Campus Security

Speaker 1: There's definitely this idea of concept creep.

Speaker 2: So there's this data journalist named Ari. He's with the Dallas Morning News. And back when he was a student at UNC Chapel Hill,

Speaker 1: There were these protests going on over this Confederate statue called Silent Sam.

Speaker 2: Silent Sam is a statue of a Confederate soldier. The statue has faced protests since the nineteen sixties, but those protests reached an inflection point when Ari was at school there. And Ari started asking these questions.

Speaker 1: Not necessarily what was happening on the ground at the protests, but what was happening behind the scenes. Right? What were the police saying to each other in emails back and forth? What were the administrators saying? And so I put in a public records request at UNC, for documents related to the protests.

Speaker 2: He waits for a response.

Speaker 1: And that records request basically got denied by the university. And so I I was a little bit angry about that.

Speaker 2: But Ari is not a data aficionado. He is a data journalist. So he kept digging.

Speaker 1: UNC has a public Polk records log, so you can see what other people have requested. So I requested everything that other people had requested about the statue.

Speaker 2: Which ends up being hundreds of different requests. So in turn It

Speaker 1: ended up with, like, thousands and thousands of pages of documents. And buried inside of those documents was this contract for this service, the social media monitoring service, Social Sentinel.

Speaker 2: Which today goes by the name Navigate three sixty detect.

Speaker 1: There's a sort of motto in investigative journalism, which is to turn every page, and we've really turned every page.

Speaker 2: But slowly, tediously, a picture of this software, how it works, how it's marketed, and importantly, how it's actually used starts to emerge.

Speaker 1: So I wrote a story about that.

Speaker 2: So the pitch for this is pretty simple. Bad stuff happens on campuses all the time, and sometimes the folks who do those things post about it online beforehand. And what if you had an AI tool that could parse the open Internet for any content that connects those subjects with the campus? That would be a very powerful way to prevent maybe those bad things from happening. That's how this product is marketed publicly. It's how it's marketed on their website and very slick promotional videos. It's how it's marketed on their blog. This is a safety tool for schools. It's not for anything else. It's It's not for monitoring those protests Ari mentioned at the start of the show. It's not for anything related to free speech, critical speech, or the first amendment. But as Ari's research started to show, there's another promotional channel, another way this software is being marketed. And how it's being sold over there raises all of these really interesting questions about data and surveillance and security and all the stuff that you and I like to talk about?

Speaker 1: There's there's two different promotion channels. There's what they are telling the press and the public, and what's on their website and what they're saying to, you know, potential clients and to clients and emails behind the scenes. And so what they say in public is that, you know, this is a really sophisticated AI service that will flag threats of suicides and shootings, that it is respectful of people's first amendment activity, that it doesn't have the capability to monitor for protests. But if you look at the emails that they were sending to colleges from, you know, 2015 onward, you know, we were seeing a lot of emails from salespeople talking about how they could mitigate protests and forestall protests.

Speaker 2: You have one product, two sales pitches. Sold a safety to the public and something else to the buyer. So I had a conversation with Ari to ask him how he gathered and parse through all of this data, these emails and posts and messages so that you and I could talk about it, Scott. To try and learn more about the software that itself gathers and parses huge volumes of data. But what this is for, who is using it and to what end? And One of us will say here on hacked

Speaker 3: here on hacked

Speaker 2: here on hacked

Speaker 3: K. The first thing I wanna talk about is the name of this product.

Speaker 2: Okay.

Speaker 3: Do you wanna repeat it? Because I don't remember it, but it was ridiculous. It was, like, Connect three sixty.

Speaker 2: Oh, man. K. So throughout this story, it's gone through a bunch of different renamings, namings and renamings. So for the sake of convenience, we're just gonna refer to it kind of all by, like, it and the company all by its what's been its name for a long time, which is Social Sentinel. It has since been renamed, Navigate three sixty Detect. I believe it was sold to a company called Navigate three sixty, and they've rebranded this product as Detect.

Speaker 3: Okay. That makes sense.

Speaker 2: But I hate that name, and I don't wanna yeah. I just don't wanna say that name. So I will go three

Speaker 3: sixty connect. The second you said it, I was like, what? Detect. Yeah. Detect sounds better, but, like, navigate three sixty detect is just a bit too much. You know? Like, we work in advertising. We know it's too much. Navigate three sixty. Okay. Navigate detect. Okay. Navigate three sixty detect. Too much. One step too far.

Speaker 2: Even three sixty detect. You can really mix and match all of those words, and I'm fine with it. But when you string them all together, it's a little much.

Speaker 3: I know that's a crucial crux of this story is the name of the product, so I'm glad that we're getting this covered right away.

Speaker 2: I like that we're establishing that our biggest, like, issue with this software is in the name. It's there's nothing substantive. There's no, like, real problem we have with what is being done here. It's just marketed very, very sloppily.

Speaker 3: Before we really get into the meat and potatoes, I just wanna touch on. We got an email from Mad Mowgli, aka Joel, who gave us some more details about the actual hack of the Mesa Mafia. Oh, yeah. Passed us over a YouTube video that kinda covered it that we we hadn't seen to know about. So appreciate that. It was, it was it looks like it was, you know, a contract kinda hack to get gets get a little bit a little bit a online cyber revenge. So pretty pretty neat. So bring the thing. Maybe we'll tweet that video out so that people could see it. The, the other thing we should do is maybe thank some of our new patrons. So I think we got a few new patrons since the last show, so appreciate that. If you feel the need and you wanna support the show, feel free to go to patreon.com/hackedpodcast. We appreciate and love you all.

Speaker 2: Love you all. Pressure, though. No. A little bit of pressure. No. High high pressure. High high pressure sales tactics. Scott, but about here on hacked. Cyberbullying via podcast. For a Patreon. It was we always knew it was gonna end up here.

Speaker 3: Yeah. If you become a patron and stop being a patron, you get 10 times more show call outs than you do if you become a become a patron.

