Episode 5 – Part 2: Terry Rankhorn

Terry Rankhorn:
The bureau has 15,000 agents. There’s only less than 250 of them undercover certified. I knew about hacking. I knew what services were running on ports. I knew what a buffer overflow was. What was the currency for hackers? What can you do? What can you hack? I was perfectly poised when one of these cases came in to hit the ground running. Once you start getting deeper in, once you start attracting attention, then you have to be prepared for that scrutiny

Voice Over:
From being the first to infiltrate hacking groups to going undercover. In an Al-Qaeda cell, Terry Rankhorn’s career shaped some of the FBI’s most critical moments in modern history as a supervisory special agent. He led covert entry teams across cyber, physical, and electronic access on some of the government’s most classified missions,

Terry Rankhorn:
You’re laughing, drinking a martini, drinking Louis the 13th cognac, having a cigar. What they don’t see, is after the meeting’s over and you go into the back room and throw up because you’re back keyed up, you literally start shaking. There was a former Taliban member who had turned; he was working for the US government. He knew that the cell needed some people to procure some things for them. I’m the guy who can get you something, and I’m also the guy who can move money around for you.

Nathan Sportsman:
Why would you take an assignment like that?

Terry Rankhorn:
Well, I did it because we wanted to pay ’em back for nine, 11, 15,000 agents. There were about 70 of us. We were trained how to break into the hardest of the hard targets. We broke into the targets that you would think nobody could break into that place, and we did it. And we got in and out and you would never know we were there. They went into a mafia, boss of a family’s house. He was sleeping on the couch, reached over him and actually put a bug in the lamb, got back out and locked the door from the outside while he was still sleeping on the couch. Initially it was just get in and listen to what’s being said. You got to bring a value proposition to the equation or they’ll send you packing.

Nathan Sportsman:
And so from Quantico, Amanda, it sounds like she went to San Diego. Is that where you went or where did you go and how did they decide field offices and what happens next? Well,

Terry Rankhorn:
According to Bureau lore, they have a monkey that throws darts at a large map. And wherever that dart lands, that’s where you’re going. And again, one of those things where you almost think that perhaps divine providence had a hand in it. I was scheduled for Butte, Montana, which is considered to be the worst office. It was a punishment office under Jager Hoover, but I wasn’t being punished. It was just they needed someone there. And it just so happened that one of those class counselors, they take agents from the field, two agents, and they embed them in a class. And you go all the way through, do everything with the students. So basically you look to someone to say, well, how are you supposed to handcuff someone? Lemme see how Ray did it. Okay, I’m going to do like Ray. And he was this one guy named Ray Holt, and this is one of those guys you look at if you turn to the dictionary FBI agent, there was Ray’s picture.
And so I was so incredibly lucky to have him as a mentor in there. It just so happened he was assigned to the Salt Lake City division. Well, the Salt Lake City division covered three states in 15 different resident agencies, the largest, including Butte, the largest swath of the US covered by any field office. And so Ray called back and said, if you’re going to stick this kid on a reservation in an Indian reservation in Butte, Montana, working basically rapes and liquor store robberies with his computer background, he might be better off in headquarter city in Salt Lake. And they listened and they sent me there.

Nathan Sportsman:
So is that Utah, New Mexico and Arizona?

Terry Rankhorn:
It was Utah, Wyoming, and Montana.

Nathan Sportsman:
Okay. And so you got stationed in Salt Lake, salt Lake City. And in terms of the type of work that you’re doing, the section that they put you in, your background in electronics, what was the tasking like once you were assigned that failed office?

Terry Rankhorn:
Well, it wasn’t a perfect fit, but you have to understand back in the nineties, there were still the overwhelming opinion of the FBI was any agent could do, any agent job. We’ve since learned that’s just not practical. It’s just not. It’s just like if you’re an attorney and you practice divorce law, probably don’t want that guy defending your life on a death penalty murder case. If he’s an attorney, he’s passed the bar, but that’s not his wheelhouse. And the Bureau is, one of the things that Mueller got right, was take people with specialties. We hired them for a reason, keep them in those specialties unless there’s compelling reason why they need to they and you want to move them out of that specialty. So at that time, it was any agent can do anything. And so in Salt Lake City, I worked a host of different violations.
There was a lot that you got to realize, this was very soon after the Murrow bombing in Oklahoma City. And Salt Lake City was the hotbed of militia activity in America because you had Montana, Wyoming, and oh and Idaho. I forgot Idaho. They had Idaho as well. And you have to understand, I mean actually you were full adult and you aware of the current goings on in the nineties for the young people that never got to experience the nineties, it’s kind of a magical time because the late nineties during President Clinton’s presidency, he had a lot of the militia things pop up. And then you had to show the X-Files, which people watched. That was their weekly news. And you had all of, and the internet was really just coming into its own with news net and different ways of communicating. And so he had all these conspiracy theories floating around, and then they would get enhanced and amplified through the X-Files or other shows.
And you had people doing pirate radio broadcasts, like Mike from Michigan, he had the Art Bell show, and we were coming up on the millennium and it was just a really interesting time. But unfortunately, that also brings out the crazy in some people that have a propensity to be crazy and violently crazy. So we did have people that shoot at us. We had a very unfortunate color designer of our bulletproof vest, and they were blue and yellow just like the un. So then we had to worry about people because they thought we were troops. And it was an interesting time. So I worked domestic terrorism, which on my squad, that was the primary focus. And then foreign counterintelligence of all things in Utah,

Nathan Sportsman:
Which is in both those two things together. So the Oklahoma City bombing that was on a federal building, the time escape, was the Unabomber around this time as well, or was that before the Unabomber was still active? And so would those be the kinds of cases that would be assigned?

Terry Rankhorn:
Yes,
Along with there were a whole number of small, I hesitate to say Manson family type cults, but polygamous, oddball cults that would be out in the desert around. So you’d need to go have a look at some of the things they were doing. But because of certain blowbacks, like Waco, Ruby Ridge, which was a Salt Lake City operation, you had a lot of pushback from a lot of the residents of those territories. And it was certainly an exciting time to be doing that. But the squad that I was on most squads in most larger offices is it’s a single violation. Sometimes you’ll have five squads that work just the same violation. Whereas this one was foreign counterintelligence, domestic terrorism. And I think there were two other things. It was like the old joke, income tax preparation, lawnmower repair and liquor store. That was our squad.

Nathan Sportsman:
And this goes back to kind of the philosophy, everyone’s an FBI agent, and so you can actually work cases across these various areas and not necessarily specialize in a particular area.

Terry Rankhorn:
Right? I told you about when I was younger, the tendency toward A-D-H-D-I was a terrible case agent on accounting cases. You have ranges of documents and you’ve got to find the anomaly. And I wasn’t an accountant, so oh God, I struggled. I mean, I did a good job, but I struggled. But then there was just the very awakening of, hey, well there’s two things. Computer crime, we don’t think this internet is probably going to go away. I don’t think it’s a fad. So it’s probably going to be around and people are committing crime on there. So we should probably take a look at it combined with the fact that, hey, the Secret Service has made a lot of good publicity, working hacker cases. Let’s take that away from them. And when the bureau wants to take something away, they were the 800 pound gorilla. So I was already on board. And again, I knew about hacking. I knew what services were running on ports. I knew what a buffer overflow was. I knew what privilege escalation was. I knew the Unix file system, both BS, D and Ary system five. So I was perfectly poised when one of these cases came in to hit the ground running, go out and interview the victim, figure out what was going on, and follow the logical leads and prepare a good case.

Nathan Sportsman:
And at this time, this starts to come into being, is it right that there was initially five squads that were set up, one of which was San Diego, which is where Amanda was, is that how y’all ultimately get reconnected outside of new agent training, where this is starting to form, this is kind of the trajectory you want to go. And she’s in one of those original founding squads? Well,

Terry Rankhorn:
That was one of those providence things where she was very, very interested in computer hacking, computer security, and I’d shown her a way. I actually discovered a vulnerability in Hotmail back in 97, and it was part decent work on my part and part, just good frigging luck. But I did discover vulnerability hotmail, whether you can get anyone’s password if you knew the username. So I’d show her that. And I showed her a couple other things. We had two one hour blocks of instruction on computer crime in the FBI academy. And then they went on to demonstrate the worst computer security hygiene that I’ve ever seen in my life. And so I showed her like, Hey, these internal student email systems and the mockups that they do for us, you can just log in as this guy and send a message. And then these two guys are fighting over email, which seemed funny at the time. Little did I know I was really playing with fire. So that got put to bed real quickly.

Nathan Sportsman:
Prankster coming back

Terry Rankhorn:
Out of Yeah, yeah, yeah. Resurfaced a little bit. Fortunately, went back under like the groundhog word stayed where it should, but she thought that stuff was great. So when she got to San Diego and saw an opportunity that I formed the computer crime squad there, I was in Salt Lake and she got on the squad, so she was already on the squad. Well then when we got married, I was transferred to San Diego and the person running the squad happened to be the guy who used to run the applicant squad and recruited me. So he knew my background. One of the hard fast rules in the FBI is you never put two spouses on the same squad. That is absolutely positively for Bolton, but they found themselves in the quandary. He wanted me on the squad based on my background. But if you kick an agent off a squad, they were really concerned. How’s that going to look? You got a lady agent on a squad and you kick her off to make room for a guy coming in, that wouldn’t have been, that’s not a good look. It’s not a good optic. So they decided, alright, we got plenty of talkings too about this. It’s like we are going to provisionally allow you two to be on the same squad. And I think we handled it very well. We barely even spoke to each other during the day. And we proved their trust in us was well placed.

Nathan Sportsman:
And we kind of skipped over it. But you and her getting married Y were actually married in Vegas at Defcon? At Defcon? At Defcon. Defcon six. Defcon six. And was that your first Defcon? Was that her first? Both. Both of ours. And so that decision isn’t just stance. I mean, you’re both starting to truly get into cyber crime, cybersecurity and decided, and were deliberate about wanting to get married in Vegas during Defcon,

Terry Rankhorn:
Right? Yes. That was a conscious decision.

Nathan Sportsman:
Were y’all ever spotted as the Fed?

Terry Rankhorn:
No. No. Actually not, which I was really worried we would be, but so actually when we got married, we still had our stuff on. We went to the black and white ball, and so that’s actually what we were wearing when we got married.

Nathan Sportsman:
I don’t even know if they do that anymore. I remember the black and white ball. Okay, so y’all had your tux on from that party and then went and got married from that. Okay.

Terry Rankhorn:
That’s exactly right. But one of the reasons I don’t think I got spotted was I was still on the young side. I was still 29, 29 or 30, 30, just turned 30 though. And I looked at that point younger, probably a few years younger than I actually was. Reason I look this way now is because of my two boys and my kung fu was pretty good, so I could actually talk to people. So someone would be talking about some exponent. I was like, well, how are you getting around this? Well, what about, what’s this thing I’m hearing about Stack Guard and just the five of us here, they’re going to. So it sounded right. And plus I was like, so what kind of crime have you been committing? And you contrast that with a person who actually approached me to be his informant basically, and big tall guy cop haircut wearing around a fanny pack holster that you could clearly see had a gun in it. And he was handing out business cards as a roofing contractor at Defcon. That’s where roofing contractors go. And he was spotted as a fed very, very soundly and quickly and by multiple people. And he was absolutely livid. He was so mad.

