got there, it was losing a lot of money,
but whatever was happening stopped since he’s arrived. This makes him believe that there’s
an insider somewhere that stopped once they saw he was investigating. But now the governor of
Puerto Rico, the highest executive position on the island, has granted him full indemnity and
that he may investigate this however he wants, even if it requires breaking the law to do it.
OS: [MUSIC] Absolutely. That’s why they gave me indemnity, ‘cause I…
JACK: You were referring to – can I break into a network?
OS: Can I break into a building?
JACK: Like, were you asking the governor that?
OS: Yeah. I was like, what do you mean by free reign? He’s like, do whatever you need to do.
I was like, so you’re telling me I could go break into a building and I won’t get arrested if – or,
if I get arrested, then I’m indemnified and you’ll drop all charges and you’ll bail me out? He’s like
yeah, and I’ll invite you over to my house to have Chinchon and freaking – some Cuba libres.
JACK: This is exciting.
OS: I geeked out. Like, what the fuck? He was totally – like, me being a pen tester, I’m like,
what the fuck? I just got indemnified by the government of Puerto Rico to do what? Okay.
JACK: This is so unusual. I don’t even – because he’s pretty much been given permission to hack
into the [00:30:00] government of Puerto Rico to find this insider, which is like a penetration
test, right? But typically this is done just to check how secure the network is. In this case,
he was going to hack into the network to try to catch someone conducting criminal activity
inside the lottery’s network. So, that’s a totally different objective from a normal
penetration test. Also, pen testers typically have what’s called a get out of jail free card,
where the head of security has granted them permission to hack into the network
or break into the building. But in Os’ situation, he has a literal get out of
jail free card from the governor which allows him to break laws if he wants.
If he gets arrested, he could just show it to get out of jail. Now, Os has done a number of
penetration tests before he did offensive work while in the Marines, but he’s also conducted
a number of them as a consultant. So, he’s experienced at this and already has a good
lay of the land since he’s been there auditing this whole process for the last month. He knows
how everything is working and who all the people are that make it work. The first thing he does
is notify the FBI. Now, you might be wondering, why would be FBI be interested in what’s going
on in the lottery of Puerto Rico? Well, that’s because Puerto Rico is a territory of the US,
so there’s actually an FBI field office over there, and Os thought this was a criminal case
worthy of the FBI knowing about, and that he was investigating it and had permission to do so.
OS: They were like alright, go investigate, get everything that you can. You have carte blanche
to do whatever you want, right? Like, literally carte blanche. Mind you, up into that point,
I had been suit and tie every freaking day, right, as a consultant is, usually on your customer’s
site. I freaking dropped into straight civilian clothes, acting like a tourist. I did some things
to change my appearance and walked right into the government building and started to look around.
JACK: He went into this building because he knew this is where the database and main
network for the lottery payout system actually sat. He figures if he can get into the building,
he might be able to get into the network covertly. But you might wonder if he has
full permission from the governor, why not just get official authorization to log into
the network systems himself? Well, he did that, remember? He found nothing. That might have been
because it’s very obvious that he was in there looking around for this particular
thing. If you’re some insider hacking the system and you’re trying not to get caught,
you’re not gonna be in the network doing bad stuff when you have auditors looking over your shoulder,
right? So, he wants to go in covertly to see if he can find malicious insider activity when they
think they aren’t being watched. [MUSIC] So, he heads into this government building with the goal
of finding a way into the network. But to be successful, he needs to bring some supplies.
OS: Full-on lock pick set. Like, that was number one. I had two laptops with me. I
carried them everywhere I went. I had my forensics laptop and my offensive security
laptop. The standard tools that I also carry is a pocket knife and a flashlight, right?
JACK: Looking like a tourist, he heads into the government building. Now,
this is a publicly-accessible building with places that citizens can go and take care
of things like permits or even cash in lottery tickets there. On top of that,
he’s been in this building a few times already as he was auditing the whole lottery process.
