1 00:00:00,360 --> 00:00:03,440 Speaker 1: On Friday, October seven, the U S Department of Homeland 2 00:00:03,440 --> 00:00:06,760 Speaker 1: Security and the Office of the Director of National Intelligence 3 00:00:06,800 --> 00:00:09,719 Speaker 1: released a statement, and it was a pretty stunning announcement. 4 00:00:10,119 --> 00:00:12,639 Speaker 1: Barely two and a half months after a cyber attack 5 00:00:12,720 --> 00:00:16,480 Speaker 1: was revealed on the Democratic National Committee, the Obama administration 6 00:00:16,560 --> 00:00:19,320 Speaker 1: laid the blame at the feet of Russia's President Vladimir 7 00:00:19,360 --> 00:00:23,000 Speaker 1: Putin with a strongly the US government publicly blaming a 8 00:00:23,040 --> 00:00:25,799 Speaker 1: foreign country for attacking a U S entity, that's an 9 00:00:25,840 --> 00:00:28,200 Speaker 1: incredibly rare thing. I was surprised when I saw the 10 00:00:28,240 --> 00:00:31,080 Speaker 1: statement come out, even though it's something that the private 11 00:00:31,080 --> 00:00:33,959 Speaker 1: cybersecurity experts have been talking about for a while. Uh, 12 00:00:34,000 --> 00:00:36,879 Speaker 1: the government formally blaming a foreign entities only happened a 13 00:00:36,880 --> 00:00:40,360 Speaker 1: handful of times, and specifically here, the US was accusing 14 00:00:40,440 --> 00:00:45,040 Speaker 1: Russia of hacking the Democratic Party right as voters prepared 15 00:00:45,080 --> 00:00:47,360 Speaker 1: to go to the polls on November eight. It's a 16 00:00:47,400 --> 00:00:50,880 Speaker 1: scary prospect. Could hackers tamper with or even obliterate our votes. 17 00:00:51,440 --> 00:00:54,440 Speaker 1: So here's my question. We are so close now to 18 00:00:54,480 --> 00:00:57,360 Speaker 1: election day, and you can tell because that's really all 19 00:00:57,440 --> 00:01:00,600 Speaker 1: you see on TV right now. So how do we 20 00:01:00,680 --> 00:01:03,800 Speaker 1: know for sure what we think we know about these hacks. 21 00:01:04,600 --> 00:01:07,840 Speaker 1: This is a perpetual problem in cybersecurity, and it reminds 22 00:01:07,880 --> 00:01:10,520 Speaker 1: me of the famous New Yorker cartoon that goes on 23 00:01:10,560 --> 00:01:13,160 Speaker 1: the internet. Nobody knows you're a dog, But when you're 24 00:01:13,160 --> 00:01:17,200 Speaker 1: investigating a cybersecurity breach, uh, nobody knows whether you're a 25 00:01:17,280 --> 00:01:20,560 Speaker 1: Russian hacker or a Chinese hacker pretending to be a 26 00:01:20,640 --> 00:01:24,120 Speaker 1: Russian hacker, or even a US hacker pretending to be 27 00:01:24,120 --> 00:01:27,319 Speaker 1: a Chinese hacker pretending to be a Russian hacker, or, 28 00:01:27,400 --> 00:01:30,479 Speaker 1: as Donald Trump put it so delicately, I don't think 29 00:01:30,480 --> 00:01:32,959 Speaker 1: anybody knows it was Russia that broke into the d 30 00:01:33,040 --> 00:01:35,240 Speaker 1: n C. She's saying Russia, Russia, Russia, but I don't 31 00:01:35,560 --> 00:01:37,480 Speaker 1: Maybe it was. I mean, it could be Russia, but 32 00:01:37,520 --> 00:01:39,679 Speaker 1: it could also be China, could also be lots of 33 00:01:39,680 --> 00:01:41,720 Speaker 1: other people. It also could be somebody sitting on the 34 00:01:41,880 --> 00:01:45,800 Speaker 1: bed that weighs four hundred pounds. Okay, And how is 35 00:01:45,880 --> 00:01:49,360 Speaker 1: the US or anyone else, for that matter, so certain 36 00:01:49,520 --> 00:01:52,520 Speaker 1: that the Russians are trying to hijack our elections? What 37 00:01:52,560 --> 00:02:04,880 Speaker 1: should an ordinary voter do? And should we even care? Hi, 38 00:02:05,000 --> 00:02:09,160 Speaker 1: am Akito, and I'm George Robertson and this week on Decrypted, 39 00:02:09,240 --> 00:02:11,600 Speaker 1: we're going to take you inside the hunt for the 40 00:02:11,600 --> 00:02:15,400 Speaker 1: people who have the Democratic National Committee. It's a sort 41 00:02:15,440 --> 00:02:17,919 Speaker 1: of tale of how two of the world's great superpowers 42 00:02:17,919 --> 00:02:21,240 Speaker 1: have found themselves locked in an escalating information war just 43 00:02:21,400 --> 00:02:24,200 Speaker 1: weeks before millions of Americans go to the polls, and 44 00:02:24,240 --> 00:02:27,400 Speaker 1: the stakes they really couldn't be any higher. Not only 45 00:02:27,480 --> 00:02:30,520 Speaker 1: is this the most divisive election we've seen in recent memory, 46 00:02:31,000 --> 00:02:34,720 Speaker 1: with Hillary Clinton and Donald Trump advocating for completely different 47 00:02:34,760 --> 00:02:37,800 Speaker 1: visions of America, but also hanging in the balance is 48 00:02:38,040 --> 00:02:42,800 Speaker 1: the democratic process itself. What happens to a country's sovereignty 49 00:02:42,800 --> 00:02:46,840 Speaker 1: in the age of the Internet. Our story today starts 50 00:02:46,840 --> 00:02:49,639 Speaker 1: in April when the i T staff at the Democratic 51 00:02:49,720 --> 00:02:53,280 Speaker 1: National Committee noticed something a little weird going on in 52 00:02:53,320 --> 00:02:56,680 Speaker 1: their network. For our non American listeners, this is the 53 00:02:56,800 --> 00:03:00,280 Speaker 1: official organization behind the Democratic Party, the d n SEE, 54 00:03:00,720 --> 00:03:04,080 Speaker 1: and the i T staff there. They escalated their concerns, 55 00:03:04,200 --> 00:03:08,320 Speaker 1: their executives and a cyber security firm called CrowdStrike what's 56 00:03:08,360 --> 00:03:14,080 Speaker 1: called in to investigate so CrowdStrike is one of a 57 00:03:14,160 --> 00:03:18,359 Speaker 1: small group of digital forensics firms that really all they 58 00:03:18,400 --> 00:03:21,880 Speaker 1: do is investigate data breaches, and they went in they 59 00:03:21,919 --> 00:03:25,040 Speaker 1: installed software in the DNC servers, essentially allowing them to 60 00:03:25,080 --> 00:03:27,720 Speaker 1: spy on the spies, and it didn't take them long 61 00:03:27,800 --> 00:03:30,600 Speaker 1: to pin the attacks on true groups of hackers associated 62 00:03:30,600 --> 00:03:33,519 Speaker 1: with the Russian government. They called these groups Cozy Bear 63 00:03:33,600 --> 00:03:37,120 Speaker 1: and Fancy Bear. Cozy Bear and Fancy Bear. Is this 64 00:03:37,240 --> 00:03:41,760 Speaker 1: some kind of industry inside joke. Yeah, The cybersecurity industry 65 00:03:41,960 --> 00:03:44,360 Speaker 1: has a lot of kind of goofy, funny names for groups. 66 00:03:44,400 --> 00:03:48,520 Speaker 1: Their thematic often associated with a region. Uh. Some others 67 00:03:48,520 --> 00:03:51,840 Speaker 1: are called deep Panda and things like that. I love that. 68 00:03:52,240 --> 00:03:55,600 Speaker 1: Then CrowdStrike closed all the security holes that had allowed 69 00:03:55,600 --> 00:03:58,480 Speaker 1: the attackers to breach the DNC servers, and so the 70 00:03:58,520 --> 00:04:01,760 Speaker 1: hackers wouldn't be able to read the stay ask emails anymore. Now, 71 00:04:01,800 --> 00:04:05,480 Speaker 1: normally you don't really disclose this kind of thing unless 72 00:04:05,520 --> 00:04:08,440 