Eric Strom From Lawyer to FBI Cyber Division Unit Chief

Eric Strom3:50

And so Throughout that process, I kind of became interested in working with the FBI. I always liked the criminal aspect of the law. I liked being in the courtroom. And so I applied pretty much right after I graduated from law school, but they wanted me to be a little more seasoned as far as work experience. And that holds true really for everyone. They kind of want you to work a little bit. They want the FBI to be your last job, not your first one. They want you to bring the experience that you learn out in the private sector or other government agencies to the FBI. And so it took about three years to get in. And that's partly just because of the process, whether it's the background checks, the health screenings, and then just the interview and then the testing and everything.

Eric Strom5:14

And then my first office was Pittsburgh division. I never lived there before. I had a friend that grew up there and that was about the extent I knew about the city.

Eric Strom5:59

At the time, it was a lot of like frauds on different payment platforms and things like that back in the day. And he wanted to create a similar platform that companies could go to about different frauds and other cyber threats that were facing them. We kept in touch. He eventually created this new group and they built this nonprofit called the National Cyber Forensics and Training Alliance, NCFTA for short. And they embedded an FBI unit in there. And he asked me if I was interested in coming over and working it. And I had never really worked cyber threats before, but I had worked a lot of Russian organized crime before. And the Russians were very involved in pretty much everything from violent crime to art theft to

Eric Strom6:35

Healthcare fraud, and then to this kind of emerging cyber threats. And so it piqued my interest. And so I worked in this kind of unique setting, not having any cyber or infosec background at all. Again, I was a lawyer by trade, and I basically just was immersed in these kind of new threats. You know, we looked at spamming and phishing and the emergency of botnets and things like that. And I just learned along the way. I learned through repetition. We had a lot of young graduate students that comprised the nonprofit staff. And a lot of them were either computer scientists or into infosec but they also had sociologists and other kind of unique job or study positions that kind of brought a holistic look at the threat and it really kind of gave me a better perspective on cyber crime because it's like looking at an onion and you start peeling away all the layers in anonymization and things like that until you finally find that individual organization that's responsible for it and so

Eric Strom7:26

How we got to that middle part was really what I focused in on, because if you're new to cybersecurity or infosec, it's kind of overwhelming. I likened it to math. I got in really early and I kind of kept up to date as the years went on. But if you're coming in and kind of the middle or towards the later part, it can be you don't understand the historical significance of why certain countries do what they do or why certain actors are doing what they're doing, because there's a lot of repetition along the way.

Eric Strom8:47

These were organizations of individuals that had certain specialties or experience or expertise, and they would get together to do these different frauds online. And so that was really interesting to me. And they were global. It wasn't like kids in the same neighborhood or in the same city. You had a Turkish kid, and then you had a kid from Russia, and then you had some kids maybe from down in South America. And they all kind of linked up on these forums and were able to execute these different online cyber threats. And so I found that very Fascinating and so much so that we ended up taking over one of these underground forums. It was the first time that the FBI ever did that. The forum was called Dark Market.

Eric Strom9:25

And a colleague of mine, Keith Malarski, was our undercover officer. And I was the case agent. And then we had another colleague, Tom Grasso, that was really in charge of kind of the technical aspects of things. Now, it's funny, none of us really had a traditional cyber background. Tom started out his career as a geologist. And Keith actually started out selling like furniture. He's a salesman. Wow. And I was a lawyer. But the three of us together, we had interest in information security and cyber. And I think we took our unique backgrounds and applied them in a way that we were able to get things done. I mean, Keith is the great example. I mean, here's this guy who was a salesman before he got into the FBI.

Eric Strom10:01

And essentially his job as an admin for this form that we took over was he was selling these guys on believing that we were just as bad as they were. Right. And we were really successful at it. So we ran this forum for two years. We prevented about 70 million in loss, and we arrested a little over 75 folks globally. And the really important thing about this case, aside from the fact that it was kind of a game changer for the FBI, it was the fact that we really started to develop our international relationships with our foreign partners and police partners. We were working a lot with the Germans, a lot with the UK, Turkey. We had a Turkish police officer embedded with us for almost a year. We also worked with

Eric Strom10:39

Switzerland, Belarus, and a couple other countries. And that really kind of made us realize at the time, and I'm talking 2006, 2008, that we can't do this on our own. And this is a global threat and these actors are everywhere and we really need to rely on each other to work well together. And that was really actually prompted my interest to try to work overseas later in my career.