Nathan Sportsman:
And you and her, y’all weren’t undercover at this point though, right? You’re just going to going to go.

Terry Rankhorn:
We were non-attributable. We call you. So you don’t advertise the fact you have bad, but you’re using your true name and you’re not purporting to be someone else.

Nathan Sportsman:
And so from that, you’re able to move from Salt Lake to San Diego. You joined the cyber crime squad in San Diego, one of the first five or six units that came into being. Do you remember your first either high profile case or just a case that had a lot of meaning to you or that was challenging as you transitioned towards the cyber crime aspect of the

Terry Rankhorn:
Bureau? I absolutely did. It was the first case I was assigned when I got on the squad,

Nathan Sportsman:
The first case, Dan, the most memorable or the one that had, okay, wow.

Terry Rankhorn:
We always remember right out of gates, the first big

Nathan Sportsman:
One,

Terry Rankhorn:
I’d worked one in Salt Lake City, which was essentially just a wire fraud. It was a guy that was ripping people off over eBay for computers that didn’t exist. I don’t really count that. That didn’t count in my book. See the bureau, they had a delineation between, well, they really called everything computer facilitated crime, meaning that if you’re a Nigerian and you have nice card stock letters with embossed royal seals and mail too is quite a bit of work and really targeted and trying to get, but once email came into play, well now that is the same crime, but it’s facilitated by use of email where they can send out literally millions of them. The problem was, and that’s the way the F FBI had always worked. They always take, they just evolved the process and they were very, I don’t want to say stodgy, but they’re very, this is the way we’ve always done it. That was their philosophy and they move along well. Now you have this disconnect where that you can know what are you going to say is the analog to a pure computer intrusion where someone use the Q pop exploit hits Port one 10 does buffer overflow gains root has root shell on there as running as the Q pop D. What’s the analog to that burglary? There isn’t one. So you need a whole nother methodology and a whole nother way of thinking about how to investigate and pursue these crimes.
I say my first real computer case was once I got to San Diego and they had a pure computer intrusion where it was a classic computer intrusion and it was to a securities trading firm. And the supervisor and the US attorney, a guy named Mitch Denon who was just, he was another huge mentor in my life. He actually helped craft the title 18 six and 10 30, the computer crime statute. Just a perfect combination of a legal genius and also his technical Kung fu was pretty good. And he also was just a very reasonable guy and a very, very fatherly type. A lot of times there was a doctor nurse type relationship between the prosecutors and the agents, not him. He treated you as a team member and when you felt you were weak on something, he’d be frank with you. He was a New Yorker, but he would also mentor you and help you get better because he believed in bring the whole team up and everyone performs better.
He told me, my supervisor Stu Roberts, who was one of my greatest mentors ever, and a true personal friend, they said, you won’t solve this one. Which, well, that’s like showing a bull, a red flag. Like, oh, you won’t want this car. It’s way too fast for you. It was a great motivator, but I was like, I’ll solve this damn thing, I’ll guarantee you. And I get there, and the only piece of evidence there was an IP address on a yellow sticky note and a reformatted system that they were getting ready to reload Unix on. So through some decent computer forensics, recovering some snippets of log files and then using that as a guide, the IP address to sort of guide, see where it’s at. I was able to compile enough evidence to get a search warrant on a home. And that was worrisome to me because I’ve always, one of probably my greatest fear in the FBI was that I would accuse the wrong person of a crime and ruin their life either by having them put in prison, which is horrific, or just by pulling them out onto their lawn in front of their neighbors while we do a search warrant and then irreparably damaging their reputation from that point forward.

Nathan Sportsman:
Right. And to your point, and not having an analog attribution gets a little trickier when it comes to computer intrusions versus physical intrusions. That is

Terry Rankhorn:
Absolutely correct. It was a telenet connection. Maybe there was a bounce on his, maybe he had been victimized. It was before botnet, so maybe there was so called BNC. You could bounce things through. Maybe it was a bounce, maybe it was an open FTP relay who knew exactly what happened. But if you go knock on their door and they really are involved, well now they’ll go take the sledgehammer to the computer. Now you’ve got no evidence at all and your case completely dies. And I did some looking into him and he seemed to have a little bit of a sketchy background and seemed to kind of fit the profile of someone to be involved in this. But they weren’t quite enough for me. But I had enough, and I bounced it off some people, and I’m like, yeah, I think it’s worth doing. I really think you should do this because the elements of a search warrant is a crime was committed and evidence of that crime is located at that physical location regardless if they did it, it could be a drug dealer storing his drugs at his mother’s home or whatnot, or murder and that gun and he left it at his mother’s place.
That’s where the evidence is. So that’s where you need to do your search warrant. So I did it and during the interview of this person, we do the search warrant, you secure the location. I’m interviewing him at his kitchen table and I’m having this horrible sinking feeling in my stomach. It’s like, oh my God, I did exactly what I said I would never do. I’ve accused this person, I’ve disrupted his life. I’ve come in here, his neighbors are going to see what’s going on. It was awful. It was truly, truly awful. I was like, I got the wrong guy until two or three days later and the computer forensics came back on his, no, he was right in the middle of the whole thing.

Nathan Sportsman:
And what was the scheme? Was it like a pump? You said it was security trading, was it like a pump and dump? Was he preempting the market? No,

Terry Rankhorn:
Those guys, I don’t think they had any idea what they had a hold of. I mean, they could have, well, it’d have been a paper towel that’d probably got caught doing it, but they could have actually moved millions if not tens of millions of dollars. They wanted a place to store their wares. That’s what they wanted. They had no concept of what they were sitting on. It’d be like war games if the whole thing. He was trying to put wares on the whopper computer. So long story short, he was clearly involved during the interview and in a subsequent interview I figured out who he was, who his online identity was, and it turned out was actually not someone who had intruded into the system at that time. So I never had any evidence he broke into the system. What he was doing is he was hosting them on his system and allowing them to attack.
So it wasn’t his computer attacking, it wasn’t him at the keyboard. So I never, and at that time personally because I felt so bad because I’d done it a whole list of reasons, and he helped out quite a bit. I recommended he not be charged and he was not charged. But through information he gave, it put me on a really strong lead to the person who actually really did it. And you’ll probably enjoy this story of all places. It was in the absolute boondocks of a place called Bowling Green, Kentucky. And so almost a year later, I’m taking a flight to Louisville, Kentucky and myself and a retinue of agents are going down to Bowling Green, Kentucky to do a search warrant. And we go in, do the search warrant, find out that the kid’s in high school, so he’s at school right now. So we go over to the high school and we met his parents there and got him pulled out.
We didn’t pull him out. We had his parents pull out of the class. We go back to the FBI I office and we’re interviewing him and a poor kid, I thought he was going to have a heart attack. He was just white. This kid I was utterly convinced had done it and had done it. And his mother, and God bless her, I mean, I get it as a parent, you don’t want to believe your kid did anything. And the whole time it was just no. He was like having a pit bull at your pants leg. He’s like, you’re falsely accusing my son. You’re harassing him. You’re doing it. There’s murder. There’s ax murderers out here. You’re focused on him. He’s got nothing to do with it. He’s a good, the whole thing, just as you might think, well, in the midst of her monologue, you hear, mom, I did it. And she just stopped midstream and she looks at us, looks at him, and she was a larger woman and attacks him.
It was like watching George Foreman and Muhammad Ali and the rumble in the jungle. This kid was turtled up and she was slapping him the sides of the head, the top of the head. She was looking for an opening on the bottom and she’d give him an upper cut. And so after about a minute of this, I look at the other agent, I was like, we think maybe we should do something. What if he gets hurt or something? And so we were kind of discussing whether we should intercede in the blatant assault that’s going on. She punched herself out.

Nathan Sportsman:
Was he of age? Was he 18 yet or was he still a juvenile?

Terry Rankhorn:
He was a juvenile. So he was like 17 and a half.

Nathan Sportsman:
So this is federal. The crime was across state lines. What then happens to a juvenile in a federal?

Terry Rankhorn:
Nothing back then. Nothing. Which was the other thing about this, you want to get to the bottom, you want to close the case out. You want to find out who did it. You want to find out maybe an 18-year-old or a 20-year-old paid him to do it. You just don’t know until you’ve collected everything. So we were at that stage, we were at the one yard line of the case, and he was a good kid. He really was. Again, he didn’t know what he had a hold of, and he just really wanted a place to store his pirated music and movies. And he could have done a whole lot worse. And he agreed to help us out with, we’ll call it intelligence in the hacker community, to be able, because he was plugged into a lot of different groups to be able to say, okay, this is the constituency of this group, this group, these guys, they claim they’re separate, but they’re actually just the same guys and gave us a mountain of information.
So it was really a win-win because he wasn’t charged and then we benefited greatly from his knowledge and his assistance. But to your point about there is no federal juvenile system, you can have a juvenile charged as an adult, like a 17-year-old that murders someone or robs a bank, but there is no federal, you can’t go to juvenile hall. There’s no federal juvenile hall. Now what happened relatively quickly in the computer crime investigations is we would form task forces. And it was very satisfying when you would go into a place and you have a 17-year-old basically giving you the middle finger and saying, there’s nothing you can do to me. And you tell ’em and say, well, you’ve done your research. You’re absolutely right, but let me introduce you to Detective Stevenson from the San Diego Police Department. He most certainly can do something to you. And that he handcuffs him off. He goes, because as a hacker, you probably don’t want to get locked up in the California Youth Authority.

Nathan Sportsman:
So your first case is one of your most memorable cases, and you just recounted that for us. You were also involved with the FBI’s Undercover program.

Terry Rankhorn:
I was.

Nathan Sportsman:
Where is that in the timeline? How does one get involved in that? Are you singled out and invited? Are you volunteered? What is that?

Terry Rankhorn:
So that was a really interesting way that came about. When I first joined the FBI, the one thing I said I’d never wanted to do was undercover said, I want to be an FBI agent. I don’t associate with the FBI agents. I don’t associate with criminals or do any of that stuff. But I’d had a training agent when I was in Salt Lake who was a big undercover guy, and he would bring me along with stuff he probably shouldn’t have brought me along on, frankly. But it was sort of fun and it was very satisfying. Well, I mentioned that in San Diego, and I wasn’t a super agent or anything like that, but I had a skillset with the computer crimes that some other people didn’t have. And unbeknownst to me, there was an undercover operation. It was being generated out of the Los Angeles office, and it involved the FBI. It involved Air Force OSI, defense, criminal Investigative Service, and one other agency. In part, it had to do with people breaking into JPL all the time.
That was the sort of part of what, oh, it was nasa, OIG. That was the other involvement. And so at this point, I was not a certified undercover agent. I was just an agent who had skills that they would need in that case. Well, they had, some people had come down from Los Angeles and we were in the midst of this one. It’s called HTCI, high Tech Crime Investigators Association Nation, actually worldwide thing. But they have chapters in different cities. Great organization, if you ever want to check it out. Great partnership between law enforcement and the private sector. Someone

Nathan Sportsman:
We had interviewed, but they talked about on IRC that people would show up on these channels. And it was almost like these bragging rights where you would show up with a dot mill or a.gov domain showing that you had penetrated that network and you were joining IRC from there.

