All language subtitles for cyberwar.s01e11.720p.hdtv.x264-w4f_Track02

A website for
cheaters gets hacked.

This hack is one of the largest
data breaches in the world.

Private data is leaked online.

My secrets, which are stored
on somebody's server somewhere,

there's a real chance that
they might become public,

and that might have real
consequences upon my life.

But what motivated the hackers?

Who would hack into a company
and do a data leak of this

magnitude because they feel that
they're ripping a customer off?

And who's vows were broken?

They figured out that there were
70,000 fembots on this site,

and they were the women that
were doing most of the chatter.

♪

It was a company that
embraced controversy

from the very beginning.

For years, Toronto-based
Avid Life Media was best known

for its dating website,
Ashley Madison.

The site was promoted as
a place for married people

looking for casual hook-ups
with other married people.

Ashley Madison became really
well known for its scandalous

services, but also for
its provocative ads,

like this ridiculous example
with an unforgettable jingle.

♪ Looking for someone
other than my wife ♪

♪ Other than my wife ♪

♪ Ashley Madison's right ♪

♪ I'm looking for someone
other than my wife ♪

♪ Other than my wife ♪

♪ Ashley Madison is right ♪

But in the summer of
2015, Ashley Madison,

a site built entirely on the
principle of cheating covertly,

was hacked and exposed.

Everybody from the FBI and
the Canadian Feds got involved,

even the local Toronto cops.

On July 12th, when several
Avid Life Media employees

arrived at work and
powered up their laptops,

a threatening message
popped up on their screens

which was accompanied by the
song "Thunderstruck" by AC/DC,

which was playing.

The company had been hacked
by a mysterious group

who called themselves
the Impact Team.

The hackers demanded that Avid
Life Media shut down its sites

right away and for good, or they
would release customer records,

profiles with all the customers
secret sexual fantasies,

credit card transactions,
real names, and company emails.

At the time of the
hack, Avid Life,

the parent company
of Ashley Madison,

claimed millions of
dollars in annual profits.

On the surface, it's a totally
controversial company because

it's designed to help people
break their marriage vows.

But there's nothing
illegal about that.

And it had 5 million
members at the time,

it was supposedly
printing money.

Tom Watson is an investigative
reporter who profiled Avid Life

for Canadian Business Magazine.

That was back in 2010 when the
company was trying to go public,

which meant Avid Life Media
needed to convince

Canadian banks it was a solid
investment for their customers.

Financial markets,
investment bankers

are not the moral compass
of society, right?

(Laughing)
No.

No one looks to them
to play that role.

And being a business
journalist at the time,

I wanted to look at it
strictly from the standpoint

of what's an investment
banker supposed to do.

But, also being a journalist,

I decided I should learn a bit
more about the company.

So I signed up, and one of
the first things I found

was that not all women
on the site were there

just to break wedding vows.

Tom requested an
interview with GMP,

the lead bank preparing
to back Avid Life.

The bankers agreed to chat,
and he went to their office

on a Friday afternoon.

And they sat down and their
key messages were pretty clear.

"You know, Tom,
we're an investment bank.

This is a banking
opportunity, clear cut.

It's legal, you can make money.

We're bringing it forward
to our clients."

And so I said,
"Okay, that's great.

That's what I
expected you to say.

I just have one other question."

And I read this posting that
I had found on Ashley Madison

from an 18-year-old student
who basically said

her mother's broke, her dad's
a deadbeat, never met him.

She can't afford school, so if
you're the kind of guy who wants

to help me pay my bills, I
can help you in other ways.

And the posting was pretty clear
that it was in physical ways.

It's not two people
breaking wedding vows.

It's financial gain for
one, sex for the other.

And blood drained from the
faces of the guys in the room.

At that point they called
an end to the meeting.

And I got a call Monday
morning, and they said

that the deal was dead
from their point of view.

Avid Life's lawyers denied
the site was designed

to promote prostitution.

But the IPO attempts
still fell through,

and the company still
wanted to go public.

But at that point it
was common knowledge that

investing in Avid Life Media
might be risky business.

When the first IPO blew up,
it had 5 million members, and

they were seen as a significant
investment opportunity, but...

the brokers and deal-makers
were afraid of them.

So how do you
tackle that problem?

Probably the best way to try
again is to have more members.

To be even more of a
good business case, right?

The bigger the
investment opportunity,

the less people are worried
about the risk, right?

If you jump forward to
when they were hacked,

they had something like
37 million members.

In only a few years,
Ashley Madison's membership

skyrocketed, which
in theory should draw in

a new set of bankers
to back an IPO.