Speaker 1: you absolutely have to. It's certainly embarrassing for the d 73 00:04:08,600 --> 00:04:12,280 Speaker 1: n C, especially when, as we learned later, they were 74 00:04:12,360 --> 00:04:16,080 Speaker 1: warned about their networks vulnerabilities and ended up ignoring those 75 00:04:16,080 --> 00:04:18,960 Speaker 1: early warnings. But the d n C may have had 76 00:04:18,960 --> 00:04:21,039 Speaker 1: a hint that some of this information was about to 77 00:04:21,040 --> 00:04:23,680 Speaker 1: be leaked on the internet, so they dropped this bomb show. 78 00:04:24,040 --> 00:04:27,840 Speaker 1: But first, the Democratic National Committee said today, Russian government 79 00:04:27,880 --> 00:04:32,480 Speaker 1: hackers have penetrated its computer network. Breaches by two separate 80 00:04:32,480 --> 00:04:37,720 Speaker 1: groups allowed hackers to access emails, internal chats, and opposition research. 81 00:04:38,040 --> 00:04:43,320 Speaker 1: Democrats have compiled unpresumptive Republican nominee Donald Trump. That's PPS 82 00:04:43,400 --> 00:04:46,560 Speaker 1: News Hour reporting the hack. On June fourteenth, the day 83 00:04:46,600 --> 00:04:50,000 Speaker 1: this all became public, and it hit the US political 84 00:04:50,040 --> 00:04:54,200 Speaker 1: system like a bolt of lightning. People were furious, how 85 00:04:54,279 --> 00:04:57,160 Speaker 1: dare Russia try to mess with America that type of thing? 86 00:04:58,839 --> 00:05:02,440 Speaker 1: And then one day after the DNC announcement, someone or 87 00:05:02,480 --> 00:05:04,880 Speaker 1: a group of people who go by the name goose 88 00:05:04,880 --> 00:05:07,200 Speaker 1: offer Too Datto came out in a blog post and 89 00:05:07,240 --> 00:05:10,320 Speaker 1: basically laughed in the DNC's face. This person was like, no, 90 00:05:10,440 --> 00:05:12,760 Speaker 1: you idiots, I am the lone hacker that infiltrated the 91 00:05:12,839 --> 00:05:15,440 Speaker 1: DNC and this had nothing to do with the Russians. 92 00:05:15,800 --> 00:05:18,440 Speaker 1: And goosefer Too Datto released a bunch of documents that 93 00:05:18,520 --> 00:05:20,200 Speaker 1: he claimed he had stolen from the d n C 94 00:05:20,839 --> 00:05:24,400 Speaker 1: as evidence that he was behind it, and from there 95 00:05:24,680 --> 00:05:28,279 Speaker 1: it was chaos. Was it the Russians with some lunar 96 00:05:28,400 --> 00:05:31,360 Speaker 1: kid who had too much time on his hands? And 97 00:05:31,480 --> 00:05:34,039 Speaker 1: that's when crowd Strait called in this guy for help. 98 00:05:37,040 --> 00:05:39,359 Speaker 1: My name is Mike Bartowski. I'm the senior vice president 99 00:05:39,360 --> 00:05:45,240 Speaker 1: of cybersecurity services at Fidela Cybersecurity here in Maryland. I 100 00:05:45,400 --> 00:05:50,080 Speaker 1: lead a incident response team of about thirty individuals and 101 00:05:50,400 --> 00:05:53,120 Speaker 1: we've handled some of the largest breaches that have have 102 00:05:53,160 --> 00:05:57,080 Speaker 1: occurred over the past decade or so. So I've known 103 00:05:57,120 --> 00:05:59,279 Speaker 1: Mike for several years now, and he's a really interesting guy. 104 00:05:59,480 --> 00:06:01,800 Speaker 1: Used to be a cop with the Montgomery County Police 105 00:06:01,800 --> 00:06:04,720 Speaker 1: Department in Maryland, and he looks like at X cop. 106 00:06:04,760 --> 00:06:08,480 Speaker 1: He's got the short cropped haircut, solidly built guy at 107 00:06:08,680 --> 00:06:11,960 Speaker 1: very friendly and uh, you know, very genial. Even before 108 