Terry Rankhorn:
Yeah, you could do that, but that would be pardon of the term ballsy move that would, you could do it and people had, but the general methodology was you penetrated the network, looked around a little bit, defaced it, and then immediately got ahold of attrition.org to mirror the site. Then you had proof you did it. That was the sort of the accepted way that you handle things.

Nathan Sportsman:
And so a lot of this was compromise the network look around a little bit, deface it, have attrition.org, merit for the lulls or bragging or whatever the case is. And so this task force was trying to figure out, are these kids just being mischievous or are they a proxy for someone else sending them tasking on this stuff?

Terry Rankhorn:
Exactly. So maybe they’re not kids that’s first and foremost. Maybe they are kids, but someone has infiltrated the group and is like, I dare you to hack JPL, or I bet you can’t hack Air Force OSI or whatnot. And then they do, and they’re like, oh, show me. You’ll bring me in with you, which would happen sometimes. And then they would use that to try to gain a foothold, establish permanency and putting it back doors.

Nathan Sportsman:
And there is evidence of this sort of stuff. From what I understand, there was an individual named Pango, I believe that was in Chaos Computer Club out of Germany. And he had ties to KGB and was hacking into US systems on behalf or paid by the KGB. And there was another individual, you had mentioned the stai earlier, I can’t remember his name. I think it was Helmut Rech or something like that. But he also had affiliation with the KGB and he was found burned alive out in the woods of East Germany. So there is precedent where these things were happening. And so this task force, you’re going in undercover trying to kind of cozy up to these groups, seeing if you can join and then find out what’s really going on. Is that at a high level to basically

Terry Rankhorn:
It was a moving target. So initially it was just get in, join back. Then the sort of main place you went was pound frack on EF net and because that’s where the real talent was. And then from there, if you could make a name for yourself without making the wrong people mad or putting your foot in your mouth or doing something stupid, then you would probably get invited to go chat somewhere else. And then that would be more of a private social club for that one particular group or number of groups. So the first thought was just get on there and listen. So in other words, go to the biker bar and just sit at the bar and drink beer and listen to what’s being said next is, oh hey, you actually worked out pretty good in that. So hey, see if you can get invited back to the Outlaws or the Hell’s Angels clubhouse.
Oh, you did that. See if you can join. Oh, you did that. Okay, well see if you can get in the inner circle, see if you can get into a leadership position. Although you got to be careful with that because some legal issues with steering or if you’re not doing it, then why aren’t you? And then you got credibility issues. So it’s like walking a tightrope. And as it transpired, it was successful. I was able to get in, I was able to then move to a smaller affiliated group on the periphery who then they liked me. And so then they introduced me to people in one of the larger groups. They liked me well enough and then I was able to then, and what we learned was that these groups weren’t as stride as we thought. There was a lot of commingling where that you might have one group, it might have 70% membership of a different group. And so you just suppose you have, it wasn’t like the Yankees and the Red Sox, you might have 70% of the players are on both teams or they’re 70% of the players from each of those are only at a third team, the San Diego Padres. And so we learned a lot. We realized one of the things Louis Free used to say is, we don’t know what we don’t know. And we realized, wow, we didn’t know a lot before this.

Nathan Sportsman:
And picking up with your analogy of bikers and Hell’s Angels and Outlaws. So from what I understand about that, the one percenters and all that sort of stuff as they call themselves or even the mafia, there’s two types of people that they generally look for in terms of skillset. One is a propensity for violence and the other is a propensity for making money. What was the currency for hackers? How do you buddy up to hacker groups where they’re starting to gain

Terry Rankhorn:
Skills? That was all it came down to because you had some, probably 70% of the people there were on the spectrum somewhere, I believe. So it wasn’t just a case of charming people to death. It really came down to they had an intense dislike for people that were formally educated in an institution. They wanted people that had learned their own skills, developed their own stuff. But boy, the big thing was what can you do? What can you hack? Can you help me fix my exploit? People would release exploits and it would just be the shell code, the bike code. It would be like Ben Eject or something, kick your CD tray out, this thing won’t work. Well, it probably is work. You’re probably kicking the CD tray out the server in the IDC, but you’re not getting a shell, which is what you think should happen. So if you actually look at this, you just change this to this and it’ll spawn a shell, interactive shell, and you’re actually on their system.

Nathan Sportsman:
And so would you, whether it was unknown O days or helping other people fix their shell code or whatever the case is, is that how you would slowly build rapport and credibility with folks?

Terry Rankhorn:
Yeah, and I gave a little tutorial on, I took ELF One’s tutorial on, was it writing Buffer overflows for Fun and Profit
And broke it down and made it a little simpler and actually wrote a couple of examples in Pearl of All Things just because it’s so readable, which it was a constant struggle legally because you can’t, as undercover, you’re not supposed to go out and make better criminals. You’re not supposed to give criminals weapons, anything that’s weaponized to use. And we had to get specific permission from DOJ for everything that I was doing. It’s called OIA Otherwise Illegal Activity Authority. And it seemed like every week we’re getting, that’s not easy, that’s got to come from the Attorney General. So it seemed like every week we’re able to get OIA for something else, but we did a good job. The guy that was overall in charge of was an FBI supervisor in Los Angeles who had been a Hoover agent. So he’d been around forever. And he was very, very guy named Charles Neal. Very, a very polished, very aware, professional agent who understood how to make everything work together. And when something was too much of a risk, he would cut it off. But he would say, but he was very aggressive as well. And we accomplished our goals for the mission. It was actually a very successful case.

Nathan Sportsman:
We talked about this a little bit last night, but the notion of creating a legend, having sort of a cover story, was there a narrative that had to be a built prior to that or is it a little bit different with online and hackers where everyone has a moniker, you don’t really know who the person is and it’s just another random person joining FRAC and you don’t really have to go through the process of creating a backstory on yourself?

Terry Rankhorn:
Yes and no. So there’s very good observations, and the way I would characterize it to young undercover students later in my career when I taught in the school was if the Street Corner Crack dealer did background investigations and every potential customer, you’d never get caught. But you can’t, I mean, you wouldn’t be able to sell any crack or enough to sustain yourself. So same thing with this. They can’t vet every single person that joins pound frack. It’s just not possible. But once you start getting deeper in, once you start attracting attention, then you have to be prepared for that scrutiny and you truly have to be prepared. In other words, don’t use your home cable modem, use a dial up ISP back then. Or if you’re going to use some university system, have a reason for being there. Are you a student there? How’d you get that access? Because you don’t know one of the other guys on pound frack, he might work at that university. You’re like, you didn’t work in the library here. And I would know him. So you really got to think those things through. It’s playing the ultimate game of chess.

Nathan Sportsman:
And when you got out of, to your point about the analogy of the bar, sort of the pound frack where everything’s just going on and you’re listening, but you’re starting to getting invited into these smaller and smaller rooms where some of these groups are actually sitting in, does it get to a point where you’re actually interacting not just online, but offline in the real world as well, whether it’s party conference, talk calls or meeting in real life, what does that look like?

Terry Rankhorn:
Well, usually not because of the age gap, because you got to realize the median age for these guys was probably 17, we call it maybe you’ve been 16 and you’re 30 back then wasn’t like now where you’re a great hacker and you could back up what you say and people would’ve respect, and you have credibility back then a 30-year-old guy, it’s like, this got to be a cop. Why is he interested in sitting in IRC half the night just sharing what would later be called memes, stupid pictures and whatnot. That would be bad. In fact, there were times when we had to, they wanted to do phone calls, so I always insisted on a voice changer. It was like, no, I don’t trust people on here. There’s a couple of guys that give me the creeps because if I’d used my real voice, I’d have been outed in a second.

Nathan Sportsman:
And a lot of these groups, so we’re still in kind of the late nineties, maybe early two thousands, somewhere around in there.

Terry Rankhorn:
Late nineties. Yeah,

Nathan Sportsman:
Late nineties. So groups like Mill or Babo as you’re making your way into these various groups, I’m not saying that those are them, those are just examples, but is there any formal process of actually being invited to a group similar to some of the agency admission that worked mafia cases where you prick their hand and there’s this whole ceremony? Or is it much more ad hoc and random than that?

Terry Rankhorn:
Extraordinarily ad hoc. Random. You catch some guy on a manic cycle and you’ve done something good for him, or he was impressed with something you did. He is like, Hey, come on over here. Come on, I’m going to introduce you to people. And once you get in there, you keep your mouth shut until you just stay in there and stay in there and just build some inertia. And then you maybe start commenting on something. He’s like, Hey, well not for nothing, but this might work better if you did this. I think that is exploit just got passed, or more appropriately. Hey, you better get attrition, Amir, that because that thing is super vulnerable, but is IAS server super vulnerable? So somebody’s going to come along and rehack it and they’ll get the credit on attrition, which that was huge currency. Having the credit for your defacements.

Nathan Sportsman:
And you said two groups and you said the operational objectives were successful. How long are we talking about in terms of an operation timeline? Is this

Terry Rankhorn:
A year? It was a year.

Nathan Sportsman:
Wow, okay. And by a year, you mean from initial scouting all the way through to arrests and indictments and stuff are coming down?

Terry Rankhorn:
Yes. Well, not through. So a year from the day I logged on to the day I pulled the plug and on, my persona just sort of vanished. But then you take what the undercover has learned, the intelligence they’ve gathered, and then the case agents follow out all the leads and do all the other stuff. And then they generally will do one big sweep. If you start taking ’em down, onesie, twosies, people will start throwing their computer in the local reservoir.

Nathan Sportsman:
And if there’s anything that we can’t talk about, please lemme know. We’ll move on. No, this is fine. But what were kind of the high level takeaways of that year of activity, what you learned about these groups, whether they had ties to anything else or not, whether they up to digital, ecr, credit cards or whatever the case. What did you learn?

Terry Rankhorn:
I learned several things. We learned that one of the things that’s classified, I can’t talk about, but we learned that we were correct in a certain hypothesis. Another thing we learned was an absolute treasure trove of intelligence about how the ecology of hackers and how they behave, how they talk. We also learned what we call tradecraft. We learned appropriate trade craft for the doing what’s called online covert operations. So for example, in the old Cold War movies, spy movies, you have something called a parole, meaning that if I don’t know, you we’re supposed to meet and let’s say, okay, he’ll be about this high at the left glasses, a level on a sport coat, and he’ll be reading a newspaper on a bench. Well, I go to a park and I see someone that matches pretty close, if not identical to what I was told to expect, but you have to go one step further.
So go sit down next to him and say, the weather’s nice this time of year, and your response has to be yes, but not as nice as in Paris. Now I know I have the right person that’s called a parole. Well, that is super important online. There was one time in particular when there was one of the, this guy named Bill, he was a defense. Well, he was Air Force. He was Air Force OSI Undercover, and he was detailed to the FBI and he was a walking, talking EEO violation. I mean put EEO suit looking, the dictionary. And there’s Bill looking at you with that smirk on his face. Great agent, funny guy, and dependable, great guy, but you never know what he was going to say in not safe for work. And so then we had a younger female agent who was an FBI agent who was just dying to do this. Oh, I want to do it. Let me do this. I’m going to let me do it. Let me do it, let do it. Finally, she kept on long enough and like, fine, do it. Just do what we tell you. Do this, be careful.