OS: There was a door that – where I knew the finance office was. Like, the finance
office, you’re – say you’re walking down a hallway and you come to a T intersection. To the right,
there was a sign that said Finance but straight ahead, like ten feet ahead past
that T intersection on the right-hand side, there was a door. I was like hm, I wonder if that’s
where they keep physical financial records. Might be a computer in there that’s unlocked, right? So,
that’s what I was thinking off the top of my head. I look up and there’s no cameras pointed
at this door. They’re pointed down the main corridor facing towards where the entrance of
the government of Puerto Rico’s entrance is, and then down the corridor of where the finance office
main door is, but there’s not one facing – or towards me or facing behind my back at that door,
because there was an end of a hallway. So, there was nowhere you could go, basically,
at the end of it. So, I’m like okay, so I just lean up against the freaking wall and
jiggle the handle. It’s locked, so I pull out my lock pick set.
JACK: He starts trying to pick the lock which is not a fast or easy thing to do. It takes time and
patience and lots of trial and error. You might not have the right tool at first and you need to
try a different one. You don’t know if you need to turn the lock to the right or left to unlock it,
so it’s kind of like throwing darts in the dark. At the same time, he’s nervous and
someone could be coming around the corner at any moment and see what he’s doing and
question him. But after a short while, he gets the lock open [00:35:00] and opens the door.
OS: [MUSIC] I pop the lock on this door. I was correct; it was the Finance Department. I was
correct; it’s where all the physical freaking documents were. I was correct that there were
computers in there. I was incorrect in identifying that there might be people
fucking sitting in there. So, four people turn the fuck around and look at me and go, what are
you doing here? How did you open that door? That door’s supposed to be locked. I’m like oh, shit.
JACK: He just goes right back out into the hallway and closes the door.
He sees that people were getting up to come see what he was doing.
OS: I was like oh, here I go, I’m going to fucking Puerto Rican jail. This is gonna suck,
right? I was freaking the hell out, dude. I didn’t know if I could believe the governor
of Puerto Rico or not. Is he really gonna bail me out of jail? How long is it gonna take for
them to realize that I’m in jail, right? Those are thoughts going through my head when that happened.
JACK: He had to think fast. He did some mental calculus; should he run? Well, that
would certainly make him look more suspicious and it could get him kicked out of the building for
good. Instead, he wanted to contain this problem to just this office, so he walks around to the
front door of this finance office and he tries to think of a story. Because he’s been there before,
he remembers that the floor above him is where the passport office is, and that’s what he decides to
use as an excuse. He was going to act like a lost tourist not able to speak Spanish and was
looking for the passport office. So, he puts on a face and walks into the finance office.
OS: I’m like hey, I was told to come here because this is the passport office. So,
the director of finance for the entire government of Puerto Rico was one of the
guys that was sitting in the back, right? He walks out and he’s like,
that door was not unlocked. I was like, it was. I just pushed on it. I don’t know. Sorry,
sir. I’m really…I lost my passport. I’m trying to go to Cuba. Because at the time, you could
fly from Puerto Rico to Cuba. You couldn’t fly direct from the United States to Cuba,
but you could fly to Puerto Rico and then fly from Puerto Rico to Cuba as a United States citizen,
right? This director of finance was giving me the side eye but he’s like yeah, follow me.
JACK: He gets escorted to the passport office. He was trying to contain his stress on the way,
and on the walk there, the head of finance was curious of the situation.
OS: Well, he drops me off at the passport office and I walk in. I’m like hey – so,
I fill out a bunch of documents and act like I need to get a freaking – my passport,
basically, freaking renewed because I had lost it or whatever, and waited
‘til he left. I just kinda sat ‘cause there were quite a few people in there,
and I just sat and just kinda waited for about half an hour or so, if I recall,
and then bounced out and continued on down the path. Totally almost got fucking popped.
JACK: He left the building. That was enough excitement for a day. Who knows
what would happen if they called security on him or caught him on
another floor trying to open other doors? He decided to leave and let things cool down.
OS: Ended up in a – and going back the next day. I had already seen what looked like a
lunch room area up on the third floor. So, this is – mind you, the government building’s like,
seven stories tall. I was like, it looks like a little lunch room. I was like,
I’ll go check that out today. So, I head up to the third floor. Mind you, Finance was on first
floor. Second floor was the passport office, so – opsec was in terrible aspects of multiple things,
and I included this in my report to the governor of Puerto Rico. I was like dude,
you have all these financial records that are sitting – your physical financial records are
sitting on the first floor. You have hurricanes and flooding continuously
on this island; you might want to think about moving that to a higher level. Shit like that.