But how had Ashley Madison

lured in so many new
customers so quickly?

- Chris, how you doing?
- Hi.

- Nice to meet you.
- Nice to meet you.

Chris Russell is one of
the people who signed up

for the site, and it really
didn't take long for him

to become a more than
dissatisfied customer.

So out of all the dating
sites you could have picked,

why'd you pick Ashley Madison?

It was a curiosity thing
more then anything.

I was separated at the time.

I wasn't looking
for a relationship.

Yeah, 'cause what
attracted you to their website?

- Was it just the fact--
- It was their advertising.

They made it sound like
it was this discreet,

active community
of people, you know,

meeting and hooking up
and looking for each other.

And for a guy who's separated

and looking for a
casual thing, it's...

Right, you know.

...it seems like the
right spot to look.

So walk me through exactly what
it was like to sign up for it.

It was basically free
to set up a profile.

And then a couple days later,
even the next day I wanna say,

I started getting emails that

this girl checked
out your profile.

She's interested
in you, or you know,

you would get
different things,

and the picture
would be blurred.

And if you want to
talk to this person,

you're gonna have to buy
these tokens or credit.

So after a few days of that,

I'm like, "Well,
this is kind of hot.

Let me see what's
going on here."

(Laughing)
Yeah.

So I went ahead and put in
my credit card information,

bought the tokens,
tried to talk to people,

but never got
any response back.

Did you have any
conversation with a real woman?

Just once.

Chris is now part of a class
action suit that accuses

Avid Life Media of fraudulent
and deceitful actions.

He's one of the few Ashley
Madison users who was willing to

put his name on the lawsuit and
even appear on camera for us.

Just three months after
he closed his account,

Ashley Madison got hacked.

The hackers demanded
that the parent company

shut down its sites
immediately and permanently.

That didn't happen,
and a month later,

the hackers released a message
with the heading "Time's Up!"

In that message,
they claim to have,

"...explained the fraud,
deceit, and stupidity

of Avid Life Media
and their members.

Now everyone gets
to see their data."

Over the next 5 days,
the hackers posted links

to download the data
in three batches.

This hack is one of the largest
data breaches in the world,

and is very unique on
it's own that it exposed

tens of millions of people's
personal information.

A third message was received
wherein the Impact Team

taunts the CEO: "Hey Noel,
you can admit it's real now."

In the summer of 2015,
a group of hackers struck

Avid Life Media, the parent
company of Ashley Madison.

After breaking into the database
of the dating site for cheating

spouses, the hackers dumped a
huge trove of embarrassing data.

REPORTER: 37 million.

That's how many email addresses
hackers may have released

that allegedly belong to
Ashley Madison customers...

(Shushing)

♪ Ashley Madison ♪

...the website that
encourages customers

to cheat on a spouse.

VOICE: Life is short.
Have an affair.

BEN: Annalee Newitz is
a journalist and author

based in San Francisco.

She couldn't wait
to get her hands

on the Ashley Madison data.

Did that make you feel weird?

You have all this
personal data?

I feel very protective of it.

Like I want to protect
those people, and I wanna only

understand them as anonymous
blips and as patterns.

I wanted to reveal
their behaviour only

in this super anonymous way.

- It's super sad.
- It is.

You don't want anyone
to be hurt by this stuff.

But Annalee's analysis of
the data revealed something

unexpected, and it
wasn't about the people

who signed up for the service.

It was starting to look like
most of the female members

of Ashley Madison were the
creations of programmers.

In other words, they
were essentially fembots.

So initially I believed, based
on looking at the database,

that there were basically
zero women on the site.

And as the story evolved,

and I got more data and
looked through it more,

it turned out that
in fact there were some women.

They had about 5% real women.

But what became very interesting
was when I figured out that

there were 70,000
fembots on the site,

and they were the women that
were doing most of the chatter.

Ashley Madison isn't the
first site to use fake women.

It's thought to be a
widespread industry practice.

US regulators took action
against another dating service

for doing the same thing,
and that company paid

hundreds of thousands of
dollars to settle the case.

But the sheer epic size of
Ashley Madison's bot army

dwarfed anything seen before.

So what were these
bots actually doing?

So Ashley Madison
had this problem,

which is that they had 95%
men on a heterosexual site

for hooking up
with ladies, right?

And so what they would do is
they would create fake profiles

of women, and then they
had software code, bot code,

that would bring
those profiles to life.

And these bots would send
messages and emails to men

who had signed up
but hadn't yet paid.

And in order to read a message
from a woman on the site,

you had to pay to
have a conversation

with what turned out to be
just some PHP code saying,

"Hey, wanna cyber?"