Nathan Sportsman:
Meaning she’s going to take on an online identity

Terry Rankhorn:
Undercover. Yes.
But she was not super proficient in hacking, so we had to take your time. We would log on, and then back then it is super easy to create a channel. You just create a channel on the fly. And we knew what we were going to do. We jumped in and the FBI agent and I jumped in there. Well, where’s Bill? And we knew it was Nick that he used on eef net and on eef net, just whoever gets the nick first, that’s them. So we’re like, ah, will he get in here? I see him sitting over here in this other group. So finally we message him, we say, Hey, can you please come over here? And so he does. Well, for whatever reason, they decided the parole was going to be, do you want to smoke? And I don’t want to curse on your podcast, but alright.
So he pops in there and Jill says, do you want to smoke? And so he replies, yeah, I wonder if you smoked my cock, which sounded just about what he might say. Like, oh God, I’m going to have to be a witness in some big thing. Turned out it wasn’t him because like I said, on net, whoever logs on right then, if the other person’s not on and they just decide they want that, Nick, it’s theirs until they log off. So we came this close had we not used proper tradecraft to blow an entire year long operation.

Nathan Sportsman:
And if you hadn’t done that, she would’ve thought she was talking to the actual bill and might’ve disclosed something. Messaged something that

Terry Rankhorn:
I thought we were talking to him

Nathan Sportsman:
Because

Terry Rankhorn:
It’s just, you get so in the habit of seeing that Nick, and that’s the person. But we were good in that we followed our protocol, we kept to our trade craft, and that saved us

Nathan Sportsman:
As we kind of started the undercover discussion. I don’t think I had mentioned this, but my understanding is you were the first agent or one of the first agents to actually go undercover in this sort of scenario. Is that correct?

Terry Rankhorn:
To my knowledge, and I’ve asked a lot of people and talked to a lot of people, I was the first.

Nathan Sportsman:
And so to your point about whether it’s parole or tradecraft, you’re kind of determining what the methodology is going to be for all future undercover operations.

Terry Rankhorn:
And I wrote a course for the bureau, it’s called Online Covert Investigations, OCE, covert Employee Investigations. I taught one of the first convenings

Nathan Sportsman:
Of it. And so that initial operation, that was for a year was the goal more to understand and enable future operations. Did arrests and breakups of groups ultimately happen through that?

Terry Rankhorn:
Let me back up on something. Sure. I was not the first person to go undercover on the internet. The child porn people have been doing it for a decade. And I’m not taking anything away from those guys. God bless. I don’t know how they do that work, but they’ll pretend to be like a 13-year-old girl and get groomed and that whole thing. They’d been doing that long before me. Mine was the first where you are affecting the persona of a hacker and trying to get into a hacking group, a real hacking group, not bunch of 10 year olds.

Nathan Sportsman:
Right. And the groups that you had targeted going undercover in sort of this format, targeting this type of crime versus child pornography groups were ultimately arrested and disbanded from those efforts?

Terry Rankhorn:
It was a double punch because A, we arrested some people, but the parent, remember I said they calling everyone fed. Oh, fed what? I dunno what you’re talking about, officer. They were actually really hackers, both of ’em when this happened. They were already paranoid enough. Well, once this happened, they didn’t trust anybody because even if, I mean, we really were undercover law enforcement officers, but they then thought everyone is either an undercover or an informant. And it absolutely shattered the hacker underground for quite some time actually.

Nathan Sportsman:
So folks were not super comfortable talking like they were before because they just don’t know who to trust anymore. And so that sort of community, or I guess whatever label we want to put on, it isn’t as tight knit. There’s not as much free flow of information or exploits or whatever the case is because no one can trust anyone. That’s

Terry Rankhorn:
Right. And their strength was their communication and being able to iteratively design exploits, I can almost get it. And then I give ’em that last little piece or whatnot that sort of went away. We basically gave them the digital equivalent of COVID. And so social separation

Nathan Sportsman:
Because they didn’t want to get caught. So that operation ends. And then Magic fx, was that an undercover operation or was that you had exited the undercover portion? You’re picking up just another, I don’t want to say standard case, but a case that’s not where you’re an undercover agent,

Terry Rankhorn:
Correct? That’s correct.

Nathan Sportsman:
Can you talk to us a little bit about Magic FX and Jerome and the whole background on that case and why it was important? I think even from a legal precedent.

Terry Rankhorn:
Sure. There was a guy that worked at the University of California UCSD Supercomputer Center, a guy named Tom Re, who was one of the absolute OG original gangster computer security guys. I mean, he worked with Shi Moura, he worked with Drew Gross and was friends with Bruce Schneider and whatnot. I mean, just a real solid name in there. And I was super fortunate that I got to know him and gained his respect, which was a huge honor. That’s like having Muhammad Ali. That’s a good point, son. And because of that, people, everyone knew and trusted and respected Tom. Well, Qualcomm got hacked and all this is in the affidavit that’s online, so I’m not diming anyone out. The director of their computer security guy named Scott Kennedy, who was another really proficient guy, he called Tom and said, what should I do about this? Well, Tom was like, well, I know an FBI agent that I trust that he could probably catch the guy, and if he can’t, he won’t further victimize your company by dragging everything out in the open and causing your stock deployment. And so Tom vouch for me, Scott called me, it was at a Christmas party and he called me. So I go in a quiet back room and sort of laid everything out. And then as Arthur Kondo said, the game was afoot.
It didn’t take long. I mean Mr. Hecken camp decided to go back in for seconds. And I got on his trail and he was never able to get me off.

Nathan Sportsman:
And Jerome Hagen camp at that time, I think he was a master’s student at the University of Minnesota or Wisconsin.

Terry Rankhorn:
University of Wisconsin. At Madison.

Nathan Sportsman:
At Madison.

Terry Rankhorn:
Brilliant kid. He started college at 16,

Nathan Sportsman:
And he either was working at the time or had worked at Los Alamos, or maybe that was later,

Terry Rankhorn:
He had been accepted for employment in Los Alamos. Los Alamos.

Nathan Sportsman:
But this wasn’t his first intrusion. He had some sort of prior two years

Terry Rankhorn:
Before

Nathan Sportsman:
That with the university and something else he had been up to. Yes,

Terry Rankhorn:
Yes.

Nathan Sportsman:
And so my understanding is the university police, I believe, were contacted and they were the first onsite at his dorm room, found his computer, it was open and that sort of stuff. Is that right? And it was ahead of the FBI’s warrant

Terry Rankhorn:
Due to the fact that the campus was in the midst of midterms and the mail server had to stay up. He had actually hacked into their mail server, and that’s where he was launching a text from. So they didn’t come back to his dorm room, which if you really think about it, didn’t do him a whole lot of good. So the administrator for the campus computer system, a guy named Jeff Savoy who was, he was formerly university trained computer science guy, and he was really good. I mean, he was a Jedi. So I called him and said, Hey, there’s so many new system’s launching attacks. He logged in, found it was good enough that he didn’t alert the drum that he was on there. But then he, using a little known legal principle called exigent circumstances logged, essentially hacked back from that mail server into drum’s, dorm room, computer, and collected a reasonable amount of evidence just to pinpoint who it was.
Well, unfortunately, when he did that, Jerome detected that hack. So he reformatted, wiped the system, slick, formatted everything, and reloaded the system with just a out of the block box red hat version with the password of password, and left it for the campus police to find. Unfortunately for him, what ended up happening was because what’s the one thing that’s the most important thing in the world to a hacker, an OG hacker that can actually write zero day exploits? It’s all their stuff. They didn’t want to lose all that stuff. So he made a huge tar ball file of his entire file system, burned it to a cd, wiped the whole system slick. But what’s the one file that the computer forensics people were able to recover was that tar ball? Right. So his alibi was that, Hey, I don’t know what happened. I just, out of curiosity, installed Red Hat Linux on my system, and I just used Idio password.
Somebody hacked me and whatever happened, it was them, not me. And long story short, when again, too much of the whole story fell apart, it’s like, really? Well, I get that somebody may have red loaded Red Hat Linux on there, or you loaded Red Hat Linux. Somebody may have hacked into it and wash attacks out. But how did they burn a cd? Because it was an iso. The tar ball had been turned into an iso. How did they burn a cd, then eject it from the tray from overseas, and then that’s when the whole story fell apart for him.

Nathan Sportsman:
And he ultimately gets prosecuted. He does try to make an assertion that the evidence should be inadmissible in a court of law, but regardless of how campus police handled it, that does not exclude, from what I understand with the briefing, that does not exclude the FBI’s proper search warrant to obtain the same material. Correct. And so even though this way may be incorrect this way, correct. This does not negate this, and a judge ruled that, no, we can move forward.

Terry Rankhorn:
Yeah. There’s a concept in law called inevitable discovery, meaning that if I am at a judge’s chambers getting the search warrant signed and the facts have not changed from my affidavit, and meanwhile, a local officer just says, heck with it, and he just goes in your car and starts searching around and finds something incriminating. The fact that I was already in the process of getting the warrant with a set of facts and circumstances that existed before that officer went into the car, so I can’t use anything he saw when he was in there illegally. What he found would still be valid because of inevitable discovery. I would inevitably, if this car had just been sequestered and nobody went, I would’ve still found those items. And that’s kind of what was applied in this case. Unfortunately, for Jerome, he ran into a concept that says, an attorney who represents himself has a fool for a client. And he actually had a really good attorney who took the case pro bono, a woman named Jennifer Granite, who at that time, she was the gold standard for computer hacker. She was a celebrity at Defcon.

Nathan Sportsman:
This was out of the Stanford Law School, I think. Right. I read about this and he fired her, rehired her, fired her, rehired her over and

Terry Rankhorn:
Over. And then she decided to part ways. I mean, she just couldn’t work with him. He wouldn’t listen to her. And so then he starts using sovereign citizen defenses like, well, the government spelled my name in all capital letters, so it’s an invalid. Well, okay, then we get a superseding indictment. It means nothing, which spelling all caps doesn’t mean anything Anyway. And then what was the other one? Oh, the entire United States had to appear in court because that was the plaintiff prosecutor’s

Nathan Sportsman:
Client needed to be in court. That’s it

Terry Rankhorn:
For a kit. As smart as he was in certain domain, you would think that he might think that in 200 years of jurisprudence, somebody might’ve addressed that already. And you might think that, maybe check Westlaw and see if that actually is a productive course of argument.

Nathan Sportsman:
And through the investigation and the proceedings, why Qualcomm, why did he break in? What was he doing there?