Those were kinda other recommendations that we were putting out there for him.
JACK: He gets up to the lunch room area, then walks around the hallways near there. He sees
another door and tries to guess what’s inside it. He puts his ear up to the door. No noises
are coming from inside. There are no windows to see in, either. He walks around the halls. No
signs as to what this office might be, and it’s not connected to any others;
it’s sort of a secluded office with no signage. Hm. He pulls out his lock picks
and starts working on the lock. [MUSIC] After a few minutes, he gets it open and looks inside.
OS: When I opened the door, man, it’s like, freaking inch and a half,
two inches of fucking dust all over the fucking floor, dude. I look to my
right and there’s three PCs lined up in a row that have plastic pulled over them. There’s
no lights on in here, so I’m like okay, cool. [00:40:00] So, I literally pull
my flashlight out and make my way over the computers, dude. Lo and behold, one’s running.
JACK: Nice. This is great for him; a room that nobody ever visits. It’s dark, it’s quiet,
and it has a running computer. This could be gold. If this computer is connected to
the lottery network, then he can use it to watch and gather data he needs to catch the insider.
OS: I close the door behind me and I actually set my laptop up against it so if,
for whatever reason, someone came in, it would knock it over and alert me to – it wasn’t a big
room. It was probably the size of – I’d say it was probably a fifty foot by fifty foot,
but it would give me enough time to at least lock down everything that I was doing. I’m like, oh,
sweet. Let’s go check this out. So, I lift the plastic off the monitor. I’m like, let’s see
if it even works. Turn the monitor on; presented with a log-in screen for Windows 98 with the admin
account. I’m like hm, it’s not gonna be this easy, right? Like, admin, admin. Nah, doesn’t work. So,
I sit there and I’m like, let’s just sit here and think through this and logically – if I were
the administrator or system administrator for the government of Puerto Rico and was running
a 1998 system, what would I use as the password for admin to get on the system? So, I run through
your typical default list of passwords for admin, like admin/admin, admin/administrator, admin/root,
freaking – et cetera, et cetera. I try this over a period of a couple hours ‘cause I didn’t want to
potentially trip if they had any alarms, like multiple failed log-in attempts on a system.
JACK: None of his log-in attempts worked. He couldn’t guess the right password. He found
some open Ethernet ports and tried plugging into them, but none of them worked. He thought
about unplugging the one running computer from the network and plugging his laptop into it,
but he wasn’t sure if this computer was running anything important. He wanted to
be as quiet as possible. So, he went home for the night to rethink and strategize.
OS: I’m like, alright; Metasploit, what do you have for 1998 Windows systems?
There was a boot screen freaking – what is it? The accessibility feature – I can’t
remember what the actual vulnerability was, but basically ended up being able
to create an exploit that I could plug in a USB and bypass the log-in screen.
JACK: Okay, so Metasploit is a really cool toolkit with lots of exploits and
vulnerabilities that are all prepackaged and ready for you to just hack into things. He
creates this USB drive with the exploit payload on it, and if the exploit works,
he should be able to just go back to that computer, plug in the USB drive,
and get into the system. [MUSIC] So, he goes back the next day, heads up to the same room,
picks the lock to get it open, puts his laptop against the door as a rudimentary alarm system,
and pulls out his malicious USB stick, and puts it in the computer running Windows 98.
OS: Drop it in, get full access. Sweet.
JACK: He’s now on this computer as an administrator. Amazing. But he quickly
realizes he’s only administrator for this computer. It doesn’t give
him access to anything else. He checks the network status. Yes,
this computer is on the network and yes, he can reach the lottery network from here. Fantastic.
OS: I’m like, alright, I’ve got this access into this system, I’m local admin. Is there
any antivirus running on it? It didn’t flag for my exploit to come on, so that’s kinda cool. No
local antivirus on the system. Connected to the network. So, I’m like alright, so, I have
a couple options here; I can either unplug and hope that they’re not doing freaking 802.11x, like
NIC-based security or if they’re doing Mac address filtering security, et cetera, et cetera. I start
thinking through, like, what are my options here? Do I install tools locally on this system or do I
unplug the NIC from the system and then jack in with my pen testing laptop? Well, in the meantime,
I’m like alright, well, I have local admin. Let me go ahead and dump the credential files.
