From a teenage life marked by cyberattacks to a career in digital security, Daniel Nascimento has seen his journey go through several different chapters — eventually reaching the big screen. In this interview, the Brazilian hacker talks about money, the boundaries he set during the period when he carried out attacks, the evolution of cybercrime, the vulnerabilities that continue to put people and companies at risk, and the experience of seeing his own story portrayed in the film “O Rei da Internet” (“The King of the Internet”).
In many of your interviews, you say that you do not regret what you did and even say that you would do it all over again. Without going into details that could encourage or facilitate new crimes, when you look back at that period today, where do you think you went wrong and what would you do differently?
Look, that is a very interesting question and, at the same time, a very complex one. I don’t know what I would change. I don’t think I would change anything, actually. I wouldn’t do anything differently.
Considering the time, the circumstances, my age, the adrenaline I experienced — it was a combination of factors, and I wouldn’t change any of them. I don’t think I made a mistake. I think I evolved. I think everything I went through was a stage in my evolution that brought me to where I am today.
So, in my opinion, you can’t be hypocritical and say that you regret something that, to me, wasn’t really that harmful, you know? It wasn’t something that negative. Nobody lost anything, nobody had problems, anyway. And considering that it was a very, very early time, when technology was still very rudimentary, I wouldn’t change anything.
I don’t think I made a mistake. I think it was part of a continuous evolution that brought me to where I am today.
In an interview, you said that you followed certain principles, such as not attacking certain types of victims. Were those boundaries entirely personal principles, or was there some kind of code of conduct, even an informal one, within the community you were part of?
Yes. Look, there is this whole question of communities and so on, but everyone is free to do whatever they want.
Most people, at least back in my time, had their own principles. Some had that principle; others even had the principle of not committing bank or credit card fraud, despite having the knowledge to do it. They chose not to. So it was somewhat divided.
Now, this is a principle that I carry with me. I have contact with many people in technology, and there are people who want to do the wrong thing. I don’t encourage it, I don’t support it, but I also don’t necessarily say that the impact is my responsibility, because everyone knows what they’re doing, right? Everyone has free will.
I usually joke about it like this: I can teach you how to shoot. You learn how to shoot, but you’re the one who is going to buy a gun and shoot someone, man. Not me. That’s your responsibility. There’s no crime in teaching someone how to shoot. A person can shoot for good or they can shoot for evil. I know it’s a rather extreme example, but, well, this is also an extreme subject.
I think that kind of code of conduct comes more from the individual. In other words, yes, I have that principle within me.
You became wealthy at a very young age, and many teenagers share that same ambition of achieving money and independence quickly. Based on your experience, can money, while providing freedom and satisfaction, also become a kind of curse?
It’s like I was saying in the previous question. Let’s use a better example: you give someone a fishing rod. Now it’s up to that person whether they’re going to catch a fish, a shark, whatever they want — even an endangered fish. It’s up to each person.
I know it’s a story that makes teenagers want to see themselves in that situation, but at the same time, the story also shows the consequences. The story is there. The consequences are there.
That’s the thing: when you’re a teenager, the hard part is that you don’t measure the consequences. You just go for it. So the consequences are there — everything I had to do, everything I paid for, everything I still carry with me today.
And yes, definitely, it’s a kind of… I won’t call it a curse, but it’s a life that… For example, I developed several problems. I have panic disorder. I have difficulty going out. I have difficulty interacting in groups. I have a number of issues. I take a lot of controlled medication. I take care of my mental health because I have insomnia, acute insomnia.
So there are a lot of things that developed in me because of the blows I took, the adrenaline and, many times, the fear. The fear of being kidnapped, the fear of being in a hotel and having the police storm in. A lot of things.
Especially when you’re a child — I consider a 16-year-old, at least back in my day, to be a child. Things are more advanced today. I’m not saying I was innocent, but I’ve always said this.
Changing the subject a little, I’m actually amazed by how hypocritical people can be. They point a finger at someone who is putting himself out there, saying: “I did it. Yes, I did. So what?”
The guy downloads pirated music, downloads pirated movies, evades income tax, refuses to provide his CPF for the receipt, does a lot of things that are wrong, runs a red light, parks in a space reserved for elderly people. But then these are the guardians of… How do you say it? Morality.
And if they had had the opportunity, the option, at that age, at that time, to do what I did, wouldn’t they have done it? Or are we going to continue with the hypocrisy?
To finish answering the question, I don’t think it’s a curse. I think it’s one step at a time. I can’t see it that way. As I said, what brought me here is a reflection of my past. Period.