Terry Rankhorn:
So I don’t want to speak I, because he’s passed away since passed, right. But he was a combination of he was mitnick with a little more malice on the edge, and I’m pretty sure he helped developed, if not developed the Q exploit. He was an absolute sheer genius in his mastery of computer science, but that doesn’t apply to law and that doesn’t apply to investigations and whatnot. So I think that because of the Q pop exploit, Qualcomm pop server exploit, I think he sort of had his eye on them anyway. And what had happened, he’d actually hacked a peripheral computer owned by an employee, not Scott, it wasn’t Scott Kennedy, it was someone else. And then he hacked that and then saw that they were connecting through VPN back into their network and the company had set up a good infrastructure. But it’s just like anything else. I tell people in my consulting roles, I said, listen, you can have the best vault door on the planet. That’s literally unpickable. Nobody can open, nobody can cut through it, nothing like that. But if people prop it open in the dictionary, it’s utterly ineffective. I mean, you’re better off with a glass door. And that’s sort of what they ran into is you had Scott who was just had great computer security hygiene, great network design, great everything, and you had a user that decided that he wanted to prop a door open with a dictionary.

Nathan Sportsman:
And did Jerome, was he ultimately sentenced, convicted? Did he serve time? Was it probation? He was

Terry Rankhorn:
Credited with time served, which quite frankly was his own fault. I mean, had he just at the very outset said, okay, fine. I did it. Accept responsibility. He might not have actually done any jail time at all. But because of the way he pursued the situation, he spent a lot of time in lockup awai, pre-trial lockup. And he didn’t make any friends with the judge either. I mean to the point of threatening the judge in court, which that is never a wise course of action. And 99% of his woe he brought on himself, or really a hundred percent of his woe he brought on himself.

Nathan Sportsman:
And was the victim limited to Qualcomm in that case or were there other hacking activities against other organizations?

Terry Rankhorn:
So when we got that tar file and we exploded the file system off of that and looked through everything, we were not much surprised me at that time. That surprised me. I mean, this kid was prolific and he also had a little bit of a malicious streak. So he found out the agent that was investigating the eBay hack he did. And he had also hacked LexisNexis and was using their data aggregation tools to collect information, including the guy’s home address and things. I mean, it’s really sinister when you started reading about it. And it’s not something an innocent kid does. Just out of curiosity, like Nik for example, by the way, he wasn’t that great of a hacker. I don’t know if you know Mitnick, his technical skills about the things he’s accredited of doing. He wasn’t all that great at the ones and zeros. He was probably one of the world’s best social engineers, but I really believe he was just doing it to see what he could do.

Nathan Sportsman:
Both Mitnick and Jerome or Jerome? No, Mitnick, Mitnick, Jerome.

Terry Rankhorn:
He had a sharp edge on what he would do. I mean, some of his things were a bit on the malicious side, like stalking an aid FBI agent for example. It was like, why would you do that? Why would you want to poke the bear and what do you intend to do with this? Are you going to kill him? Are you going to swat his house? There’s no plausible explanation for why you would be doing that.

Nathan Sportsman:
And I think this was 99 when this case came out. And then if we fast forward a couple of years, so you’re continuing through the cyber crime unit, one of the squadrons within the FBI, but then nine 11 hits 2002, you’re reassigned to Al-Qaeda.

Terry Rankhorn:
So that was an interesting, when I was just sitting at my desk and someone calls into the FBI, San Diego Computer Crime squad, the person that was the acting supervisor. So when the supervisor’s out of town, you have one of the agents be acting supervisor. So he is like, is anybody here undercover certified? I’m like, I am. And they’re like, Hey, Sacramento wants to talk to you. And so it was essentially a real Al-Qaeda cell, not some idiot students. And I’d blow up the Sears Tower if I had a bomb and if I owned a car, I could drive the bomb up there. And it was actually real known, true villains.

Nathan Sportsman:
And when you say sl, it’s here in the us?

Terry Rankhorn:
In the us and there was a former Taliban member who had turned flip sides because he didn’t want to end up on a deck of cards with a bullet in his head. And he was working for the US government and he knew that that cell needed some people to procure some things for them that they couldn’t otherwise get. And so they were desperately looking, someone that had technical knowledge and also was a certified undercover. So I said, I can do it. It’s just a three day job. Maybe I can go do a three day job. Well turned into a little bit longer than that. It was three and a half years I think. So it was June of 2002 to October of 2005. And it was much like the hacker undercover where it’s like peeling an onion. Okay, well if you got to step A to B, see if you can get to step C or D When you end up at step M, well see how far else you can get.
What else can you do it? It just kept going and it was a hyper-productive case, great people working on it. And we made some astounding discoveries, collected some amazing intelligence, and at the end of the day we ended up having to stop the case because one of the younger members had gone to Pakistan to get trained to do his jihad and come back and it’s just too volatile asset to be floating around at that point. You got to bring it down. If you bring him down there, you got to in the affidavit say how you knew about him and then they’ll unwind that and they’ll find me in the source.

Nathan Sportsman:
And was the trade craft similar to the trade craft from the undercover hacking in the sense of, was Al-Qaeda all online at this point and you were No,

Terry Rankhorn:
No. They were very, very, very, very small online presence.

Nathan Sportsman:
And so is this traditional undercover where you’re actually meeting folks in person?

Terry Rankhorn:
Yes, it was the real old school undercover. And

Nathan Sportsman:
You did that for three and a half years?

Terry Rankhorn:
I did. And two weeks into it, we found out that my wife was pregnant with our first child, so she got to be a single mom.

Nathan Sportsman:
So you have a new baby, you’re dealing with a life. This is a real Al-Qaeda. So this isn’t students. You’re having to meet them in person and convince them that you are who you’re portraying to be. And what was your digital legend? Were you a facilitator of selling stuff to them? Yes. So

Terry Rankhorn:
I purported to be a guy. I’m the guy who can get you something and I’m also the guy that can move money around for you. And I was the guy that could do several different things. So again, it’s playing a game of chess, so it’s worse than that. It’s like playing minesweeper on an old Windows computer where you’re clicking, you’re hoping there’s not a mine under there, but you don’t know, it could be hair raising because you don’t want to be the guy that can get anything. What’s that? You need a suitcase and you, oh, I can get you one of those because you, and they would know that you couldn’t. But on the other hand, if you say No too many times and what good are you? Because they didn’t like me at first. So you got to make yourself, you got to bring a value proposition to the equation or they’ll send you packing. So it’s always like this gut wrenching in undercover. I mean, some of my best friends are undercover agents and the bureau has 15,000 agents. There’s only less than 250 of them are undercover certified.
And it’s extraordinarily stressful occupation because again, you see on surveillance when they’re surveilling you with the targets and you’re laughing drinking a Martine, you’re drinking Louis the 13th, cognac having a cigar and everything. What they don’t see is after the meeting’s over and you go in the back room and throw up because you’re that keyed up and literally the meeting gets over and you literally start shaking. It is extremely stressful, just making decision after decision after decision after decision on the spot with just the information you’ve got in your mind and sort of just playing it. And they all have to be right. There’s very little room for error. They might slip something, you might slip something past them. But my main target, he had a PhD and spoke several languages, but he was also a stone cold killer.

Nathan Sportsman:
And these cells, and so whether it was the Twin Towers or maybe this time it’s going to be the Golden Gate Bridge or whatever the case is, you’re the guy that if glycerin or thermite or whatever it is that they need the makings of some sort of explosive device. How do you convince them? I mean, just being a white male, just what does that look like just ultimately that you’re someone that cares about money more than anything else and you’re indifferent of what they’re going to do with it.

Terry Rankhorn:
Exactly. Right. And you have to, well, every case is different. And some people might say, why are you saying this, Terry? You’re going to give all the undercover secrets away. I’m not. In fact, just the opposite. People that think that they can watch anything, any podcast, any TV show, any movie and back solve the undercover process of what we can and can’t do and say, ah, that’s going to, that means anybody that does that’s in undercover, they’re crazy. I mean, I’ve heard things like if you ask someone, if you’re a law enforcement officer, they have to tell you, well, don’t you think we’ve thought of that before? Of course we don’t. I mean if Joe Pistone, Donnie Brasco iss in the basement cutting the body up and they’re like, Hey, are you a cop? He’s like, ah, you got me. You think that’s that’s going to unfold. It’s not. So every case is different. We have different means methodologies, we have different backstopping. So anybody that thinks they’re going to be able to listen to any broadcast like this and say, oh, now I’ll be able to pick out any new cover, they’re not. To your question though, in this case we had to look at a psychological profile of these people. What do they need? What will they tolerate? What level of disrespect or pushback will they tolerate?

Nathan Sportsman:
Is he he of Italian descent?

Terry Rankhorn:
He is

Nathan Sportsman:
And Mark as well?

Terry Rankhorn:
Yeah. Mark, yeah. Joe Pistone, the real life. Donnie Brasco who they wrote the book about and made the movie about, he’s from northern New Jersey, but Italian family descent, and he mentored a guy named Mark Delio who New York Italian. And Mark was my mentor in the undercover program. He was like a father to me. He was one of the people I’m the closest with on the planet and he was just a great influence on me and been an even better friend. But those guys really taught me the true art of undercover versus just some sort of productized process

Nathan Sportsman:
For them growing up, an Italian family. Understanding what that’s like, having sort of a background of that, I can see the pattern of putting them in, it’s risky, but putting them in harm’s way where there might be an easier way to get credibility. Looking at what you were doing with Al-Qaeda, someone with more Arabic or maybe Pakistani or Iraqi or Syrian descent, just something different from Afghanistan, maybe one of the tribes that wasn’t on the side of the US coming in as a white male US citizen, it feels like your level of risk is much higher in terms of them ultimately trusting you and then winding up in a burning inside of a cage or getting your head chopped off. Why would you take an assignment like that?

Terry Rankhorn:
Well, I did it because we wanted to pay ’em back for nine 11. We were still hurting from nine 11 and we wanted to, in a fair number of cases across the US where idiot college students on campus talking about how they’d like to do their jihad and blow something up, but they had no means to get a gun or a bomb or anything else, and they just get themselves into hot water. And that was that These guys were legitimate. They were true villains. And lemme pose a question to you. Would the Ku Klux Klan ever buy guns from a black man?

Nathan Sportsman:
Yes,

Terry Rankhorn:
Agreed. Why would

Nathan Sportsman:
I think Because the means justify the ends and they’re indifferent about where it comes from, only that they need guns to do whatever it is that they need to do.

