She’s a professional con artist, a burglar for hire, a world-renowned social engineer, a TED Talks keynote speaker and, as her namesake suggests, a people hacker. She is, of course, Jenny Radcliffe. She also happens to be a great storyteller, so the pressure is on Eleanor Dallaway to tell her story, and tell it well...
Sorry, this isn’t a very good interview so far! I’ll be better in a minute. Go on, keep going.” These are the words of the people hacker, Jenny Radcliffe, about five minutes into our interview. I’m taken aback by her honesty. She’s right, though.
The interview takes place on Microsoft Teams, or at least it should be. Technology lets us down, so we end up on FaceTime with my phone balanced precariously on the bookshelf next to my desk as I type frantically, trying to keep up with Jenny’s speedy, typically Scouse, dialogue.
Virtual interviews are not my cup of tea. This is only the second time ever that I’ve conducted a profile interview virtually (cheers, COVID) and, five minutes in, I remember why I don’t like to do it. Jenny’s analysis of the interview to date exposes a vulnerability in what initially strikes me as an otherwise tough exterior.
Unlike virtual interviews, Jenny is my cup of tea. She’s honest, she’s funny, she’s sharp. I like her a lot, but today it seems like her guard is very much up. I’m getting one-word answers, tight-lipped smiles and nods. It strikes me that, in a way, journalists hack people when they interview them. We try to gain access into someone’s psyche, to their essence. Right now, it seems like ‘the people hacker’ is pretty unhackable, and I think that’s rather poetic.
It’s hard to imagine any Infosecurity reader returning a blank stare when they hear ‘the people hacker.’ Jenny Radcliffe is a household name, in our industry anyway, a world-renowned social engineer or “professional con artist and burglar for hire” as she puts it. Jenny’s consultancy, Human Factor Security, offers security assessments, penetration testing and training. She contends that most people associate her with social engineering but counters, “I also do other things like surveillance and investigations.” More on that later.
So back to the interview. We’re doing an awkward slow dance of the ‘needs must’ questions when something shifts. I ask her about young Jenny, and despite initially worrying that “I feel like I will be boring people to death,” gradually as Jenny introduces me to the younger version of herself, her walls come down, her smile gets warmer and we start to laugh, really laugh.
“People have this impression of me, and I suppose it’s my fault, of being this sort of poacher-turned-gamekeeper,” she grins. “I am quite rebellious in terms of corporate stuff, I don’t subscribe to any set of rules or anything, which is why I work for myself, but actually, I was a really good girl.” She describes herself as “swotty,” achieving good marks in most subjects and being well-behaved in the classroom. Emphasis on “in the classroom.” I raise my eyebrows, willing Jenny to explain why she is adding that addendum. She complies: “School was just one part of my life; from a young age, I had an exciting hobby and was out doing all that security stuff, so of course, I could be well-behaved at school.”
It’s the first time I get a glimpse of her two different personas. A good girl at school, a rebellious girl on the streets.
We’ll park “all that security stuff” momentarily. Back to school, as Jenny explains she didn’t find school too challenging thanks to her excellent memory, which served her well in exams, and her natural aptitude for almost all subjects, excluding maths which she considers “a shame as it would have helped the technical bit.” She read a lot and never felt out of place.
The Streetwise Kid
So far, so uneventful, right? Things took a turn when, at the age of seven, Jenny was – for want of a better word – kidnapped by a 17-year-old neighbor. “She locked me in her house and didn’t let me go. She didn’t physically hurt me, but she meant me real harm, put me through an ordeal. She played the same song over and over again, she wouldn’t let me go to the loo and when my mum came to look for me, she had her hand over my mouth.” I’m still trying to pick my jaw off the floor when Jenny commits to sending it straight back there.
