Behind the Mask of Social Engineering: A Mission for Justice

Christopher Hadnagy is a renowned professional social engineer, author, and ethical hacker with over two decades of experience in human behavior and cybersecurity. He is the founder of Social-Engineer, LLC and The Innocent Lives Foundation (ILF), a nonprofit organization dedicated to helping law enforcement identify and stop individuals involved in child exploitation and the production of child abuse material. Known for his groundbreaking work in applying social engineering to ethical causes, Christopher has authored multiple books on the art and science of human hacking, including the bestseller Human Hacking: Win Friends, Influence People, and Leave Them Better Off for Having Met You. Christopher is a sought-after speaker, delivering keynotes and training sessions worldwide on the intersection of human behavior, cybersecurity, and social good. Through his work, he aims to not only educate but also inspire others to use technology and human interaction for a positive impact. When he’s not uncovering critical threats or supporting his nonprofit’s mission, Christopher dedicates his time to mentoring and training the next generation of cybersecurity professionals.

My message is simple but powerful: Your voice, your leadership, and your influence can save lives. As leaders, whether in the nonprofit world, you have the unique ability to inspire, educate, and mobilize people toward meaningful action. One of the most important things I want you to think about differently is how we view and address child exploitation. This isn’t someone else’s problem—this is our problem. Traffickers and predators thrive in silence and ignorance. By breaking that silence, raising awareness, and supporting organizations like The Innocent Lives Foundation, you become part of the solution. I urge you to take a closer look at how your organization or community can contribute to the safety of children. That could mean supporting local education programs, partnering with nonprofits, or even hosting workshops on digital safety. Sometimes, it’s as simple as starting the conversation. Together, we can be the difference between a child remaining in danger and a child finding safety. I hope that after hearing this, you’ll feel empowered to step up and use your platform to shine a light into the darkest corners and protect those who cannot protect themselves.

More at – https://www.innocentlivesfoundation.org 

 

The Interview Transcript

Hugh Ballou:
Welcome to the Nonprofit Exchange. This is Hugh Ballou. I’m the founder and president of SynerVision Leadership Foundation. Leaders create synergy with their teams by being very clear with their vision. So be very clear. create that synergy because we don’t do it alone. We’re dealing with a topic today that’s sometimes invisible, but it’s a huge problem. So, my guest today is Chris Hadnagy. I misspelled your name. Chris is a new friend and he’s got a great mission. So, Chris, let’s start by telling people a little about you, your background, and What led you to do this important work. And I’m going to give people the titles today. It’s Behind the Mask of Social Engineering, a Mission for Justice. So first tell us about yourself and then about the topic.

Chris Hadnagy:
So I’m not just a normal guy. I have a wife and two kids. The business that I run, which is not a nonprofit, is called Social Engineer. We audit companies, large companies, and employees for their vulnerabilities and susceptibility to cyber attacks, and then we help educate them so they know how to report and not fall for those attacks. During one job that I had for a really large organization, we found a man. who was in that work, trading videos of himself molesting little children with people on the dark web. And that for me, this we’re going back maybe 10, 11 years. For me, that was new. I thought this was a third-world problem. This wasn’t a problem here in America. And it was this light bulb eye-opening moment that I’m like, this is a problem here. We did a sting operation with federal law enforcement and that man will be in prison for 150 years. And for me, that was like a, I don’t know, like a superpower moment. I felt like I didn’t know my skills could do anything good. So that’s kind of was the start of how I wanted to do more of that and to form the ILF. So the ILF, talk about that. So it’s the Innocent Lives Foundation. When I wanted to start it, the first thing I did was go to my lawyer because I said, I know what I’m asking to do is highly irregular. There are a lot of great organizations out there that try to build tools for law enforcement or save the kids once they’re taken out of those situations. I wanted to stop the predators. I wanted to stop the people who are hurting kids and creating child abuse material. So doing that meant we were going to be in the deepest, darkest, dirtiest places of the dark web and seeing, and reading things that were going to be terrible. And I just needed to kind of have some basis of how we can form an organization that can get volunteers to come in and safely, both legally, physically, and mentally, go do this work and help law enforcement with this job.

