The 404 Media Podcast (Premium Feed)

Hello, and welcome to the four zero four Media Podcast where we bring you unparalleled access to hidden worlds both online and IRL. Four zero four Media is a journalist founded company and needs your support. To subscribe, go to 404media.co, as well as bonus content every single week. Subscribers also get access to additional episodes where we respond to the best comments. Gain access to that content at 404media.co.

I'm your host, Joseph, and with me are the other four zero four Media cofounders, the first being Sam Cole

Hey.

Emmanuel Mayberg Hello. And Jason Kevlar.

Hey. What's up?

So Sam and Jason, you had an event this past weekend, I think. Tell us about it.

Yeah. We were at the LA Public Library, the central library in Downtown LA with our friends Dexter Thomas and Geeta Jackson from Aftermath, which you should check out Aftermath. If you haven't, you should check out Dexter's YouTube and podcast if you don't know him. We were talking about how AI changes is changing the Internet. It was very fun.

Sam, did you have a good time?

Yeah. It was really fun. I mean, I love hearing Dexter and Geeta speak in general and you also. I hear you speak quite often, but I get to hear them less often on stage. But, yeah, it was great.

It was, it was a really good time. I'm glad everybody came out who came out. I think there it was an interesting crowd because there were quite a few software folks and tech folks who were showing up and saying, you know, similar to what Emmanuel wrote about recently, like, I'm experiencing this AI influx at my job and I'm interested for that reason to talk about, you know, how AI is infiltrating all of our lives. So that was cool. It was a good it was a good time.

The the LA public library is lovely. People are lovely. The place is beautiful. So I'm back in New York now, but, yeah, it's a good time.

It's really crazy. The library is they have this thing called the Octavia Lab, which is named after Octavia Butler, a fantastic dystopian science fiction writer. And it has, like, a bunch of gaming PCs with, like, 40 nineties in them as well as, like, three d printers, embroidery machines, podcast studio, like incredible resource. People were gaming in there. I went in after really nuts.

You can go in and game?

Do can go in and game at the library. Wow. And they're they're like, you know, the the cases, the the computer cases have see through, like, sides, like, they they have cool cases and stuff too.

It's like Mhmm.

These are good these are good devices.

Maybe I can do that and I can find the game on the PC.

My tax dollars at work, but, like, in a good way in a good way. But anyways, this will be on the Internet soon. I don't know exactly when, but I think probably in the next few days, it will be on the LA Public Library's YouTube channel. And we'll try to get it on our podcast feed. I'll talk to them about it.

But, yeah, you'll be able to watch it.

Yeah. And if not, I'm sure we'll link to it somewhere. It'd great to get on the feed. Sam mentioned, sort of tech and software people coming and talking about AI at their work workplace. We're gonna definitely touch on that in the second half of the show.

As for this first half, we're gonna start with Jason's really wild this is one of the wildest hacking stories I think has happened in quite a while. The headline is hackers simply asked Meta AI to give them access to high profile Instagram accounts. It works. Jason, we'll go into who was hacked, the sort of people doing it, all of that sort of thing in a second. First, can you just very simply explain how the hack works?

What did the hackers do and how did they gain access to these accounts? We'll just start with that.

Yeah. I mean, it's funny because this is one of the craziest hacks, but it's also one of the simplest things you can possibly imagine. And so basically, back in March, Meta launched this AI support assistant, which is basically a chatbot assistant that is that goes beyond the type of help bots that you might have encountered on like other websites where, I don't know, like customer support, you start talking to an AI chatbot, and it just sends you a link to like, you know, a guide that says like, here's what you should do if you're locked out of your account or whatever. What they've done is they've empowered this chatbot with actual access to like the support back end of Meta of Instagram and Facebook. Meaning that this chatbot not just can give you like, oh, here's what might be going on.

It can actually change settings in your account, which is like very critical and and a difference. It's like it's an LLM that's actually hooked up to people's accounts. And so what these hackers, basically like groups of people on Telegram, learned was that they could just talk to these chatbots and say, hey, I lost access to my old email address. This is my account, and they would send the account that they wanted to take over on Instagram. And they would say, can you please send a recovery code to my new email address?

