Things Matt Wrote

If you do a Google search for the term “Felony Lane Gang”, you will get “about 2,860,001” results. That’s a little more than a bunch. Most of them appear to be news reports with titles such as,“Felony Lane Gang targets Moms”, “EPD arrests woman they say is part of the Felony Lane Gang”, or “Felony Lane Gang Ramping Up Again”. The commonality of these reports is the generalization that all of these bad actors have a familial connection. The news reporters and journalists undoubtedly get this bent from those of us in law enforcement and financial industry security who flippantly suggest the connection. We casually suggest the conspiracy by referring to every group who steals bags and cashes checks through the far drive-through teller lane as “the Felony Lane Gang”. Singular. As if they are all connected like a crime family or neighborhood sect of a national gang.

They are not. And we should stop doing this.

“The” Felony Lane Gang did exist. They were a group from Florida that traveled the east coast and were eventually arrested and prosecuted in the Middle District of Pennsylvania. My home bailiwick. Many of us remember this case, and I’m sure that a few readers of this newsletter were involved in the investigation and prosecution of the case. It was brilliant work. Here is one of the press releases from 2014 that I could find still online https://www.ice.gov/news/releases/leader-floridas-million-dollar-felony-lane-gang-sentenced-more-15-years-prison.

The method of operation (MO) was to steal purses and bags from unattended vehicles, then disguise themselves as the victims, and cash the checks through the far lane of the bank drive-through. The distance of the far lane made it more difficult, and sometimes impossible, for the teller to discern the actual identity of the driver presenting the check. The thief just had to look closely enough. The farthest lane of the drive-through has become known as the “Felony Lane”.

New York Times author Nikole Hannah Jones recently made headlines herself for claiming that the United States dropped a nuclear weapon on the Japanese cities of Hiroshima and Nagasaki due to the sunk cost fallacy. The United States had spent so much money and time in creating an atomic weapon that it used the resulting tool only to prove that it was worth the effort. Anyone who has a half understanding of world history knows this is incorrect. This claim made in the weeks, months, or even a few years after the event, would be understandable. But after 81 years of study, scrutiny, and academic review, this assertion is proven wrong. So wrong, that someone who makes it should be held in no more regard than a person who still claims the earth is flat. Of course, Ms. Jones isn't about the truth.

Giving credit where credit is due, government decision-making and policy can be influenced by sunk costs. Personally, it is easy to pivot when realizing we're “throwing good money after bad” but in the machine of government, that is much easier said than done. Particularly, when the ego is involved.

Law enforcement agencies have this odd organizational setting where it's not quite a strict hierarchal military rank and file system but yet not run like a free market business entity. Much like a business, law enforcement agencies must satisfy the needs of their customers – the public it serves, and the executive board – the elected politicians. But unlike a business, the customers can't just go to a competing business. No matter how poor the service, the customers keep paying the bill – in the form of taxes. And the executives are everchanging, so if the law enforcement leadership conflicts with the CEO or Board of Directors they need only wait them out through the next election.

Being a voracious reader, I would share my interesting findings with friends and colleagues through email. Eventually, one politely asked that I save his inbox the stress and just send a single email aggregating all of the interesting links I had gathered over the week. Matt's Newsletter was born.

That was the first try. It is hard to keep interested in something when no one is paying attention. I stopped publishing after a few weeks of no feedback and no subscribers.

I never lost my appetite for reading and sharing my knowledge though. I started to collect and publish my writings on a write.as blog. When I learned about the newsletter service Substack, I wondered if I could combine my writing with a newsletter sharing the best news stories I had read over the previous week? Matt's Newsletter was re-born.

52 weeks later, and a name change, it's still going.

Welcome to the Threats Without Borders Newsletter – Issue ONE YEAR!

So what have I learned after publishing a newsletter every week for one year?

As defined by Wikipedia, the Curse of Knowledge is a cognitive bias that occurs when an individual, who is communicating with others, wrongly assumes they have the background to understand the communication. Just because you have mastered a subject doesn't mean everyone you communicate with has also. I often assume that my audience has the prerequisite knowledge to understand the information I am presenting. I am often wrong, which leads to frustration on both ends. This doesn't mean they are low intelligence, or unable to learn, it just means we have different backgrounds, experiences, and professions. An orthopedic doctor trying to explain bone density to me is going to get the same response as me trying to explain Network Address Translation to her.

I recently participated in a ransomware tabletop exercise at a local business. Initially, I was disappointed in the simplistic scenario presented by the consultant running the exercise. Uhh, so basic, I can't believe they are getting paid for this, I thought. But as the exercise played out, I observed that even such a basic scenario led to very productive conversation. In fact, the participants couldn’t have handled much more. Many of the stakeholders were not in the business of security, or Internet technology, and needed to be brought up to speed.

The curse of knowledge got me again. I allowed my mastery of the topic influence my opinion of the exercise and assumed the other participants had an equal or better understanding of ransomware and the incident response process. I had been through the scenario so many times, in both exercises and reality, that I had the answers. I wrongly assumed the others would also.

This week President Biden claimed to be “committed to the cybersecurity of the country” and promised to hold those that threaten our nation's security accountable. He also announced that his administration was hosting a meeting with 30 countries from the NATO and G7 alliance to discuss the problem of cybercrime and come up with a plan to combat it. The statement asserted the group would bring the “full strength” of their capabilities to disrupt the malicious cyber actors.

Israeli defense minister Naftali Bennett describes Iran as an Octopus that spreads its influence across the middle-east through its long tentacles. Mr. Bennett is the original proponent of the “Octopus Doctrine” declaring the only way to successfully beat an octopus is to target its head. “When the tentacles of the octopus strike you, do not fight only against tentacles, but strike the head also”. Life comes from the head, not the tentacles.

Previously the Biden administration outlined a new strategy for combating ransomware and cybercrime as detailed in this Wall Street Journal article. The administration plans to target the financial infrastructure of ransomware gangs hoping to remove the financial incentive of cyber-criminality.

Targeting the financial systems is just striking at one of the tentacles. You may cut it off but seven more exist and as you battle those the injured one will grow back.

I love speaking to telemarketers. It's a game really. I like to see how long I can keep them on the line before they hang up in frustration. The key is to not be an overt jerk and string them along like you want to be part of their program but just can't grasp what they need from you. Or offer a problem that they just can't get around. For instance, not being able to grasp the difference between a debit account and a credit account when credit card debt consolidators call. Another favorite is explaining that I live on an overgrown wooded lot and agreeing to purchase solar cells if the company will remove the five mature oak trees on my property.

Sometimes this game has unintended beneficial consequences. The vehicle warranty callers are relentless and I had been telling them that I have various vehicles and couldn't understand what vehicle they wanted to offer an extended warranty. They don't know what vehicle you own when they first call so their script offers a little social engineering attempting to get you to mention the make and model of your vehicle. I would try to keep them on the line as long as possible without ever mentioning a specific vehicle. Eventually, the caller would hang up. But someone else always called back. Sometimes the next day.

Recently one caller slipped and asked what vehicle I owned that was between the model years of 2012 and 2019. I guess the actual company behind the calls realizes there is no need to offer an extended warranty on a new vehicle that already has a valid warranty. Or one that is too old and will be a sure claim.

So, I told the next caller that I owned a 2021 Tesla to see how he handled the new model year. To my surprise, it wasn't the year that stymied him. It was the vehicle. The caller said, “Oh, we can't offer a warranty on a Tesla. I'll remove you from the list.” And then he hung up.