Hugh Ballou:
So that’s scary, the deep, dark web. Most of us don’t even know what that is. But give us an idea of the extent of how big this problem is.

Chris Hadnagy:
OK, let’s look at 2022, NCMEC, which is the National Center for Missing and Exploited Children. That’s a global organization that houses all child abuse images, gives them hash, and then gives them out to law enforcement agencies around the globe so they can go and stop these bad guys. In 2022, they had 32 million images submitted to them. In 2023, they had 36 million. That went up by 4 million images. And these are unique images of children being abused. And now, this year, with AI-generated child abuse material, the problem is bigger than it’s ever been. And the pandemic kind of took it from where we were seeing 15, 18 million pictures a year to 30 million. So when all the predators were home, all the kids were home. So I hate to talk like this, but the supply and demand were there and child predation went through the roof.

Hugh Ballou:
Wow, wow. So how do you get parents to listen? So I wanna talk about the organization and your work more, but parents is listening to this. What is some of the flags that parents need to look out for?

Chris Hadnagy:
That’s a great question. So when the child is being groomed, the groomer, the person that’s trying to get them to send pictures or do things with them, will create an environment where that child and that groomer, have this intimate relationship. They’ll be convinced that the only person in the world they need is that groomer. That they don’t need anybody else. So what you’ll see is your child might start isolating themselves more. Isolating themselves from family, in real-world friends. They might be spending a lot of time online. You might notice strange gifts pop up like a brand new cell phone or jewelry or something like that. Where’d you get that? Oh, a friend gave it to me. Now, I’m not saying if any of these things happen. I mean, teenagers, go through depressive moods and isolate themselves. So I’m not saying if that happens, your child is being groomed. But if you see this kind of all coming together, you may want to sit down and have a conversation about these types of things with your child. One thing I have to say, we’re starting to see now grooming happen as young as eight years old. So we’re not just talking like 15 to 18-year-old kids. We’re talking even young kids are being attacked.

Hugh Ballou:
Wow, wow. So dig into it a little bit more. You’re a cybersecurity expert, so you know how to dig in. So how do you unmask these predators? And then when you finish that part, talk about how you then make a connection with law enforcement.

Chris Hadnagy:
Yeah, so that’s kind of an interesting topic because when my lawyer sat me down, he was part of the board. He said, here’s a few things you need to consider. One, you can’t view any images at all because it’s illegal. Two, you can’t download them and give them to law enforcement. That’s illegal. Three, you can’t interact with the predators, because so many organizations do that, and that’s vigilantism. So if I make believe I’m a 13-year-old boy on the internet, and then I get these predators wanting to meet me, and then I get their name and their address and tell them to meet me over here at the McDonald’s, 86% of those cases get kicked out by law enforcement. They never see a trial. So he said, none of that. And third, or fourth, you have to be concerned about the mental health of anyone who volunteers. So, and then there was a fifth, that you have to have solid law enforcement contacts before you start the work, because doing this and not having a place to put the case, it’s a waste of everyone’s time and mental energy. So when I formed ILF, we built some technology, some proprietary technology, that’s called a virtual desktop interface, where our people can log into that and safely do the work where everything is blurred, they don’t download anything, and they can do all their research on this machine, so it’s never touching their home machine. Second, we hired a therapist at ILF and we mandate therapy. So if you work on this, you have to see her at least once a month and you have to talk to her about what’s going on. It’s a real therapist. She can’t come back and tell me what you’re talking about. It’s to keep the people safe and to keep the organization safe. And then third, I worked hard and long to build long-lasting law enforcement contacts. And we’ve successfully done that. We work in the US, we work with DHS, FBI, Army, CID, and local police around the country. And we have police connections in many, many countries across the globe from South America and Europe and all over the place. So we were able to tighten that down early on in our organization, which made us very effective. And a lot of times you don’t see nonprofits last so long. We’ve been about seven and a half years going on eight years, and we’re over 568 cases that we’ve handed into law enforcement agencies around the globe. In how many years? Seven and a half years. September of 2025 will be eight years. Give me that number again. 568 as of today, I think.