And then they would just provide an email address that they controlled. The chatbot would send a two factor code to that email address. The the hacker would then take that two factor code, provide it to the chatbot, and then the chatbot would send a password reset link. And so, basically, the chatbot was changing the email address associated with an Instagram account and allowing that person to then change the password. He's letting them take over Instagram accounts, like, in huge numbers.

Yeah. And, like, usually, when a hacker wants to do that as in, hey, I want to put my attacker email address onto an Instagram account, it usually has to be a lot more elaborate as in, you know, maybe they'll just fish the original account owner and they'll swap it themselves in the back end, so then the owner's locked out and now they have a link to their email, that sort of thing. I mean, how elaborate it gets, obviously there's lots of SIM swapping and stuff of Instagram accounts. A lot of these accounts are very, very valuable, right, in the underground where you have ones with just one letter or maybe just a single word or whatever, and I think we saw some of those here as well. But now you just ask Meta AI, give me access to this account, and the AI does it.

Like how did they not see this coming? It's absolutely fucking crazy.

It is nuts. And I saw a few like, a lot of this was happening in telegram groups where people were talking about how to do it and sharing, you know, wins and things like that where they were able to take over accounts. And in some cases, it was like a more sophisticated prompt injection where they were like giving like really detailed instructions, but then they realized that that wasn't even necessary. They could just say, hey, I want I own this account. Give it give it to me.

And the chatbot was like, yes, I will help. And so it it's kind of mind boggling as to like how Meta allowed this to happen, how this sort of like red they weren't able to like red team this out before it actually launched. But but since publishing the article, and I guess I should have included this in the article because I I did know about this. It's like a lot of the people who used to work on this type of support have been laid off in the last few months and replaced with AI in general. I've gotten like a few people reach out like, I work on the team that is supposed to prevent things like this from happening.

And it's like, we know that Meta is writing a lot of code with LLMs right now. We know that they are pushing a lot of code that has been AI generated, and we know that they're using AI for content moderation. They're using it for support. And I mean, lot of the people that would have presumably caught this or been able to fix it quickly, no longer work there. And so this was apparently being exploited for at least weeks, possibly longer according to the folks who were were doing it and demonstrating it.

And then it kind of went wild or went like loud over the weekend. And Meta did fix it on Sunday, but there are many people who had their accounts stolen. Like the Barack Obama, White House lost their account for a bit. Sephora was hacked, the the makeup and skincare store, like giant. An executive at Space Force lost their account.

And it's hard to say exactly like which accounts were stolen using which tactics, but in general, it's like, I've seen many, many, many, many people talking about how they've been locked out of their Instagram accounts, how they had how they've had their accounts stolen, and it was clear that this was working for quite some time.

Yeah. There was some rumbling about, you know, pro Iranian hackers breaking into the Space Force one and and that sort of thing, and like, maybe, I don't know, I think our reporting focused much more on the the method and like the technique that was going on, but it looked like there were some people with valuable usernames as well, like those OG handles I mentioned that only have a few numbers or letters in them as well. When when did you hear about it? When it when it went loud and then you went to go find more evidence in Telegram? Like, explain that process of figuring out what was going on.

Yeah. I mean, honestly, I logged on to the Internet Monday morning and I saw a few Reddit posts. Like, I subscribed to many different Reddits. And so like people on the Instagram subreddit were talking about their accounts being taken over. I think I saw a post on like Mastodon from a security researcher who mentioned it.

And then I also had someone in my signal saying like, hey, this is crazy. You should look into it. And then I went into just a bunch of different hacking subreddits and hacking telegram groups and saw videos of this in action. I saw sort of discussion dating back weeks as to like how this was working. I also saw, you know, specific accounts that were taken over.

And then some of the accounts had still were still hacked, and then others were totally disabled. And then a few of them had been returned to their owners. It seems like it's been a bit bit of a mixed bag there. I don't know. I guess this is something I feel comfortable saying on a podcast, but not in the article.

