You were just telling me a story when you exposed a 61.

>> 61398. I go into work the next morning.

All of a sudden my cell phone rings and I answer it and it's my now ex-wife.

And her exact words were, "What the did you do?"

She's like, "Turn on your TV."

We had it right cuz we use Google Earth, Shawn.

Isn't that insane? What kind of stuff did they steal?

It would be hard to say what they didn't.

You know, that's the reality. I mean, when they And that's why General Alexander, you read the testimony from the director of.

The NSA,.

Largest IP theft in history, Admiral Rogers after him, General Nakasone, all of them kind of allude to China's kind of taken.

A ton. Now, there was a dialogue after that report.

Here's what's amazing.

At Mandiant, what we were doing is we were kind of monitoring victim networks, meaning we saw traffic coming in and out.

With consent.

And the whole defense industrial base was working together by then.

They started a whole consortium.

Where Raytheon and Lockheed and Boeing, they all work together to figure out what China's doing and how do we thwart this.

So, they do play team ball now and it's actually.

Pretty organized.

Um.

But I remember.

Uh at the time going,.

"We're seeing over 70.

Companies a month.

Compromised by China right now. Just in our little network of watching what they do."

After we went public with that report, it went down to zero for a while.

So, I think they noticed. We changed behavior.

Or some say, "Well, maybe you just lost vision on them."

Because when we wrote that report, one of the things we didn't kind of say in the report.

Is we provided that trace evidence, the fingerprints.

We provided over 5,000.

Fingerprints.

Of this is their infrastructure they're using to hack us.

This is the malware they're using.

So, all the defense companies that make software to stop it, we could just stop them.

So, we kind of burned their infrastructure.

We burned their methods. Their TTPs or tools, tactics, and procedures were fried.

So, we fried it. So, they had to go away anyway and recreate all that stuff.

Um, but again, going from.

Anywhere from 10 to 70 companies hacked a month just in what we could see, and I could tell we probably saw.

Less than 1% of what they were doing.

Um, we'll never know. Did we see 80% or 2%?

It was probably closer to the two.

Down to zero for a few months and then it starts creeping back up again.

>> Just for the audience, can you can you elaborate on some of the stuff that you thought was most concerning.

That they got they they had access.

Into? >> Uh, flag officer's email.

I always hated that stuff, you know, because you get to see what contracts matter, what weapon systems matter.

I I never read those emails, you know, I didn't want to know, you know, but when you see a communication of.

A high-level official get stolen, I've always felt, "Oh, man,.

Like there's unvarnished truth in that, period."

Like no matter what we're trying to posture publicly,.

You really.

You've got the the back door story.

In China as to what we're thinking and how we're going to arbitrate.

And I think I I just That was the first the first time I ever saw.

It was in the mid '90s that China got flag officer's email.

Just instinctively I went, "Man, that's bad."

First off, the good news, most flag officers didn't really use email back then,.

But what did you put in it?

You thought it was private,.

You know, and I just felt I didn't like that.

>> Like SIPRNet email? >> No, no, I've never seen a SIPRNet breach, you know.

Not not That's got to be physical separation.

I've heard rumors of it. I've never been involved in one and I don't know if I don't know I personally don't.

Think it's happened, but.

Probably a physical security issue if there's a SIPRNet breach.

Someone got to a SIPRNet terminal, you know.

>> Did they get blueprints to.

Weapons?

>>.

They Yeah, the the problem we've got as a nation is we're so damn open, you know, in academia, everything that becomes.

Classified somewhere was unclassified first, for the most part, you know.

How it's used and who's using it and where they're using it usually is classified, but we have this, you know, you.

Look at.

University of Illinois Urbana-Champaign,.

LSU,.

Penn State, all these great American universities, Harvard, MIT.

I can name them all. Almost all of them, Berkeley, they're all doing work with the government.

And.

You want to like the easiest thing to compromise an offense is a university.

Period.

So,.

Go do it. And go look at the programs.

And.

You're probably I mean, I'm giving the playbook, but the the Chinese already knew the playbook.

Um the students,.

I mean, we have a bunch of Chinese foreign nationals at the schools, that's a challenge.

And, you know, somebody once came to me, Shawn, and they said, "Hey, man,.

If you were working at a company in another country,.

And Uncle Sam came to you and said, "Can you just take this for us?"

Would you do it? I mean, yeah.

You know, >> >> I'll do that for Uncle Sam.

I'll do that for you. Let's go.

But, you know, so now I'm unemployable to any foreign company.

That's what's happening here,.

You know, with all the you know, we we went with this global economy and we said, "Come work here and we'll.

Take your best and brightest."

The problem is where are their families?

And and and and.

And who they are they truly loyal to?

So, I actually felt man, you know, the compromises occurred.

Cuz you can do it from 10,000 miles away and there's no risk to it.

