Security Confidential S5 E6 Mia Landsem

Manoj Tandon:
Hello everyone, and welcome to another episode of Dark Rhino’s Security Confidential. Today we have a very special guest. Mia Landsem joins us.

Mia is one of the nominees this year for Cyber Security Woman of the Year. She’s an honest-to-god celebrity in her homeland. She has written a best-selling children’s book. She is a cybersecurity practitioner, and she has taken up some very noble causes, including getting laws changed in her home country and getting law enforcement much more engaged with cyber law enforcement, especially when it comes to minors.

She’s kind enough to join us today, and we are honored to have her here. Thank you, Mia, for coming on the show.

Mia Landsem:
Hey, thank you for having me.

Manoj Tandon:
Prior to the show, for our listeners, we had a little discussion. Mia has done some very serious work, and I think it would be good to give our listeners a little bit of the beginning. How did you get engaged with cybersecurity? What was your journey into this arena of cyber, and then to the nomination for the Cyber Security Woman of the Year award?

Mia Landsem:
So, yeah, my way into security was a bit bumpy, I guess.

I’ve always loved video games, so I started loving computers and PlayStation and Nintendo and stuff when I was really young. I always liked to play with my cousin and stuff like that. I always loved computers, but then it was the security part of it that I got interested in. I don’t really know when. I was maybe 15 when I started thinking about security, because I was hearing about people getting hacked or losing their gaming accounts, and I really did not want that to happen. It never happened to me, and I’m very glad. But my friends started to get their accounts hacked and stuff, so that was the first time I ever thought about that.

Then I continued with the gaming stuff for a while and actually made some money by streaming gaming, went to gaming conventions and stuff like that, and really enjoyed it. I got interested in how to build computers to have the best computer possible for my games, of course.

And through that arena, I got friends that went to IT school or who were into hacking and stuff like that. So I got introduced to it when I was maybe 13 or 14. I started just to look at stuff. I found it fun to solve puzzles and do small hacky things, but I wasn’t really good at it.

And then I was a Taekwondo specialist, so I was on the national team in Taekwondo and spent my spare time just playing games because I was really tired. I was training a lot, so I did not always have the time or energy to go out with friends.

Manoj Tandon:
Were you trying out for the Olympic team from Norway?

Mia Landsem:
Yeah, actually. My plan was 2020, but I damaged my knee a lot, so I don’t know if I’m able to kick again.

Manoj Tandon:
Oh, I’m sorry to hear that.

Mia Landsem:
I’ve had four years of injury, but I really wanted to pursue that Olympic dream, and I went to the Norwegian School of Sports Sciences to learn more about sport and to just work out all the time.

So I was doing that a lot, and since I was so tired, I did not have the time to meet my friends. I didn’t get to drink or party like everyone else, so it got kind of lonely. I just was playing games and having friends in the gaming world, really.

Manoj Tandon:
Are there learnings that you took away as an athlete, as someone that was training, that you have applied to the world of cybersecurity?

Mia Landsem:
Well, yeah. I am a fighter. I was a martial artist, so I am a fighter for sure.

I really got into the world of cyber when my ex-boyfriend took a picture of me without me knowing. And when I broke up with him, he placed it all over the internet. He sent it to someone who hated me and told them to send it everywhere.

So I really got to feel not just online bullying, but harassment and blackmailing, people trying to threaten me and my family. It was just everywhere. Everywhere at school, everywhere on the internet, porn sites. I was getting nasty messages all the time.

So I did not find the internet funny anymore. I started to really see the security part of it.

I think the way I had been training my head for so long helped me. If I did not have that, I wouldn’t be here anymore. I got really depressed and suicidal after my pictures got out. But I think that I really had this mentally tough head after years of training in martial arts, and that’s why I survived.

But I started to get really angry, right? So I’m a fighter. And the thing about sports and cybersecurity is the tactics and techniques. I’m used to spending hours a day just to do one special technique, this one kick, right? And just look at it and break it into pieces and see and record it: what am I doing wrong? Why is my foot not going higher? Why did I not hit that person? What did I do wrong?

So it’s kind of the same thing, and it made me do the same thing in the cybersecurity world. So when my picture got out, I didn’t just cry and give up. I started to figure out what kind of pages these pictures were saved on. Okay, what is this page, and how does it work, and how can we take it down? I started to look at takedowns for pictures. Just nerding myself into the situation.