00:06:11,960 --> 00:06:14,240 Speaker 1: his time in the private sector, he had this long 109 00:06:14,279 --> 00:06:18,360 Speaker 1: experience of tracking down criminals. Mike's now an incident responder 110 00:06:18,480 --> 00:06:21,200 Speaker 1: in cybersecurity speak, that means he flies out at the 111 00:06:21,240 --> 00:06:23,360 Speaker 1: drop of a hat to companies that believe they've been 112 00:06:23,400 --> 00:06:26,760 Speaker 1: breached and he helps investigate and fix their networks. So, 113 00:06:26,920 --> 00:06:29,600 Speaker 1: like the computer nerd version of c s I or 114 00:06:29,920 --> 00:06:33,160 Speaker 1: Law and Order right and Mike and Fidelis, his job 115 00:06:33,200 --> 00:06:36,120 Speaker 1: was to independently verify the group of people who attack 116 00:06:36,160 --> 00:06:41,200 Speaker 1: the DNC, and this cybersecurity version of the who done it? Investigation. 117 00:06:41,440 --> 00:06:45,880 Speaker 1: It's called attribution in the industry, and CrowdStrike had asked 118 00:06:45,880 --> 00:06:49,040 Speaker 1: Fidelis and to other firms to check their work. So 119 00:06:49,160 --> 00:06:51,760 Speaker 1: so we had, um, you know, we got five pieces 120 00:06:51,760 --> 00:06:54,600 Speaker 1: of now where we had a team of four reverse engineers. 121 00:06:54,600 --> 00:06:56,680 Speaker 1: That's all they do is reverse engineering, so we had 122 00:06:56,720 --> 00:06:59,960 Speaker 1: them bang on it. Jordan, I think we should have 123 00:07:00,040 --> 00:07:04,479 Speaker 1: slain the store listeners. Sure, So crowd Strike sent Mike's 124 00:07:04,480 --> 00:07:07,839 Speaker 1: team five files of the computer code that was on 125 00:07:07,880 --> 00:07:11,200 Speaker 1: the DNC servers and was responsible for stealing information from 126 00:07:11,240 --> 00:07:13,920 Speaker 1: the emails. And the job of Fidelis and these two 127 00:07:13,960 --> 00:07:16,400 Speaker 1: other firms was to look at this code in what's 128 00:07:16,400 --> 00:07:20,960 Speaker 1: called a virtual environment, like a parallel universe. Right, it's 129 00:07:20,960 --> 00:07:23,640 Speaker 1: a simulated computer system where the code can't do any 130 00:07:23,680 --> 00:07:26,760 Speaker 1: damage on the real servers. Hackers used all kinds of 131 00:07:26,800 --> 00:07:30,280 Speaker 1: tricks to prevent their malware from even opening in that 132 00:07:30,360 --> 00:07:32,840 Speaker 1: kind of hall of mirrors. So a key job of 133 00:07:32,880 --> 00:07:36,160 Speaker 1: an investigator is decoding all of those techniques to see 134 00:07:36,160 --> 00:07:40,080 Speaker 1: how the attack code actually behaves. Okay, and then Mike's 135 00:07:40,120 --> 00:07:44,320 Speaker 1: team they compared that behavior. Two documented code in the 136 00:07:44,360 --> 00:07:47,640 Speaker 1: past that was linked to the two hacker groups associated 137 00:07:47,640 --> 00:07:51,160 Speaker 1: with the Russian government and crowd Strait called these two 138 00:07:51,160 --> 00:07:55,320 Speaker 1: groups Cozy Bear and Fancy Bear, and the clues surface immediately. 