Hugh Ballou:
Nick, that’s a good number. It’s just the tip of the iceberg though, isn’t it?

Chris Hadnagy:
It is. The hard part and I have to tell my people this all the time, you have to be happy at what you’re doing. And you can’t look at that 36 million image number and say, well, what is 568? That’s not even a fraction. I get it. But if you think about how a serial child predator could affect anywhere from 12 to 100 children, every time one of these people gets arrested, you may have stopped 100 kids from being harmed. You may have stopped the production of child abuse material for 100 kids. So that alone, yes, I know that number’s huge and I know we’re not gonna wake up someday and it’s gonna be gone. I understand that’s not our goal. Our goal is how many predators can we stop. How many kids can we give a safe future to? And how much time can we save our hardworking men and women in law enforcement so they can get to the end much faster?

Hugh Ballou:
It’s huge. So when I hear the numbers, I’m thinking, what’s the use, what difference can I make? And you just answered that. You just answered that. So when you bust somebody and they get arrested and go to jail, you’re saving a whole bunch of children.

Chris Hadnagy:
whole bunch of children. And we’re also stopping a production line. So if you think about this, if this guy is producing child abuse material, which means he’s hurting kids or trafficking kids, and he’s filming it, when he goes away, that production line stops. So every time we do that, and if we can shut down a website on the dark web because law enforcement gets involved, well, then we shut down a whole production site. Yes, I know someone’s going to say, well, they’ll open it up again somewhere else. I know that’s true. But if we can interrupt the supply chain, even for a short period, that short period, kids are safe for that. So I’ll take it. I’ll take it as a win, not realizing that I’m never going to solve the problem 100%. That’s a much bigger issue, but I’ll gladly be part of the solution in the meantime.

Hugh Ballou:
Well, So what is your call to action for people that are listening? So first, I want you to go back over the things that people do wrong first. You told us a little bit, but tell us more. People do things the wrong way, and then it’s not effective.

Chris Hadnagy:
Yeah. So first from a, from a, like you said, this is a passion of yours and you want to get involved. Uh, there’s a lot of groups up there that do this thing where they set up sting operations and they go on, they go online, they make believe they’re an underage girl or boy. They, they get a little flirtatious. They get these guys to then agree to send pictures, which is illegal. If you think you’re sending a nude picture to a minor, that is a crime. And then you make a meeting, a meeting spot. I’ll meet you at McDonald’s at this time, 4 p.m. after school. And then when they get there, they film these guys and they humiliate them. Sometimes they even physically abuse them. They assault them. We’ve seen many of those type of videos on YouTube. Then they take that to the police and it goes nowhere. Mainly because, one, they could be arrested for physical assault. I mean, you just beat somebody up. Yes, I know they’re a bad person who was going to have sex with a child, but you assaulted somebody. That’s a crime. One crime does not make another crime better. Second, is you entrapped and enticed? So any lawyer is going to get that case kicked out. So we tell people if you want to do this right, think about it. What we did is we sat down with law enforcement and we said, what would we need to give you so our cases were usable by you and they can make a difference? And they gave us their laundry list of wants and needs, and that’s what we focus on. Is it cool to go do undercover work? Sure, it sounds like it’d be a lot of fun and cool and might even give you that adrenaline rush. But my goal is not to feel cool. My goal is to stop these predators and help law enforcement with their job. So that’s the major thing we see people do wrong. And the second is you can’t view these images even if you’re on the good side. So I can’t tell federal law enforcement, but I’m helping you. That’s why I have all these images downloaded. It’s still a federal crime and the only people who are authorized to view those images are authorized federal and local law enforcement agents. So they’re given the authority to – sadly, they have to view those images for forensics and discovery and things like that. We don’t so I don’t need to see them to stop that predator. All I need to know is this guy’s product He’s a producer now I can go find him and we can stop him So I don’t need to view those images once he gets arrested Law enforcement will need to view those images to prove their case, but I don’t need to do that So those two things are the big major things that we see people who are passionate about this make mistakes in doing It would occur to me that it was also taking this on your own could be very dangerous.