JACK: When you have users on a computer, their username and password hash is stored somewhere
on that computer. When you’re administrator, you can see the password hash. Now, the password
hash isn’t the password; it’s the result of the password when it’s passed through an algorithm,
and it looks like scrambled letters. So, he grabs this hash file to try to crack
the passwords on this computer, because [00:45:00] with the USB exploit he used,
he just bypassed the log-in process. He didn’t actually use a password to get in. So,
he thinks if he can crack the password on this computer,
then he can try using this username and password to get into other computers on the network.
OS: So, I dropped that to my thumb drive, pull that off, throw that into my pen test laptop.
JACK: He then runs a tool called John the Ripper to try hundreds of thousands of passwords to
see if they match the hash. The program can try hundreds of passwords per second or more
depending on how fast the computer is, so he knows this will take a while, and just lets it run.
OS: So, I’m like you know what? Fuck it. They haven’t been aware that this
system’s online. They’re not gonna know if it goes offline, so I unplug…
JACK: He only unplugged the network cable, not the power cable.
OS: …and actually leave it unplugged overnight just to see what happened,
right? So, I leave the room, I leave it unplugged overnight, go and build
another thumb drive that has a bunch of tools on it like Nmap and freaking man-in-the-middle
tools. But basically, I build my tool suite onto a thumb drive that I can take and actually
just run off of my thumb drive instead of installing directly onto the system, right?
JACK: [MUSIC] With all kinds of extra tools, he heads back the next day,
goes up to the floor, picks the lock, gets back in, sets the laptop against the door,
and goes back to the computer. He plugs the computer back into the network port and all
is fine. So, he plugs in the USB drive and starts to run one of these tools he brought.
OS: So, I actually enumerate the network.
JACK: This is the typical first thing a pen tester does to get a lay of the land. Enumerating the
network is basically getting a map of what’s out there. You can ask certain systems what
other computers do they know about, and they’ll be happy to tell you. Nmap scans are also common
which can scan a whole range of IP addresses inside the network to see if anything responds.
OS: I knew the IP address ranges for the IT systems over in the lottery,
so I was like well, let me see if I can ping those IP addresses and see
how this network looks. It was like – basically looked flat.
JACK: I like to think of a flat network like an empty hull of a ship. If it’s just one big,
open space in the hull and there’s a hole in the hull, the entire hull can fill up with water. So,
a good idea is to segment your network so that if someone gets into one part of your network, they
are completely blocked off from getting into other parts. So, what he found is this long-forgotten
computer not only was connected to the network, but it could reach every part of the network
since nothing was blocking it. This was fantastic for Os who wanted to find a way into the systems
he thought were suspect. But now it’s closing in on the end of the third day. He’s thinking
it’s starting to get risky if he has to come back here every day and pick a lock and sneak in, so
he sets up a reverse shell to this computer. This allows him to go back to the hotel and from there,
he can remotely connect into this computer and use it as if he’s sitting right in front of it. So,
he goes back to the hotel and looks at the scans that he was doing on the lottery’s IP range.
OS: I find a web server that has port 80 and I’m like alright,
that’s cool. I wonder if it’s open from the outside.
JACK: By ‘open to the outside’,
he means can he get to it from the World Wide Web and not the local network?
OS: So, I ran a scan on the outside of the network as well. Again, fortunately for us, we had already
been given the IP addresses for the entirety of not just the lottery, but the government of Puerto
Rico because as we were talking with them, we’re like look, maybe someone compromised them from
the outside and you’re getting money siphoned off, right? Maybe that’s a possibility. So,
we asked and they provided. So, I run a port scan against the outside, find the web server
that enumerates at the same version of Drupal that I had. I go through the Metasploit table;
there’s an exploit for remote code execution, exploit for – and it’s running on a Linux system.