“Not long after that, I walked home through an alleyway on the way back from the shop, and all these boys, local kids, surrounded me to beat me up, and I had to fight my way out.” That she did, by splitting her can of Tango in half. “I shook it, blew it up in the guy’s face and hit him over and over on the head with it until he had blood and Tango coming down his face. He fell to the floor, and I ran.”
In the wake of these two shocking events, Jenny’s parents concluded that she needed to be more streetwise. “I had hundreds of cousins, loads of family and people who were almost like family, big gangs, who were getting in and out of all the empty buildings in Liverpool, England, doing these horrible, terrible dares. I was hanging out with them and mum and dad were busy and thought I was fine.” Jenny pauses but quickly adds, “it was the 70s and 80s, so a completely different era.”
Although she doesn’t say it outright, I realize that these events understandably disturbed Jenny way into later life. “Before my mum passed away, I asked her why nobody went to that girl’s house to find out what the hell was wrong with her and why they’d let it go. She said, ‘Oh you were fine! She didn’t physically hurt you!’” Jenny laughs, incredulous.
The Challenger
Out-of-school-hours Jenny was “all over the place,” she says, explaining how she had to tag along and keep up with her cousins as they broke into buildings across Liverpool. “Half of my family worked in law enforcement, and half did not,” she says pointedly. As some of her cousins got older and got jobs as security guards and bouncers in nightclubs, they got to know some professional football players. “The footie players found out that we got in and out of buildings and asked if we could get into their houses. They were being robbed and mugged, you see. We did good business, got paid, but the boys didn’t want to do the written reports, but I did.”
"All these boys, local kids, surrounded me to beat me up, and I had to fight my way out...I shook [a can of Tango], blew it up in the guy’s face and hit him over and over on the head with it until he had blood and Tango coming down his face"
This differentiator turned out to be pivotal. “So they ended up going the wrong way, so to speak,” explains Jenny, “Whereas I went to uni [to study a BA in English Language and Literature at the University of Liverpool] and would write the reports from the jobs.”
One client asked Jenny to do a job on her own, “I said yes, and then I started to get a few jobs a year, then more and more.” The rest, as they say, is history. “I never thought that it would be a career, and that’s why I never told anyone because I thought ‘I’m a burglar!’ If anyone asked what I was doing, I was robbing somewhere. Even though someone had said it was OK to do that, I didn’t know anyone else that did it.”
In the beginning, there was a lack of protocol and process in the jobs she was doing. Jenny laughs as she recalls how things were being done. “It wasn’t strictly speaking what we’d call a pen test now; it was ‘get in and take something.’ In my head, all this was cleared. We asked no questions, went through no protocols, just said, ‘yeah, of course, you’re clearly legit!’ Really, they were not.”
Jenny is clear that she did not choose this career, but more accurately, decided to continue “the job” that she’d joined her cousins in doing. “I just happened to be the one who turned it into a career. I’ve been asked to do all sorts of things, domestic investigations, getting people talking on trains, stuff like that.”
The “domestic stuff” never really floated Jenny’s boat, but she was learning on the job, acquiring high-level people skills and developing her negotiator abilities.
Jenny has always worked for herself, contracting as a negotiator for hire for a couple of Fortune 500 companies back in the day. This doesn’t surprise me one bit. She would break the rules, both inside and outside of her assignments. “I always took on extra work, but you’re not even meant to have a bar job without running it past HR, let alone breaking into offices while I was on business trips. I had to be given permission, so I just never said anything; it’s none of their business, is it? It’s nothing to do with them; that’s how I saw it!” There’s something charming about Jenny’s rebellious nature. It also explains why getting paid to be naughty fits her like a glove.
She doesn’t deny this. Instead, she describes that she has an “attack mindset and a challenger perspective.” As an example, “if someone tells me I can’t go through a gate, I’m like ‘Why? Who says? What’s the point? Where’s that written?’ If people say, ‘You just can’t,’ I’ll challenge that with, ‘well that’s not a good reason. Who are you to tell me?’” What Jenny is trying to say is that she needs a good reason to obey a rule. She won’t just follow them blindly. The more I learn of the mischievous side of Jenny, the more I enter fangirl territory. She has a twinkle in her eye that is hard to ignore.