139 00:07:56,600 --> 00:07:58,520 Speaker 1: You know, really there were a couple of things that 140 00:07:58,520 --> 00:08:00,680 Speaker 1: that we looked at, So you look at the complexity 141 00:08:00,800 --> 00:08:03,280 Speaker 1: of of what the malware was able to do. The 142 00:08:03,320 --> 00:08:08,560 Speaker 1: fact that it had the ability to m basically terminate 143 00:08:08,600 --> 00:08:12,320 Speaker 1: itself and wipe its its tracks, hide its tracks. You know, 144 00:08:12,360 --> 00:08:15,440 Speaker 1: that's not stuff you see in commoditized malware. Really, it 145 00:08:15,520 --> 00:08:17,720 Speaker 1: kills itself. It kills itself. Yeah, and actually one of 146 00:08:17,760 --> 00:08:20,120 Speaker 1: the functions within the one of the pieces of malware 147 00:08:20,600 --> 00:08:25,680 Speaker 1: UM had had a terminology for essentially Harry Carey UM 148 00:08:25,920 --> 00:08:30,160 Speaker 1: to kill itself. So this automatic suicide switch, this is 149 00:08:30,200 --> 00:08:33,920 Speaker 1: something that's incredibly sophisticated, right, I mean, this is one 150 00:08:33,960 --> 00:08:37,160 Speaker 1: of the reasons that Fidelist and CrowdStrike and the other 151 00:08:37,320 --> 00:08:41,880 Speaker 1: forensics researchers were so taken aback by this malware. You know, 152 00:08:41,880 --> 00:08:44,600 Speaker 1: there's a there's a black market for pre built malware 153 00:08:45,400 --> 00:08:48,760 Speaker 1: on the Internet that even somebody like me can piece together, 154 00:08:48,960 --> 00:08:52,040 Speaker 1: so like malware can be like legos. But this feature 155 00:08:52,080 --> 00:08:55,640 Speaker 1: of killing yourself to avoid getting detected, that's really complicated stuff. 156 00:08:56,120 --> 00:08:58,120 Speaker 1: And that's when Mike's team knew they were dealing with 157 00:08:58,160 --> 00:09:00,480 Speaker 1: real pros here. You know, there aren't ton of people 158 00:09:00,480 --> 00:09:03,400 Speaker 1: around the world who have this level of sophistication. And 159 00:09:03,440 --> 00:09:05,120 Speaker 1: there were a bunch of other things that packed up 160 00:09:05,120 --> 00:09:09,480 Speaker 1: this conclusion to the level of access that the malware 161 00:09:09,520 --> 00:09:15,000 Speaker 1: gave the malicious user, UM was pretty astonishing. Uh. It 162 00:09:15,080 --> 00:09:19,360 Speaker 1: was also written very very um well, I think I 163 00:09:19,360 --> 00:09:22,319 Speaker 1: guess elegant is probably a good way to to say it. 164 00:09:22,320 --> 00:09:25,640 Speaker 1: It was not sloppy by any stretch of the imagination. UM. 165 00:09:25,679 --> 00:09:28,120 Speaker 1: And again, so you start looking at, Okay, who would 166 00:09:28,160 --> 00:09:30,040 Speaker 1: have had the capability to do that? And you know, 167 00:09:30,120 --> 00:09:33,040 Speaker 1: we we talked earlier how you know, Yeah, you can 168 00:09:33,080 --> 00:09:35,760 Speaker 1: have somebody on the inside do something, but they may 169 00:09:35,760 --> 00:09:38,480 Speaker 1: not be the best at it. So you have, uh, 170 00:09:38,679 --> 00:09:40,640 Speaker 1: you've got to have people who are a lot of 171 00:09:40,679 --> 00:09:42,760 Speaker 1: experience doing it or a lot of training to do it. 172 00:09:42,800 --> 00:09:46,840 Speaker 1: And um, it was. It was a very complex piece 173 00:09:46,840 --> 00:09:50,160 Speaker 1: of malware that the average person probably couldn't use. Uh. 174 00:09:50,200 --> 00:09:53,920 Speaker 1: It's also not something that we've seen out in the 175 00:09:53,960 --> 00:09:59,040 Speaker 1: wild necessarily, it's very targeted pieces of malware, very limited 176 00:09:59,040 --> 00:10:00,720 Speaker 1: and can't buy it on the black market. You can't 177 00:10:00,720 --> 00:10:07,520 Speaker 1: buy these components not that. No, not that we've come across. Okay, okay, 178 00:10:07,559 --> 00:10:10,839 Speaker 1: so so far we know that this attack was orchestrated 179 00:10:10,880 --> 00:10:15,480 Speaker 1: by someone really really good, someone really