JACK: So, when trying to exploit a system and get unauthorized access to it,
the more you know about it, the better. A scan might show you what kind of server is running,
what kind of web framework is on that. In this case, Drupal was the web framework
and the operating system was Linux. On top of that, you might get versions of what software
is on that system. If you know what version it’s running, you can go look to see if that
version has any known vulnerabilities that you can exploit. Os found a vulnerability for that
version of Drupal and tried to exploit it from the outside, and [MUSIC] bingo,
it worked. He got in, which is always a rush to hack into a system from the outside.
OS: I was like, holy fuck yes. Literally, the whole team was sitting around the table and
I’m sitting there freaking – I’m drinking a Mai Tai at this point. I’m like fuck yes, check this
out. I’m doing my due diligence with screenshots and all that other shit, right? They were like,
are you fucking serious? I’m like, yeah. So, I do general commands to show [00:50:00] who am I,
and it shows root. Then I actually do freaking a dump of basically the file structure and freaking
show that it’s actually the Puerto Rican web server, right, not just some random-ass server,
dude. Start pinging internal IP addresses that they had already grabbed forensic images off
of as well, too. They were like, holy shit. I’m like yeah, from the hotel WiFi, bro. What’s up.
JACK: Excellent. He’s now in a system inside the lottery’s network,
and from here he’s able to get into other computers and route traffic to this Linux
server so he can capture and analyze the traffic in the network. This is the man-in-the-middle
attack that he was wanting to do. It’s kind of like a wire tap but for network traffic. So,
once he’s got all this set up, he watches the traffic day in and day out.
OS: Basically, this is – yeah, we’re about, what, month three and a quarter at this point. So,
what we did is we actually started laying low once I actually had popped everything and had access,
and just started monitoring. We were sitting just at the hotel monitoring. I’m chilling,
hanging out. We know that the drawing goes, we know that the actual input goes
the night of the drawing, but doesn’t start the payouts ‘til the morning.
We see a log-in from the individual – one of the database individual systems into the mainframe,
which was abnormal to see that. Then, at that point we said okay, we need to go basically
get on this mainframe. So, the governor of Puerto Rico forced the CIO to give us physical
access into that mainframe. They basically pulled the CIO from his job and placed him
on temporary leave. We have administrative access on this mainframe, this IBM mainframe
where the database is running, and we put some monitoring tools on and just started monitoring.
JACK: They were able to watch the logs of the database; who logs in, what changes do they make,
what data is being updated. With a database like this, there are tons of changes. So, when someone
comes to cash in their winning lottery ticket, they take it to a place where they can cash it,
and the clerk scans the ticket. At that point, the scanner will check the database to see if
it’s a winning ticket or not. So, already the database has a read operation that would show
the logs. Then the database tells the clerk this is a winning ticket; you should pay this
amount. When the clerk pays it, it updates the database to indicate this ticket has been
paid and it shouldn’t be cashed out again. So, every lottery ticket that gets paid,
there’s an update to the database, which means there’s a lot of logs that he’s gotta sift
through to try to find anything unusual. So, he’s watching these transactions happen all day, every
day. A clerk scans a winning lottery ticket; it’s a winner and should be paid out for a dollar, and
the clerk pays out the dollar. Nothing odd there. But as he looks closer at these logs and analyzes
them more, he sees something. [MUSIC] He sees someone change the payout amount for a winning
lottery ticket. They went into the database and made the payout higher than it actually was.
OS: The payout was supposed to be a dollar, but it would change to like,
$10,000. You would see the transaction for $10,000 exit, and then you would see
the amount that was actually paid out go back to a dollar in the database.
JACK: This was it. This was the smoking gun. Someone inside the lottery IT team
was going into the database and changing one number, waiting for the payout to happen,
and then changing it back. This is why when they audited all the transactions before,
they didn’t find any sign of this happening, because someone’s going in the database and
wiping the evidence. It was only from sitting patiently, doing some real-time monitoring of
logs, collecting network traffic, and watching these tickets get paid out that they caught this.
OS: At the point that I had actually dropped in and we were monitoring and we see this,
I immediately have to contact the bureau, the FBI field office in Puerto Rico.