To this day, you are considered one of Brazil’s best-known hackers. Although you say that you don’t regret your journey, today you work precisely to protect companies from attacks similar to those you once carried out. Besides the professional offer you received when you were 16, was there another decisive factor behind switching sides?
It wasn’t an offer. It wasn’t an offer, no.
One day, I received a kind of invitation to have my biography written, and before that biography was written, I was warned that my life was going to change, that I would be exposed.
“Man, you’re someone who has panic attacks, you’re someone who has anxiety, you’re this, you’re that. Are you going to be able to deal with this?”
Then I thought: “Well, to me, it’s a book that’s not going to… You know? It’ll just sit there. At most, the family will read it, and that’s it.”
I didn’t really believe the book would gain enough attention to eventually become a movie.
Well, to me, it’s a book that’s not going to… You know? It’ll just sit there. At most, the family will read it, and that’s it.” I didn’t really believe the book would gain that much attention, to the point of eventually becoming a movie. And now, just 10 or 12 days after its release on Globoplay and Prime Video, we’re among the Top 1 most watched — not only among Brazilian films, but international films as well. And now the rights have been sold for the movie to be produced in the United States and Canada.
I think that was the factor. It was that proposal, which was very difficult. I thought about it a lot, but because I like challenges, I said, “I’m in.” And suddenly it turned into a level of exposure that was beyond my control.
I remember that when I was invited to appear on Danilo Gentili’s “The Noite,” three months after the book was released, it started to sink in. I thought, “Uh-oh…”
Then some film directors started calling, already familiar with the story and interested in making a movie about it. There was more than one proposal to turn the story into a movie, but it was produced by Fabrício. Thankfully. Fabrício is a great professional, and today I see that he really is the guy — he’s the guy to make this movie.
Although stories involving hackers have existed for decades, cybercrime is still perceived by many people as a relatively modern form of crime. In your view, is crime increasingly moving from the physical world to the digital one, or will these two worlds continue to coexist and even complement each other?
Look, cybercrime, as you said, has always existed, ever since computers have been computers. We have to pay attention to this question and know how to distinguish one thing from another.
One thing is a scammer who picks up a phone and tricks you into falling for a scam so they can make a Pix transaction using your account. Another thing is someone who breaks into the Pix system and makes the transaction.
What’s happening? Today, scammers are innovating a lot in order to commit fraud. So, for example, a guy bribes someone who has access to a system, gets that person’s username and then uses the credentials of the person who was bribed. That’s more or less how many crimes are working today.
And then, when the person is arrested, the media says: “Hacker…” That’s a major mistake in Brazil. Brazil doesn’t even know how to distinguish the word “hacker” from “cracker.”
So they arrest the guy, but what did he actually hack? What did he study? What does he understand about technology? Nothing. But he has the street smarts, the cunning to pay someone, get somebody’s password and then pretend to be a hacker.
It happens in the Brazilian judiciary as well. There are a lot of passwords that I know about, that I’m aware of, belonging to judges, courts and who knows what else. Then the guy goes there, gets the password, issues a warrant or does something like that, and the media comes along and says: “Hacker so-and-so.”
No, man. The guy didn’t hack the justice system. He simply bought an intern’s password. So this issue has to be looked at very carefully.
Another thing is that crime is, in fact, moving more toward the digital world than the physical one. Well, think about it: how much money does cybercrime involving banks move today, and how much money does armed bank robbery move?
Money is disappearing. Paper money is disappearing from circulation. Everything is virtual, everything is digital. So naturally, cybercrime is going to grow more and more.
Today, there is an enormous amount of information about scams and digital security. The main types of scams are discussed by the press, banks, companies and experts, and yet people of all ages — and even major companies — continue to fall victim to them. If we know so much about these scams, why do we keep falling for them?
It’s like I told you. First, there’s the innovation in social engineering, as I was saying about scams in the previous question.
And the second thing is, you know what happens? A company, an individual, thinks they’re never going to be hacked. People don’t take precautions.
For example, in everyday life I see people plugging cables into their phones at airports without imagining that the cable could be a spying cable. I see people not using two-factor authentication. I see people leaving their phone screens unlocked without a second thought. I see so many mistakes.
Wi-Fi: you go around connecting to any Wi-Fi network you see — at the coffee shop, gas station, bakery, gym. People aren’t aware that they could fall victim to an attack there, you know?
I’m talking about a hacker attack, okay? I’m not talking about a scammer. People aren’t aware of that.
So it’s difficult. You talk about it over and over, but in the end it’s: “Man, okay, fine, but me? What hacker would want to hack me?” That’s how people think, you know?