Speaker 2: Today's podcast is brought to you by NordLayer. NordLayer safeguards your company's network, but it's also a lot more than just a VPN for business. As you already know from this podcast, business networks today are more vulnerable than ever due to where do we start? Remote work, ransomware attacks, and data leak incidents. NordLayer secures and protects both remote workforces as well as business data, and it can even help you ensure security compliance. Simply go to nordlayer.com/hacked and get an entire month free. NordLayer is easy to start. It takes less than ten minutes to onboard your entire business onto a secure network. NordLayer is easy to combine as it's hardware free and it's compatible with all major operating systems. And finally, NordLayer is easy to scale as you can choose a plan unique to your business requirements and your rate of growth. If you wanna secure your business network, go to nordlayer.com/hacked to get your first month free. That's nordlayer.com/hacked. Question. Were you on the Facebook when it was still the Facebook? This is relevant. I promise.

Speaker 3: I joined Facebook when I came to Canada, and I wanna say that was, like, 2003. So I don't actually remember if it was the Facebook. I think it might have just I think when they did their global launch out of The USA, it was they had migrated from the Facebook to Facebook by then. So I think you had to be an American university student to really get in on the Facebook. So, no, I don't believe I was.

Speaker 2: I don't think I was either. I think I caught it right as it was coming to high schools. Like, right as it it dropped out of you need a university email to you need a you need someone from your high school to invite you, I think was was the criteria back when I joined.

Speaker 3: If anything that demonstrates the idea of manufactured scarcity, you know, it's like everybody can have an account, but you can't have an it was like Google did that when they launched Gmail. Remember? They sent everybody five invites, and then it kind of spiderweb grew out from there. It's, like, such an interesting thing. Manufactured scarcity. That's, the name of Jordan and I's marketing podcast that we're never gonna launch, but it's a great idea and a great name.

Speaker 2: Like, this is just gradually becoming a podcast about all the other podcasts that we should start, and we, like, kick one of these out every two weeks.

Speaker 3: We did get some love on Twitter about the idea of starting a gaming podcast, so

Speaker 4: that would be hilarious. That's

Speaker 2: a great idea. Yeah. Social Sentinel. And as we said, it's gone through about a jillion namings and renamings. But for the sake of convenience, I'm just gonna refer to the company, the product. I'm just gonna refer to this whole thing as Social Sentinel.

Speaker 1: The cofounder of this company is a guy called Gary Margolis, and, he was a police chief at a university. So I thought that was really interesting that, you know, he sells this service to police chiefs at universities, but he himself was a police chief at a university. In fact, the other cofounder was also a police chief at a university, at Wellesley and at Princeton. So it started by these two guys, these two former police chiefs.

Speaker 2: But the real heart of that story is a dispatcher named Diane.

Speaker 1: And so the story that Margolis likes to tell when he's interviewed on podcasts, in blog posts, these sorts of things is that, one day, he was, you know, leading, you know, sort of police debrief meeting. And, there was a sergeant named Jimmy who's, like, giving him all this this crazy information. And he asked Jimmy, you know, Jimmy, where did we get all this stuff? Right? Like, how did you get all this new information? And he said, well, you gotta go talk to this overnight dispatcher. Her name's Diane. And so he goes and he talks to the the overnight dispatcher, and, apparently, she had gotten all this information from, what was then called the Facebook.

Speaker 2: The Facebook. You got your Myspace. You got your, I don't know, your Nexopia. Monster.

Speaker 3: Nexopia. Reference there, I think, mostly.

Speaker 2: Canadian reference. I forget that that's not international. That was that was big in Western Canada.

Speaker 3: It was huge. Well, it came out of Edmonton, Alberta, which is It's true.

Speaker 2: Very February hip.

Speaker 1: So this is, you know, sort of dates this, reference back to the early two thousands. So she was looking at these online forms and the Facebook, and apparently, all this information was out there. And what he says is, well, you know, what this means is we need, like, a, you know, we need something or someone to be monitoring this information because it could be really useful for police purposes.

Speaker 2: Margolis wrote in a 2015 blog post on Social Sentinel's website, quote, it became clear that we needed a digital beat cop. Someone with an ear to the social landscape. So they say, let's start a company. Let's create this product to be that digital beat cop, to patrol this vast new frontier of the Facebook. And pretty immediately, there's, like, a really big audience for this, this social media monitoring service for schools, this digital beat cop. In an email to a UT Dallas police lieutenant, Margolis said that, like, right now, the product was used by hundreds of colleges and universities in about 36 states across The US. The data that Ari was digging through contained just a tiny, tiny chunk of that.

Speaker 1: We found 37 colleges, in The US that have used this service since 2015. And what the company says is that this is a social media monitoring service for, people posting threats of, like, suicide or shooting. So if I was to you know, I went to UNC. If I was to say, you know, hey. I'm gonna go jump off a bridge, and I had Chapel Hill, North Carolina in my bio, they might send that tweet to the UNC police department, and UNC police, in theory, could go and stop me from, you know, killing myself. The same thing for a shooting. Right? If I say I'm gonna go shoot up a school, the UNC police could prevent me from doing that. What our reporting found is that, actually, campus police are using it not only for, you know, shootings and suicides, but also for tracking protests, and activists as well.

Speaker 2: We'll talk a little bit later about how many schools total are using this or other products offered by the manufacturer because depending on where you set that boundary, it's a lot more than 37. As Ari mentioned, Social Sentinel starts to get picked up. A school here, a school there.

Speaker 1: The contracts we looked at ranged from about, like, 9,800 to at $51,000 a year, which, you know, is a lot of money for you and I, but for a university, that's not a ton of money. Right? That's kind of a drop in the bucket. Social Sentinel starts

Speaker 2: to spread kind of like the Facebook from campus to campus to campus. And all the while, you've got generally the same story in the way this is being publicly marketed. We're gonna scour the Internet for content posted about the school in service of preventing school shooting suicides, the things that everyone going to this school and paying for the school can agree that the school should want to stop. They use these two terms on their website, harmful intentions and behavioral warning signs. The software is looking for behavioral warning signs online of those harmful intentions. The natural question then is how does the software work? How do you actually use it, and what is the AI that's powering it kind of doing?