It seems like this originated out of an Arabic language, like hacking group. Like, that's sort of everything I've seen has pointed back to to them sort of, discovering this like a specific Arabic language hacking group. So I don't know. Maybe it's too much of a leap, but I don't know. Maybe that that speaks to like well, I I don't know.

Actually, I I wouldn't say it.

But that but that's still interesting in all of itself. Yeah. And I I think we've sort of cited that. You obviously have this community of fraudsters and hackers and scammers called Com, we've covered Mei Mei times before. And there's definitely like more, not even cooperation, but overlap from them and their English language primarily with people in The Middle East.

We've actually seen like some hackers in Jordan and that sort of thing who are now like kind of part of comms. There is like some swapping of techniques it seems there. If this originated in the Arabic stuff, Arabic speaking stuff, then it it seemed to have like break containment basically.

Yeah. And I mean, they're saying it's like the Arabic sect of calm. So, yeah. The other thing, there there's one more step, one more thing that the people who are doing this claim that they had to do, which is that they turned a VPN on to, make their account look like it is in the account of or in the region of the target. And so there was also these big text files of OG usernames.

So basically, as Joseph was saying, like high value usernames that have, like, short, you know, like, they're single words or they're just, like, really high value ones like iPhone. I saw, like, the Instagram account for at iPhone was taken over for a bit. It was a list of those usernames, but then also the geographic region that they're associated with. And so then people would turn on a VPN to put themselves in that geographic region, and then they had a higher success rate with this chatbot support.

It can also impact, I mean, people's livelihoods, right? I mean, there's the Sephora account got taken over. Yeah, sure, whatever. Brand accounts get taken over all the time. And then I think after we published, it was just shared in one of our group chats somebody was saying, this is the account I use for my livelihood and I was entirely disabled and I can't get it back.

And it seemed that the people who were impacted, they of course, when they tried to get access to their own account, there was no human to speak to because as you said, it's all being outsourced to this AI anyway. So then the victims are totally screwed as well.

Yeah. So the victims are screwed. And then also I think that because Meta's support is notoriously so terrible because of what you just mentioned, there's like very few humans in the loop. It's like anyone who's lost access to their Instagram account for any reason has been saying like, oh, it must have been hacked through this method. And it's like kind of unclear at this point and and they can't get any any help.

So they don't really know like what's going on. Like some of these accounts might have been disabled or taken over or some like through some other means, like it's kind of hard to say. And so I've seen like quite a lot of just confusion from influencers or from people who have business accounts. There's like a lot of viral threads on X and on threads about like losing access to an account and not be like spending hours and hours talking to a chatbot and not getting anywhere. And I think that this whole thing just shows the danger of outsourcing all of your support to an LLM.

It's like there's any number of, you know, unexpected things that can happen like we've seen with all chatbot tools that, like, know, testing the guardrails and jailbreaking them is something that people like to do for fun. And so if there is a monetary incentive for a hacker or something like that, like we're gonna see that happen. And so, it doesn't really matter how much you red team or test this stuff. Like, there's enough kind of unknowns and exactly how any given prompt is gonna work or how any given tool is gonna work that there there may be vulnerabilities introduced.

Yeah. And there's kind of a a weird ironic layer here where people have been locked out of their Instagram accounts going back years, like we covered this at Motherboard a bunch and I think a little bit at 04:04 Media as well, where people would get hacked or they'd lose access to their Instagram account, hackers would extort them or whatever. And the customer support mechanism was so complicated and crap that victims would end up hiring white hat hackers who knew how to navigate this system to basically like break back into those accounts. And now it turns out that maybe victims could have used this to get into their like long dormant Instagram accounts or something. I don't know.

It's a complete mess. As you say, Meta gave the statements of, we fixed it and we're restoring access to the accounts and stuff, but like this is a complete garbage fire. It's absolutely crazy. All right, We'll leave that there. When we come back after the break, we'll talk about Emmanuel's story and Amazon's AI leaderboard.

We'll be right back after this. Alright. And we are back. The headline for this one is Amazon shuts down internal AI leaderboard after employees cheated. So first of all, Emmanuel, what was this leaderboard and what was it designed to track exactly?