Eric Strom12:49

The field has ready access to U.S. attorneys. They have an evidence room. They have an ELSHA room that's electronic evidence and all these other support systems that help with their investigations. We did not. And so we had to rely on, again, I kind of leveraged my relationships with Pittsburgh Field Office because I used to work there. And we worked out a deal where we'd be able to leverage their support systems to help us with this case. And in return, we were then referring cases on subjects out to other field offices like New York or Omaha, Nebraska or Chicago. And so we became almost like a referral mechanism, both internally within the United States, but then also externally with our foreign partners.

Eric Strom13:29

And I'd be remiss in not saying that we also work very closely with the U.S. Secret Service because they also were kind of getting into this field at the same time. Obviously, one of their mandates is looking at financial crimes and especially online. And so we did a lot of deconfliction and coordination both with their headquarter units as well as their local Pittsburgh office, which was very helpful. And then in return, a lot of the stuff that we were able to identify in our case solved a big case for them. They had a case against a gentleman named Max Butler, who was actually arrested out in San Francisco. His nickname was Iceman, and the Secret Service and our case were kind of looking at him, but they had some really good evidence against him, so we tried to provide them as much as we could to help them get him because he had a knack of kind of disappearing and basically stealing wireless signals all over San Francisco, so you can never really track him down until they eventually did.

Eric Strom14:15

They got one of those rare no-knock warrants to get him because he was always online, and the concern was that he would lock up all his systems and we wouldn't get any of the evidence on there, so... It was a very interesting spinoff case of what we were doing. And they've written some books and other things about him, but he was an interesting character. And we subsequently brought him in after he went to prison to talk to companies and cybersecurity reps to talk about what he did and how he did it. And one thing I learned over these years is a lot of these criminals, they love talking about themselves and what they do. And so they're really in And they love to spill the beans and talk about everything that they did.

Eric Strom14:51

And they get really excited about it. And it really shows you how easy it is for young people to kind of fall into that kind of lifestyle and not realize the damage they're causing. And I believe back in the day, the damage globally wasn't as bad because we weren't as interconnected as we are today. But today you look at things like the Mirai botnet and other things where they're knocking off major companies offline. I mean, you're talking about the significant financial losses and communication losses and other things. And I think a lot of young people just don't realize the power that the Internet has these days.

Eric Strom16:06

But yeah, I mean, that's the kind of trust he developed. And really that's trust is the big word here because between myself and Tom and Keith, the trust we developed both with partners in law enforcement, Our foreign partners, and really the private sector partners. Because as I mentioned, we prevented $70 million in loss. And so as these guys were posting bank accounts and brokerage accounts and other things online on this forum, we were scraping those out and then contacting these different companies saying, hey, we're seeing your client's information being sold. And they would confirm, yes, that is. And so they would take Matters into trying to mitigate those losses. And so in doing that and having that kind of two-way exchange, we really developed solid relationships that the FBI could then leverage later on and vice versa.

Eric Strom16:47

We got to know a lot of these folks and what we were doing. And we had the benefit in our group in particular that, because eventually I took over this unit in 2010. And we were together for almost 10 years, which is really unheard of in government speak. Most people kind of moved to different positions, but we really enjoyed what we were doing. And we could see that it was a tangible difference that you And see being made, which is another thing. Cyber cases can be long-term and time-consuming because of this sophisticated nature of things. But ultimately, the end result when you either make a disruption or you make an arrest or you indict or you're taking money back out of their accounts that they stole, I mean, it's really satisfying at the end of the day.

Eric Strom17:24

And I think it's really the mission which draws a lot of people into the FBI and what we do and the variety of types of work we do. I mean, it constantly changes. The threats constantly change. And that really makes the job interesting. There hasn't been a day that I've been in that I'm like, look at the clock watching. I'm like, okay, when's this day going to get over with? It's usually like, oh my gosh, it's already four o'clock. Like what's happening? And that's great. That's the thing I really like about it. And I've known some guys that have left and have gone to work for companies and they're like, I'm making more money, but it's just not the same mission. You're not helping people as much as we like.

Eric Strom17:57

Yeah, it's wonderful.