Jenny gets paid to legitimately do the things you can’t do in a conventional job and in a conventional life. “Very early on in my career, someone said to me, ‘you’ve got to pick a side.’” She refers, of course, to whether she would use her skills for good or for bad. “I picked the side of the angels because if you’re in security, you should be in it to help people, not for attention or money or anything. Your drive should be to help people.”
I’m starting to question these two sides to Jenny that we discussed earlier. As Jenny’s story unfolds and I get to know her on a deeper level, I see only one Jenny. I put this theory to Jenny, and she concurs. “It’s not that I’m two different people; I’m one person but can assume different personas and different perspectives. I look at a building and can adopt an attacker mindset.” She explains that she imagines an angel and a devil on her shoulders, “but the angel’s the bigger one, literally.”
The Hunter
The nature of penetration testing means that anonymity is a bonus. As Jenny’s profile has become increasingly public and recognizable, how has that affected her business? “It’s a small circle,” she says of the industry, “I’d hardly be recognized outside of that.” With a few TED Talks under her belt and a season on Channel 4’s Hunted, I wouldn’t be so sure.
“I was on season four, the only season when we caught them all,” she says proudly. Despite putting in a huge shift, “it was bloody hard work, 12-hour days, six days a week, I wouldn’t go home because I wanted them done, caught, busted.” Refusing to play up to the cameras, her edit was modest as “they [the producers] realized I was only interested in getting the job done,” and that she did.
Both Jenny’s work ethic and standards are high, and her staff are expected to match those. “If you fall beneath the high standards, you don’t come back because it would be dangerous.”
Speaking of dangerous, Jenny tells me about a job she was doing in the United States between lockdowns. “I had a target in America. I had to talk my way in and take something from the house. I needed a driver, and I asked a friend of mine who is former military if anyone could be the driver with me. He asked how many people I’d have with me, and I said, ‘well, just me and a driver, everyone in the office will know where I am and will be monitoring me from the office.’ He said they’d put a minimum of eight people on that job.”
Are you brave or silly, I ask? “I just do things differently,” she replies.
Hers is a job that requires a hell of a lot of work ethic, a big dollop of stamina and side dishes of discipline and patience. She dispels the Hollywood perception of her job. “Hundreds of people contact me wanting to do the job. It’s all fun and games until you fall off a fucking bridge!
“It’s actually a lot of hanging around and walking in circles for hours.” She uses the term “emotional rollercoaster” to describe her job, describing the adrenaline highs from doing something dangerous or delivering a killer keynote at a big conference. Then there are the comedowns in the hotel room afterward or the sitting on a metal fire escape in a thunderstorm and pouring rain doing a job, “you know what I mean?” I don’t have the heart to tell her I don’t, not really. The life of an editor is a somewhat flat line in comparison.
Jenny finds herself facing less fear these days, despite the dangerous parts of the job. “I’ve got younger and tougher people I can put in place. I’m not massively hard!” she protests. Au contraire, Jenny, I contest, reminding her of the Tango can story. If you’re that ‘hard’ at age seven, you’re definitely hard with decades of penetration testing and surveillance experience under your belt.
The Person at the End of the Bar
As we talk about all of the other things Jenny does that supplement her “real job,” her podcast, public speaking and media interviews, she finds herself shocked that people want to hear it. “It’s crackers to me; I’ll look out from the stage and think what the hell is going on? Why are all these people listening to me about breaking and entering? I’m not blind to the fact I do a fascinating job, but it still amazes me that respectable people with proper, respectable jobs, like the police, military and government, want to speak to me.” She pauses, suddenly serious, “it could have gone either way, Eleanor.”