You heard about this a little while ago.

Yeah. So a few weeks ago, I wrote a story based on quotes from a bunch of software developers across many companies in the tech industry, talking about how they are being forced or heavily pressured to use AI coding products, whether it's AI coding agents or other AI tools to produce code and how that is not working out so great for them or the company. But that it doesn't matter because that's what leadership wants. They want to show that people are using AI tools because they think that it increases productivity and it's the way of the future, that's how you have to work. In response to that story, I heard from a bunch more developers, this is something that they're very riled up about.

I think we're going to do a bunch more stories about how this is shaking out internally at various companies. One place where I thought there was an interesting story was at Amazon. As I was talking to some people at Amazon, they were telling me that one way that they are incentivized, I will say kindly or pressured, I think is how some employees are experiencing this, is that there's a thing called the leaderboard. Keyro is Amazon's AI coding agent, much like, I believe it's Codex for OpenAI, and Cursor is another independent, very popular, very successful company. And essentially, what the leaderboard does is keep track of how many requests or tokens employees are using with Kiro, and whoever uses more moves up the leaderboard, and and and that's what it's tracking.

The point of it is friendly competition. If you guys recall, our reporting back at motherboard on Amazon warehouses is employees compete for, like, pieces of flair that they wear on their uniform, and there's something very similar here where internally, there's like an employee registry called a phone tool, I believe. So people who move up the ranks get, like, pieces of flair they they can put next to their username and, like, the company's internal registry. So there's no monetary rewards or you get days off or you get some kind of vacation or something like that. It's just telling you you're doing a great job if you're using Keyro a lot.

And I guess what another way in which the pressure is applied is, you know, I've heard from one employee who had a performance review and they kind of got the hint that they're not using AI enough. So then they moved up the leaderboard in order to show that they're responding to the criticism.

Yeah. We'll talk about those other employees in a second. Just to sum up, yeah, basically a leaderboard for, with all the employees names or whatever or their handles or whatever it might be, and this is how much you are using AI based on the token usage. That doesn't necessarily mean that you've contributed the most to this product. You haven't provided the most value to shareholders, whatever stupid of a metric you want.

It's this uniquely stupid metric in that you are using AI more, so you go up leaderboard and in Amazon's eyes, and as you said, we're a bunch of other tech companies eyes. That's probably a good thing because that's what they want. But they're not actually saying you're doing better work or anything like that, or it's not soul destroying. They're just saying that number go up basically, so that's good.

Yeah. Yeah. Was trying to think what would be the equivalent for us. And it's

the quarterly boards, right?

The

good the the traffic numbers.

Well, no. Because the traffic numbers don't, like, cost us money. I was thinking, like, if it's it's as if you worked at Vice and people there was a leaderboard for like how many Getty images you paid for regardless of whether they ended up in stories or they led to good traffic or anything like that. It's just like, good job. You spent a lot of company money

Right.

On this resource. Yeah.

Yeah. Yeah. Yeah. There's the other way around. You're correct.

Yeah. That's how many pens you bought or something

like that? Right.

I would love to see that have an advice specifically. That would be so fun. I feel like people were doing that unofficially.

For sure. I mean, it could be like how many Slack messages you send because We just

do that. Yeah.

Well, Slack does send some like weird like, like ranking system and you can check that. And it's like Slack as a proxy for like doing actual work is so stupid. And if if we had chosen to prioritize that, it's like, you could just send dozens and dozens and dozens of DMs to yourself or, like, to your friend at the company or whatever, and that would push up the leaderboard. And it doesn't cost it's worse. What you're describing is worse because it costs the company money, as you said, like with the AI tokens.

But, like, it's basically the same thing where it's like, this is useless. Like, this is useless as a proxy for work.

I remember one time Jason got fed like the company data and Slack use and either you or I were like the number one.

We were definitely one and two because we were just talking to each other all the Definitely

like 90% not about work either. Yeah.

