Key Moments

Brett Johnson: US Most Wanted Cybercriminal | Lex Fridman Podcast #272

Lex FridmanLex Fridman
Science & Technology6 min read228 min video
Mar 27, 2022|9,789,818 views|64,169|6,467
Save to Pod
TL;DR

Brett Johnson, former US Most Wanted cybercriminal, shares his journey from childhood trauma to building ShadowCrew, his path to redemption, and insights on fighting cybercrime.

Key Insights

1

Childhood trauma and a dysfunctional family environment significantly shaped Brett Johnson's early life, fostering a mindset for manipulation and crime.

2

ShadowCrew, founded by Johnson, pioneered organized cybercrime by establishing trust mechanisms among criminals, facilitating the exchange of stolen data and services, and becoming a precursor to darknet markets.

3

A crucial principle in cybercrime is beginning every fraud with identity theft, providing a buffer that makes it difficult for law enforcement to trace the actual perpetrator.

4

Social engineering is key to successful cybercrime, as perpetrators exploit human trust and emotional responses by feeding into victims' desires or creating believable narratives.

5

Cybercrime rarely ends well, not just due to arrests, but because it leads to a destructive personal life filled with lies, distrust, and the inability to form genuine relationships or find happiness.

6

Redemption and a positive life path are possible through self-acceptance, taking responsibility for actions, and having people in one's life who offer a chance for change and believe in one's potential for good.

7

Effective cybercrime defense requires understanding the networking and trust aspects of criminal operations, fixing known vulnerabilities, and encouraging companies and individuals to report and press charges against cybercriminals.

EARLY LIFE AND CRIMINAL INITIATION

Brett Johnson's journey into crime began at age 10 in eastern Kentucky, a region where illicit activities were common due to economic hardship. His mother, a central figure in local fraud and scams, engaged in everything from stealing heavy machinery to charity fraud and even pimping, exposing him and his sister to a chaotic and abusive environment. His father, though a good man, was unable to protect them due to his subservience to his mother. This upbringing instilled in Johnson a sense of self-reliance and a knack for manipulating situations for survival, laying the groundwork for his future in social engineering and cybercrime.

DESPICABLE ACTS AND THE LACK OF EMPATHY

As a cybercriminal, Johnson engaged in morally reprehensible acts, such as stealing a coin collection from a single mother needing a roof for her home and orchestrating pump-and-dump schemes that destroyed people's retirement accounts. At the time, he admitted to lacking empathy for his victims, solely focused on his own gain and justifying his actions by claiming they were for his family or loved ones. This detachment allowed him to exploit human trust, often by feeding into what victims already wanted to believe, highlighting the dark side of his social engineering skills developed in childhood.

THE BIRTH OF SHADOWCREW: ANONYMITY AND TRUST IN CYBERCRIME

Johnson's pivotal creation was ShadowCrew, an online community that predated today's darknet markets. After being scammed while trying to obtain a fake ID, he realized the need for a trusted platform for criminals to exchange goods and services. ShadowCrew provided a forum, review systems, and escrow services, fostering trust among its members—a critical component for successful, decentralized cybercrime operations. This environment allowed for the trading of stolen credit card data, counterfeit documents, and later, the development of sophisticated phishing and identity theft schemes, attracting skilled individuals and significantly increasing profits.

THE EVOLUTION OF CYBERCRIME AND NATION-STATE INVOLVEMENT

ShadowCrew's success in facilitating credit card fraud and identity theft drew the attention of law enforcement, with Johnson observing the increasing presence of government IPs on the forum. He also detailed the rapid evolution of cybercrime, from low-tech scams to sophisticated phishing attacks that yielded complete identity profiles. He highlighted the role of nation-states like Russia, China, and North Korea in cyber warfare and financial cybercrime, often collaborating with or employing individual hackers. The SolarWinds attack, which exposed source code and sensitive data from numerous organizations, exemplifies the catastrophic potential of such sophisticated operations and the ongoing threat to digital infrastructure.