JACK: The governor wanted whoever was behind this arrested and instructed him to contact
the FBI. Remember, Puerto Rico is a territory of the US, so there’s an FBI field office on
the island. But before he could give the FBI all this evidence, he needed to figure out who
the person was that was making these changes, because the problem was whoever was doing this
was using the username ‘service’ to make these changes, not his actual username. So, it wasn’t
clear who was going in and making these changes. [00:55:00] But the thing about this database,
because it’s a super-secure database, the only way to actually make changes to it is to physically go
into the data center room where the server was and log into it that way. There was no
way to connect into this thing remotely. This is great because now he just needs to know who was
in the room during that time that the change was made, and there’s an easy way to figure that out;
security camera footage. Os gets access to the video and rewinds it to that moment.
OS: [MUSIC] We’d see him walk into the server room like, two seconds later, log into the mainframe,
be there for a few minutes, and then leave. So, we were able to tie hey,
there was a transaction that occurred between here and here. What was this at this time? So, what
they started doing is taking snapshots on that database, like literally on the hour, basically,
and they were able to actual – what we were able to point out is look,
last night’s synchronization of this, this ticket should have paid out a dollar. It
changed at this time. Here’s camera feed, here’s network access into the mainframe,
here’s camera feed access to him walking into the server room where the mainframe is,
here’s the modification into the payout table, and here’s a modification of the actual payout table
being done again. Here’s him walking out of that server room, badging in back into the database, or
the IT room, and here’s video feed footage of that as well. So, we nailed, tied down, all the way up.
JACK: So, this explains what was happening inside the network at the time,
but what about what’s happening outside the network at the payout
stations? This operation must have been coordinated with someone outside.
OS: Yep, so they would say I will be at this payout station at this time,
so this guy would go in ten minutes beforehand, change the payout amount. The person will walk
up with a boleto, take a number. They would actually type in the boleto serial number,
and it would be for $10,000 versus a dollar. He would see the transaction process and then
immediately go flip it back to a dollar. So, the individuals on the end, at the payout stations,
didn’t know. They were like oh, this is a $10,000 winning ticket; sweet. Here’s your $10,000.
JACK: Os has cracked the case. He’s figured out how the millions of dollars are being stolen from
the lottery, and he knows exactly who did it with all the evidence showing how it was done.
OS: We called the bureau. We’re like dude, we’ve got soup to nuts evidence of freaking
fraud right here. Like full on, we know that this is happening;
definitive – this individual is fully active and doing this. The bureau’s like cool, wrap up all
your information. This is kinda freaking fun. When you meet with the bureau to do data drops,
you think you’d go to a field office and go hand them whatever evidence you had. Well, that’s not
the case here. Because we were the gringos on the island, because they had freaking taken
and actually put the CIO on leave, and basically we had interviewed and there was already enough
noise fluttering around and people were starting to kinda talk. The FBI mentioned to us that hey,
there’s chatter in the cartels that there’s gringos on the island actively investigating.
Be heads up. That’s why we went in to wait for a little while post me actually having access. One,
I needed to collect evidence, and two, we were laying low because the cartel – there
was chatter from the FBI that the cartel was aware that there was some sort of
investigation going on. But once we actually – so, this is the fun part, though.
Again, what I was trying to say is that you would think that it would be a field office
that you go walk this data into. Well, no. Here, I’m a gringo in freaking Puerto Rico, right? They
call outsiders gringos, right? So, they – the FBI, instead of having – and this tripped me the fuck
out because I had worked with them tons in the military, right? It tripped me the fuck out when
they go yeah, meet us at the mall food court and just bring it all on a thumb drive. [MUSIC] I’m
like, what the fuck? So, I go to the Puerto Rico mall to meet the bureau to transfer the empirical
data that we have at this point on at least this database administrator making these manipulations
and payouts, right? And literally meet these two guys wearing casual clothes. We go order our
food at the little food stall. We’re walking with the trays [01:00:00] and he’s like, you got that
thumb drive? Just drop it on my tray while we’re walking. Then I do; he grabs it, puts it in his
pocket, and we go sit down and eat lunch. Kinda fucking wild, right? It’s like, what the fuck?