But Jason, you you mentioned sort of gaming the system there by DM ing yourself on Slack. Well, that is basically what some people at Amazon did here, right? So as you mentioned, Emmanuel, somebody goes into a performance review, they get the impression that, hey, you're not really using AI enough, so you need to use more AI. I know you have to be a little bit careful in specifics here, but like how did they go about that and sort of the why? Was it just to sort of settle those concerns or like because they basically cheated.

Yeah. So imagine you're a software developer, the way you would legitimately use Hero is you would say, you know, I need you to like plug in a piece of code to this thing I'm working on, I need you to like code out this widget for me. But even coming up with the useful tasks was like too much labor and unnecessary labor for this employee. So in order to get their score up, as you say, I don't want to say specifically what they did because that can help identify them, but just imagine any completely useless, unnecessary task that you can automatically have Kiro take over and over and over and over again. So you're like, hey, Kiro, like, generate me a poem, and when you're done with that, generate another poem, and then do that infinitely.

And that is not producing anything of value to the employee or Amazon as a company, but on the back end, it makes it seem like the employee is shooting up the leaderboard.

Yeah. Yeah. And then you spoke to other employees as well who may not have necessarily cheated, but for some reason, of course, they came to you and told you about this leaderboard. So what were they what did they make of it and sort of why did they come and tell you about it if you know?

So the reason that people brought up the leaderboard is because I was specifically asking employees at tech company to tell me about ways they are pressured to use AI, and that's how people at Amazon read the leaderboard. There was one employee that I talked to who actually reached out to say, I use AI, I find it to be pretty useful. I think that the people who are complaining about it are suffering from a skill issue, and he was basically like, I'm I'm kind of pro this tool if you know how to use it. All that being said, the leaderboard is clearly having kind of like a toxic effect at work because it is just promoting AI use for the sake of AI use, and he found that to be detrimental to the company, detrimental to him as an employee, and detrimental to, like, the adoption of AI tools even if you think they're useful, which we have to do some speculation here, but it's informed speculation is what eventually led to Amazon to terminate the leaderboard and why we end up running the story.

Yes. So Amazon does close this leaderboard. What is the reason that Amazon gives? And and and I guess this and I think I might be wrong here, so please correct me if so, but there's sort of two different announcements. I think they announce the closure internally, and then they also give a statement to you publicly.

Is that right?

Yeah. Correct. So initially, I mean, this whole thing is not a public facing leaderboard or like a press or consumer facing thing. It's entirely a piece of internal company policy. And what happens is on May 18, people log in to work, and some of them are checking the leaderboard to see how they're doing, and rather than seeing leaderboard, they just see an announcement from Amazon that says, hey, the point of this leaderboard was to incentivize people to use Kiro and to teach them AI skills, And we have seen that people completed I don't want to say the specific number because I'm worried about being like potentially identifying as well.

But overall at Amazon, many thousands of tasks were completed with Kiro since we've introduced the leaderboard, and that to us says that the leaderboard has accomplished its job, and for that reason, it's no longer necessary and we're shutting it down. Somebody in Blue Sky commented something that I thought was was funny and accurate, which is, oh, yeah, like, there's no better corporate policy than shut down a program that is working extremely well. So it's like a suspect explanation.

Yeah. Well, and now it's closed. So now people are gonna rightly chill, like not do as much well, suppose they'll still track the AI usage and it'll still come up in performance reviews and stuff, but they won't be the leaderboard. So Amazon says, hey, mission accomplished, we can all go home, we can retire the leaderboard, it's all good. What do the employees speaking to you think?

Do they link it to the cheating that was going on in their eyes?

Yeah. I mean, immediately several employees reached out and said because they were talking to me about the leaderboard having this toxic impact before this happened, and then they were like, hey, guess what? They just shut it down. And what I heard from them is they this was said to people in, like, Zoom or in person meetings. They they got the impression that Amazon from their managers that the reason the real reason that Amazon was shutting down the leaderboard is because they eventually figured out that it was promoting waste.