Speaker 1: So it's interesting because Social Sentinel is very opaque about how their technology works, you know, you know, what specific models and training data they're using. But based in like, what we've been able to piece together from the colleges, you know, the campus police who have talked to us and, you know, their marketing material is that so a college will buy this service. Right? And then they'll set it up, and then, Social Sentinel will ask for a list of words to enter into the service, you know, into something called the local plus list. And sort of the benign reason for this is, like, you don't wanna get all the threats of suicides and shootings for all over the world from Twitter. You only want the ones that are locally specific. So you would say, like, you know, you might input the name of your administration building. So, you know, instead of getting, I'm gonna shoot up the building, I'm getting, you know, I'm gonna shoot up the Kerr Administration Building or what whatever it is. So it's a way of narrowing.

Speaker 3: Doesn't sound super

Speaker 2: AI. No. It sure doesn't.

Speaker 3: As as as somebody that's studied, researched, and done a lot of things in the AI space, I'm by no means an expert, but have I got the a plus in the 400 level AI class in university.

Speaker 4: Just want you to the I got a

Speaker 3: top grade in the class, so, you know, that gives me the credibility to answer this question. The, usually, AIs work with training sets. You know, you train them. You give them you give them information. They learn to identify patterns that humans can't, and then, you know, they go from there. You could choose your learning algorithms. You can choose all kinds of stuff, but but eventually, they they kind of figure out cause and effect, causation, I guess. Yeah. In like a in like an n dimensional space, and then kind of draw an n dimensional plane through it and say, when things cross this plane, they potentially could have an the the the outcome that we're we're looking for. So Yeah. That's a having a bunch of keywords in a hot search doesn't doesn't hit me as a a serious AI system.

Speaker 2: So No. I it doesn't strike me as that either. And I don't wanna say definitively that there isn't buried somewhere in some piece of marketing an explanation of not even the specific AI model that they're employing, really any AI model that they're employing. I'm not saying that doesn't exist somewhere, but I sure couldn't find it.

Speaker 3: Think about that premise. Like

Speaker 2: Yep.

Speaker 3: If you're looking for communications online that have led to an an undesired outcome, and then you make that into a training set

Speaker 2: Mhmm.

Speaker 3: And and also communications online that lead to or, like, that lead to no outcome. Right. So, like, essentially, the ante of what you're looking for.

Speaker 2: Sure. Red herrings.

Speaker 3: Yeah. There's so much of that training set. Like, literally all the communication that goes on on the Internet or, like, not all of it, but, like, you know, almost all of it has no impact. So the training set for no is huge. Yeah. The training set and the training set for yes is tiny. And, like, and, like, you know, obviously, there's a lot of bad things that happen, but, like, when you compare it to the scale of the amount of discussion that just happens organically on the Internet every day, that's insane. Like, that that training set would be Huge. A monstrosity. Yeah. Yeah.

Speaker 2: Yeah. Like, my question is, does it look it was the exact same thing that you just said. Are they looking back at previous instances where a harmful intention occurred, where, say, a school shooting or a suicide did actually happen to reverse engineer and say, take everything that person did previously and including that as their dataset because that kind of would make sense to me. You could maybe derive some patterns of well, you wouldn't think it, but a person who is going to do that maybe does x, y, and z in the time leading up to it. You could build out, you know, some some patterns for predicting it. I don't have any reason to think that's what the software does, though maybe it does behind the scenes. They sure don't talk about it, though. What they talk about is this seems like it's a keyword based system.

Speaker 3: It feels like and this is just to, you know, touch back to previous episodes we've done on, I think, TikTok. We talked about this in in online advertising in general, like the psychographic profiling

Speaker 2: Mhmm.

Speaker 3: That advertising has been able to do.

Speaker 2: Yeah.

Speaker 3: I bet you'd be way better off making a model That's a really good point. Of of who commits these acts and then plugging that into Sure. You know, like, all of these large advertising networks, you know, Facebook, Google. These people have have the goods. You know what I'm saying?

Speaker 2: Yeah. For sure.

Speaker 3: They know what you're into. Like, I get ads in my pop ups, my in, like, just my Google News items of, like, things I own. And, like, I haven't Googled them in years, and they're like, you'd probably like this in case you missed it. And I'm like, oh my god. These people, like, they're tuning in on me. They're like, hey. Check out this cool headphone amplifier. I'm like, oh, yeah. I bought that three years ago. And clearly

Speaker 2: for sure.

Speaker 3: Clearly not in my thing, but you now know that I like, you know, boutique audio equipment, and it's like, cool. It's like they they're really dialing in on who I am as a person, and they're like, yeah. We can feed them this ad.

Speaker 2: Yeah. If it has to do with, like, buying a new pair of socks off Amazon, they can make astonishing predictions about what you will do based on what you've previously done. But if it's about whether or not you're gonna, like, commit a horrible violent act, it seems like it's pretty much at, like, did you tweet that you were planning on committing a horrible act? If not, there's not much we can do for you.

Speaker 3: Yeah. Like, I would I would love to you know, maybe the the cost of all of this removal of online privacy is that we take some of this data and do good with it. You know? Maybe the positives could outweigh the negatives in this one. You know what I'm saying?

Speaker 2: Yeah. I think that's where I have the exact same question, and I keep bouncing back on forth on what my answer of it is. And I think that's what's so interesting about this story.

Speaker 3: Oh, it sounds philosophical. Yeah.

Speaker 2: I think it's gonna get real philosophical. Alright.

Speaker 3: Well, let's let's go there.

Speaker 2: So what the marketing is saying is mostly to do with keywords. Not so much about AI, mostly to do with keywords. But as long as those keywords have to do with those, quote, harmful intentions, you are using Social Sentinel according to what's on the box. You're using it as it is being marketed. You're using it sort of as the manufacturer intends it to be. But that local plus list functionality that Ari mentioned, the sort of the the system that you're punching those keywords into.