THE CONSEQUENCES OF A CRIMINAL LIFE

Despite the financial gain, Johnson emphasized that a life of cybercrime inevitably leads to ruin, not primarily through arrest but through profound personal degradation. He described how constant lying to himself, family, and friends eroded trust, leaving him with only associates, no genuine connections. His first marriage failed due to his deceit and control issues, and a subsequent relationship with a stripper, while deeply loving, was also marred by his continued criminal activities and the emotional distance it created. This constant deception and self-justification prevented him from forming truly healthy relationships or experiencing personal growth.

ARRESTS, ESCAPES, AND THE PATH TO REDEMPTION

Johnson's criminal career saw multiple arrests and even an escape from prison. During his time inside, he experienced solitary confinement, which forced introspection, and witnessed the harsh realities of prison life, including violence and a strict inmate hierarchy. A turning point came through his sister's unwavering love and, crucially, the residential drug abuse program (RDAP), a cognitive behavioral therapy intensive. This program, combined with years of reflection, helped him accept responsibility for his choices, recognizing that his crimes stemmed from his own decisions, not just external circumstances.

REBUILDING LIFE AND FIGHTING CYBERCRIME

Upon release, Johnson faced significant challenges, including the inability to find legitimate employment due to his criminal record. He even resorted to shoplifting for basic necessities. However, meeting his current wife, Michelle, provided a second chance, her unconditional love helping him prioritize genuine connection over financial gain. An unexpected opportunity arose when he reached out to an FBI agent from his past, leading to a role where he now helps organizations understand and fight cybercrime. This shift highlights his belief in the power of second chances and the importance of individuals taking a risk on someone willing to change.

ADVICE FOR INDIVIDUALS, COMPANIES, AND GOVERNMENTS

Johnson stresses that fighting cybercrime requires a multi-faceted approach. For individuals, he advises knowing when to disengage from toxic relationships, similar to how he eventually cut ties with his mother. For companies, he emphasizes understanding how criminals establish trust and network, recognizing that most attacks exploit known vulnerabilities rather than zero-day exploits. He advocates for fixing basic security flaws, reporting all incidents, and avoiding the temptation to pay off insider threats. He also passionately argues against forcing citizens to surrender their full identity to private companies for government services, highlighting the immense value of personal identity in the digital age.

THE FUTURE OF CYBERSECURITY AND HUMANITY

Looking ahead, Johnson underlines the pervasive danger of cybercrime, now intertwined with global organized crime like the mafia and cartels, bringing inherent violence to digital spaces. He finds hope in humanity's ability to unite and respond to injustice, despite political divisions. His ultimate advice to young people is to strive for a life of helping others rather than hurting them, acknowledging that while challenging rules and seeking financial success are acceptable, maintaining an ethical core is paramount. This philosophy, born from a life of regret and redemption, underscores the enduring human need for purpose and connection.

Common Questions

Brett Johnson's life of crime began at age 10, influenced by his mother, who was deeply involved in various frauds. His early experiences included shoplifting for survival and witnessing his family constantly breaking the law. He later transitioned into online frauds like eBay scams, pirated software, and eventually mod chip installations for cable and satellite systems.

Topics

Mentioned in this video

People
Max Butler

Known as 'The Iceman,' he ran carter's market.com, where Brett Johnson's name appeared on the US Most Wanted list.

Stephen Schwecke

A real person from Ohio whose identity was used for one of Brett Johnson's early fake driver's licenses; he worked at ADP payroll.

David Thomas

A member of Shadow Crew who was on the run for check fraud, received collections from other members, and was later arrested in Issaquah, Washington.

Keith Milarski

An FBI agent from the Pittsburgh office who was involved in Brett Johnson's arrest, but later offered him references and advice, helping him transition to a legal career.

George R.R. Martin

Author quoted at the end of the podcast, from 'A Clash of Kings', stating 'A good act does not wash out the bad, nor bad act the good. Each should have its own reward.'