JACK: Supposedly the reason for this is safety and security. There are drug cartels on the
island and the FBI knows that the cartels are watching the FBI field office very closely and
knows everyone who comes in and out. Since Os was already being talked about by the cartel,
they didn’t want to tip off anyone that Os might have found something and was meeting
with the FBI. So, they made it look like it was just a casual lunch meeting. Surely you wouldn’t
pass along top-secret evidence to someone in a public place where anyone can hear,
right? That was exactly why they did it there.
OS: Whenever I made that dead drop to them, they jumped on and looked at it, right? But I get a
call like, 7:00 that night; hey, meet us at X location. We want a debrief basically of what’s on
here and walk us through like I’m talking to you right now on the details of what’s happened. I had
my significant other actually traveling into town that was supposed to be there at like, 9:00. I
didn’t get out of my debrief until like, freaking almost midnight, and missed picking my significant
other up at the airport. They were standing at the airport in the dark with the lights off, and
I wasn’t able to leave ‘cause I’m doing a debrief to the FBI. I tell them hey, my significant other
is over at the airport. Would y’all mind going and picking them up? They go, sure. So, they drive by.
JACK: But the FBI didn’t pick anyone up. They just drove by and said they didn’t see anyone,
and left. So, by the time the debrief was over,
Os calls his significant other to see what was going on.
OS: My significant other was just fucking furious, bro. Like,
just absolutely beyond pissed off. Here I am; I can’t explain shit to them.
JACK: The reason why he can’t explain this is because it’s a classified case.
He can’t explain that he was with the FBI the whole time, because what if the cartels
are tapping his phone or something, right? So, all Os could do is just make up a story.
OS: I’m so sorry. I fell asleep.
JACK: But of course, that wasn’t the case. He just couldn’t explain. At least, not here, not
now. But he returns back to his hotel and stays on the island a little longer to assist the FBI.
OS: They basically put us on monitored custody. They were following us everywhere we went.
JACK: He kept meeting with the FBI to provide more
evidence and information that he had access to that might help the case.
OS: The bureau took over most of the investigation. We had some limited
support to them as more ancillary and informational just to fill in
gaps that they weren’t able to pick up out of what we had provided and whatnot.
JACK: The FBI was uncovering evidence that the names Os had provided were linked to a cartel
on the island, [MUSIC] basically an illegal drug smuggling group. The FBI somehow found a cartel
member with lottery tickets and confiscated the tickets from him. They call the lottery tickets
boletos there, and so, the FBI was curious; what if they try to cash in these boletos? So,
they get someone to go undercover into a payout station and hand them one of these boletos that
was from a cartel member. The payout clerk looks at the serial number on the ticket,
and back at the undercover agent, and doesn’t even try to cash the ticket. Instead says…
OS: Pull around back into the garage and then someone would help them out shortly, which turned
out to be the individual was told to pop their trunk, don’t look back, and go drive to this
location. So, they popped their trunk, stuff was put into it, they drove to basically where – not
where they were told to go and basically wherever they went, I don’t know. They popped the trunk to
look in there to find that they had like, fifty kilos of cocaine and forty freaking assault
rifles, man. So, not only were they stealing money from the government of Puerto Rico,
they were also running guns and drugs through that process.
JACK: Apparently the people who worked at the payout station itself were also part of this.
They had a system set up that if someone came with a specific ticket, it meant they were a driver for
the cartel and here for a pickup. So, when the FBI pulled around back and got the car loaded
up with cocaine and weapons, this was quite a surprise. They realized they had stumbled
upon something much bigger than just lottery fraud. But somehow it was all linked together.
OS: [01:05:00] So, a pretty elaborate scheme from the cartel. So, at that point,
the bureau literally safety-extradited us off the island. They were like,
y’all gotta get the hell outta here. Like, y’all – you’ve interrupted a huge cartel
operation and we’re gonna do the takedown, and y’all need to get the hell off the island.