Terry Rankhorn:
You’re mostly correct, but in fact, you’re virtually completely correct. There’s one other teeny tiny component that’s super important in this. Why would they buy guns from a black man? It’s because there are no white men that they know that have the guns that can sell ’em, sell them, right? So that’s why you have to factor that in to the overall equation and know where you stand. So if they’re treating me with disrespect, for example, well there’s only so far I can push back and it’s like playing poker. If there’s three clubs on the table and I’m playing with somebody and they just start betting crazy hard and I’ve got a full house, well, I know that well, actually, let’s say that I’ve got a royal flush almost sitting there, a possible world flush, and I’m sitting here with a full house. Well, this guy is really pushing hard, should I stay in here or not?
And that’s what you’re doing with them. If they become very disrespectful or things are getting a little, I’m not liking the way things are looking, I’m thinking a little dangerous. Fuck get ’em, leave one of the case team going crazy, what are you doing? Get back in there. Are you mad? Sure enough, I was like, just give it a minute. Next thing you know, my cell phone is ringing. It’s like, oh, well I must use my Muslim name, but come brother Terry, come back, come back. We were just messing around. We were just playing around. Sure enough, you go back over and you actually negotiate a better deal than what you had started with because I knew if they had anybody in their network that could provide that, they wouldn’t have touched me with a 10 foot pole. They didn’t like me, they didn’t want me around, and they were dealing with me only because they had to.
That last part’s critical. They’re dealing with me. They had to. Now that was the beginning of the case. As the case goes, ideally if you’re a good undercover, hopefully you will begin to ingratiate yourself slowly, very, very slowly. It’s just trying to befriend a wild animal. So eventually you can pet that coyote, but if you go up there and try to grab the coyote’s tail at first you’re going to lose an arm. So over time, it got to the point where they liked me more and more and more and you kind of try to pick out the, I don’t call ’em the weak willed base, the more person that’s more likely to give you audience or seems to have a greater affinity for you. And then you sort of springboard that off of that to get yourself further into the organization. And it worked well enough that eventually they’re like, Hey, we like you, but we just cannot have you around as kafi. And so they proposed me converting to Islam and that, as you can imagine, created quite the stir all the way up through the FBI and DOJ. And then I did and got my Muslim name, and then I continued to do what I was doing for them. It’s just now they weren’t paying me, which is probably why they wanted me to convert. But then when I continued to prove myself, I then became accepted with them and I actually became reasonably close with some of the higher level guys,

Nathan Sportsman:
The conversion to Islam, I guess as part of the operation. But did you find any, I don’t know a better word for it, but did you find any beauty in the religion or anything that you could resonate with as you learn more about it?

Terry Rankhorn:
So it actually can be a beautiful religion. Anybody says it’s a hundred percent religion at peace, they’re not accurate. I’m not saying they’re lying. That’s not accurate. I mean in the Quran itself, you can see evidence of that. That being said, I have some friends of mine are Muslim and they’re dear, dear friends, dear friends, and they wouldn’t hurt a fly. They’re the some of the best people I know ever. And there are good elements of Islam. I mean, look, we used Islamic medical books in western medical schools into the 17 hundreds, actually almost into the 20th century, one in particular. So it was a language, it was a religion of science and advancement and conquest, but certainly a productive one. That good thing, great architecture rose from scientific discoveries. So I’m not trying to indict the religion. Islam. What I am indicting is the perversion of it. And just like there’s perversions of Christianity that say it’s okay to shoot an abortion doctor with a microscope.

Nathan Sportsman:
And then so some of these folks developed an affinity with you and I guess sort of like maybe a mob case. You start out maybe with the soldiers, then you ingra your to the captains and you’re trying to work your way up into the organization. And so you were slowly developing relationships with some of these upper tier people. But this individual Hama, is that his name, he goes off to a training camp and that’s ultimately we got to reign this in. It is too risky. And so there’s shutting it down and you’re picking him up at that point for the information that you have, but there’s no more pushing into the organization. The operation has to get shut down. It’s too risky.

Terry Rankhorn:
And it was a real tragedy because we’d made such great inroads. I mean he was here, we were here. But it is what it is. Sometimes it just doesn’t matter. If you have someone that’s a potential match in a powder room, you’re going to have to, you got to stop it. It’s too dangerous.

Nathan Sportsman:
So there could have been furtherance of the investigation, more covering of other folks that are involved or associated with Alqaeda, but at the end of the day, nothing happened. Right, that something was stopped by you being involved in that.

Terry Rankhorn:
Well, that I can’t talk about, but I can say the case, the overall case, not that, I mean Hyatt part of it, the overall case was unbelievably successful.

Nathan Sportsman:
Was that kind of looking over your entire period at the F fbi I was that the most meaningful project for you?

Terry Rankhorn:
I would have to say it was the most miserable but net effect on the citizens of America and other countries as well. It was by far the greatest impact I ever had in my entire service, my 29 years, 11 months of service to the government.

Nathan Sportsman:
Yeah, it’s an amazing experience and I appreciate it. Thank you. That’s very kind of you Al-Qaeda operation against this cell that was operating in the us That operation concludes, you probably need a little bit of decompression, but what happens next from there at the bureau?

Terry Rankhorn:
So they affected what was called a safety move for me where they moved my family and I to Washington DC area and they decided the best place for you is not working in an FBI office. You’re going to work in a covert facility.

Nathan Sportsman:
Does even talking about it now, present risk, God, I mean it was 2000. Oh my God, three. It’s not fully dismantled though. It does still exist.

Terry Rankhorn:
No, it’s actually had sort a bit of renaissance. So there they’ve generally got bigger fish to fry and I think I would be pretty far down on the kill list if they did decide to come after some people, I believe. I hope

Nathan Sportsman:
Even if they learned through this, that you had converted to Islam as part of the operation. That’s all in the court records. It is. Okay. Okay. Sorry to just curious.

Terry Rankhorn:
No, that’s fine. That’s a good question.

Nathan Sportsman:
And so they move you to dc, keep your family safe and I’m sorry. And then what is the next assignment?

Terry Rankhorn:
So I worked for a guy who was a legend in the FBI by the name of Mark Delio. And Mark was a true New York Italian tough guy. I mean before being an FBI agent, he was a professional boxer. He boxed for custom auto. He lived with Mike Tyson. I mean he was a

Nathan Sportsman:
Legitimate tough guy. And with Mark, so I mean it sounds like it’s life lessons and Tradecraft that could probably fill a book, but similar to your experience through the Naval Bootcamp, are there any kind big sort of takeaways from Mark and sort of what you learned from him, whether you applied that to your role at the FB or just life in general? What was it where he was almost, I mean that’s a second father figure. That’s a pretty big term. What was it And Mark

Terry Rankhorn:
Nathan. It was a daily learning experience. One of the things he would do is we’d go to a bar after work and he’d say, that guy right there over there, what’s he do for a living? It was like you ever read the sign of the four Sherlock Holmes where he takes the pocket watch, Watson’s pocket watch he inherited from his dead brother and
Read just that portion of it. It’s the pocket watch sign of the four where that he looks it over examines it, takes the magnifying, basically tells the entire guy’s life history. And he’s so accurate that Watson thinks he did research and it was a cruel joke. And then he walks him through the methodology, okay, this is how I know he had an alcohol problem. This is how I know he had a limp. This is how I know that he had financial problem. I was like, I don’t know, maybe I works, said I don’t know the car plant or something like, nope. And he would walk through, he’s like, see that? See that, see that? And it was like a veil had been lifted from my eyes. I was like, wow. And it’s super important in undercover because as I come in to assess someone, I need to understand how to negotiate with them what’s going to make them mad, what might they perhaps find pleasing, they might have an affinity for. Those things are super important and you don’t get a second chance of the first impression.

Nathan Sportsman:
Is he still at the bureau today or did he retire as well?

Terry Rankhorn:
He retired in 2005.

Nathan Sportsman:
Okay. And so this program that he’s asking you to set up, Hey, we need to get this going. We don’t want this to bite us as part of that, had he been an undercover agent previously? Like you had he ever done? Oh, he was legendary. Okay.

Terry Rankhorn:
I mean legendary. He only had one failing in my book and he was too good because I mean when you met him, there was zero question in your mind that he wasn’t a soldier from a New York mafia family had a big black Lincoln town car with New York plates on it, had the dress pants, the polo shirt with the chain and the leather jacket and the cigar. And he would go into DC doing these undercovers and there was one where a government official was shaking down someone shaking down, meaning that he was extorting them to get them permissions and permits and whatnot. And so Mark goes to meet with this guy just on the cold and he’s like, Hey, listen, I hear you giving my friend, my partner a hard time over here, so we need to work this out. You and me see where I’m from. I understand how things work. You need a little something to make things right. Well, we all make money here. He was being as lowkey as he possibly could be, but this guy was like, well sir, I don’t know what you’re talking about because I think this was just a clerical error. He starts issuing the permits, never Trump Darville darkened that guy’s door again. Mark security was so bad because he was that good and that convincing that the guy changed his life.

Nathan Sportsman:
And so whatever was going on with that person that was shaking these folks down, obviously there’s no case to move forward because he completely backs off. He says he was furious talking to someone from New York. And so he sets up this program, he or asked you to help set this up, take the trade craft that you had learned previously and help operationalize that across all of FBI operations.

Terry Rankhorn:
Exactly. And that was a tough sell because some undercovers back then that they’re like, I’m an old school, this ain’t the streets. I don’t have time to fool with this. It’s like, listen, I get it, it’s 2005. Not everybody probably had an email address and certainly not everybody had a social media account, so you think you can get away with it, but the internet moves it’s dog ears so you won’t be for long. And you may say, I’m not going to do it, but that would be coming and saying, well, I don’t use telephones, I don’t trust them. What? You’re not going to do any business with these guys then? So now you put yourself in an even worse situation where that you are forced into having to quickly adopt something and you don’t understand the risks behind it.

Nathan Sportsman:
And so trying to teach folks that trade craft, was there similar to your new agent training? Did folks start going through some sort of curriculum or some sort of training to try and help educate them on this specific style of tradecraft?

Terry Rankhorn:
I wrote a one week course on how to operate in a covert manner online apart from what they call the Innocent Images project, which is the pretending to be a 13-year-old girl. It was how to operate online for hackers, online hate groups, things of that nature form counterintelligence operations and things of that nature. So I brought the trade craft that I had sort of developed on the fly and spoken to colleagues who had done cases since then and sort of brought together the things that worked, discarded the things that probably weren’t the best idea in the world and put that into a course format and

Nathan Sportsman:
Taught it to people. And was that in person? Yes. Was that back done in Quantico or Quantico? And there you mentioned some things that maybe shouldn’t have done. They get tossed out, incorporated in lessons learned. How do you make sure that there’s a feedback loop and that the trade craft remains relevant? What worked last year and maybe it doesn’t work two years from now and making sure that they’re using the latest and greatest techniques.

Terry Rankhorn:
You should consult with the FBI because you’re asking the right questions and the answer is there usually wasn’t. And one of the things that has plagued the FBI is operational amnesia. To give you an example, all of that stuff that I developed in the two years where I worked for Mark and it was great stuff, very, very positive reception from the field offices of people out there using it. I was actually adopted by another three letter agency, my solution and was just going great. Well, when Mark retired, there was an executive above him who really didn’t care for me. And I get it sometimes I can’t be the most pleasant person in the world when somebody snide or condescending with me, regardless of where they’re at on the food tree, I tend to snap back and it’s not the best survival trait in the world and I didn’t ingratiate myself well to him. So the guy was circling like a vulture from when Mark left. So before Mark left, he got me a job at the black bag team. So that got never had an opportunity, but as soon as I left that program, they shut everything down that I was working on and essentially flushed it. And you’re talking about hundreds of thousands of dollars worth of tech and solutions that I’d gotten out in the field that just went away and years later, years later, this still wasn’t resurrected.