That was one of the things
the bots would say.

Said, "Hey, wanna cyber?"

Yeah!

They're pretty much
the simplest, dumbest bots

you could possibly imagine.

'Cause you couldn't have like
an actual scripted conversation

with them, like,
"Hey, what's up?"

You couldn't even really
have a conversation.

I mean, you could
respond to them,

and then you would have to
pay to see their response,

and you would just
ultimately never get anything.

And what we see in the
company emails is that

the people running the
company knew very well that

that was their business model,
and that the vast majority

of their conversions
of unpaid customers

to paying members
were as a result of a man

either contacting a bot or
being contacted by a bot.

Alright, so right now we
are in the MySQL database

with all of the accounts of
all the people who signed up

for Ashley Madison
starting in 2002.

Right here, #10 - so
that's the 10th person

to ever sign up - was a bot,
and that's Sensuous Kitten.

And then their
second bot was "sexygal",

and "honeybunch"
and "princess".

And how are these bots
actually made though?

Was it just somebody going
on a Google image search

and snatching pictures of
ladies, or like what was it?

So they hired a bunch of people
to go and actually harvest

photos from inactive accounts
that had been created by women

who joined any number of the
Avid Life Media properties.

And they'd take those photos
and they'd put them into

a new profile, pay women
to spend all day typing in

fake information into
these profiles,

and then that would
become part of their bot army.

It sort of seemed to me
like the ultimate dystopia,

because it's a bunch of
men in this community

who are searching for women.

The men are not allowed
to talk to each other,

so all of the real humans in
the community are prevented from

talking to each other and
are forced to talk to bots.

And those bots are
mostly cobbled together

out of the dead accounts
of real women.

So it's kind of like a bunch of
men in cages talking to zombie

robot women, and I can't think
of anything more sad then that.

(Laughing)

That's a really horrible
picture you've just weaved.

(Laughing)

It just made me so...
I was just like--

Yeah, that might
just be the internet.

BEN: In the summer of 2015,
a mysterious group

calling itself the Impact Team
hacked Ashley Madison,

dumping nearly 10GB of
sensitive and revealing data.

Erik Cabetas is a hacker
and security consultant

based in New York.

The day of the dump, he went
straight to work on the data,

looking for clues about
the identity of the hackers.

I met him at a bar in Brooklyn.

- Hey, how's it going?
- Hey, what's up?

- Eric.
- Ben.

- Nice to meet you.
- Nice to meet you.

Club Europa, yeah.

Big red door.

(Laughing)

It's a really, like,
bright, clean-looking place

to talk about Ashely Madison.

Yeah, it's...

So this place used to be
an Eastern European club...

Nice.

...where you would hear more
Polish than anything else.

That's wicked.

So we don't know how
advanced it was to initially

get in there, but what they
did when they got in there

was dump all the emails,
all the internal data,

everything on the customers.

And that was really
the big impact

of the Ashley Madison hack.

And who is the Impact Team?

Is there any idea?

Not me.
(Laughing)

So, you know, that's
the big question.

Everyone wants to know that.

You, me, the police,
everyone wants to know that.

All the data that they leaked

were scrubbed and
cleaned of meta data.

Everything that they released,

they released on anonymous
networks, and everything

was done through crowdsourced
seeding like BitTorrent.

Nobody has found anything,

any smoking gun, or even just
like a shadow of a fingerprint.

In the wake of the news,
reports surfaced that

some Ashley Madison users
were US government employees,

and even members
of the military.

This led to speculation that
foreign governments could use

the data to blackmail
or extort US officials.

Florida state attorney
Jeff Ashton was the only US

government official to publicly
admit he used Ashley Madison.

I deeply regret my
affiliation with the site,

which has caused a great amount
of stress and heartache

to my wife and children.

What do you think a
foreign intelligence agency

could do with this?

The intelligence community likes
to keep data like this private

so that they can
exploit it themselves.

But once it's out there in the
open source world, they tend to

not use it as much because it's
not that private secret data

that they can operationalize
and use their capabilities for.

If you're a black hat hacker or
some criminal organization doing

this for some financial gain,
what do you do with the data?

Uh, you don't
release it publicly.

(Laughing)

So if they would have reached
out to each individual and said,

"We will release all this data
and try to extort people

en masse, all of the
customers of Ashley Madison,"

that might have been
a little bit more of

a black hat
financial motivation.

So have you ever seen
anything like this before

in terms of the
motivations behind it?