Speaker 1: So now what we found is that that local plus list could also be used to narrow for specific terms related to, like, protests and, you know, sort of these, contentious events. So, like, at UNC Chapel Hill where I went, you mentioned earlier that there are these protests over this confederate statue called Silent Sam, and we know that, from the emails that UNC police were entering keywords into this local plus list, to surface posts related to Silent Sam. And this was something that, you know, they could do at any point in time. So you could enter local plus list keywords. You know, what they would do is they would email the Social Sentinel representatives. The representatives would enter the keywords, and then you would start to see, you know, posts related to these sorts of events.

Speaker 3: Let's just hold there for a sec and talk about talk about if you're a communications liaison for a university who knows the media is gonna be calling and asking you about this protest. Totally. And it's like social media monitoring, like, in the ad and marketing space is very common. We've seen some very nasty products in the last ten years. Ones that get past privacy filters, ones that get on to private. Like, if you mark your profiles as private and stuff, they're they're used to be. I'm not sure if they still do. Like, I haven't we obviously didn't use them because they're ethically gray, but

Speaker 2: Of course.

Speaker 3: Maybe not even gray. Yeah. Just see, they're bad. But the, but, yeah, there has been there's been tons of like, your data is for sale, and people are paying for it. And it's, like, social media monitoring to whether it's sentiment around things, you know, like, communications people, people that deal with crisis management and stuff. They they they need that stuff. They need to know what people are saying about it because they're gonna have to respond to it because the media is reading Twitter. They're reading Facebook.

Speaker 2: Mhmm.

Speaker 3: So So when they go to a press conference about it, they're gonna be getting pinged about these topics of conversation that are coming from the Internet. So it's like, to me, if I was the VP comms at that university, I would be doing the same. Sure.

Speaker 2: I would

Speaker 3: be adding terms to that list to make sure that I was prepared for the conversation coming up.

Speaker 2: Mhmm.

Speaker 3: So that's just me being an apologist for them and and wait waiting to see where this story goes.

Speaker 2: The motivations of everyone in that anecdote all make sense even if, maybe some interests between campus, leadership and the students on campus aren't necessarily aligned. I get why everyone is doing what they're doing in that story. I would agree with you there.

Speaker 3: Hooray. We have unity.

Speaker 2: So let's branch out a little bit then. UNC wasn't the only school that was showing up in these reams of data. It's just where Ari went, so it's where he started. So he starts to sort of follow you know, he starts to sort of navigate through this data. It starts to find some situations that didn't happen at UNC, and importantly, it starts to find some situations where protests weren't the only kinds of keywords that people were punching into this software.

Speaker 1: There's another school in North Carolina, North Carolina A and T, where, they were surfacing posts about a cheerleader who had complained that, you know, she had reported, that she had been raped to her coaches. Her coaches, allegedly mishandled that complaint, and so there was a lot of criticism over the coaches and of the university administration. And we have in fact, we have a document. We can see exactly what was entered at that point, you know, the specific keywords and hashtags that were entered into the system.

Speaker 2: A tool for identifying harmful intention and keeping students safe being used to track criticism and protest of the school, which to my mind is not a harmful intention. That is a very unconventional use for a hammer in this situation.

Speaker 3: I don't know because it's like, I can go to Twitter and search for anything. Right? Sure. And if it's in a public post, it pops up. So, like, if somebody's critical of of, like and and, you know, this is by no means a justification, but it's like adding something to an automated system that's gonna deliver me an email with a media report versus me going to Twitter every hour and checking it. Like, I'm getting the data no matter what probably unless this channel is doing something to the back end. It's just essentially automated information gathering. Yeah. Again, if I'm the VP comms and I know that this is a media story, I wanna be apprised of of the most recent points of discussion because the media will be going to Twitter and searching for if not using a tool like this that maybe isn't security police focused, but is media gathering and, like, media tracking is is is as old as time in that in marketing. So it's like

Speaker 2: For sure.

Speaker 3: They used to pay services reput them and then fax them to you. Like, no joke. Like, that that's a that was a real thing. And it's like that has progressed and progressed. Like, if you deal with any big age like, big companies in Fortune five hundreds, they all pay media services, and they get a morning report of everything that was talked about in all forms of media about their company the day before. Mhmm. And it's like, I don't I don't think that's a bad practice. Like, if I'm the CEO or CMO or, you know, whatever, some senior person at at some big company, I wanna know what the world's saying about us because at some point, I'm gonna have to, you know, maybe stand in front of a microphone and talk about it.

Speaker 2: Sure.

Speaker 3: So so redirecting a tool that's essentially just doing keyword searches to look up information that I could look up just by going to Twitter and typing in the search bar is just making my life easier. So maybe I am a full apologist on this topic.

Speaker 2: I get the appeal of it as a tool. Like, I would agree with that. I get the appeal of it as a tool. But then I try and switch perspectives a little bit. I'm imagining it from the student's perspective

Speaker 3: For sure.

Speaker 2: To find out that their, tuition is being spent on a piece of software that is used to follow them, for lack of a better word, online to see if they're posting anything critical of the administration. For as much as I can empathize with the person wanting to use that tool, I'm not sure how I would feel in the position of the person being monitored to know that, it was being employed, But I take your point.

Speaker 3: Well, well, like, the it's a very interesting topic. Like, the

Speaker 2: Totally.

Speaker 3: Well, here's the other side of that. You don't like that the money is being spent on this tool Yeah. But the money could be spent on three administrative staff who just sit and monitor all day. So it's like a

Speaker 2: good point.

Speaker 3: So it's like, you know, I don't you know, maybe you're Technically speaking. On that. But yeah. Exactly. So it's like, it's it's it's more efficient. It's more effective, and it's automated. But, like like, by no means do I think that it like, I'm not letting anybody off the hook for their bad behavior.