Nathan Sportsman:
It’s

Terry Rankhorn:
Difficult to process because you sir, are in a for-profit business that would go bankrupt if you did things like that. When you’re in the FBI with limitless amounts of money, you can make the most idiotic decisions imaginable and suffer zero consequences for it.

Nathan Sportsman:
Kind of to your point, the part that I’m processing, you’re absolutely right. So for profit, so clear goals and you have to focus on those things, but that’s just profit. What we’re talking about here and what blows my mind is that’s trade craft that could help make sure someone remains out of harm’s way and because there’s a personality conflict or whatever, you’re just going to she all of that and not have those other agents learn those lessons. That blows my mind.

Terry Rankhorn:
Some people could do the most shocking things imaginable in the FBI and again, suffer. I mean, God forbid you drive a mile out of your route home to pick up some dry cleaning, you end up with 30 days off of no pay. But you could do something like a male agent got into an argument with the female agent and he was a supervisor at headquarters. So he goes back and removes her from a database of certified people to do this one job just for spite. I mean that’s to be beyond shocking. And he suffered no consequences because of that.

Nathan Sportsman:
And there’s just, huh? There’s no whoever, but the people above don’t level set with some sort of accountability.

Terry Rankhorn:
It’s arbitrary. Sometimes you’ll have someone that takes notice if you can get their attention and they’ll do the right thing, which oftentimes doing the right thing is okay, get that guy out of the position where he can ever do that, which means promote him literally so that he no longer has access to that database. So that’s always a great idea. Give him even more important database to monkey with.

Nathan Sportsman:
So any organization, it’s made up of people and people are going to to the

Terry Rankhorn:
Week. In my consulting practice, I explained to ’em and said, listen, it costs probably about a million dollars to get a zero day exploit for Microsoft Suite or Adobe or something like that. It doesn’t cost a million dollars to get your cousin Dimitri a job in the mail room where you can stick a thumb drive in a computer when no one’s watching that doesn’t cost a million dollars and it is just as effective.

Nathan Sportsman:
And so this mark, but before he departs and the program is ultimately shut down after he leaves, but he sets you up. You said something Black bag program.

Terry Rankhorn:
Yeah, forgive me. That was I, sorry. Our internal name for it’s the technical name was the Tactical Operations Center, and that was a very, very, very small group. Out of 15,000 agents, there were about 70 of us and we were trained how to break into the hardest of the hard targets, pick the locks, defeat the alarm systems just in the movies, get into their security camera system and change the video and the whole, I mean it was literally like a mission impossible movie. It was the best job I’ve ever had in my life ever

Nathan Sportsman:
Is an analog or sort of the Watergate stuff under, but I don’t think that was the bureau. I think that was the agency, but they called the plumbers. But effectively what they were doing is breaking in and it’s doing that sort of trade craft.

Terry Rankhorn:
So there’s actually a really good miniseries about that that came out about a year ago. And you’re right, they’re called the White House plumbers. They worked for a guy named Howard Dean who was a council for the White House, and it was sort of an unofficial group, and I think they were actually paid by the Republican National Committee and they broke into the Democratic National Committees headquarters to steal documents in the most boneheaded, idiotic fashion. You should see some of the schemes that they had to get prostitutes with venereal diseases and infect democratic. I mean, these are these crazy pulp spy novel plans. And then they hire a bunch of Cuban expatriates who were burglars, who botched picking the locks in the, I mean everything that could possibly go wrong, went wrong because of their idiocy.

Nathan Sportsman:
And that’s somehow what I remember. The way that they had either propped the door open or kept it open, had to do with the way that they had tape it, and they did it one way and should have done it another way. So this black bag program, these are the folks that would, for example, like, Hey, you might not want to do it that way. This is the proper way to do it. And not that they would focus on that, but this is a team that was highly skilled to, they were an insertion team basically.

Terry Rankhorn:
I hate to be a modest, but we really were good. I mean, we broke into the targets that you would think nobody could break into that place and we did it and we got in and out and you would never know we were there.

Nathan Sportsman:
And so were you an operator on that team? I was, yes, I was. And I don’t know because sources and methods, but were there specialized teams within the team that would focus on various components? Yes.

Terry Rankhorn:
Every entry team was made up of, well, one or more components from individual teams back in the center. So you had maybe a team that worked just locks. Maybe you had a team that worked just alarms, maybe you had one that worked the IP based security systems and one that dealt with, they could go into any of these books, I mean drill into this wall and put a monitoring device and you would never know it was there and they clean everything up, but by the time they’re back, you come in in the morning. It was literally like a mission impossible thing. And the I’m talking hyper, hyper competence. I mean, you look to the left and the right and you knew these guys were the best on the planet and we really were, and we were better than any other agency. And I do mean any other agency in the US government at doing that.

Nathan Sportsman:
And it’s similar to your point about the, I think you said the Swedish agent case number two that she was involved with. Given that this team was probably highly specialized and there weren’t a lot of folks, how did cases get prioritized where they’re going to actually leverage this capability? Was it like your top 10 cases and that’s who sort of is prioritized towards this sort of stuff?

Terry Rankhorn:
So the FBI had a designation called mc major case, and there’s not many major cases at any one given time. I’d say less than 20, 10 to 20 probably. I’m just speculating probably about 10 to 20 at any given time. And so a major case gets anything they want, period, the end. Then below that, then it’s kind of a who comes to the table first if we happen to be sitting idle, which would be very unusual, and somebody came with a really low level case and said, can you guys do an entry? We’re like, well, is it a predicated open case? It’s being prosecuted? Yeah, absolutely, we can do it. But if there’s a conflict, which there usually is, then there will be some sort of decision criteria. It’s like, well, this case is a little more important than this case, so we’re going to do this and if we can do, we’ll do this other one.

Nathan Sportsman:
And so I guess one way to show up would be with a warrant, you have a RAID team, they’re clearly going to know you’re there and in this capability you’re coming in to find some evidence, but the goal is for them to be unaware that it happens. Correct?

Terry Rankhorn:
Correct.

Nathan Sportsman:
Okay. And so the case is ongoing. You’re not ready to make an arrest or anything like that. You’re still building evidence towards making an arrest, and so you don’t want to give away that the target is on.

Terry Rankhorn:
That is exactly right.

Nathan Sportsman:
Okay.

Terry Rankhorn:
And the things task has done over the years are just unimaginable. For example, we’re talking about the mafia before they went into a mafia social call, beg pardon? They went into a mafia boss of a family’s house. He was sleeping on the couch, they snuck a reached over him and actually put a bug in a lamp and actually got back out and relock the door from the outside while he was still sleeping on the couch.

Nathan Sportsman:
That’s insane.

Terry Rankhorn:
And the guys there, like I said, they’re absolutely professional competent, but it’s like I said, it’s like watching these spy movies. The first job I was ever on, we piled into a foyer and there’s two locks. There’s a handle lock, and then there’s a deadbolt lock. One guy goes down and was picking this lock, another guy’s up over his back picking the other one. Then you’ve got the guy that’s the overall commander for the whole entry and he’s got a radio, he’s calling out, making sure everything’s okay out there. And he is like, hurry up, hurry up, hurry up. So the guy’s picking the locks, and meanwhile they’re picking away focused on it. He is like, that’s not what your wife was telling me last night. You can’t help laugh, but the consequences are immense if you get caught.

Nathan Sportsman:
Well, and to your point about the consequences, similar to the Al-Qaeda focusing on a cell within the us, so this is a covert capability.

Terry Rankhorn:
So

Nathan Sportsman:
You’re not walking in with a blue jacket and yellow FBI letters on your back prove

Terry Rankhorn:
Vest or anything.

Nathan Sportsman:
And so if that person on the couch wakes up or you think the individual is gone and they’re actually there and they walk out on you, they don’t know that you’re law enforcement. They could think that you’re a burglar,

Terry Rankhorn:
They will think you’re a burglar

Nathan Sportsman:
And things could get messy pretty quick. So it’s exciting, but why choose that? Was it just being part of the best of the best and what those teams, regardless of the risk, why do that work?

Terry Rankhorn:
It was, and also again, I watched Mission Impossible, the series when I was a kid, and I thought, I’d always thought, in fact, Ronald Kessler wrote a book about the FBI that I read before I went in and he had a short chapter on them and I was like, wait a minute, these guys picked a lock on the door. They go in, they crack the safe in the movies and they get documents out, copy them, put them back and everything and come back out. I was like, that’s unbelievable. How do you get on something like that? And then lo and behold, my mentor was leaving the FBI and he was like, you still want on that thing. And it sit, everybody knew Mark and everybody respected him so much. He was able to get me a spot on there.

Nathan Sportsman:
How long did you do that work?

Terry Rankhorn:
October of oh five to April of oh nine. And I loved every single minute of it

Nathan Sportsman:
There. Any public domain at this point? Anything that’s worth talking about or is it all pretty much cool and dagger and classified?

Terry Rankhorn:
I’m trying to think. Well, Ronald Kessler did an interview on NPRA few years ago, and he lays out stuff that we can’t even talk about. I don’t how he got away with that, but

Nathan Sportsman:
So if folks are curious and they wanted to understand more of the tactics and tra half, you said Ron Kessler?

Terry Rankhorn:
Yeah, Ronald Kessler. He wrote Secrets to the FBI

Nathan Sportsman:
And then he had some sort of interview on NPRN.

Terry Rankhorn:
He had a radio interview. I want to think it was probably around, actually it was 2009, 2009 when he gave the interview. So that’s a really good one. He actually really does describe some of their techniques and some of the places we broke into, which are, I mean, like I said, you never ever mentioned those places, but he did. But there’s others too. The one, I think it was Paul Castellano’s house is the one that they did where they reached over him while he is sleeping. And then there’s some true crime shows on Discovery Channel or one of the other networks. I forget what, but they’ll mention some of the FBI covert entries into places.

Nathan Sportsman:
And Paul Castella, Castellano being the boss of, I think the Gambino crime family.

Terry Rankhorn:
Exactly correct.

Nathan Sportsman:
Prior to Gotti after being gunned down at that steakhouse.

Terry Rankhorn:
Absolutely correct. On every respect.

Nathan Sportsman:
It kind of reminds me of Sammy the Bull Gravano showed you a bur earlier, Gotti’s

Terry Rankhorn:
Under Boss,

Nathan Sportsman:
But you had mentioned Mark was a professional boxer and there was a relationship to Mark and Sammy the bull. Can you talk about that a little bit? I

Terry Rankhorn:
Can. So again, Mark’s so modest, he wouldn’t admit this, but I admit it, but we won’t bring it up. So when Sammy, the Bull Gravano became a state’s witness, he would’ve been a huge high value target for them to kill. So they housed him at Quantico, which you’re not going to get in there. First you got to get through a marine perimeter, then you’d have to get through the F FBI I perimeter. Then you’d have to find him. And there’s no safer place he could have been in America. So even though he was the state’s witness, he wasn’t super fond of law enforcement. And he was actually a very talented boxer. So he started asking F FBI’s like, Hey, I want to box with somebody, anybody you can box. But he meant to just beat them mercilessly. So they went to the FBI Hostage Rescue Team, which is housed at Quantico.
Those guys are very fit, very good runners, good athletes. There’s former seals in there. In fact, I had a good buddy of mine who was SEAL Team six, and he served on HRT for a while. But boxing is not just a sport. I mean, you can take a person that’s a great track guy and you’ll probably do great at basketball, just a very close skill translation, boxing’s way different way, way different. And so Sammy the Bull was a very good boxer and he really injured some agents on HRT. And so they looked around, was like, who do we know that was a boxer? And they’re like, well, we’ve got a guy who was a professional boxer and a really good one. And so they call Mark, mark comes down and decides to, he is like, I’ll get in the ring a box with you. And he absolutely punished him. He never once again asked to box any FBI agent. It was a slaughter.