But, I actually felt and I remember for years working with the defense industrial base, we always thought to ourselves, "If we.

Lock down the cyber door,.

Are we just going to have an HR problem?

Are we going to be hiring the scientist that steals everything?"

And most people would rather have a cyber.

Problem.

Than personnel.

Working at their company stealing their stuff, you know?

So, it's a tough.

Man, when you're heavily targeted like the DIB is, defense industrial bases, it's a it's a complex place to secure.

>> Wow. Looks like in that timeframe,.

IP theft by China was an estimated.

300.

Billion and 1.2.

Million American jobs per year.

>> Impacted? >>.

Yeah. >> Yeah, I mean, there there's no question like like they won in uh in solar power, right?

Do you think they hacked the solar power companies?

Probably. Probably every damn one of them.

You know, everybody makes fun of you know, the space shuttles all look the same.

Well,.

How did I get it? You know?

The least risky way to spy.

Cyber.

Period. And probably the most comprehensive.

Cuz when you spy, you want comms.

You want the communication,.

Right? Did they ever.

Did China ever.

Confirm that they did it?

No, when we went live, certain quotes you remember your whole life.

I'll probably get this one wrong, but.

When we went live, you know, we went live because.

We.

We did that report in conjunction with the New York Times, by the way, deciding that they were going to go live.

Because they had the reporters compromised.

They had a reporter.

Named Mike Barbosa over in China.

And the Chinese were stealing his email.

And.

You know, when we wrote that report, by the way, I remember it was like a movie in a way.

I remember getting on the phone with David Sanger who wrote the article for New York Times, but all of our press.

Were compromised. They were going after Washington Post.

They were going after New York Times.

They were going after USA Today.

They were going after all the press cuz China wants to see what are you going to publish about us.

Before you publish it. I don't know why, but they they do that.

Especially if you have.

Bureau in China.

And I just remember getting on a call, and on the other side it's like, "Hey, it's Barbosa."

You know? And the New York Times wanted to verify PLA unit 61398.

So, we gave him an address,.

And I think Barbosa went and checked it out and went, "Oh, man.

It's like a whole bunch of noodle shops."

And then there's this NSA looking thing with antenna everywhere right in the middle of them all, and a bunch of dudes.

In uniform going in every day.

We had it right cuz we used Google Earth, Sean.

We saw the building get built.

Isn't that insane? We watched it grow,.

You know, on Google. And we went, "Okay, that's where they're doing it from."

We figured it out. We figured it out in a couple ways.

We figured it out in a couple ways.

Everyone's and you got to look every day to find it cuz a lot of evidence will pop up and disappear.

>> I've been using Ridge for a while.

And what I like about them is they take everyday gear and make it cleaner, tougher, and more functional.

Wallets, power banks, luggage, travel gear, all the stuff you actually carry and use.

In fact, their power banks, I just got three charges.

Off one bank at the airport.

Amazing. And now Ridge is back with their annual sweepstakes for the sixth year.

And this one is insane.

Two winners get to choose between a Lamborghini.

Huracan.

Sterrato,.

A Hennessey Velociraptor,.

A custom Ford Bronco, or a $100,000.

In cash. I'd probably take the Velociraptor.

It's got 558.

Horsepower twin turbo, and it's basically American muscle built into an all-terrain truck.

That's a hard one to pass up.

Even if you don't win, Ridge is still worth checking out.

Their power bank has built-in cables, wireless charging, MagSafe compatibility,.

And enough power for up to three full phone charges.

Their wallets are slim, durable, and built for everyday carry.

Ready to upgrade your wallet and maybe your ride?

For a limited time only, head to ridge.com.

And use code SRS clips at checkout for 10% off your order and a chance to win Ridge's biggest sweepstakes ever, a.

Lamborghini.

Huracan.

Sterrato,.

A Hennessey Velociraptor,.

A Ford Bronco, or $100,000.

In cash. No purchase necessary to enter, but every dollar you spend gets you more entries.

That's ridge.com.

And use code SRS clips. After you purchase, they'll ask you where you heard about them.

Please support our show and tell them our show sent you.

>> We were finding resumes by Chinese.

Students that were transferring.

Schools or going for jobs. We had Mandarin speaking folks who would translate these resumes.

This was before you could just use Google Translate and just read everything in English.

So, we had to hire our own translators and we were translating resumes and we kept hearing about this PLA unit 61398.

And what people did there. And when you read the bullets, you know, you transferred from Chinese character set to English, it.

Was basically like, you know, we hack.

For a living. We get our orders and we hack those companies.

That was it. And uh we had we um we knew where they were.

Uh but the New York Times went public at the same timeframe.

Uh about their compromise and they were the first ones really one of the first victims.

Google was another first victim.

Google's so big when they were hacked by China, they just told everybody and they actually withdrew doing business in China.

They were just like, "Yeah, this isn't worth it."