Whether that refers to straight up cheating and burning tokens and money and power just to game the leaderboard, or it's referring to just like very inefficient use of the tool is not clear, but that's the impression that like several people got separately from different managers. And then I should also say, the Financial Times beat me to this news. I think they published something on Friday, and they have some sources kind of higher up the management ladder, and their sources say that like explicitly this was the reason. The reason is that Amazon figured out that this was promoting wasteful and costly use of AI.

Yeah. Very, very interesting. And I'm sure other companies are trying similar things. Right? Like, maybe it's not on the as on the nose as like a big leaderboards, but I don't know.

They're trying to incentivize it somehow, and this obviously blew up, massively in their face.

I mean, the leaderboard is is a literal representation that the entire company can look at of something that that we have reported is for a fact happening in many, many companies, not just tech companies, which is this idea of token maxing. Right? So it's like, maybe not everybody is looking at the chart beat equivalent of how many tokens are being used, but managers are like talking about it on LinkedIn to be like, we've spent so a 100,000 Jason has reported on this. There was just like this whole toxic manager LinkedIn brain about we're burning through hundreds and thousands dollars worth of tokens that we must be doing really well with no comment or insight about what the actual impact is on the product or the company or the customer, etcetera.

Yeah. And I mean, maybe we'll we'll cover this. I'm not sure, but it's kind of out there. But as we're recording, I think GitHub just turned it on. So it's now charged per token in a lot of cases rather than the subscription and people are like burning through.

They're like, oh, the amount of AI usage I got for $60 a month or whatever is now nothing compared to what I'm paying per token. So I don't know, there's some really interesting economics that are to impact people who are using this tool. But with that, if you're listening

to Wait.

Can I

share the leaderboard for us? Our Slack word award.

Wait. You've

shit. I haven't. I'm at first. I'm definitely at In the last thirty days.

Wait. Wait. Wait. Okay. Go ahead.

Well, I haven't been here, so I'm I'm good. Okay.

Jason is, like, way in first.

Joe is first by a lot. Wow. By a lot. By a lot. I'm next.

Wow. And then it's Jason and Emmanuel. Emmanuel, you're last by a lot. But you were

I mean, I haven't I've been out, like, So most of the I

don't know. This not all time. This is just the last month.

This is the last thirty days. Let's see if I can do all time. I'll do a longer range.

Dude, I don't like it. Low low slack use indicates depression perhaps.

Also indicates you're barely doing any work. That's how you know. This is how you know by slack.

Mine is high functioning depression maybe. I'm just like, it's it's the other direction. Yeah.

Let's see. August 2023. Right?

Sure. Sure.

Yeah. Wow. Where are you finding this?

In our Slack analytics, which is something that I didn't know we had. Oh my god.

That's a very pay for those Slack AI tools so we can get

Oh, it can only do from it can only do from May 1 to today. So let's do today.

2023. 06/20/2025. Right.

Okay. Jason's first.

There you go.

By by a margin. Not a big margin, and then Joseph, and then me, and then Emmanuel.

I don't like that. I'll get my numbers up. I'm sorry, gang.

You're busy vlogging.

We we literally have a room in Slack called counting.

It's I haven't been doing counting.

We're we're supposed to just if someone does the number 125, then someone else does 126, clearly Emmanuel, you need to get like in there to inflate your numbers. But then all of us have to reply to inflate all of our numbers. So then we'll have to scrap the leaderboard, basically. It'll be disaster. Yeah.

We're That's the latest.

We're up to two fifteen. We can check-in at the end of the year or something till

Seems like we're up

to two fifteen in two and a half years. Not not so high.

Oh, my god. Yeah. Let's definitely let's keep an eye on that for sure. Alright. If you're listening to the free version of podcast, I'll now play us out.

But if you are a paying for a full media subscriber, we're gonna give you direct access to the Slack leaderboard, and you can come in and follow it yourself. No. We're gonna talk about our lawsuit against ICE and some documents we got from there. You can subscribe and gain access to that content at 404media.co. We'll be right back after this.

Okay. And we are back. We are back with an update about a lawsuit that we filed last year, that I think we're very excited about just because it's important work. The article here is we sued ICE to get its spyware contract. The agency is redacting essentially everything.