Nathan Sportsman:
We’re coming to the end of the black bag program and then is at the point in which you switched to a supervisory agent and then we kind of pull out through to the end of your career at the FBI.

Terry Rankhorn:
So I was a supervisory agent as a black bag team member. Somebody along the way figured out how to make those positions supervisory, which I never supervised anyone. I supervised a tool bag. And so at the end of that, in 2009, a position opened up in the Louisville, Kentucky office. Well, Amanda had wanted to go home. Women from Louisville have a home beacon. They want nothing more than to go home and it’s a great city. So I was okay, that’d be fine. And so we were both trying to look for spots. We had always kept our eye, our entire careers. We kept our eye open for spots in the Louisville. Well, here’s one, and there might not be another one because it had been 12 years in, and that was the first one we’d seen.
So we thought, well, if we take this one, we may not get it. So I stepped down from my position and went to Louisville to be an agent. And then once I was there fairly quickly, I became what’s called the undercover coordinator. So he’s the guy that sort of manages the whole undercover program before that office. And for me, it was the entire state of Kentucky. So you’re in the planning of the operations, you select the people that are going to go to the school. You initially train those people, you have oversight for the operations and sign off authority, you can pull the plug on them. It’s just sort of, I don’t know, just sort of the major Domo for undercover operations.

Nathan Sportsman:
And so that brought you all back to her, back to Kentucky. You originally being from Tennessee, but relatively close, any horses? Just curious.

Terry Rankhorn:
I’m sorry? Any horses?

Nathan Sportsman:
Any horses?

Terry Rankhorn:
No, not a horse person. No. Okay. Yeah, a lot of work horses.

Nathan Sportsman:
And so from that point through 2021, was that your last year with the FBI 20 19, 20 19,

Terry Rankhorn:
December 31st, 2019.

Nathan Sportsman:
And you were stationed in Kentucky? Yes. And that’s where you completed your career?

Terry Rankhorn:
I was.

Nathan Sportsman:
What ultimately made you decide to leave the bureau and do something else?

Terry Rankhorn:
So there’s a clock ticking. Once you reach 50 and you have 20 years of service, you are eligible to retire at 57. You’re going to go with them holding onto your legs and you got your hands on the drapes. So at some point between those two things, you probably ought to be thinking about going. If you’re waiting more toward the end, well now you’re less employable. There’s skills issues, there’s age issues for employment. If you go at 50, you’re still certainly with Gen X people, you’re still relatively a young man. I mean, just recently my boys are finally able to outrun me. So I thought, well, I’m still young enough, I’d still be very employable. And at the end of the day, ended up forming my own business anyway. But I left sort of on my own terms when I wanted to go. I didn’t get pushed out the door of the plane. I jumped out and I really don’t regret it. I mean, I’m actually very happy that I did it. Not that I disliked the bureau, although the bureau I left was not the bureau I joined, but it allowed me to spend much more time with my sons sort of makeup for some of that time that I was gone when they were younger. And it was a wholly positive move.

Nathan Sportsman:
And the Tradecraft and the things that you learned from the bureau, whether it’s digital forensics, incident response or training or bug sweeping, these are things that rain, corn and associates, the company that you ultimately founded offer. Is that right?

Terry Rankhorn:
That is exactly correct. So I offer consulting services that marry well with other companies. Computer auditing service, computer security, auditing services. For example. I don’t do an EDR deployment. It’s just too much to manage and it’d be a nightmare. But I would pair very well with a company that does that. Because again, my analogy earlier about it’s a million bucks to get a zero day, it’s free to get your cousin a job in the mail room. So I explained to them, I say, this is your next big vulnerability. It’s not going to be a more sophisticated attack. It’s going to be a different attack vector. And then that blends well with the TSCM, technical security countermeasure sweeps, which my guys are the best. They’re the best in the world, and they’re certainly the best in the country. They’re certified to sweep the White House. If it’s there, they’ll find it. If it’s on, if it’s off, it doesn’t matter what it is, they will find it and have found things. So those are my two primary offerings.

Nathan Sportsman:
And is your sort of clientele you focus on, is it companies net worth individuals? What is government institutions? What sort of folks do you service?

Terry Rankhorn:
So I don’t do government institutions because, and I don’t know if you’ve ever dealt with dealing with the government. The contracting process is absolutely byzantine. It is just not worth it. The juice is not worth the squeeze. It really isn’t. And the money is, you think the money is huge from government contract, then they’re usually the most parsimonious of any of ’em. My primary focus is high net worth individuals. That’s my absolute primary focus. Those are the really good contracts. The second would be generally medium sized businesses. Large sized businesses generally have their own components and they’re not interested in any outside help coming in. And small businesses, they can’t afford my bill rate.

Nathan Sportsman:
And for folks that are curious, where would they go to find out more about your company?

Terry Rankhorn:
Www.rankhorn.com has all my offerings.

Nathan Sportsman:
Awesome, thanks. Thank

Terry Rankhorn:
You.

Nathan Sportsman:
And you also had, I think, correct me if I’m wrong, it’s 23 or 24, but you also started a separate initiative outside of your company called Virtual Safe House.

Terry Rankhorn:
Yes. That’s my passion. It is completely free and it always will be free. I don’t search anything for it. It’s a Facebook group and just search virtual safe house. I’ll take anybody in. And what I’m doing is I’m actually taking the undercover method and I’m taking the computer crime process that we used to work at, and I’m using it to basically build a taxonomy of how the scammers work and sort of enumerating their network. They can get a credit card, how do they charge the credit card? And then once we’ve collected that information, then coming up with productive strategies to disrupt their thing, cost them that bank account, cost them that credit card processing account. They have things that really hurt them. You get an email account shut down, they’ll have one in an hour. You get their Facebook account shut down, they’ll have one in 10 minutes, another one.
But you start affecting the infrastructure where it hurts and they feel that. So my goal is to push the cost of doing business up where I can discriminate out a lot of the chaff and then just leave the bigger organizations which law enforcement then can focus on. So what I’m doing is I’m doing this, but I’m also training people in this group to, okay, this is how you do it. Okay, if you get on with these scammers, don’t just disconnect. Everyone says, well just disconnect. Delete the email, give ’em an expired credit card number, a prepaid card that’s expired. Do this to help enumerate and pull out what they’re doing, engage with them, but do it safely. I teach ’em how to do it safely so they don’t lose control of their computer

Nathan Sportsman:
At work. We get hit by these things all the time, and they’re getting, it seems like increasingly sophisticated. So they’re targeting us as a organization versus individuals, but without fail within the first two weeks without fail, if you join Proto and you will get a text message from me in your first two weeks of something to the equivalent of, please go to Walmart and buy a thousand dollars worth of gift cards, things like that. We’re getting these emails inbound that have an entire dialogue with me, an invoice that looks legitimate for cloud services for us to pay $73,000. And so for people that are not part of a business and have various controls in place to try to mitigate that and are just dealing with this one-on-one, where could they go to find out more about scams, how to spot them, number one. But number two, like you said, increase the barrier of entry where these things are costing these folks more virtual, safe house, virtual safe

Terry Rankhorn:
House virtual safe house baby. Because I’ve been able to assemble a really good team of some other professionals around the world that are just best in class. So they contribute on there. We will have users will submit scams, Hey, I think this is a scam. And it’s like, okay, let’s break it down. Let’s examine everything. Let’s look at all the metadata. Let’s look at everything. Okay, this is this scam. This is how it works. And then anything else they’ve been able to tease out, then we’ll sort of build that into the body of knowledge so that then we’re all working to improve ways that we can disrupt their business model.

Nathan Sportsman:
And it feels like from kind of where we started in this discussion, the late nineties, some kids may be tinkering, some things more sophisticated, but it feels like that that tinkering and curiosity and sort of juvenile approach is long gone,

Terry Rankhorn:
Long gone.

Nathan Sportsman:
And now everything is monetization scams, ransomware or nation state level activity. But there is no just intellectual curiosity anymore. It’s a business. Now,

Terry Rankhorn:
Intellectual curiosity has now moved to hardware hacking. I don’t know if you have a flipper. Zero greatest thing on the planet. My wife got me one for Christmas and I was just enthralled forever every, but again, I taught my boys the ethical things of this. I don’t ever do anything that’s going to inconvenience or cost someone else any money. So for example, taking it on campus to school and then brute forcing a HID Prox card, okay, yeah, you can do it and it’s cool and everything like that, but think about it, you just brute force someone else’s number. So now that guy’s going to get in trouble for going in a classroom. So you’re going to put that guy in a bad situation for you just wanting screw around. So don’t do that. Instead, here, let me go buy some prox card hardware for sale used off of eBay. And I don’t know, I’ll stick it on the liquor cabinet and I’ll give you something to do. Which as I say that out loud, I hope my wife doesn’t watch this podcast.

Nathan Sportsman:
Well, I had mentioned, I think last night, can I leave you with this one last question? I’m excited for you to be here because I want this to have a 360 point of view. I want law enforcement’s point of view, academics, intel, community, business, and the hacker community, everyone that was foundational to this industry. Why are you doing this? Why come out here, fly out to where we are today, to spend time to sit down? What is it that motivated you to say yes or maybe what you’re hoping to accomplish?

Terry Rankhorn:
It was funny when I spoke with you at first, I told my wife, Amanda, I said, this has got to be a commercial cover nation state approach. Nobody’s just nice. This has got to be. And then after speaking to you, I was like, no, I think he’s legit. I think this guy is real. And I did some, of course, my due diligence. I was like, no, he’s definitely for real. And I was immediately struck by a feeling of humility, and I was honored the fact that you would want to know about this. And then I thought more and I was like, this is a space no one else is really in. I mean, you are trying to go back to that magic time when really it’s not the birth of the internet of course, but it was really the early adoption of the internet back when, I mean, you had open tell net, you just logged in, guest guest, and you could just go all over the place and people hadn’t really put two or two together.
It’s like, you know what? I’m hooking this as my corporate network. I might want to put some sort of security on it. And you’re wanting to go back and explore that, and you’re exploring it from the people that maybe take advantage of it. And now you’re bringing in people that sort of work the other side of the table from it. And frankly, I’m honored. I’m honored you would want my viewpoint and my experiences and it’s just been a wholly positive experience from every, you’ve treated me like a king and coming out here. And then, like I said, I’m just honored that you would like to chronicle the story that I can contribute to

Nathan Sportsman:
Terry Rainn. Thank you for doing this, sir. It is my pleasure. I appreciate it.