She’s referring, of course, to those early days on the streets of Liverpool, breaking into buildings with her cousins, many of whom “now do something else, or came to a bad end, shall we say.”
For Jenny, though, her path brought her right here, and she says that unequivocally, she loves what she does. “Except for the witching hour, when you pour a glass of wine to start the weekend or kick off the Christmas holiday or a vacation. You can guarantee your phone will ring and you can’t leave it, you’re compelled to answer.”
“What I will say is that I won’t do it for much longer.” By much longer, she means a couple more years. “I want to be the person at the end of the bar boring people to death about what I used to do – but not actually doing it anymore!”
Before finding her seat at that bar, Jenny confesses she’d love to have a crack at breaking into the White House. “If it was completely legitimate, of course, and Eleanor, please write LEGITIMATE in block capitals.” We both laugh as I engage ‘CapsLock.’
Even if the opportunity presented itself, I’m not sure how she’d find the time, although something tells me she’d find a way! Jenny’s book should be out this year and is jam-packed with anecdotes and stories of the pen tests she is proud of and those that she is not. “I tell the story of a pen test when all the odds were against me, I had to break into somewhere I 100% should not have been, and I did it all with a piece of paper.
“I would say that sometimes you get one from God, but I’m a complete atheist,” she says of the pen tests when everything magically falls into place. “Occasionally, you get one from the universe, it just goes ‘you can have that.’”
"With Scouse jokes, 364 days of the year I’ll laugh at it and take it fine, but don’t be the person telling us a Scouse joke on day 365!”
I ask how she celebrates those gifts from the universe. “With chips,” she exclaims. “We have a song that we play in the car, usually some kind of heavy metal or Queen track, and then post-attack chips and beer or chips and wine to close it off mentally and psychologically.”
During this interview, Jenny tells me many stories of pen tests, mainly raving successes but with a couple of blush-worthy failures for good measure. She tells the stories so well that to repeat them in print would only serve to turn them monochrome. Instead, I urge you to watch her talks and listen to her podcast. The protagonist tells the story the best.
The One
Jenny is in the privileged position that Human Factor Security can afford to turn down a lot of work. In fact, she confesses turning down at least half of the pen tests she is asked to do. So what’s the deciding factor? It comes down to two things. “Is it just a compliance exercise? If so, I won’t do it. Secondly, do I like you? Because if I don’t, I won’t do it. That’s the joy of being the CEO,” she laughs.
It’s not the first time that I’ve thought that I wouldn’t want to cross Jenny Radcliffe. That’s why I used capital letters in the last section. I jest, but I mean it. “I’ve turned down so many publishing things that have come my way, TV and entertainment gigs, because as much as I laugh at the job, and it’s funny a lot of the time, it’s actually a serious thing that we do, so I can’t always see the funny side.
“It’s like with Scouse jokes, 364 days of the year I’ll laugh at it and take it fine, but don’t be the person telling us a Scouse joke on day 365!” The odds are decent, but do you know what? I don’t think I’ll take the risk.
So when you’re sitting at that hypothetical bar, talking about what you used to do, what will you actually be doing, I ask? “I’ll be writing down all the things that have happened, even if nobody wants to read it. I’ll go back through a lifetime of journals, diaries, recordings and films and write it all down to stop people making the same mistakes.” I, for one, will be in the queue to read it. I have a feeling that one book won’t be enough to capture the insanely colorful life and career of our people hacker.
“I’m sorry if that was a bit of a weird interview. Was it a bit disjointed?” Jenny asks as we wrap up and promise to meet for wine and off-the-record chats soon. That vulnerability sneaks back in, and I determine that while I don’t think I ‘hacked’ Jenny, I definitely found a way to break down those perimeter walls and earn a deeper insight into who she is. Contrary to that initial belief that there are two sides to her, I conclude that there’s one, but with an insane ability to think like there are more. When all is said and done, there’s only one Jenny Radcliffe.