Carol Combs

Brett Johnson's high school English and drama teacher, who was the first 'decent person' he met and became a surrogate mother figure.

Edward Emanuel

The person who wrote 'Three Ninjas' and offered Brett Johnson a scholarship to San Jose State's theater program, which his mother sabotaged.

Dmitry Golubov

A Ukrainian spammer who launched 'Carter Planet,' a website dedicated to modern credit card theft, after being inspired by Counterfeit Library.

Strom Thurmond

His son was hired by Brett Johnson as an attorney, but he was forced to drop him because he paid with illegal funds.

Fake ID Man

A person Brett Johnson tried to buy a fake ID from online who ended up ripping him off, leading to his frustration and the development of Shadow Crew.

Satoshi Nakamoto

The pseudonymous creator of Bitcoin, whose ideas were foundational to the development of early darknet markets like Silk Road.

Bill O'Reilly

Mentioned as part of 'Inside Edition' where the segment on Beanie Babies aired.

Roman Vega

A buddy of Script who sold counterfeit physical credit cards.

Ross Ulbricht

The founder of Silk Road, who was initially driven by ideology but later resorted to violence, ordering hitmen to protect his empire.

Albert Gonzalez

A Shadow Crew member who was arrested for credit card fraud, became a Secret Service informant, and contributed to the takedown of Shadow Crew.

Jonathan James

A talented minor hacker who broke into NASA, DOD, and the Pentagon, later committed suicide due to fearing charges related to credit card theft.

Jim Ramichon

A Secret Service agent and the second-in-charge in South Carolina, who tried to get Brett Johnson to cooperate.

Bobby Kirby

A Secret Service agent who befriended Brett Johnson and tried to help him, later getting fired due to Johnson's actions.

Dustin Deramus

A landscaper who hired Brett Johnson after his release from prison, giving him a chance to work legitimately.

Paris Hilton

Her phone contact list was published by a T-Mobile employee involved with Shadow Crew, which made national news.

Kim Taylor

Brett Johnson's second-in-command in Shadow Crew, who was involved in various fraudulent schemes, including receiving stolen goods, and later got associates arrested.

Brad Pitt

An actor who makes a brief but genius appearance in the movie 'True Romance.'

Companies
PayPal

An online payment system that criminals, including Brett Johnson, exploited due to its initial lack of security, facilitating widespread fraud.

Tiffany & Co.

A luxury jewelry retailer from which Brett Johnson's stripper girlfriend desired engagement rings, leading to more fraud.

Deloitte

A professional services network that offered Brett Johnson a job to run a cybercrime office in the UK after his release from prison, which he couldn't take.

Microsoft

A technology company that hired Brett Johnson to consult with them, which established enough trust for him in the cybersecurity industry.

Hallmark Stores

Stores where Brett Johnson initially searched for rare Beanie Babies.

Western Union

A money transfer service used by cybercriminals to move illicit funds before the widespread adoption of prepaid cards and cryptocurrencies.

T-Mobile

A telecommunications company whose employee provided internal information about Secret Service investigations to Shadow Crew members.

Outpost.com

An online merchant that was defrauded by Shadow Crew members making large orders with stolen credit card data.

ID.me

An identity verification company used by government agencies like the IRS, which Brett Johnson criticizes for its policies requiring citizens to give up complete identity profiles to a private company for marketing purposes.

Bank of America

A financial institution that a Shadow Crew member named Tron had unfettered access to.

Joe's Roundup

A strip club in Charleston, South Carolina, where Brett Johnson met Elizabeth, the stripper he fell in love with.

LinkedIn

A professional networking platform where Brett Johnson connected with FBI agent Keith Milarski, which began his legal career in cybersecurity.

Kroger

A supermarket chain where Brett Johnson purchased blue dye to attempt to alter a Beanie Baby.

KnowBe4

A phishing security awareness training company that offered Brett Johnson a job, which he couldn't take due to his probation restrictions.

