The Second Man to Take Something

There is a certain kind of help that is really just a better-organized form of harm, and the only difference between the two is who is holding the invoice.

I have been thinking about this since I read about a fellow named Zohar Pinhasi, who did business under the name Zack Green, which is the first sign that a man is not planning to deal with you straight. He ran a Florida company called MonsterCloud, and what MonsterCloud sold was this: ransomware hit your computers, we fix it, and we do it without paying the criminals who broke in. That last part was the whole pitch. A lot of the clients who called MonsterCloud were local police departments and sheriff's offices who had been locked out of their own systems and were not willing, philosophically or otherwise, to send bitcoin to whoever had done the locking. They chose MonsterCloud specifically because they believed the firm would not pay ransom. That belief was the product they were buying.

What they were actually getting was different. Federal investigators say Pinhasi paid the ransom, added a fee on top, and handed the client a bill. In one case the government describes, he paid roughly eight thousand dollars to unlock somebody's files and charged the client about a hundred and fifty thousand. The Justice Department indicted him last month, and he has pleaded not guilty. He faces up to twenty years. The official press release says he "turned the victim's crisis into his own profit center," which is either a very precise legal description or a very good sentence, and I think it might be both.

Now I have to tell you about Pastor Holmgren and the snowblower situation of 2003, and I know how that sounds, but stay with me.

After a storm that dropped nineteen inches of wet snow on the Bend in what felt like a single long Tuesday, Holmgren's church needed its parking lot cleared. A fellow from two towns over offered to handle it. Said he had a method. Charged the church a fair amount of money for this method. What the method turned out to be was his nephew, who owned a plow truck and did the actual work for considerably less. The nephew mentioned all this at a Wednesday potluck, not to cause trouble, but because he was proud of a clean job and assumed people knew the arrangement. The church board then had a conversation with the middleman. Brief. Final. The lot had gotten cleared fine. That was not the issue. The issue was that the middleman had sold them a method, and the method was someone else, and the gap between what the church paid and what the nephew received was the whole point of the exercise.

Pinhasi's arrangement was the same thing. Bigger invoice, ransomware instead of snow, but the same gap, same design, same direction the money traveled.

What kept nagging at me, though, was the MonsterCloud website, which featured a promotional video starring John Pistole, former deputy director of the FBI and former head of the Transportation Security Administration. In the video, Pistole vouched for the company. He was listed as the sole member of MonsterCloud's Cyber Security Advisory Board. When reporters asked him about it in 2019, Pistole said he understood that the business involved paying ransoms. He also said Pinhasi had scripted his testimonial. He was paid through a speaker's bureau. He was not named in the indictment, and the Justice Department has declined to comment on his connection to the firm.

I am not saying the man broke a law. That is for other people to decide. What I am saying is that up here, if your name and your face are on something, you own a piece of what that thing turns out to be. That is not a legal standard. It is a different kind of standard, and it has been in place a good while longer.

When someone with that particular résumé appears in an advertisement for a company that the FBI later helps to indict, a person in Chamberlain's Bend has questions. Mainly: who checked? And if nobody did, why not? Aunt Vi would say that a man who has spent forty years minding the store ought to know better than to put his name in the window of a shop he has never been inside.

Ransomware, for what it's worth, is worse now than it was when all this was happening. The tools are sharper, the people running them are more connected to foreign governments that do not wish us well, and the artificial intelligence is making it easier to spread. It is growing the way something grows when nobody is walking the perimeter.

But the technology is not the part of this story that stuck with me. The part that stuck was the sheriff's departments. Local police who were frightened, who were trying to do the right thing, and who called MonsterCloud because a man they had reason to trust had looked into the camera and said trust them. They were looking for help and found something shaped like help, which is a worse outcome than finding nothing, because at least nothing doesn't hand you a bill.

The ransomware attackers took their files. That was the first theft. But the second one came from the direction of help, wore a better suit, and charged a hundred and fifty thousand dollars for the privilege.

You can change your passwords. You can patch your systems. You can eventually recover the files. What is harder to recover is the particular confidence that comes from calling someone who said they were on your side, and finding out later what they were actually on.

That one takes longer. And there is no invoice that covers it.

---