You know, um because China does have to learn about the Chinese dissidents here and what they're doing.

So,.

Uh bottom line of you know, whenever there's ideological conflict, you're going to see cyber activity.

Uh and we have plenty of that right now.

>> You were just.

Telling me a story.

About >> Oh, yeah.

>> when you exposed a 61.

>>.

61398 >>.

61398 >> you know, even when I went live with that, I didn't know the five digits right away.

You know, I remember being on like 60 minutes.

I'm like, "6243".

You know what I mean? It's like you you worry about those damn things and as I get older I I forget.

It. But yeah, when we did that story, David Sanger kind of and Nicole Perlroth from the New York Times.

It was kind of coincided with the New York Times was compromised by the Chinese government.

That's a little weird.

And.

They decided to go live with it and we decided,.

"Well, let's go with who did it and what they've been doing."

That's the PLA unit 61398.

Thing and it was Sanger's idea and Nicole's idea.

Let's just put this on the front page.

And I remember like the day before, I don't know where every once in a while I think I'm an expert when.

I don't know You know what I mean?

So, I'm literally on the phone with Sanger and I'm thinking I I his job better than him.

He's like, "This is going to be a big deal."

I'm like, "No, it's not, Dave.

You're you're wrong. Nobody gives a damn about hacking.

Yeah, I've been doing this for 20 years.

No one's ever cared and and they still don't."

I go into work the next morning and I get in I still remember my lights weren't even on in my office.

Yet.

Um and I go in it's it's out you know, in Alexandria, Virginia.

It's about 7:20.

In the morning.

And it's live. We're on we you know, it was like February 13th of 2013.

We're the front page.

And.

I don't remember what the headline said.

And and what's weird, too, you're an entrepreneur, you know, it's like no matter how good yesterday was, the only thing that.

Matters is tomorrow. I already been done I'm done.

We're fine. We're on the front page.

Who gives a We're off. Let's get let's get our work day done.

And uh all of a sudden my cell phone rings and I answer it and it's my now ex-wife.

And her exact words.

Exact words were, "What the did you do?"

>> >> And I went and and immediately because I'm a guy, I'm like, "What left field thing am I in trouble.

For now?" Like, I didn't know it why she was saying it.

And I'm like, "What are you talking about?"

You know, I probably got defensive right away.

"Like, what the hell are you talking about?

I didn't do anything." You know, she's like, "Turn on your TV."

And I have a TV right in my office.

I turn it on and I'm not even kidding, the very first scene I saw.

Is a the building I recognize the building in the background.

It's PLA Unit 61398's.

Headquarters. And there's like a dude in a taxi.

Going, "Drive away. Drive away."

And I look at the bottom and it's like, you know, uh Mandiant report and all this.

I'm like, "Oh crap, what did I do?"

Like, I didn't even know. We we didn't think about.

People were like, "This is a marketing troll."

Really?

No, it wasn't. It was a bunch of former US soldiers saying, "Screw this.

It's Chinese New Year. Let's get the report out.

Let's burn their infrastructure. Burn their operation.

Give our government a tool.

So the government doesn't have to point finger at China.

We'll do it for them." And let's just see what happens.

And we dialed that report back.

We actually had the names of a few of the soldiers.

Like, we knew who they were.

And we pulled I remember I edited those things out.

I'm like no, we're not going to put that in there cuz I didn't know what would happen to these guys for.

Getting caught.

Uh but anyway, I ended up that day doing about 13 interviews or something like that.

And by the way, with no staff, like nobody's handing me power bars, nobody's coordinating.

I think uh you know, I just ran around trying to get out.

The truth of it. Because what's weird is if I didn't go out and do those, Shawn, those interviews, someone make crap.

Up or say something and we were um we were in the ring.

Like I you know, we were in the ring.

We knew exactly what China was doing.

So I just felt.

Let's be the voice of reason on this one and get it out there.

>> Nobody had even heard of 618.

Or 61398.

>> I don't know. To be honest, I hadn't either.

My team wrote it. It we picked Here's what's weird.

We had like three groups who could have picked in China.

There's like a little naval group we called APT4.

We chose APT1.

For a lot of different criteria, but one was they kind of they weren't they weren't the Mike Tyson in the ring,.

You know, in his prime. They were more,.

You know, Buster Douglas. We we knew we could take the uppercut coming back from them.

Uh and uh so we literally picked them.

And it was a tool to give.

You know, Congressman Rogers, you know, something the government.

Like US government, we know, we probably know you know, but we're we'll let you guys have this work of art from.

Us.

So, we did it. >> No matter where you're watching the Shawn Ryan Show from,.

If you get anything out of this at all, anything,.

Please like,.

Comment,.

And subscribe.

And most importantly,.

Share this.

Everywhere.

You possibly can. And.

If you're feeling extra generous,.

Head to Apple Podcast and Spotify.

And leave us a review.