Manoj Tandon:
You mentioned many serious things there, but one of the things that I’d love for you to address to our audience, a lot of whom are very young people, is bullying and getting these pictures out and anything like this.

When some horrible event happens, what should an individual do? Because we do hear a lot of young people suffer from depression and mental illnesses, and in the worst cases, they lose their lives. Nothing is worth the loss of one’s life, right? So how would you advise them? What would you say to them?

Mia Landsem:
Well, it’s really hard when someone does that to you, especially when it’s your own boyfriend and stuff. It’s heartbreaking, and you really need to stay calm and just try to focus on collecting the evidence.

And that’s also what I did: taking all the screenshots, saving the pages that posted me, saving the image URLs, everything. Just saving everything. I’m really happy that I have a cool head because of my sports experience, because you might make some mistakes when you’re desperate to get those pictures removed or when you go into a state of crisis.

You really have to stay calm and just collect everything you can as evidence. And then you really have to talk to someone. That’s my biggest regret: that I did not talk to anyone. I was an anxious child and I had a lot of bullying, so I did not really have anyone to tell this to. I figured I’d solve it myself. I think my head would be better if I spoke to someone early.

Over time, I had some friends to talk to, and I ultimately reported the crime to the police after several years because I was scared. I really regret that I should have gone there at that time.

Manoj Tandon:
Let’s chat about that for a second. When you went to the police, what was their reaction to this?

Mia Landsem:
The police reaction? I was really shocked because they did not know too much about this. They were asking me a bunch of stuff, of course, like if I had taken those pictures. I said, “Of course I didn’t take those pictures. You see both my hands in the picture. He took it.”

So it was kind of scary. I sat there with a male older than myself. He was nice, though. I’ve heard some stories about people having really bad experiences. So he was really nice, but he did not know what I was talking about, and I felt like I was talking to a wall, even though he was nice.

And it took a lot of time before anyone did anything. I didn’t hear anything for a while. I had all the evidence, you know. I had my ex-boyfriend saying, “I’m really sorry I did this to you, and I really regret that, and I’m ready to take my punishment.” So I had everything. I had a screenshot of him sharing it, the attacks, everything.

And then, after many months, they just closed the case without doing anything.

Manoj Tandon:
What was the situation with the laws in Norway? Did the laws just not exist for them to enforce, or were they choosing not to enforce the law?

Mia Landsem:
There weren’t any laws that were talking specifically about image abuse, but there were privacy concerns, harassment laws, and sexual harassment laws. So it usually went under those kinds of laws.

But we did have a law that was about children under the age of 18, which was images that sexualized children, and that means everyone under 18 years old.

So after being so heartbroken about my case being closed, I started studying the law, and I did see that they had placed it under sexual harassment for grown-ups. At the time, I was 18 or 19 before I reported the crime, but in that picture I was 16 or 17. That means that this picture was a picture sexualizing a minor or a child in Norwegian law.

And the reason that they closed my case was that they said I had spent too much time before reporting the crime. For the sexual harassment laws, you have one year to report a crime, but for pictures of a minor or child it’s three. At this point, I knew about the pictures one year after he had shared them. It was really slow in the beginning and then just exploded with me being on television and stuff. So actually I had three years, and that’s what I figured out. They had placed me under the adult class with one year to report, and I reported after maybe two and a half years.

So I figured it out and I called them. I was kind of pissed, actually, and I said, “I was a minor and these are the correct laws.” And this lady was yelling at me on the phone. She was yelling. And she is actually the woman who closed the case, and she is really known in these kinds of sexual cases.

I just wrote my own letter to the police complaining about them closing the case and what the correct law was.

And then it went on. This was a year and a half, maybe, after I first reported the crime. No one had reached out to me and no one asked me if I needed help or anything. And then I just got a letter that he had to pay a 500 euro fee for ruining my life.

Five hundred euros was the price of sexually harassing me and destroying me.

And then I saw, again, they had placed it under the wrong laws. They had placed it under pornography. I’m not a porn star, and that’s when I really got pissed off. Because the way that I got to know that my pictures were out there was when I was 18 and had my first beer outside in a bar. Then I saw some boys laughing at me, and I went there and said, “What’s your problem?” and they were like, “You’re that porn star, aren’t you?”

So those boys called me a porn star. I was on porn sites. And then the police actually called it pornography.