Speaker 2: No. No. No. I love this.

Speaker 3: Of mishandling things, but it's like, if you're posting things to a public forum being critical of something, the something you're being critical of has the right to know of the criticism.

Speaker 2: Sure. You have

Speaker 3: the right to defend and and respond if they choose to. Yeah. Yeah. Like, I prefer open dialogue as a as a as a means to a solution.

Speaker 2: Mhmm.

Speaker 3: But I I I don't I don't hate it. Like, obviously, by no means am I giving anybody a pass on what happened. I don't know. But it's like I I don't think it's as far as if if you just reform it from, like, a protest quashing tool to a media monitoring tool, to me, it's pretty basic. Like

Speaker 2: It is.

Speaker 3: How many people have Google alerts for their name? Probably a ton. Yeah. And it's like, is that any different?

Speaker 2: So I'm just gonna keep I'm gonna keep peppering you with with stuff Ari learned during his invest investigation because I I find, I I quite enjoy this back and forth.

Speaker 4: Yeah. Go.

Speaker 2: So let's add another thing. Yeah. We we've got we've got keywords for protests. We've got keywords for, criticism of school leadership. Let's toss in a new type of thing. Let's get names into it. Going back to that local plus list. So, you wanna track any chatter about, say, the school chancellor. Right? You wanna make sure nothing bad is gonna happen. No threats have been levied against them specifically. You need functionality, not just for tracking keywords, but, you know, say names.

Speaker 3: Names. Names are keywords.

Speaker 2: Names are keywords. I think that's kind of the thing is that Social Sentinel likes to talk about this not really being for tracking individual people, but I cannot, for the life of me, figure out the difference between a keyword and a name, which means if you have a good system for tracking a keyword, you have a very good system for tracking an individual.

Speaker 3: Of course. You know? The names are keywords. If I typed, you know, hacked podcast,

Speaker 2: you

Speaker 3: know, the they're just keywords.

Speaker 2: Mhmm.

Speaker 1: So on the tracking of individuals, we did find evidence that, some schools would enter the names of individual people into that local plus list. So now the benign reason for this is, like, okay. You put in your chancellor's name. So you're getting tweets about, like, you know, I'm gonna go shoot the chancellor or whatever. Now the the more sinister reason so say you have a prominent activist, you know, leading a protest movement. You plug in their name, you start to get all the information about them. You can, you know, almost collect, like, a file or dossier about them in addition to getting all of their tweets. So we did find evidence that students' names were getting plugged into this service. There's a college here in Dallas, UT Dallas, that, was putting students' names into the list, and we asked for the contents of their list. And they said, we can't give that to you because it has students' names on it. So we sort of, were able to infer, you know, what, you know, what was on that list because they wouldn't give it to us. And, yeah. So there was that. We also found evidence that they were using something called the filter management interface to enter specific social media users, like account information. I don't know if that's the same as the local plus list or different from the local plus list. This was very early on. This is in 2015. There were some emails to NC State where they're talking about tracking specific social media, users for these so called threat assessments. And, yeah. So there's definitely was an element of, like, tracking individual users either with the local plus list or with, you know, some other feature of the service.

Speaker 3: So they're actively monitoring specific students.

Speaker 2: Yeah. They're actively tracking specific students.

Speaker 3: That's an interesting one because there's two sides to that. One, it's a bit creepy. And two and then two, if you've got somebody who's actively critical, you know, maybe they're a protest organizer, you know, somebody who's who's constantly putting out content that maybe is even newsworthy. Like, if they're starting to get followed by local reporters and, you know, other other syndications and things that you'll have to start responding to in in official channels, again, makes it more efficient, the process of gaining the information so that you're well prepared to answer the questions. But, again, it is a bit of a I think that this really all boils down to information privacy. And when you post something in a public forum, it's public.

Speaker 2: Mhmm.

Speaker 3: And, you know, whether somebody wants to add your name to a keyword list or not, it's still public information.

Speaker 2: It's incredibly public information.

Speaker 3: It's not like they're tracking the GPS coordinates of your cell phone and, like, stuff like that.

Speaker 2: Every it's all legal. Like, it's it is stuff that you have posted for the world being amalgamated inside of this one piece of software. I I kept coming back to that where I was like, oh, no. The yeah. That's like, Twitter could make that functionality. Right? Like, Twitter could have a pro type account that you pay for that allows you to track stuff related to your, like, like, to certain subjects. Like, I some versions of that functionality is already built into Twitter.

Speaker 3: Well, the the functionality is inherently there. You just have to hit new user, create a burner account, and follow everybody that you wanna see their content on. I guess Yeah. It's it's public information. You're just figuring out how to filter it out the best.

Speaker 2: I think where it gets interesting comes back to, as a lot of these stories do, marketing, which is a good transition, for us.

Speaker 3: And something we also oddly know about.

Speaker 2: There's what this software can do, which is certainly legal, and I really like the conversation we're having about whether or not it's cool or okay or good or necessary. It's like I I find that a very fascinating conversation. But then over here, there's the way they talk about it, which is a separate thing. So I think we need to talk about that here now. Social Sentinel has said in so many words, this is not software for tracking protests. A value we hold deeply is First Amendment rights on campus. They, quote, according to their sites, scan while respecting constitutional rights of privacy, freedom of speech, and the right symbol, which is, I'm certain, legally true. But very regularly, they talk about how this is not for tracking individual users across the Internet. They regularly talk about how this is not for monitoring protests. The entire brand of this product is safety. It's not monitoring. It is not data kinda tracking. It is for safety. It's not about protests, which is where we get to how this thing is marketed on other channels, not publicly, not in the promotional videos. 2017, a guy named David, who works in the marketing at the company, reached out to UNC Charlotte administrator named Christine to, you know, try and sell the service. And in his correspondence, we see that David contacted Christine multiple times saying the service could be used for forestalling, quote, disruptive demonstrations and protests. Right around that same time, representatives from the company used the same language of mitigating and forestalling protests at, in a message to Stephen f Austin University. Another same message to UNC Asheville. In another instance, quote, I hear that you are interested in uploading usernames, user accounts, etcetera, to follow known threats. One of their, employees wrote to a university police chief in Carolina State. Quote, we recently released that feature. You can now upload a list of Twitter authors. Woven through that data, Ari was parsing, now writing for the Dallas Morning News. We're case after case of this. And that's where I think the real tension of this starts to emerge. Publicly, this is not software for tracking protests. This is not software for monitoring individuals on the Internet. Backchannel, this is an incredible way to monitor protests. This is an incredible way to follow individual users across the Internet.