Eric Strom19:18

And in fact, one case we had, it was the Game Over Zeus case. We infected ourselves with it. And then when we actually took the botnet down, and when I say take it down, it was group work. We had researchers from universities. We had private sector companies. We had other nonprofits all helping us take this very sophisticated botnet down.

Eric Strom20:24

That was the best we can do outside of trying to actually fix the problem globally just because it just wouldn't happen. That argument went all the way up to the attorney general, and he said he'd rather not do that. But, I mean, it's little things like that.

Eric Strom21:37

We want to do things where we can always say, hey, that worked out well. Let's try that again in this situation because it worked so well in the prior one. And legally, we were administratively pure. So those are the really kind of neat kind of challenges that unlike some of these other operational divisions that we have, whether it's criminal or counterterrorism stuff that we face almost daily. And it really kind of gets your mind going and really keeps you involved in kind of How you can challenge yourself and challenge the system at times to make change.

Eric Strom22:56

It's being worked globally. And so you really got to get the word out there on what's going on. So being able to communicate, being able to develop trust, obviously having the technical skills. You don't have to be a ones and zeros programmer. I mean, that would help just to have an appreciation. But what I have seen in the past is that people that are super technical tend to get lost in the technical nature of what they're looking at and not really realizing that, yes, this is a malware and this is what it's doing, but why is it being used? I liken it to like a bank robbery. Where someone is a gun expert and they look at the gun used in the bank robbery and they're like, well, that was just a tool.

Eric Strom23:31

The reason they took the money was why? Was it because they just needed money? Did they need a drug fix? Are they part of an organized crime group that's doing something larger or a counterterrorism group that's doing something larger? You can't get so focused in on the technical. Aspects either. But having a general understanding of what a bot network is and how malware works and just understanding infrastructure in general would be very helpful. And we have a lot of, at least in the FBI, we have a lot of training that we provide, basic cyber investigative training. We also work with a couple other independent companies that provide training outside the FBI that you can get certified in. That really helps.

Eric Strom24:03

And again, I learned basically from sitting in a very unique environment that And was immersed in it. And unfortunately, not everyone really gets that opportunity, but having just a basic awareness would definitely be helpful. And then being able to speak in front of people. We do a lot of conferences. We do a lot of media interviews. You're constantly trying to sell your investigation to U.S. Attorney General's office, executives within the FBI. I mean, you might be briefing the FBI director at some point on the case. And so that's just another aspect of what makes a good investigator.

Eric Strom25:21

So a PIN is kind of a high level private industry notification that we provide to, I guess, be written more to an executive level overview of kind of what the threat is. And then the flash is actually basically the YARA rules and other things, the IOCs that maybe the particular malware is associated with. And so anybody who's a defender at a company or whatever can then use those or input those into their system to try to identify whether they have an issue or not.

Eric Strom26:20

So when we are reaching out to a particular energy sector or a company within that sector, We're trying to develop intel requirements that we can then relay to our field or operational units to say, hey, this is what we see affecting the oil and gas sector. What are we seeing out there from nation state actors or criminal actors and how they may be trying to exploit these vulnerabilities that we're identifying? And then we try to circle back to those companies in that sector saying, hey, this is kind of what we're finding. Have you seen any of this? And if so, can we share it to the broader audience so that the sector itself can be strengthened?

Eric Strom28:11

Convince them that, Hey, this is a great job. You're more than likely going to be traveling around the world. So you'll be using a passport. You'll need a passport if you don't have one, you know, you kind of run through it. Every new agents class, it's like, that's, I always tell the instructors, you got to emphasize the fact that they need to get their official passport because literally within weeks or months, they may be already going over to Germany or wherever, because that's where their case is taking them.

Eric Strom29:58

Or I think he was with Fort Worth. How is that helping Fort Worth? Well, in a way it is because if you can get the individuals responsible for this ransomware campaign that's hitting school districts and local governments and police departments, well, then you're solving a problem for the United States. And ultimately that's going to show the benefits. And it's also, to be honest with you, I mean, if you have that kind of, if you can do that and have that kind of background, to be honest, when you retire, I don't want to say the sky's the limit, but I mean, you would really be marketable in the private sector with that kind of background.