If the stated motivation
is the actual motivation,

if really a hacktivist
who wants to keep

Western society chaste and good,
I've not seen something

like this for that goal...
to this level ever.

Well, then what do you make of
Impact Team saying they are

pissed off about the fraud that
Ashley Madison has been up to?

So that's very interesting,
because the initial motivation,

or the two stated motivations,
one being kind of like this,

"We don't like what you
are doing as a core concept,"

and the other being,
"We don't like that

you're making additional
money off of pretending

to delete people's data."

The service that they
were providing which was

a "Full Delete" of all of
your personally identifiable

information was not
actually happening.

The information was still
retained in logs and backups

and various other things.

Who would hack into a company

and do a data leak
of this magnitude

because they feel that they're
ripping a customer off?

So you look forward to the day

you actually figure
out who it is?

Um, I do and I don't, because...

I mean, everyone
always gets caught.

It'd be funny just to see
somebody not get caught.

After Avid Life Media was
hacked, things took a dark turn.

We'll probably never know for
sure, but reports surfaced

that several Ashley Madison
users killed themselves

over being exposed.

A pastor in New Orleans
specifically cited the hack

in his suicide note.

Avid Life's CEO Noel
Biderman resigned.

To this day, no one knows
who Impact Team is,

or if this is the outcome
they even wanted.

- Joseph.
- Ben.

How you doing?

Joseph Cox is a freelance
reporter for Motherboard,

VICE's tech and science site
that covers cyber-security.

He landed the only published
interview with the Impact Team,

an email Q&A.

The way it went about is
I contacted somebody

I'd spoken to before, and I
had a feeling they would know

how to get in touch
with Impact Team.

I asked them for a
contact email address.

I reached out to Impact Team,

not really expecting
them to get back.

They get back fairly quickly.

They refuse to talk on
other encrypted channels,

like instant
messaging or something.

It all has to be
done by email.

I fire off a few questions,
maybe a dozen or so.

They then reply, and then
we just run the article

pretty straight after that.

So what are the
motivations of these hackers?

Well, they claim that
they hacked Ashley Madison

to expose the website for
its fraudulent practices.

The site was running something
called a Full Delete feature,

where you pay a certain fee,
and then the site promises to

obviously delete all
of your information,

because of course it's
a quite sensitive site.

They claim that
this wasn't happening,

and they found evidence
of this in the data,

and they released it to sort of
vindicate these customers.

But it gets a bit hazy, because
then in conversations with me,

they also describe
Avid Life Media,

the company that owns Ashley
Madison, as feeding drug users,

in the same way a drug dealer
might feed heroin addicts.

Out of pure speculation, who
do you think these people are?

I mean, all I can glean is
that they were experienced,

they were obviously
highly motivated...

they knew what they wanted,
and they went to pretty

extreme lengths to get it
and to embarrass this company.

You know, the one thing that
I find interesting about

this particular case is
that if you look at a lot of

the other major hacks, the
hackers keep popping up.

What happened to Impact Team?

I don't think anybody's
come across evidence

that Impact Team
has struck again.

In the interview, they said
that they might come back

and hit other companies.

As far as I know, and according
to public information,

they haven't hit back.

Do you think that this hack
did a lot of damage?

Like what was the end impact?

I think it was a watershed
moment or a wake-up call

for ordinary people who might've
signed up to these services

years ago, or they might
just use them fairly regularly.

But they probably realized,
"Shit," you know,

"My secrets which are just
stored on somebody's server

somewhere, there's a real chance
that they might become public,

and that might have real
consequences upon my life."

I think it was a real
kick in the teeth

for just ordinary people.

But the company is
still... still operating,

and months after the hack,

Ashley Madison even claimed that
there were more customers now.

But considering all
the bullshit they had

around bots and fake
user accounts, I mean,

you should seriously take that
with a pinch of salt as well.

(Laughing)

Avid Life Media is
currently being investigated

by the US Federal
Trade Commission,

and still faces a class action
lawsuit by former members.

But Ashley Madison is trying to
repair its rocky relationship

with its customers despite
its ongoing legal troubles.

A year after the hack, Avid Life
announced it were rebranding

with a new name, Ruby,

and a new set of
commercials for Ashley Madison.

♪

♪ Are you reading? ♪

♪ Did you choose? ♪

♪ Can you see into the future? ♪

♪ Are you listening? ♪

♪ Are you scared? ♪

♪ Will you know it
when you see it? ♪

The company denied all our
requests to talk about the hack.

And after the relaunch we
reached out again for a comment,

but they declined.

I guess they're just trying to
move on, but Ruby's new CEO

has made one thing
public: no more fembots.

♪