Speaker 3: Can I ask you a question? Please do. As somebody who's been involved in protests, has seen them from the from the inside, from the outside

Speaker 2: Yep. Yep.

Speaker 3: As as have I

Speaker 2: As as of you.

Speaker 3: How does this software forestall a protest?

Speaker 2: I don't think this software can do much of anything to forestall a protest. I think this software can empower, in no way more than Twitter could, a school police, you know, force to forestall a protest. If that police force doesn't know the protest is happening, they can't go out and forestall it. They can't go out and do anything, respond to it in any kind of way.

Speaker 3: But if they go and try to to forestall it, then they're in violation of people's fundamental rights.

Speaker 2: They sure would be.

Speaker 3: There's an expectation that the the campus and the security force will be prepared to respond. Yeah. And by response, I don't mean, you know, squash the protest and, like, you know, break it up. I mean, preserve the school capital.

Speaker 2: Yeah. Sure. Sure.

Speaker 3: You know? What what cops are there for us to make sure that the capital is damaged. Yeah. Yeah. And and also and and, like, you know, and not just the capital, but the human capital. It's like there's other students and people that that will be around and come into to interaction with this protest, and they need to make sure that those people's safety is, you know, secured. So it's like, if if I'm a if I'm somebody who's liable for a ton of, like, a ton of people's safety, I wanna know that an incident, be it peaceful or violent, is about to occur. Because peaceful ones can turn violent, and violent ones can turn extra violent. So it's like Yeah. I don't know. To me, I'm maybe I am a full apologist on this topic because it's like, to me, I just feel like preparation isn't a bad thing. Risk mitigation isn't a bad thing. And I don't think that you should use it to like, I I'm a die hard fundamentalist when it comes to fundamental freedoms and rights, and you should know that. But it's like, at the same time, I think that people who need to who have other liabilities and and and things to manage need to be equipped to best manage those. And in today's world where everything is digital, having access to that digital information is critical. And I would actually say that it would be you would be mishandling people's safety if you weren't reviewing it. Bold statement.

Speaker 2: Bold statement. So to my mind, there are two different questions here. One is should any version of this exist? And I appreciate the argument that it some version of it should. And maybe a kind of dumb, ineffective version that just sort of amalgamates keywords off the open Internet is the best version. Maybe a a crude version is good, and maybe that should really exist so that the people that are tasked with safety have the most relevant information necessary. I'm gonna put that question over here. Then there's another question, and it has to do with the specific tool they're using. And it's what does it mean when the manufacturer of that product publicly is saying, we don't want you to use our software for that. We don't think that's a good thing. That's not what this is for. It's for safety. But then privately, they're going out into the world and saying, this is a great way to do that. This is a very powerful tool for the thing that we're publicly saying you should not use this for. To me, that delta between what they're saying publicly and what they're saying privately, that's kinda what I'm interested in. That make sense?

Speaker 3: Yeah. Completely. I think I I think deceptive marketing is shitty.

Speaker 2: Here's the thing. I actually like this sort of threat of giving them the benefit of the doubt. And to follow it, I have no clue how many salespeople Social Sentinel employs. Probably a lot. And I I don't know that I would hold the entire company accountable if there were some overzealous salespeople, if the company really does believe in those guardrails to protect that privacy, if they really do hold those values about, right to assemble, but there's just some rogue salespeople that saw it in and took it, that sounds plausible to me. I get that.

Speaker 1: They could have said, well, these were rogue salespeople. Right? These are just two guys who were, you know, working, you know, going a little beyond what they were told. Right?

Speaker 2: Unless, of course, there was some sort of document buried in all of that data that revealed that the company was, from the top down, endorsing and marketing this as software for surveillance and monitoring beyond matters of pure safety. A document in that data proving that this was not rogue salespeople. It was institutional. For Ari, that'd be the smoking gun.

Speaker 1: The white paper really shows us that this was company policy. This was, like, official officially the company's line that this service could be used for monitoring demonstrations and monitoring protests.

Speaker 2: That document right after the break. Starting some new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's going to work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch, to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button that's used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 5: When you need to build up your team to handle the growing chaos at work, use Indeed sponsor jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications, and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a $75 sponsored job credit at indeed.com/podcast. That's indeed.com/podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed sponsored jobs.

Speaker 6: No one goes to Hank's for his spreadsheets. They go for a darn good pizza. Lately though, the shop's been quiet, so Hank decides to bring back the $1 slice. He asks Copilot in Microsoft Excel to look at his sales and costs and help him see if he can afford it. Copilot shows Hank where the money's going and which little extras make the dollar slice work. Now Hanks has a line out the door. Hank makes the pizza. Copilot handles the spreadsheets. Learn more at m365copilot.com/work.

Speaker 7: When he was at the other schools, they didn't understand him. He was lacking focus. He seemed checked out. He didn't care. After switching to Connections Academy, he's back to being Ryan. This joy, this ambition, this confidence, I knew it was in him all along. I'm just so grateful to have my son back.

