Jack Rhysider: How a Security Engineer Built Darknet Diaries

Every few weeks, a calm, unhurried voice tells hundreds of thousands of people a true story from the dark side of the internet: a mom who hacked a prison with a clipboard and a USB stick, a Secret Service hunt for a carding kingpin, a ransomware gang that fell apart.

The voice belongs to Jack Rhysider, and the show is Darknet Diaries. Since 2017 it's become the closest thing cybersecurity has to This American Life, a podcast that explains hacking to people who've never opened a terminal, and still keeps the professionals listening.

Rhysider didn't come from radio. He came from a security operations center, and for about the first 40 episodes he did almost every job on the show himself.

Jack Rhysider at a Glance

• Rhysider started in network security in 2007 as a NOC technician and worked his way up to lead architect of a security operations center at a managed security provider with clients around the world.
• On January 1, 2010, he launched TunnelsUp, a blog where he stored the lessons he learned at work and helped strangers troubleshoot their networks.
• Hearing people outside tech talk about hacks they didn't understand, he decided to explain them. His only formal media training was a high school radio class.
• Episode 1 of Darknet Diaries, about PBX phone hacking, went out on September 1, 2017, 14 minutes long.
• By the end of 2018 the show was on the Boston Globe's list of podcasts that stood out that year, and in 2019 it won best new cybersecurity podcast at the European Security Blogger Awards.
• The podcast pulled 8 million downloads in 2019 alone, and around episode 40 it turned a profit, letting Rhysider hire writers, researchers, editors and designers.
• By October 2026 the show had reached 180 episodes plus 10 bonus episodes, 168 hours of audio and roughly 1.8 million words, the length of 23 novels.

The Life of Jack Rhysider

Ten Years on the Blue Team

Rhysider's path into security was a working one. He holds a bachelor's degree in computer engineering, and in 2007 he started out as a NOC technician, the person watching the network monitors and handling the tickets.

He moved up quickly to senior engineer and then to lead architect of a security operations center at a managed security services provider, the kind of outfit that watches over hundreds of client networks at once. On his own blog he listed the alphabet soup that came with the job: CCNP, CCNP Security, CEH and a string of Juniper, Blue Coat and Check Point certifications.

"I'm part of the blue team of network defenders," he wrote. The clients ranged from schools and governments to banks and commercial companies, which gave him a view of how attacks actually arrived, day after day.

TunnelsUp

On January 1, 2010, Rhysider launched a site called TunnelsUp. It began, in his words, as a "place to store my lessons learned while at work," full of networking how-tos and small tools.

It found an audience he never met. "Every day, I help hundreds of strangers on the internet troubleshoot their network issues," he wrote on its about page.

Eight years of writing about technical problems turned out to be good practice for something else: explaining complicated things to people who'd never seen them.

Everyone Was Talking About Hackers

The idea for a podcast came from outside the industry. "All these people who were not in tech were saying things like, 'Oh, did you hear about the hack on this and the hack on that?'" he told The Record in 2020.

The headlines said what happened. He wanted to explain the mystery and magic of how it happened, the part that'd kept him in the field for a decade.

So he taught himself to tell stories. He studied This American Life and Radiolab, read Jessica Abel's Out on the Wire on narrative radio and worked through Pixar's online storytelling lessons. His only formal training was a radio class he'd taken in high school.

Episode One

On September 1, 2017, Episode 1 of Darknet Diaries, "The Phreaky World of PBX Hacking," went out. It ran 14 minutes and told how two men on the FBI's Cyber's Most Wanted list for hacking corporate phone systems were finally caught.

Episode 2 followed two weeks later, then a story about the collapse of the Dutch certificate authority DigiNotar. Rhysider was still working in the SOC, and he was doing almost everything himself, from research and writing to narration and editing.

The show's stated mission was ambitious for a one-man operation: to "capture, preserve, and explain the culture around hacking and cyber security," and to entertain technical and non-technical listeners alike.

Finn and the Seven-Month Episode

Episode 17 showed what that meant in practice. "Finn" is the story of a bored 14-year-old who hacked a Twitter account and got far more than he bargained for.

Rhysider recorded five hours of phone conversations with Finn and his mother. The episode took more than seven months to piece together and over 70 hours of work, almost twice the average, and it still came out three days late.

That patience became the house style: long interviews with the people who were actually there, cut into a narrative that a listener can follow on a commute.

Chartbreakers

In 2018, Rhysider noticed something wrong with the Apple Podcasts top charts, and turned his own industry into an episode. "Chartbreakers" investigated how unknown shows were being pushed into the rankings through what he called dark podcast marketing.

He traced the promoters and found the operations were run out of Bangladesh. He asked them to send photos of their offices and equipment, and then published what they sent.

The episode borrowed its title from a Chartable article and leaned on help from Podnews, Discover Pods and Libsyn. It was proof that the SOC analyst's instincts worked on any target.

The Awards Roll In

The Boston Globe put Darknet Diaries on its list of 10 podcasts that stood out in 2018, calling it "a true-crime podcast with no blood, no bodies." The Irish Times praised how "storytelling is mixed with investigative techniques to provide a strong narrative with real people at its core."

It was runner-up in the technology and science category at the 2018 Discover Pods Awards, and in June 2019 it took best new cybersecurity podcast at the European Security Blogger Awards.

The numbers followed. The show pulled 8 million downloads in 2019 and held a 5.0 rating on Apple's app, and by 2020 it'd been featured in the New York Times, the Guardian and Vulture.

Around episode 40, the podcast started turning a profit. Rhysider used it to build a team of writers, researchers, editors and graphic designers, with theme music from Breakmaster Cylinder.

Where the Show Is Now

As of October 2026, Darknet Diaries stands at 180 episodes plus 10 bonus episodes: 168 hours of audio and roughly 1.8 million words, which the show's stats page notes is the length of 23 novels.

Recent episodes have covered a National Security Letter fight that rewrote privacy law, the hacker behind the National Public Data breach, Sophos's six-year secret war with a state-backed group and, in Episode 180, how the Conti ransomware gang fell apart.

The show has also moved onto YouTube, where Rhysider's channel has 437,000 subscribers and 34 million views, plus a separate clips channel. His channel description ends with a warning that tells you what kind of audience he has: "I am NOT on Telegram."

Jack Rhysider: Shining a Light on the Dark Parts

Rhysider's achievement is translation. He took the stories that circulated inside security operations centers and incident response teams and made them legible, and gripping, to everyone else.

He still produces the show with a small team, releasing a new episode every few weeks, each one built from hours of interviews with the people who lived it.

A NOC technician who wanted to explain things to strangers ended up explaining hacking to the world. The strangers just kept showing up.