Arko Solutions

A company mentioned by Brett Johnson as being focused on increasing the cost of fraud for fraudsters to deter them.

eBay

An online auction and shopping website that Brett Johnson initially used for low-level frauds involving bad checks and later developed schemes around.

ADP

A payroll processing company where Stephen Schwecke, whose identity was stolen for a fake ID, worked.

Software & Apps
Tor Browser

A free and open-source software for enabling anonymous communication, initially developed by the U.S. Navy and later adopted by cybercriminals for hidden websites.

Craigslist

A classified advertisements website where Brett Johnson found a landscaping job after his release from prison.

ICQ

An early instant messaging service used by Brett Johnson and his criminal associates to communicate.

Carter Planet

A website launched by Dmitry Golubov, which became the genesis of modern credit card theft, focusing on buying and selling stolen credit card details.

Silk Road

A darknet market founded by Ross Ulbricht that gained notoriety for drug trafficking and was a major early adopter of Bitcoin.

Evolution Marketplace

A darknet marketplace whose operator stole $24 million but was later found murdered, highlighting the dangers of the criminal underworld.

Plenty of Fish

An online dating platform where Michelle, Brett Johnson's current wife, found his profile.

e-gold

An early digital gold currency that preceded modern cryptocurrencies, used by criminals for money laundering.

Camtasia

Screen recording software used by the Secret Service to monitor Brett Johnson's computer activities during his time as an informant, alongside a key logger.

Internet Relay Chat

An early form of online chat where criminals would try to conduct business, but it was unreliable due to anonymity and lack of trust.

Liberty Reserve

A digital currency service used by criminals for money laundering, active before cryptocurrencies became prevalent.

Counterfeit Library

A website that initially dealt with counterfeit degrees and certificates but later served as the foundation for Shadow Crew, evolving into a credit theft site.

Organizations
Pentagon

The headquarters of the U.S. Department of Defense, which Jonathan James, a minor, hacked into.

IRS

The U.S. Internal Revenue Service, which used ID.me for identity verification and had an $86 million contract with the company that was partially lost.

NASA

The National Aeronautics and Space Administration, which Jonathan James, a minor, hacked into and shut down computers for six weeks.

Identity Theft Council

An organization that hired Brett Johnson after he began his legal cybersecurity career.

United States Secret Service

The agency that referred to Brett Johnson as 'the original internet godfather' and was involved in Operation Anglerfish and the takedown of Shadow Crew.

Electronic Frontier Foundation

An organization that started sponsoring the Tor project after it went open source, supporting its use for privacy and circumvention.

Wired (magazine)

A magazine that published an article about Max Butler, which mentioned Brett Johnson as a Secret Service informant, causing him trouble in prison.

Department of Veterans Affairs

A U.S. government department that uses ID.me for identity verification.

CNN

A news channel mentioned by Brett Johnson that he watches to feel 'pissed off at everyone,' highlighting his critical view of media's role in division.

Shadow Crew

The first organized cybercrime community built by Brett Johnson, considered the precursor to today's darknet and darknet markets. It operated as a forum where criminals could establish trust, exchange information, and facilitate various types of fraud.

Social Security Administration

A U.S. government agency that uses ID.me for identity verification.

Fox News

A news channel mentioned by Brett Johnson that he watches to feel 'pissed off at everyone,' highlighting his critical view of media's role in division.

Forbes

A business magazine that featured Shadow Crew on its front cover in August 2004, highlighting identity theft.

Department of Defense

A U.S. government department that Jonathan James, a minor, hacked into.

FBI

The Federal Bureau of Investigation, which arrested Brett Johnson in Charleston, South Carolina, following a controlled delivery.

More from Lex Fridman

View all 193 summaries

Found this useful? Build your knowledge library

Get AI-powered summaries of any YouTube video, podcast, or article in seconds. Save them to your personal pods and access them anytime.

Try Summify free