Speaker 1: Learn more about Connections Academy online public school at connectionsacademy.com. Yeah. So I really think the white paper is our smoking gun document. And it was funny. You know, the white paper, we kept seeing this attachment, on emails. It was like HED protests white paper. You know? And we we saw it, like, three or four times. And, but they wouldn't include the actual attached document, in the documents that they were sending us. And it was really frustrating. I was like, this that sounds, like, really juicy. And so, you know, I was going back through my documents, towards you know, I think this is probably in April or something, like, towards the later stage of the process. And I figured out that, actually, we we had this document all along. It was, like, buried in some pages, that we had gotten not through FOIA, not through the public records laws, but through, like, just downloading stuff on the Internet. And those are two two separate folders. So I was searching in one folder, but not the other folder. And so we found that we had this this protest white paper. And the reason I say it's sort of the smoking gun is because, you know, in theory, if we had just published without the white paper, Social Sentinel, you know, or, you know, the company is now called Navigate three sixty. They could have said, well, these were rogue salespeople. Right? These are just two guys who were, you know, working, you know, going a little beyond what they were told. Right? But the white paper really shows us that this was company policy. This was, like, official officially the company's line that this service could be used for monitoring demonstrations and monitoring protests. And so once I, you know, was able to find that document and all the records we had collected, it sort of really proved the case that this was a service that was explicitly marketed and advertised for surveilling protests.

Speaker 2: So we've talked a lot about what this software is. We've talked a lot about, you know, whether it's good or bad that some version of this exists. We know that at least several schools are using it in a way that is seemingly off label, but is in some sense endorsed by the manufacturer. Students are paying money, and a little blip of that money is going to pay for the software that's monitoring them, however you feel about that, whatever. But here's the thing. This story about Social Sentinel is one product made by this larger company, Navigate three sixty, that holds this sells this giant suite of different software navigating these thing these themes of digital monitoring and real life safety. University social media may have been the start. The Facebook may have been the beginning, but it is certainly not the end. Let's zoom out a little bit. We've been talking about social media on campus. Let's talk about something less intuitively public, like, say, a university email account.

Speaker 1: In the beginning, Social Sentinel was a social media monitoring service. But in sort of 2019, they started offering colleges like, hey. Do you wanna sign up for our email monitoring feature as well? So we know now that Social Sentinel, or as it's now known, Navigate three sixty detect, has this, email monitoring capability. And so, originally, they were advertising an integration with the Gmail and the, like, the g Suite of services. And then soon, they were advertising that they had an integration with Outlook as well. So it's not only, just a, social media monitoring service. Now it's also an email monitoring service as well. And assuming, you know, it works in a similar way to the social media monitoring service, you know, this would pick up on, emails that have these sort of keywords, you know. And what we've seen from the tweets that have been flagged by this service is that, oftentimes, it's not very sophisticated. Right? Like, it would pick up on something like, you killed it in the presentation yesterday. You know, like sports related words, like, shooting the ball, you know, things like that, you know, where it might have one of these, like, words in what they call their language of harm. But, you know, it's obviously not threatening or not dangerous. Right? So, you know, in the email context, you're surfacing private stuff as well.

Speaker 3: I I I I I I would love to jump in and say that I think there's just a fundamental switch there between something that you're posting on a public forum versus something that's going to a private email box. I agree. Even if there's terms and conditions that allow it, it's still skeezy. I don't like it.

Speaker 2: There is an expectation of privacy there that does feel kind of materially different

Speaker 3: than

Speaker 2: social media. You could say there's like you said, it's terms and conditions, man. It's a university run account where the admins were allowed, but there is an expectation of privacy there.

Speaker 3: 100%. Anyway, that's my those are my strong feelings on that. Also Yes. I can throw in a cool reference there

Speaker 2: Sick.

Speaker 3: To Co intel Pro, which is, like, one of the first theoretical email surveillance systems for, like, the FBI apparently way back when. I think this is the sixties, Cointelegraph. And I think I forgot who it was. I think it was one of the OG text based Unix email editors used to have, like, a little preference that you could flip on that would include, like, a huge list of keywords at the bottom of the email. Mhmm. And then every email you sent got flagged. So they would just overload the monitoring people with, like, just tons of garbage just because it would just, like, throw 60, you know, obvious keywords at the bottom of an email and just bang everything got flagged. Oh, clever. Just overloading the system. And they I'm pretty sure if I remember the story correctly, and this is me digging deep, but they got they essentially got sued and had to remove it. Had to remove the feature Oh. By the government, if I recall correctly.

Speaker 2: The government.

Speaker 3: Maybe I've made this entire thing up. Maybe it's premise of a great fiction novel, but I'm pretty sure that's true.

Speaker 2: But that's still presumably university emails. Should an adult presume anything they post on social media is read? Yes. Should they presume their university hosted email is not private? Maybe technically. Maybe not every adult knows that, but every adult should start thinking that way.

Speaker 3: I feel like It's it's a little skeezy.

Speaker 2: It's a little skeezy.

Speaker 3: I feel like there needs to be a flashing red box when you log in every time that is just like the university is reading this if it's not private. Because, you know, you say my email. It's, like, possessive. Like, I this is my email. It's my mailbox. Yep. I think the the expectation of privacy is huge on email, and I just I just think that Yeah. You know, whether you slide something into the terms and conditions that says we're allowed to read your messages or not, just

Speaker 2: I would agree with that. I don't like that. It would be prudent for every adult to know that, but not every adult does. I was saying the word adult a lot there to transition us to the next market that, the company crossed into. Not adults.

Speaker 1: And I should say that, you know, Social Sentinel is not just used by colleges, but it's also used by k 12 schools. And the email monitoring thing has been going on for a very long time in the k 12 environment. There's a lot of services that do this. There's three others that we looked at last summer, called Gaggle, GoGuardian, and Securely. And I think all of them have some sort of email, Gmail, G Suite monitoring technology. So this is really just, you know, offering colleges the ability to do something that it was already in place for k 12.

Speaker 3: I wonder how many parents are aware of that.

Speaker 2: Probably not a lot.

Speaker 1: One in four schools in the country, you know, use some sort of navigate three sixty product.

Speaker 2: And if you've cornered k to 12 schools and then you've cornered the kind of university where those students graduate into, why would you stop there? What about the workplaces where they go to work after graduation?