Hugh Ballou:
I

Chris Hadnagy:
You know, if you think about it, the large majority of abusers are indeed perverted family or friends of family. That is true. But there’s a massive, massive organized money-making machine when it comes to child abuse material. So, sometimes they’re funded by terrorists, sometimes they’re funded by cartels, sometimes they’re funded by gangs. So, the trafficking of children, especially around things like the Super Bowl or the World Cup, we see heavy trafficking of children into massage parlors and things in the cities where those are held. Those are generally organized by some kind of organized crime unit. So yes, me going out like some kind of Batman vigilante, I’m gonna get myself killed, right? So this is why with ILF, you won’t see our name on any case. You won’t see a sticker that says arrested by ILF. We give our cases to law enforcement. We talk about how good it feels and what we did, but we don’t talk about the who, where, and when. I don’t want my name on some of the cases that we’ve done because I know where they’re connected. So I’m happy to be in this background and just to have the spotlight on law enforcement for doing the job they’re doing. That man vigilante.

Hugh Ballou:
You’ve heard it right here. That is not you, folks. So, I usually wait until later to talk about the website, but I think we need to go there now because going to the website helps people deal with this. Am I right? Yes. So, some people are watching, but other people are going to be listening to the podcast, so they can’t see it. But let me give you the URL. If you are listening or you’re watching us on Facebook, you can go to the T-H-E, Nonprofit Exchange, thenonprofitexchange.org, that’s O-R-G. You can go there and you’ll find all of the episodes listed, including this one. And just remember that the title of this one is Behind the Mask of Social Engineering. And you just talked about the cartels and the money people that are behind some of this. But golly, golly gee, it’s in our neighborhoods, isn’t it?

Chris Hadnagy:
Yeah, it is.

Hugh Ballou:
It’s everywhere. I’m sorry, I talked over you. We’re going to go to innocentlivesfoundation.org, and I’m going to show it on the screen for those watching. And if you go to that link that I gave you, thenonprofitexchange.org, you’ll be able to see the transcript of this, plus you’ll be able to see the website. You can go to the website directly. So, Chris, when people go to the website, what will they see?

Chris Hadnagy:
There’s a lot there, right? So first, for parents and caregivers, we have a lot of information on how to talk to your children about these very difficult topics. A lot of times we find that parents don’t have that conversation until after something happens because they’re afraid or they don’t know how to bring it up or they think, are they too young? Well, there are age-appropriate ways to talk to your children about this difficult topic and make them feel safe. If your child falls for something, what they need is an advocate, not an adversary. So saying something like, how stupid could you be, or how could you fall for that, is going to make shame and guilt even worse. So we have a lot of info on there for that. Second, we have a report a case. So let’s say you’re a parent and your child fell off a trap and you took it to local law enforcement and they said they couldn’t help. They didn’t have the resources. They didn’t know what to do. You could come here and report that case to us and we will get federal law enforcement involved. We’ll help do the research and see if we can locate the person that hurt your child. So there’s things there. We have a wonderful woman, Dr. Abby Morono. She’s a volunteer also at ILF. She writes articles about shame and guilt and dealing with the aftereffects of being abused. So if you’re someone who’s been through this, sadly, and you’ve had to deal with this, there are articles there on how you can use that shame and guilt to motivate yourself and not beat yourself down. There’s a lot on the site. Is that the blog? It is yeah, there’s a blog section and then there’s one on the blog called the Doctor’s Corner So yeah, go there, and then the Doctor’s Corner got it I’ll make sure people can find it because there’s a lot of good stuff Wow Okay, work in process says Abby.

