---
title: "White hats and the Vastaamo extortion | Juho Ranta | Negotiator 42"
titleOriginal: "2NS-Valkohatut ja Vastaamon kiristys | Juho Ranta | Neuvottelija 42"
episodeNumber: "42"
guest: "Juho Ranta"
datePublished: 2020-10-26
duration: "36:24"
youtube: "https://www.youtube.com/watch?v=oFFR4exAbCI"
captionsVtt: https://www.neuvottelija.com/podcast/episodes/ep42-2ns-valkohatut-ja-vastaamon-kiristys-juho-ranta/captions.en.vtt
captionsSrt: https://www.neuvottelija.com/podcast/episodes/ep42-2ns-valkohatut-ja-vastaamon-kiristys-juho-ranta/captions.en.srt
originalLanguage: "fi"
topics: ["ai_enterprise_tech","free_speech_society"]
subtitleMethod: "none"
provenance: "Owner page assembled from the MacWhisper SRT transcript, YouTube metadata and the neuvottelija.fi episode record. Chapter timecodes are taken from the transcript; no caption files are published with this page."
fiCanonical: "https://www.neuvottelija.fi/fi/episodes/48-neuvottelija-42-2ns-valkohatut-ja-vastaamon-kiristys-juho-ra"
canonical: https://www.neuvottelija.com/podcast/episodes/ep42-2ns-valkohatut-ja-vastaamon-kiristys-juho-ranta/
---
# White hats and the Vastaamo extortion | Juho Ranta | Negotiator 42

## Chapters

- [00:00](https://www.youtube.com/watch?v=oFFR4exAbCI&t=0s) A case unique in Finnish scale
- [02:31](https://www.youtube.com/watch?v=oFFR4exAbCI&t=151s) The Twitter hack and what phishing means
- [05:06](https://www.youtube.com/watch?v=oFFR4exAbCI&t=306s) White hats and black hats
- [07:36](https://www.youtube.com/watch?v=oFFR4exAbCI&t=456s) Tor and the two sides of anonymity
- [10:10](https://www.youtube.com/watch?v=oFFR4exAbCI&t=610s) Bitcoin and operational security
- [12:44](https://www.youtube.com/watch?v=oFFR4exAbCI&t=764s) GDPR: legitimate interest and misunderstandings
- [15:26](https://www.youtube.com/watch?v=oFFR4exAbCI&t=926s) Security as a whole, not a single system
- [17:58](https://www.youtube.com/watch?v=oFFR4exAbCI&t=1078s) Passwords and two-factor authentication
- [20:41](https://www.youtube.com/watch?v=oFFR4exAbCI&t=1241s) Three identifiers: email, phone and identity number
- [23:12](https://www.youtube.com/watch?v=oFFR4exAbCI&t=1392s) Can a Finnish identity number be renewed?
- [25:42](https://www.youtube.com/watch?v=oFFR4exAbCI&t=1542s) Strong authentication, Estonia and deepfakes
- [28:16](https://www.youtube.com/watch?v=oFFR4exAbCI&t=1696s) For companies: the business owns the risk
- [30:53](https://www.youtube.com/watch?v=oFFR4exAbCI&t=1853s) Notification duties and contradictory instructions
- [33:28](https://www.youtube.com/watch?v=oFFR4exAbCI&t=2008s) Do not pay, and do not read the leaks
- [36:00](https://www.youtube.com/watch?v=oFFR4exAbCI&t=2160s) Crisis as an opportunity to improve

## Summary

Second Nature Security CTO Juho Ranta unpacks the Vastaamo data breach and extortion while it was still unfolding: what white hat and black hat actually mean, why Tor and bitcoin are double-edged in the same way, and why you should neither pay the extortionist nor read the leaked files. The episode also covers common misunderstandings about GDPR, password practice and two-factor authentication, the three identifiers of which only two can be changed, and why security has to be run on the business's terms rather than by staring at a single system.

## What is discussed

- **Why this case is different.** Ransomware and ransom demands have appeared in Finland before; what is unprecedented is the sensitivity of the data and how directly it reaches ordinary people. Both men stress the company and its customers are all victims of a crime.
- **Phishing, explained.** The victim is tricked into surrendering credentials by mail impersonating a delivery firm, the police or the postal service — as in the summer 2020 Twitter breach, where a 17-year-old obtained admin access and ran a bitcoin scam through Musk's and Obama's accounts.
- **White hat versus black hat.** Identical tools and methods; the difference is a client engagement and responsible disclosure. Ranta concedes the line blurs for state intelligence services on both sides.
- **Tor.** Born from a US Navy-supported anonymisation project; the onion structure hides source and destination, which serves dissidents in dictatorships and criminals equally.
- **Bitcoin and OPSEC.** Anonymity depends on how it is used; converting to euros leaves the trace. The Twitter teenager failed at this, the Vastaamo extortionist used a separate wallet per target. Volatility and settlement time rule bitcoin out as an everyday currency.
- **GDPR is misunderstood.** Recruitment creates a legitimate interest, so an applicant cannot demand deletion mid-process. The aim was to bring member states onto one line — Finland's old act already required much of it — and the EU–US transfer arrangements collapse and restart every few years.
- **Security is a whole.** A clinic leaving a patient record system open in an empty room is the same category of failure as a database flaw. Focusing on one system leaves large gaps unseen.
- **The business owns the risk.** Security management is done with the business, which makes conscious decisions about which risks to accept, because it is the business that takes the hit in revenue and profit.
- **Three identifiers, two replaceable.** Email, phone number and identity number are all exposed for victims. A secret must be replaceable — and Finland's identity number is not, which is why identity theft risk persists and reform, though important, is a multi-year and expensive project.
- **Do not pay, do not read.** Payment guarantees nothing and invites a second demand; reading the leaked files is itself a crime and strengthens the extortionist's leverage. The closing analogy is aviation, where learning from accidents produced exceptional safety.

## Watch

The recording lives on the Neuvottelija channel: [2NS-Valkohatut ja Vastaamon kiristys | Juho Ranta | Neuvottelija 42](https://www.youtube.com/watch?v=oFFR4exAbCI).
A Finnish edition of this episode is published at [www.neuvottelija.fi](https://www.neuvottelija.fi/fi/episodes/48-neuvottelija-42-2ns-valkohatut-ja-vastaamon-kiristys-juho-ra).

---

Cite as: Sami Miettinen, Neuvottelija — White hats and the Vastaamo extortion | Juho Ranta | Negotiator 42, https://www.neuvottelija.com/podcast/episodes/ep42-2ns-valkohatut-ja-vastaamon-kiristys-juho-ranta/, 2020-10-26. For quotes include episode 42 and timestamp.