Speaker 1: We've also seen marketing material that, you know, they're selling to businesses as well, like, moving into the workplace, and out of schools. So it's really hard to, you know, parse through that material and, like, make coherent sense of, you know, what's going on.

Speaker 2: K to 12, universities, offices, and it all started with, wow, there sure is a lot of useful stuff on this, the Facebook.

Speaker 3: I think that for me, the big the big ethical line in the sand here is public versus private. And if you're shouting in private forums or standing in the middle of the campus quad screaming, people people have the right to listen and Yeah. You know, respond. And if you're saying it privately, then it should be held to the people that you disclose it to and whomever they share it with. But it it's it's by no means should people have access to it. And I just that's that's my big thing is

Speaker 2: Yeah.

Speaker 3: I think I think I am, you know, a die hard fundamentalist when it comes to fundamental rights and freedoms, and I think that that's a that's a that's the preservation. And if you're using this information to violate people's fundamental rights and freedoms, then you're a bad person.

Speaker 1: There's definitely this idea of concept creep. Right? That a service, you know, that might have started for one purpose gets repurposed for another purpose, and then it's, you know, way less effective. You've seen that a lot with machine learning systems where, you know, there's a great investigation from ProPublica, I think, you know, six, seven years ago about this algorithm called Compass, which, you know, they were using first for pretrial release, and then some judges started using it for you know, after the person was convicted to determine sentence. You know? Like, and it became, you know, beyond what the the company was selling it for. So there's definitely this idea that, you know, the services are going beyond even what their purposes is. And so, you know, Social Sentinel could have been a case of that. Right? You could have had two guys who, you know, genuinely believed that, you know, like, they were gonna create AI that could help save, you know, save students' lives and, you know, stop school shootings. And, but what we found is, you know, obviously, it it had this dual purpose. Right? They were marketing it for suicides and shootings, but they were also, you know, marketing it for protests. So it wasn't just universities going rogue. It was also, like, this is an explicit push by the company. And, you know, the experts I've talked to said that this is very often the case, you know, even with these sort of good intention systems that, you know, sometimes they can be used for nefarious purposes. And just the nature of machine learning is, like, you're you're scraping up so much data. Right? You know, you're you're surfacing so much stuff. Like, you know, it's very hard to filter out, like, what's really actionable and what's not even with, you know, the most sophisticated sort of machine learning systems that are out there today.

Speaker 2: Well, the unasked question here is, does it work? None of this is worth it if it doesn't work. There's no bargain to be struck if there's no nothing to be gained. And Ari was quite coy with me about that because it sounds like it's the subject of his next story that he's still working on.

Speaker 1: We're gonna we're gonna publish a story pretty soon answering this question. But I think if you you know, what I've what I've been telling people is that, you know, if this is an AI service that's supposed to save, you know, people from shootings and suicides, I feel like you would get a lot more people saying publicly, you know, how great this tool was and how it stopped the shooting or suicide on my campus. And, you know, you don't really see a lot of that. So, you know, I think that is highly suggestive that this service may not be as effective as the company claims it is.

Speaker 2: I had, like, a question pyramid, and it's like, should any version of this exist? Should this version of this exist? And is this the company to do it? And then I'll get philosophical, though. Starting at the top, should any version of this exist? The privacy and, like, first amendment minded side of me, my gut wants to say no. But, theoretically, if there was some way to both preserve privacy while using openly available information to stop terrible things from happening, I couldn't say no to that deal outright. It's it's too much bad stuff to just say no. It it's not worth it. It's like, if you could do that, we need to have that conversation. Next tier down, is this the version of it? Is this what it would look like? This being a a keyword based system operated by campus police. There seems to be a relatively high potential for abuse. I don't know what a better version of it is, but when a person can punch in, oh, this girl sure is making a ruckus about how a campus handled a rape case, better follow what she's doing across her social media and her email. I I don't think that's it. And then my last question is, is this the company to do it? And that one's tough. Companies change. They get new leadership. Reputations become out of date. But if the answer to that question is rooted as it is in my head in trust, this company has spent a lot of energy saying publicly this is not software to do x, while privately saying it's a great way to do x. And I don't think that's how you earn the trust necessary to be the company I want behind this kind of tool. Thanks for listening, everybody. Do I sound weird right now? Do I sound like I'm recording this on a laptop microphone? That is because I'm in a hotel room in Germany. I'm on the vacation we talked about last episode. I did, however, edit this on the red eye flight here, so I hope everything is where it's supposed to be. Shout out to our new patrons on Patreon since the last episode as Scott mentioned earlier. We really do appreciate you. Oliver Ashby and Eric Fergus, thank you so much. Patreon.com/hackedpodcast. Great way to support the show. Hope you enjoyed us getting all philosophical on this lap, this hour long episode. We will catch you on the next one.

Speaker 4: There's a new way to sweet green. Meet wraps. Handheld, hearty, and made for life on the move. With bold chef crafted flavors, fresh ingredients, and over 40 grams of protein, they're built to satisfy without slowing you down. Try wraps today in the app or at order.sweetgreen.com, available at all participating locations.

Speaker 8: Athletic brewing company crafts award winning non alcoholic beers for those who want to be part of every round. With over 185 flavor awards, they're exceptional NA beers that fit your lifestyle and any social occasion. Summer's full of good times and athletic fits right in. Go to athleticbrewing.com to have brews delivered to your door or find them at a bar, restaurant, or store near you. Near beer, athletic brewing company fit for all times.

Speaker 9: The right window treatments change everything. Your sleep, your privacy, the way every room looks and feels. At blinds.com, we've spent thirty years making it surprisingly simple to get exactly what your home needs. We've covered over 25,000,000 windows and have 50,005 star reviews to prove we deliver. Whether you DIY it or want a pro to handle everything from measure to install, we have you covered. Real design professionals, free samples, zero pressure. Right now, get up to 45% off-site wide, plus get a free professional measure at blinds.com. Rules and restrictions apply.