Hugh Ballou:
She’s been on our show. Oh

Chris Hadnagy:
And then you can see all these, you know, don’t tell me how to grieve. I knew we’d come back. These things are articles that Dr. Abbey as a scientist and as a researcher and also as a victim, as a survivor. That TED talk that she gave is a powerful talk that people can watch and realize the shame that she went through and how she ended up dealing with it and battling it to make herself stronger. So really on the website, there’s a plethora of things that people can find as resources, whether they’re a parent, caregiver, law enforcement, a child, or anyone in between.

Hugh Ballou:
So earlier, you told us things that we were not supposed to do. like we can’t look at the picture. So then there’s this whole dark web. So if we have any suspicions to go in there and report a case, even if it’s, we’re not sure about it, I mean, at what stage should somebody report it to you?

Chris Hadnagy:
So we’ve had people come and report because they were browsing online and they were in some Telegram channel or Discord channel and someone posted child abuse material. So they did see it. I’m not going to report them, right? I know that was a mistake. They come there and they say, hey, this user on this date and this channel, they posted some images. Then again, we have had parents come who their child has been groomed or sextorted and they come to us to find help how they can get that taken care of. So really you can report anything and we’ll gladly answer if we feel it’s not something we can action on. We’ll come back to you and say we really can’t do anything about this because there’s not much that we can do without law enforcement. We should take this to your local police. We’ll even try to give advice if there’s nothing that we can do. But really, it’s better to be safe than sorry. So if you have something you think your next-door neighbor’s kid is being abused or something like that, we have to have, of course, something that can’t just be an intuition. But if you feel that you’re seeing things like that, we can point you in the right direction.

Hugh Ballou:
Well, I’m going to go back to the website again, because there’s some more stuff relevant to that that you’re talking about. So the Resources tab, I pulled down the Resources tab. So talk a little bit more about this under Reporting, and then I’ll scroll down.

Chris Hadnagy:
Yep. So we have a button there, as you can see, to the left, where if you could find a local emergency number, you click that, it can take you anywhere, tell you where you’re at, and it will say, here’s your emergency number for your area. Next, we have a direct link to report to, if you’re in the United States, to report to NCMEC. That’s a cyber tip line. But if you’re not in the U.S., we also have a button that you can report anywhere else in the world if you are a victim or you know someone who’s been groomed or you found images. And if none of those things worked or you want to, the last button is reporting to us. And we put those three things first because we know that we’re not law enforcement. So we will help you if law enforcement can’t. or if you didn’t have a good reaction from law enforcement, we give you those links so you can first take that action if you feel that it’s necessary to go to them before you go to us. You know, we have a whole mental health resources. What we try to do, of course, is a lot of times, and sadly in this country, I think in the last couple of years, we’ve had close to 40 suicides from teenagers who have been sextorted. So we like to give information out about suicide prevention, drug rehab, a lot of teenagers that are groomed and then subsequently hurt or end up using substance abuse. So we like to put that stuff out there and we’re big proponents of seeing a therapist and getting mental health. If you’re a parent or a caregiver listening to this and your child has been through something like this, besides calling law enforcement, one of the first things you should be doing is getting your child into therapy. That would be the first thing I would do.

Hugh Ballou:
You’ve used the word sextorted a few times. Can you explain it to somebody else like me?