Of course, you have selected targets. That’s when you direct an attack at a particular company or a particular person. But 90% of the time, that’s not what it is. Ninety percent is random. You throw out the bait, and as long as the fish keep biting, you reel them in. You know?
So you’ve got 100 fish in the lake. If ten bite, you get ten. That’s more or less how it works.
What is really missing is people’s awareness of this. Security awareness. Understanding that yes, this can happen to them.
Does having been on the other side allow you to identify vulnerabilities that a security professional with a more conventional background might not notice? How much of the hacker you once were still exists in the professional you are today?
Having been on the other side does allow me to have a better and broader understanding of hacking. Why?
First, because I understand a little of what the person feels, what that sensation is like. Second, at many lectures, debates I’ve taken part in — panels, actually — there’s always that professor, that PhD who knows everything.
But what’s the point of him knowing so much, maybe even more than me or my team? What’s the point of that guy having so much theoretical knowledge if he’s never hacked anything? You know?
Then the guy comes along talking about code, systems, everything you can imagine, but he’s never hacked anything. And the biggest breaches I’ve ever seen in my life were simple. People think it’s like “The Matrix,” you know? It isn’t. They were simple.
I’ve seen small breaches that are much harder than a major one. So the bigger the system, the more vulnerable it is.
When you’re talking about a major breach, let’s say it’s a large corporation with 50,000 employees, 500 terminals, a thousand terminals, 30 servers. Look at the size of what you can explore.
Then you say: “No, I’m going to rob… Sorry, I’m going to hack the little grocery store.” The grocery store has four checkout counters and one computer. It’s much harder, you know?
But that’s a feeling that only someone who really is a hacker — in my case, a cracker, hacker, anyway, which I was — and others out there can identify.
The difference is that I put myself out there. The others don’t. So I’m here, you know? The others don’t do the same thing. I think, for me, that’s it.
True stories adapted for cinema inevitably undergo changes and dramatization. In the case of “O Rei da Internet,” how much of what we see actually happened to you, and how much was changed or dramatized to work on screen?
Look, the movie does in fact follow the timeline perfectly, exactly as things happened, but the scenes change and the characters within those scenes change.
So, for example, the way the school is portrayed… I was bullied, but maybe more, maybe less, you know? Not to that extent. I think the bullying I experienced was more psychological than the kind involving so much physical violence that you see in the movie. There’s a lot of action.
I didn’t have such intense clashes with my father. Although we argued a lot — we used to argue a lot, and we still argue today — it wasn’t quite like that. I can’t recall those kinds of clashes.
But my father and I did fight, yes. Well, it wasn’t exactly that we fought; we didn’t understand each other. And my father never accepted what was happening with his son. I was kind of rebellious, and that’s how things went.
That woman they put in the movie who says “good evening” and all that, regarding the virginity thing — that didn’t exist. The guys were trolling me. Yes, I lost my virginity to a sex worker. That’s true, and it happened in Porto Alegre, but it wasn’t the way they portrayed it. She was younger, okay?
What else? I don’t know. I’d have to go through the scenes. I think there’s a scene where someone punches Muralha, something like, “I’ll give you this much, I’ll give you 10,000, 5,000…” I don’t remember. I’d have to watch the scene again. I don’t remember that happening. I don’t think it happened.
But there really was a guy called Muralha who provided security for the group and looked after the boys — me, in particular — quite a lot. I actually ran into him, the real person, in Rio de Janeiro a few months ago. I met him. He’s still around today. He’s one of the few people from that period I’m still in contact with.
I’m saying all of this as the timeline comes back to me. I think the Telemar attack, when the Northeast went without internet for a week, is one of the most perfect scenes in the movie.
João Guilherme, playing Daniel, at the piano while everything is happening… Him explaining it technically, step by step — it was perfect. Honestly, a ten out of ten. I think he performed the attack even better than I did. It was very good.
So that’s it. I’d have to watch the movie and go through it step by step. Because, to be honest with you, I can’t watch the whole movie. I watch it in parts, because seeing yourself in a story is very difficult — at least for me.
Because you’re watching yourself there and you feel embarrassed, almost as if this weren’t really happening, you know? It’s like watching my own interviews. I don’t watch them. I can’t.
But to give you a better answer, I’d have to watch the movie scene by scene and respond to each part individually.
The timeline, based on the three or four times I’ve watched it in parts and what I remember because it’s my story, really does follow the course of what actually happened.
Some scenes are more dramatized or changed; some are exaggerated more, others less, so the audience becomes engaged with the movie. That’s normal in any story.
Follow Daniel Nascimento on Instagram