It is not pornography to have a sexualized picture of a child. I complained again, and they said, “You cannot complain about anything right now.” I did not get any money, nothing. No help, no information, no help to remove my picture. I spent one and a half years of my life just for my ex to pay 500 euro.

Manoj Tandon:
Did they end up opening up the case again then, Mia?

Mia Landsem:
Yeah, that’s what they did, because they accepted that, yeah, they did something wrong. But then they placed it under pornography, so it’s just a mess. That’s when I got really pissed off and I started helping other people in the same situation.

I think that was kind of therapy for me. That’s when I really started to enter the world of cyber: finding ways to find my pictures, like reverse image search. I really spent all night finding my pictures, and then when I would find my pictures, I would find everyone else’s too, like women that I knew from my hometown. I just got so obsessed with helping everyone.

I didn’t have a good time, and I figured I’d help others too, so they would not find out about this by being called porn stars in bars. I really wanted them to hear it from me in a respectful, kind way instead of getting nasty messages like I did, because that’s a big shock.

So I just started telling people that their pictures were out there.

Manoj Tandon:
You’re taking your skills now as a cyber professional and helping other people who have had image abuse happen.

Mia Landsem:
I’ve helped thousands of victims throughout these years, at the same time studying. I helped this world handball star, and she was just like me. She was a sports star. She’s the world’s best handball player, Nora Mørk, and she decided to help out.

So I helped her when her pictures got out, and she actually brought this to the media. She knew that by telling the media about this—because this has happened to a lot of celebrities in Norway, but no one wants to talk about it. Everyone knows, but it’s not everywhere.

She knew that that picture would be everywhere, and she’s the world’s best handball player, so it would go worldwide. She made this sacrifice to help me and everyone else, to make people aware of this happening.

Because I did not go to the media. I did not tell anyone about the work that I did. And then she just went to the biggest newspapers and television shows in Norway, speaking her case and speaking for the victims and doing such a good job. She name-dropped me, and I got some interviews.

I thought, okay, this will last some weeks and then it will be over, but it’s been three years, almost four years, and it’s not stopping.

Manoj Tandon:
You’ve got it at over 300 schools as well, right?

Mia Landsem:
Oh, yeah. I’ve lectured everywhere in Norway. I’ve written a children’s book, as you mentioned. She really gave me these opportunities, and the media gave me the opportunity to actually make a real change, not just helping, because I was exhausted by helping everyone alone.

After the media explosion, I was getting like 30 messages a day, and I was still in my second year of sports sciences school. I stopped sleeping. I really wanted to fight this cause, so that’s when I decided to quit my bachelor’s in the third year.

I just quit, and I started at network and IT security school here in Norway because I really wanted to learn more. I wasn’t confident in my technical skills. I just knew basic tips and tricks, and I really wanted to help even more and make a change in this world.

Of course, I didn’t believe it at first, but now it’s actually happening. I was like a celebrity overnight. I got to go to these TV shows. I got to write for the newspapers about what I wanted. People stopped asking the old men for IT stuff. They started asking me. So I really wanted to learn more and just use my skills, and it worked out.

Manoj Tandon:
You must have faced some backlash from people as well, I would imagine.

Mia Landsem:
Yeah, I live at a secret address. I have a lot of males that really, really hate me, spreading fake rumors about me, harassing me, stalking me, death threats. It’s been really hard, but you kind of get used to it.

I’m really anxious when walking outside, and I still struggle with a lot of it because it’s been a lot, like grown-up men stalking me at night. Someone edited pictures of me being killed. Threatening with weapons at my shows, at my talks, calling me a Nazi feminist.

I’m helping both women and men, so I don’t really get why men are so focused on this Nazi feminism stuff. I think it’s really bad, because feminism is a really good thing, and I’m not really talking about feminism ever. I’m just helping out, and it seems that so many men are calling all women Nazi feminists when they are just talking about something important.

If you’re a woman and you talk about something and you get attention for it, then you’re a Nazi feminist. It’s really weird, and I’m really scared about that internet culture. I think it’s really damaging and scary. It’s like a cult.

Manoj Tandon:
It is, and I can only imagine getting an onslaught of such harsh messaging. I actually can’t imagine it. I’ve never been the victim of that.