Chris Hadnagy:
Yeah, so extortion is something relatively new. It’s where someone chats with your child and they make believe that they’re a similar age child. So they’re another 14-year-old girl or boy and they start to flirt with them and it becomes a relationship where they ask for a nude picture. And they get the person to send a nude picture or video of themselves. As soon as they get that, that’s when they reveal that they are not a child, that they’re a 36-year-old man. And they tell the person, you’re now going to do some things. So the sextortion goal is either you’re going to go steal money from your parents like you’re going to give us credit card numbers, and we’re going to take money from them. or you’re going to continue to perform sex acts on film so we can sell them. And if you don’t do those things, we’re going to send these pictures and videos to your father. We’re going to post them on Facebook. We’re going to humiliate you. It’s a very, very gruesome method of hurting children because, like I said, we’ve had close to 40 suicides in this country. And that’s just this country. I know in other countries, there’s many, many more high rates of teen suicide and preteen suicide because of this.

Hugh Ballou:
Right, Jake?

Chris Hadnagy:
Yeah.

Hugh Ballou:
So you’ve given us a lot of powerful information. You’ve led us to your website. If people can’t find what they need on the website, is there a contact button on there for them?

Chris Hadnagy:
There is. There’s a contact button, and you can also reach out to me on LinkedIn. Like you, we are a 501c3, so we’re always looking for support from people who are passionate about this mission. So you can reach out to me personally or on the website. You can reach out from the contact us, and we’ll be happy to get with you.

Hugh Ballou:
So do you deal with it, I’ve read where parents are with children in public, and the children get snatched from them. Do you deal with anything, any safety issues like that? How do we prevent that?

Chris Hadnagy:
Really, it’s just being very self-aware with your child. And if your child’s going to walk away from you, like they’re going to go use the bathroom, depending on the age of that child, I would not let that happen alone. For me, and maybe because of the work I do here, but my daughter’s 20 now, so of course she’s old enough. But when she was little, we never let her roam around without having eyes on her or being close to us, because it could take a second for that to happen. Literally, they can nab them and they could be gone. If that happens, call law enforcement right away. If you’re in the U.S., dial 911. Don’t wait a second. You call right away and you get them involved because that is the quickest way to get your child back is to get them involved.

Hugh Ballou:
Now we think, oh no, I live in a quiet neighborhood. That doesn’t happen here. What about that?

Chris Hadnagy:
It’s sad. A lot of people think that. I thought that 10 years ago. I thought, well, it’s not happening where I live. And then to my surprise, you know, doing this job, we found somebody who was doing horrific things to children and filming it. Sadly, this is a huge problem and I mistakenly thought this only happened in third world countries. It is very much a first-world problem. My wife is from Thailand and we went back to visit her family and I landed in Bangkok and I got into a taxi and this guy hands me a book and it’s pictures of naked children. And I’m like, whoa, why do you do this? And there’s a number and you can order any one of them and they’ll be sent to your hotel room. And I asked him, why are you doing this? He says Americans, Americans love this. I was, of course, disgusted, but he said it plain and clear. This industry exists because of first-world people who are interested in hurting children, and it’s getting younger and younger every year. So it is not just in bustling cities. It’s in quiet neighborhoods. It’s all around the country here, and it’s all around the globe, and it’s growing.

Hugh Ballou:
That is so amazing. So this is a very informative interview, and our 25 minutes has just gone flying by. What do you want to leave people with, a call to action or thought?

Chris Hadnagy:
A call to action. You know, we want to continue this mission. So if you want to support us, we are a 501c3 so we can use donations. If you think you have the skill set to help us with the research and you want to join and volunteer, you can also do that. And if you are a parent listening, I strongly encourage you to have a conversation with your child way before something happens to them. Make it clear to them that if something happens, they can run to your arms for help and safety, and they won’t have to feel shame, they don’t have to feel embarrassed that they’re going to be punished. Just have that conversation now before something happens.

Hugh Ballou:
Chris Hadnagy, thank you so much for being my guest today on the Nonprofit Exchange. You’ve really opened my eyes to how big this issue is. Thank you. Thank you.