really experienced, and 180 00:10:15,800 --> 00:10:19,000 Speaker 1: that immediately limited the pool of people who could be 181 00:10:19,080 --> 00:10:21,920 Speaker 1: responsible for this. It really limited the pool of people 182 00:10:22,480 --> 00:10:26,040 Speaker 1: to someone with the kind of resources with backing from 183 00:10:26,080 --> 00:10:28,720 Speaker 1: an entire government. And on top of that, there were 184 00:10:28,760 --> 00:10:30,640 Speaker 1: a bunch of things that pointed to the code being 185 00:10:30,640 --> 00:10:33,840 Speaker 1: written in Russia. Yeah, some of these details are really interesting. 186 00:10:34,600 --> 00:10:37,840 Speaker 1: So one of the most fascinating for me is, you know, 187 00:10:37,880 --> 00:10:40,480 Speaker 1: from the way the code was written, it was clear 188 00:10:40,640 --> 00:10:43,600 Speaker 1: that it was written on a Russian language keyboard, and 189 00:10:43,640 --> 00:10:46,719 Speaker 1: the dates and times that the code was compiled was 190 00:10:46,800 --> 00:10:49,920 Speaker 1: during normal business hours in Russia, and that's consistent with 191 00:10:49,960 --> 00:10:52,320 Speaker 1: the code that's already been traced back to the Russian 192 00:10:52,360 --> 00:10:55,560 Speaker 1: government backed hackers in the past. And that's not something 193 00:10:55,559 --> 00:10:58,920 Speaker 1: that you can easily fake, right, like change the time 194 00:10:58,960 --> 00:11:01,640 Speaker 1: stamps or something. Yeah, that was my question too, but 195 00:11:01,679 --> 00:11:03,760 Speaker 1: Mike said, there's so many different things that you'd have 196 00:11:03,840 --> 00:11:08,520 Speaker 1: to consistently change to successfully pull off that spoof. You're 197 00:11:08,559 --> 00:11:10,880 Speaker 1: dealing with a situation that if it was a one off, 198 00:11:11,120 --> 00:11:13,760 Speaker 1: easier to change, you know, same same thing with you know, 199 00:11:13,800 --> 00:11:16,199 Speaker 1: you can change the day in time on your computer. Absolutely, 200 00:11:16,200 --> 00:11:18,240 Speaker 1: you could do that, and it would potentially throw an 201 00:11:18,280 --> 00:11:21,920 Speaker 1: investigator off consistently across five pieces of hour, okay, you know, 202 00:11:21,960 --> 00:11:25,199 Speaker 1: probably a little more difficult across x number of pieces 203 00:11:25,200 --> 00:11:27,720 Speaker 1: of malware across how many incidents and to all have 204 00:11:27,880 --> 00:11:32,360 Speaker 1: them point to the same place. And that's why Mike 205 00:11:32,400 --> 00:11:35,240 Speaker 1: doesn't buy Trump's theory of this four pound man sitting 206 00:11:35,280 --> 00:11:38,959 Speaker 1: on the bed orchestrating this incredibly sophisticated attack, and why 207 00:11:39,000 --> 00:11:41,520 Speaker 1: he doesn't buy Gooseifer two Dato's claim that he was 208 00:11:41,559 --> 00:11:44,280 Speaker 1: a lone hacker. Okay, is it a script, kiddiers, it's 209 00:11:44,280 --> 00:11:46,280 Speaker 1: somebody who bought a piece of malware? Or is it 210 00:11:46,480 --> 00:11:50,360 Speaker 1: you know, somebody drinking mountain doing, eating twinkies and mom's basement. No, 211 00:11:50,720 --> 00:11:55,960 Speaker 1: it really needs a level of operational discipline that you 212 00:11:56,040 --> 00:12:00,480 Speaker 1: don't see really in the wild. And you're right, the 213 00:12:00,559 --> 00:12:02,360 Speaker 1: number of people who could pull it off it becomes 214 00:12:02,440 --> 00:12:09,040 Speaker 1: dramatically narrower. So Icky, are you convinced? I mean I 215 