JACK: So, of course Os booked it out of there. This is why he didn’t want to have his name
mentioned in this episode, because his life was in danger for uncovering this cartel operation
in Puerto Rico, which means that even though he still has indemnity from the governor to commit
crimes on the island, he’ll likely never go back. The FBI indicted ten people involved in
this case. An indictment is just a charge against someone basically listing reasons why these people
should be arrested. The indictment claims that these people took 12 million dollars to a nearby
island and bought cocaine and brought it back to Puerto Rico. They used boats and airplanes to
traffic the drugs in, and used BlackBerry phones to communicate with, and they even had spiritual
rituals before doing a big buy. They intended to distribute and sell this in Puerto Rico for
financial gains. The indictment also claims that three of the people listed were involved
with laundering money through the lottery. In total, the FBI believed that these ten people
illicitly generated 127 million dollars from the sale of drugs and weapons and lottery tickets.
The feds wanted to try to seize all this money if they found it, as well as planes,
boats, cars, and property that was part of the operation. As I looked through this case,
it links back to a case where a few years earlier, twenty other people were arrested,
including the leader of this cartel. A lot of evidence points to testimony from what those
people said in their trial. Ten individuals were arrested from this operation that Os uncovered.
The first few I looked at all pled not guilty at first, and then switched to guilty. Those
people got five to fifteen years in prison for this. One guy held onto his not guilty plea,
which meant that this case went to trial, which is cool for me because now I can see a lot more
details about this case, because the court transcripts are publicly available. It turns
out they were using these winning lottery tickets to launder money. Here’s how they
did it; [MUSIC] the court records show that they had someone inside the lottery who would produce
winning lottery tickets. Then those winning lottery tickets were sold to people in the cartel
for 20% more than whatever it was worth, so if the winning lottery ticket was worth $10,000, the
cartel members could buy the ticket for $12,000. The reason for this is because the cartel had a
lot of illicit cash and they wanted a way to make the cash look legitimate. So, when they’d cash in
the winning lottery ticket, they would get a check from the Puerto Rico lottery and take the check
to their bank to deposit it. This would allow them to legally declare their winnings on their
taxes. This way, they had a nice, clean record of where they got their money from. Sneaky stuff.
Anyway, this guy who went to trial was found guilty, and the judge sentenced him to life
in prison not just for this lottery stuff but also for the cocaine and weapon smuggling. So,
this brings us to the guy inside the IT department at the lottery. He was one of the ten that got
arrested, and he appears to be a really dangerous guy. He was being charged with all four counts of
drug running and lottery fraud, but I called up Puerto Rico and I spoke to someone who was
close to him, and they said he was a good guy and just fell in with the wrong crowd. See,
besides being an IT guy, he also had a private pilot’s license and liked flying planes,
and on the weekends he would charter tours in his planes to show people around the island. Well,
this cartel heard about his planes and hired him to move some drugs from one island to another.
Eventually, he was being hired to do more and more trips for the cartel. He got out on bail
while the courts figured out what to do with him. At first he pled not guilty, but then he came
back into court and changed his plea to guilty. The court said okay, come back in four months
and we’ll determine your sentence. Well, in that four-month timeframe, he somehow got involved with
this cartel again and was part of a mission where he had to capture someone and take them somewhere,
and in that mission, he was shot and killed. The police found $30,000 in his car after that.
This is a surprise ending for me. The IT guy who was changing the numbers in the database
was shot and killed in the end? While playing the lottery itself is a gamble, this guy was
gambling with his life. When the stakes are that high, you might either get rich or die trying.
(OUTRO): [OUTRO MUSIC] A big thank you to Owl Stalker, Os, for sharing this story with us.
He’s been sitting on this one [01:10:00] for a while, not telling anyone this whole story,
and I’m thrilled to be sharing it with you which is the first time this story’s ever been told
publicly. If you like stories like this, if you think they’re valuable, please consider supporting
the show. I’m an independent creator and I can focus on this full-time through listener support.
If you donate to the show, you’ll get bonus episodes and an ad-free version of the show. So,
please visit patreon.com/darknetdiaries and consider supporting the show. Thank you. This
show is made by me, El Lince Oscuro, Jack Rhysider. Sound design and original music
was created by the Lobo Loco Andrew Meriwether. Editing help this episode by the Siempre Lista,
Damienne, and our theme music is done by the Melodica Breakmaster Cylinder. Hey,
what do you call two monkeys that share one Amazon account? Prime mates. This is Darknet Diaries.