Mia Landsem:
And it’s not only messages, you know. People follow me in the streets. They use knives. They are harassing my family, video recording them. I had to quit my job when I was studying because they were entering the shop all the time, screaming and recording me.

Manoj Tandon:
It’s really unbelievable, but you were successful in spite of all this in getting some laws changed.

Mia Landsem:
Yeah, I did. We got new laws in July this year.

Manoj Tandon:
Well, congratulations on that effort. Can you give us a little color on that?

Mia Landsem:
Now it’s not just sexual harassment. These are laws that actually mention pictures and image abuse. It’s kind of the same rules, but they’re rewritten so people really understand that these kinds of things are illegal.

I’m still not quite happy with the new laws, because it’s under the same paragraph as if I was recording you falling and posting it and you were humiliated. It’s the same law. They didn’t give it the gravity of what it is.

Because that’s a personal violation, right? It’s a huge personal violation of yourself, your body. This is a sexual violation. Videoing someone falling, funny videos, that’s not the same thing.

So that’s another story, but I think it’s really good that we actually have it written down now. So now I’ll work to get this into its own laws. I doubt that will happen, but it’s a step in the right direction.

And also, a positive thing is that it gives the victims the possibility to get some restitution. I did not get anything when I reported the crime, and now it actually says that you will get that.

Manoj Tandon:
Law enforcement has become much more conscious of this now, and they’re not so quick to dismiss someone that’s been a victim of this kind of situation, I would hope.

Mia Landsem:
Yeah, they know even more now. I had my talks with the police as well, and now I feel like it’s much better. There are a lot of great people in both cybersec now and in the police. It’s much better, but it’s not perfect. And it has to be even better. I’m not satisfied.

There are still some people out there who actually tell the victims, “No, you cannot report that because it was your fault.” We do have some of those old guys that work in the police who actually make victims turn away and shame the victims.

The fun thing is when I started doing my talks, it was really successful. Everyone was booking me and I was traveling 100 days a year.

Manoj Tandon:
I would imagine—300 lectures, TED talks, TV appearances. When do you get to actually practice cyber?

Mia Landsem:
In school.

It was really fun because the police started asking me questions and wanting to learn from me, so I actually had a talk at the law school and the police academy. That was really positive.

And then they just arrived with their own talk about pictures and image abuse. They were copying my presentations, and they were actually taking notes at my talks. Of course, I let them. But then they copied my whole talk and started traveling all over Norway with their own talk with the same things.

I like that they kind of did it, and people still like my talks better.

Manoj Tandon:
There’s a saying in English: mimicry is the greatest form of flattery.

Mia Landsem:
So, yeah. But it was positive because people seemed to respect the law and the uniforms, of course, and then they actually made internet patrols. They actually have a Facebook account and an Instagram account that people can ask questions to, and that was one of the things that I thought was missing, because I did see in other countries that they had those kinds of things.

So now they have that and it’s getting better, but they need to learn more.

Manoj Tandon:
You go after a lot of these online sites that are posting these images and have very little accountability. What was that experience like? Did you get any kind of positive reaction from them, or were they completely indifferent?

Mia Landsem:
They started out actually just telling me to stay back, like, “This is work for the police and we don’t think that Mia should do these kinds of things.” So they were really negative in the start.

But then they chilled more. I started actually winning prizes and awards for my work, and I made some big headlines helping the police with the cases. They would say to the newspapers, “Yeah, we caught this predator,” but they didn’t mention, “Yeah, Mia gave us this predator.”

So they would actually steal my glory in cases. But then they started cooperating. They knew that I’m not going anywhere. I’m not stopping. I will not stop discussing things with them. I will not stop telling them what’s wrong and what’s right, and people started to acknowledge that. They had the same feelings like me, and they cannot stop the feelings of a whole nation.

So they started saying, “Mia does a really good job. Why didn’t you applaud her?” Yes, it took like three years, but they invite me for stuff now. They want me to work there. So it’s a really positive thing.

Now they have some more work to do. Some employees in these internet patrols are not nice people, so some of them really don’t like me. I get that it must be hard to have a blonde 24-year-old tell you how to do your job. I get that. But yeah, it’s much more positive now, and that’s why I keep doing this, because I do see that there is a change.

Also, I finished my studies last year in June, and I got a job at Orange Cyberdefense as a pen tester, ethical hacker. And what really also helped me when people were threatening me and stuff is that my employer has my back and they believe in me. They let me do my work, they let me speak. They will not silence me.