00:12:09,160 --> 00:12:11,920 Speaker 1: think so. I don't know. I keep on expecting a twist, 216 00:12:12,000 --> 00:12:14,760 Speaker 1: like you're you're tricking me, Like in law and order 217 00:12:14,800 --> 00:12:17,560 Speaker 1: when the guy who seems really suspicious turns out to 218 00:12:17,600 --> 00:12:20,640 Speaker 1: be innocent in the end. Yeah, I like that. Well, 219 00:12:20,920 --> 00:12:23,120 Speaker 1: here's maybe the most important part. Then you need to 220 00:12:23,120 --> 00:12:25,240 Speaker 1: look at the target, the victim of this hack, which 221 00:12:25,280 --> 00:12:27,559 Speaker 1: was the d n C, and it later turned out 222 00:12:27,600 --> 00:12:30,320 Speaker 1: a broad cross section of the U. S political system, 223 00:12:30,360 --> 00:12:34,520 Speaker 1: everyone from lobbyists to lawyers to Hillary Clinton's campaign. And 224 00:12:34,600 --> 00:12:37,160 Speaker 1: going back to Mike's background of working in law enforcement, 225 00:12:37,200 --> 00:12:39,880 Speaker 1: you have to ask who would have had the motive 226 00:12:39,920 --> 00:12:42,640 Speaker 1: to pour this kind of effort into spying on key 227 00:12:42,679 --> 00:12:50,320 Speaker 1: members of American politics. Sure, an opportunistic hacker, you know, 228 00:12:50,400 --> 00:12:52,760 Speaker 1: putting a feather in their caps, saying, hey, we you know, 229 00:12:52,920 --> 00:12:56,160 Speaker 1: we broke into the d n C. Okay, yeah, I 230 00:12:56,200 --> 00:12:59,920 Speaker 1: mean that that could potentially happen. Um. But then releasing 231 00:13:00,040 --> 00:13:05,520 Speaker 1: the emails the evening before the convention started, Well then again, 232 00:13:05,600 --> 00:13:07,840 Speaker 1: now you now you're looking at it, Okay, Well, you 233 00:13:07,880 --> 00:13:13,520 Speaker 1: know that really smacks like an information operation. And here 234 00:13:13,640 --> 00:13:16,679 Speaker 1: I think we should remind our listeners of the chronology 235 00:13:16,720 --> 00:13:19,560 Speaker 1: of the events that took place just a few weeks 236 00:13:19,640 --> 00:13:22,200 Speaker 1: after the d n C announced the hack in mid June. 237 00:13:22,600 --> 00:13:25,560 Speaker 1: I mean, this was a time when the Republican Party 238 00:13:25,679 --> 00:13:29,360 Speaker 1: was still in complete disarray, but things were looking pretty 239 00:13:29,360 --> 00:13:31,400 Speaker 1: good for the Democrats. This was a time when Hillary 240 00:13:31,440 --> 00:13:35,200 Speaker 1: Clinton UM was trying to solidify her support and you 241 00:13:35,240 --> 00:13:38,200 Speaker 1: have this forest fire raging on the internet about this issue. 242 00:13:38,320 --> 00:13:41,120 Speaker 1: You have Wiki leaks and Goosea for Toutato publishing a 243 00:13:41,240 --> 00:13:44,239 Speaker 1: stream of emails that turned out to be really embarrassing 244 00:13:44,240 --> 00:13:46,200 Speaker 1: for the d n C. At you know what couldn't 245 00:13:46,240 --> 00:13:48,960 Speaker 1: have been a worse time for them, Yeah, like that 246 00:13:49,040 --> 00:13:52,280 Speaker 1: one from when Bernie Sanders was still in the primary 247 00:13:52,400 --> 00:13:55,880 Speaker 1: race with Hillary Clinton and a senior staff were at 248 00:13:55,920 --> 00:13:58,480 Speaker 1: the DNC talked about how they should try to paint 249 00:13:58,559 --> 00:14:02,079 Speaker 1: Sanders as an atheists, try to question his Jewish faith 250 00:14:02,200 --> 00:14:04,520 Speaker 1: and the party itself is supposed to be neutral. And 251 00:14:04,559 --> 00:14:07,040 Speaker 1: that led to a lot of turmoil within the party. 