Eric Strom31:15

At the federal level and how we're collaborating through the interagency. And then we also have our National Academy at the FBI that we always bring state, local, federal, and foreign partners in. And we've been really trying to push providing cyber training at those events so that they're armed with more awareness. So when they do go back to their departments, they have a better idea of what's going on. It's interesting, a lot of these state and local departments don't have responsibility for their IT department. That's usually from the city or the county. And yet when there's an event like a ransomware attack and their files are locked up or say someone goes in and starts manipulating electronic evidence, I mean, those are major issues that these guys need to know about.

Eric Strom31:52

And that's what we're trying to promote to a lot of these, what we consider up and coming folks that are selected or nominated to be at the National Academy.

Eric Strom32:59

I mean, I think a lot of local police would be surprised at how many complaints are filed from their area of responsibility with the IC3. It could be $3 or $4 million of loss. Wow. And the local sheriff or chief might say, oh, this is a problem, but we can't really see it because we're not working collaboratively because you have multiple agencies within a certain state and they're not really sharing all that information. It's all being shared federally. Gotcha. Yeah.

Eric Strom34:57

And that's really a problem. And so we're always constantly talking to people that they need to make sure that they're training their folks to have good password management, that they make sure that they're not clicking on everything that they see online, that they verify who's reaching out to them because there's a lot of social engineering going on, whether it's through the phone or through online. And these are really kind of the basics where folks can get into the network. And then they just kind of hang out there for a long time. And then next thing you know, you're losing all sorts of money, intellectual property. So that's really what it boils down to. You also have to realize what's most important within the company.

Eric Strom35:29

What are your crown jewels that you need to protect and make sure they are protected? Do you segment your network so that you can't get into the R&D from the normal network? Are you segmented from other companies or other offices that are global? And are you protecting yourself that way? There's a lot of things that I think if you went to the basic CISO school that they always beat in everyone's heads. But I mean, we just repeat things. That because those are really the basic things that you need to look out for. And that's what's really important. We always encourage companies to develop strong relationships with their local field offices because when there's an issue, the people that will be responding will be the local field office.

Eric Strom36:08

That's going to be the first phone call. The stuff that my unit does, we're almost kind of like the backup. If for some reason they can't get hold of the field office, they call us or they call the Office of Private Sector or some of the other outreach units that we have and try to get in touch with the FBI. But ultimately, for the general counsel of a company, for the CISO of a company, to have those early discussions when everything's calm and fine and knowing how the FBI will react, knowing what the FBI will do with that information. Knowing who else, what other agencies may respond, because a number of agencies have, as part of our new cyber strategy, it's really kind of a whole of government aspect to this.

Eric Strom36:44

So you'll have DHS CISA that provides some remediation. We're more threat response. And so we all bring certain aspects to the table and to have that rolodex of people hey this is who you need to call and this is how they're going to respond knowing that ahead of time instead of when you're in panic mode and you've got your pr people and your lawyers and everybody kind of figuring out what's going on yeah having that laid out ahead of time will really produce great results in the end of the day and knowing what those expectations are really important and to be honest one of the things that our unit's doing is reaching out to a number of cisos that we've worked with And said, hey, when you first got the job and you didn't have a relationship with the FBI, what were your first couple of questions?

Eric Strom37:26

What would you want to know ahead of a meeting or during a meeting with the FBI? And we kind of provided a sheet, basically, to hand out or give to the field offices. So when they do have those initial conversations with a new partner or a new company, they can say, hey, these are some questions that you might want to pass your general counsel on. That way, if there's any follow-on, we can get back in touch with them and talk to them.

Eric Strom38:50

So these are some of the things that we've been doing for the last couple of years to try to enhance those partnerships.

Eric Strom39:36

And I think a lot of folks in my position would be because I think most of us really love our job. And I think it really kind of gives them, they walk away with some excitement about it. It is challenging. There's a lot of people interested in these positions, but it's still worth it. Even if you have a really good job right now, there's no real downside to putting in for one of these positions if that's something you really want to do.

Eric Strom40:38

So it's not really a cutthroat profession. Technology is changing so quickly and you might have a friend who's really on top of it on that particular technology. And then all of a sudden you might have an interest in a different one and you're on top of that one. And you're sharing notes and comparing and meeting up and these cyber conferences are Great presentations, but after hours, that's when the real conversations and really interesting talks are. That's what I really enjoy about going to those. That's what I miss currently in this current situation. Seriously. Yeah.