That’s why I’m not working in the police, because they will silence me. They will not let me talk. So I’m so happy that I’m in a good place. And even though I still get a lot of threats and hate, I’m getting used to it and I’m just really happy to help.

And to be nominated for the Cyber Security Woman of the Year as well was just amazing. I didn’t win the prize, but it made me connect with a lot of cool people. My LinkedIn is full of amazing things. LinkedIn got more interesting than Facebook. So I got to connect with so many great and cool people.

I hope to do more work internationally. I know there are still some states in the US where it’s not illegal to spread people’s photos. And also, you mentioned children. My main thing is not just helping people who are victims of image abuse, but also children with grooming and child sexual abuse online. I work a lot on those cases.

Manoj Tandon:
Have the laws made it harder for you as a cybersecurity practitioner to go and find this information out there?

Mia Landsem:
Well, yeah. There are rules, you know. There are privacy rules, GDPR, a lot of rules that you need to watch out for. And of course, you cannot save pictures of children, even though your intentions are great. You really have to be in this gray zone.

Because, of course, if I do find something, I will send it directly to the police. So if you do that, then it is okay.

Because I work a lot with really horrible cases with children online, and I work on finding Norwegian victims. I actually did place pedophiles in jail. That’s also why I’m getting threats: because I ruined their lives. To hell with them.

But I work with these things. I don’t recommend people to do it. You really need a tough head. It’s horrible to watch. And I’m trying to find Norwegian victims, but you will see a lot of children being in pain, and that’s the worst part of it.

Actually, the worst part is seeing grown-ups that do these kinds of things and then they go home to their wives or husbands and live normally with their kids. So I’m working a lot with that kind of stuff and catching these predators, especially those that live in Norway.

And the laws, of course—I am not like you have seen on these TV shows where they catch groomers and stuff. I don’t do those kinds of things. I do not post anyone on my Instagram or something. I do not post the predators. I am following the laws. I’m not doing anything that I’m not supposed to. I’m not using tools—you know, I could easily find more IP addresses or find out where people live or their names, but the law stops me from doing so. I can only find IP addresses in a legal way.

And yeah, sometimes people, when they hear that I work as a hacker, think that I do a lot of illegal stuff. But when you are an ethical hacker, you do have great respect for the rules.

Manoj Tandon:
We had an instance today, right before the show, where there was a client that wanted us to try and test various aspects of their environment, and it would have absolutely gotten us in trouble had we done that. There are rules here that just because we know something’s broken, we can’t go exploit that vulnerability. To a degree, it’s a handicap too. There’s no exception under the law for us to actually go and help someone in that regard.

Mia Landsem:
Do you have laws like—we do kind of have laws like if someone’s in danger, or life danger, you are allowed to—let’s say you’re lost on a mountain and then you found a cabin. You’re freezing, you have no food or water, and you break into the cabin to save your life. Then you will not get criminal charges pushed against you.

But I’m also playing a little bit with that, because if you do see a child being raped, that’s danger, and that should by law allow me to use tools to find out who this person is.

And they keep saying that the physical rules are the same as online, and I tell them, “Yeah, but then why cannot I use this tool to save this child?” “Oh yeah, because that’s an illegal tool, because they have privacy too.” And I’m like, “Yeah, but what about these laws? You do say that the physical laws are the same on the internet, so why is this not the same?”

So I’m trying to figure out more about this, because if I was to see a live stream of a child being raped, I would use whatever I could do to find out where this child is.

Manoj Tandon:
Wow. I absolutely agree with you.

Mia Landsem:
And yeah, if the law wants to punish me for that, then so be it. I haven’t done anything like that because it’s not really common that you will find a live stream of a child from your hometown being raped. Most of it is already recorded stuff, so it’s not the same danger there. It might be an old video.

So I’m trying to figure out those rules and what can we actually do, because the laws are a bit outdated.

Manoj Tandon:
Yes, they do need to be reviewed.

Mia Landsem:
Yeah, because it’s a lot of new tools. Sometimes they will say, “We do not allow programs that do this and this.” Okay, but what if it’s not a program? Can I then do that?

So we really need to figure out those things. But I am completely bound by the law and I will continue to follow it until I see something like murder or child rape live.

Manoj Tandon:
I hope you never see that.

Mia Landsem:
No, me neither.