Joseph, you've taken the lead on this lawsuit. It was your FOIA initially. So can you remind us what the lawsuit is and also what Paragon is?

Yeah. So Paragon is a spyware company that lets government agencies remotely break into phones. Think of like NSO Group hacking team, that sort of thing. Where Paragon differs allegedly is that it positions itself much more as an ethical player. So while NSO Group is riddled and controversy and has been abused all over the world, Paragon says, We only work with I mean, can't remember if in the documents they say democracies, but they sort of spell out their ethics statement in these documents that we got.

That said, the Italian government abused Paragon tools and then Paragon cut them off. So they do have a history of cutting off problematic and abusive customers. There's that part. They're also a little bit different in that they don't fully take over a phone, at least according to reporting from Forbes a while back. They're like, we're just going to break into signal or we're going to break into WhatsApp or whatever.

It's not about persistence across the entire device. It's about getting to that messaging app. So that's what Paragon is. In 2020 was it 2024? A while back, ICE buys Paragon, or rather sorry, it buys a product from Paragon for $2,000,000 And obviously, it is very significant that not only a US government agency is buying spyware probably from an Israeli company, or really any company.

It's also very interesting, of course, is ICE and specifically HSI, Homeland Security Investigations. So we file this FOIA to be like, hey, I want the contract, the statement of work, which would explain this is what this spyware is for. And, you know, ICE doesn't get back to us basically at all. So then we filed this lawsuit to basically try to compel them to hand over these these records.

Yeah. So it's been a few months, and I guess maybe like a little bit of behind the scenes is the lawsuit was like mega delayed because of the government shutdown. And I think this is correct. Please correct me if I'm wrong. But basically, like, when there was a government shutdown, the ICE lawyers, DHS lawyers said, like, we're we don't have to respond to this for quite some time.

And then they did. And then there was a DHS specific shutdown, that in the short term didn't really impact ICE's raids and that sort of thing, but did impact them responding to this lawsuit. Yeah. Is that correct?

I mean, they basically closed the foyer office in a way. And I think this impacted a little bit of customs and border protection as well, obviously another part of DHS. But with ICE, they already told us months and months and months ago, yes, we have responsive records, we're going to provide them. And then as you said, these shutdowns happened, so we didn't get anything. When of course, all would have taken is sending an email with like a Dropbox link or something, which I think is what happened here eventually.

Was like, okay, we're going to produce it today. There you go, there's the documents. It really doesn't take that much time at all. But yeah, this was annoyingly and massively delayed because of the DHS funding, obviously. That is a tiny snippet of impact when the DHS shutdown stopped ICE doing other things or at least some things.

Was still doing all other stuff across The United States as well. But yeah, it definitely slowed the progress, but now stuff is coming back and we and we should get more material.

Yeah. So you you just got some documents back. What what are they?

Yeah. Well, they say the responsive documents are like six seventy, maybe 700 pages, something like that, which is a pretty good number. Of course, there might be some duplicates in there and we'll talk about the redactions in a minute. But what they provided was 70 pages in the initial interim release. I'm not sure if it's the statement of work exactly, but it is partly Paragon's pitch to ICE where they're saying, we're the ethical player here.

We want to help out HSI, that sort of thing. There's a little bit from ICE and that we need this spyware for XYZ reason. But crucially, XYZ reason is redacted. The exact capabilities of this tool that they've bore are redacted as well. So yes, we're getting stuff and there is some interesting stuff.

Actually, interesting thing I'll say before we get to the redactions is that there's a paragraph in there that says that Paragon has like a dedicated operational security team, an OPSEC team, and they help customers, in this case ICE, ensure that they can use the spyware without being caught. And like we kind of knew that where you have Citizen Lab where they're trying to map out a spyware company's infrastructure and of course, NSO Group or whoever, they don't want to be caught. Their customers are trying to deploy this spyware covertly and and securely, I guess. But it was interesting to see that Paragon's tell ICE, we have a dedicated team to make sure you don't get caught when you deploy this stuff. I thought that was kind interesting.

Yeah. And that's something we've covered, in FOIA reporting in the past is that the I mean, jurisdictions, obviously, this is federal, but different jurisdictions in different states have different carve outs that let the subject of the FOIA kind of pick and choose what to redact and what not to redact. And sort of like under the guise of different privacy exemptions or trade secrets exemptions, things like that. And a lot of those are it's like if you ask the company what they wanna redact, they're gonna say everything. And so

And that's what happened here, basically. Yeah. Like, we were told explicitly, well, rather told to our lawyer who then communicated it to me, and I've seen some of the emails, it's like us saying, well, we need to give Paragon more time to look at the response so they can I wouldn't maybe use the word decide what to redact, but they can contribute what they think should be redacted or something like that? And maybe that's under trade secrets or privacy or something like that. Something that we're not entirely clear on yet is that there's another third party that ICE is now saying we need them to check for redactions as well, and I have no idea who that party is.

Like, is it another part of Paragon or something? Is it Red Lattice, the American company that now owns Paragon? I'm not entirely sure, but yeah, it is very normal and very expected that agencies like ICE or other government agencies, as you say, sometimes let the spyware manufacturer or the social media surveillance company or whatever go through and seal the responses and then say what they would like redacted. That doesn't make it less wild sometimes. It's pretty crazy that a company is just saying, no, we don't want you to release that.

You know? You have you you come up across that a lot, Jason?

Yeah. I mean, because I'm often filing on companies like Flock and and things like that. And it's like in some jurisdictions, the the law is such that it's like they are allowed to consult with the the company and in others they're not. And I don't actually know what the law is federally. But but, yeah, it does kind of like vary by jurisdiction.

So I mean, I guess what, like, what comes next?

Yeah. Yeah. So, well, short term, hopefully get the rest of those nearly 700 pages of documents. Maybe there's more interesting stuff in there. See the redactions alike.

And then I anticipate not to box us into a corner, we won't get specific on any arguments that will be made, I would anticipate that we would argue against some of the redactions. That's another step in the process of the lawsuit itself, we'll cross that bridge when we come to it. But as we said in the piece, pretty sure that some of these redactions are very over the top, overzealous. It's like, what is wrong with HSI or ICE explaining why they bought this software in the original documents when you actually have the acting director of ICE coming out and saying, Yes, I approve this purchase to deal with fentanyl traffickers or something like that. And that's just like one line in a letter he sent to Congress.

Well, show us the contracts where it says it and we want to see the original language that was used to justify this purchase. So we'll get the documents, then we'll do the redactions. And then I know we just spoke about it now, but I imagine we'll do a FOIA forum about this. We need to do another FOIA forum soon. I don't know when this one will be exactly, but we'll definitely, I think run subscribers through, hey, this is what the lawsuit looked like.

This is actually some of the language that was used and sort of explained the process. Because I'm all used to this. I've never done a FOIA lawsuit before, but it's very, very interesting and I'm glad we're getting some documents out even if ISIS continue to redact and, you know, and we'll we'll keep pushing the lawsuit to get more basically. Yeah.

Yeah. And I mean, I think as part of this lawsuit, it's like we're learning a lot about one, how lawsuits work like this type of lawsuit, but then also, as you said, it's like we're learning that there's these other potential other third parties, like things like that. Like, I think there's gonna be a lot more to come out of this as it as it goes on. And I think that that makes it worthwhile in and of itself. Even if even if, like, the documents that continue to come out are redacted, and hopefully, we'll be able to fight that.

And hopefully, there'll be, like, more that comes out that's less redacted and and that sort of thing. But like, it it does go to show us sort of like how secretive this agency is and the software is and and all that.

Yeah. Absolutely. Alright. With that, I think I'll play us out. As a reminder, four zero four Media is germs founded and supported by subscribers.

If you do wish to subscribe to four zero four Media and directly support our work, please go to 404media.co. You'll get unlimited access to our articles and an ad free version of this podcast. You'll also get to listen to the subscribers only section where we talk about a bonus story each week. This podcast is produced by Alyssa Midcalf. Another way to support us is by leaving a five star rating and review for the podcast.

That stuff really does help us out. This has been four zero four Media. We'll see you again next week.