252 00:14:07,440 --> 00:14:10,040 Speaker 1: I mean the Democratic Convention that took place at the 253 00:14:10,120 --> 00:14:12,800 Speaker 1: end of July that was kind of a mess, at 254 00:14:12,840 --> 00:14:16,280 Speaker 1: least at the beginning. All these Bernie supporters were protesting 255 00:14:16,520 --> 00:14:19,640 Speaker 1: and booing down speakers on stage, and ultimately d n 256 00:14:19,720 --> 00:14:22,840 Speaker 1: C Chairwoman Debbie Wasserman Schultz, who was a rising young 257 00:14:22,880 --> 00:14:26,760 Speaker 1: star in the party, she resigned. And bringing this back 258 00:14:26,760 --> 00:14:29,440 Speaker 1: to our story, today. Like you said, Jordan's this really 259 00:14:29,520 --> 00:14:33,000 Speaker 1: does point to motive. I mean, who would really want 260 00:14:33,040 --> 00:14:36,480 Speaker 1: to introduce this kind of turmoil to the democratic process 261 00:14:36,560 --> 00:14:39,680 Speaker 1: itself in America, which is, you know, really the sacristanic thing. 262 00:14:40,520 --> 00:14:42,440 Speaker 1: Who would want to do this thing that would make 263 00:14:42,520 --> 00:14:45,880 Speaker 1: you question the fairness of the system that we've developed 264 00:14:45,920 --> 00:14:48,600 Speaker 1: over the years. Yeah, this project has been interesting to 265 00:14:48,640 --> 00:14:51,040 Speaker 1: me because I consider myself, you know, a pretty serious 266 00:14:51,080 --> 00:14:52,960 Speaker 1: skeptic on a lot of these claims. It's it's just 267 00:14:53,040 --> 00:14:55,720 Speaker 1: way too easy for a hacked entity to throw out, oh, 268 00:14:55,760 --> 00:14:59,440 Speaker 1: the Russians did this, and the Chinese did that or whatever. Yeah, 269 00:14:59,520 --> 00:15:01,800 Speaker 1: kind of like is get at a jail free card 270 00:15:01,840 --> 00:15:05,800 Speaker 1: when your company has been hacked? Right, these really sophisticated, 271 00:15:06,000 --> 00:15:09,640 Speaker 1: organized hackers backed by a whole government. If if someone 272 00:15:09,680 --> 00:15:12,080 Speaker 1: like that tries to target you, what could you have 273 00:15:12,200 --> 00:15:15,680 Speaker 1: possibly done. It's like when we reported about Yahoo's breach, 274 00:15:15,760 --> 00:15:18,680 Speaker 1: which was this massive, you know, more than five million 275 00:15:18,720 --> 00:15:22,440 Speaker 1: customer accounts getting hacked, we reported that the company's claim 276 00:15:22,480 --> 00:15:25,280 Speaker 1: of the attack being state sponsored, you know, isn't so 277 00:15:25,320 --> 00:15:28,400 Speaker 1: iron clad. But this one with the d n C. 278 00:15:28,680 --> 00:15:32,080 Speaker 1: After talking to Mike, after talking to all these other experts, 279 00:15:32,960 --> 00:15:36,440 Speaker 1: Jordan Are you convinced. Yeah, I'm pretty convinced. I mean, 280 00:15:36,480 --> 00:15:38,920 Speaker 1: it takes a lot to clear that hurdle of you've 281 00:15:38,920 --> 00:15:41,840 Speaker 1: got this piece of malware and this is evidence that 282 00:15:41,880 --> 00:15:44,960 Speaker 1: the Russians did it. Uh, you know, but Mike will 283 00:15:44,960 --> 00:15:47,360 Speaker 1: be the first to tell you this. Well, it's it's 284 00:15:47,360 --> 00:15:50,000 Speaker 1: always risky. I mean, you know, when you're when you're 285 00:15:50,320 --> 00:15:53,640 Speaker 1: you're doing attribution, you're really never saying a hundred percent 286 00:15:54,200 --> 00:15:58,840 Speaker 1: that it's this person, because, you know, barring seeing somebody 287 00:15:58,880 --> 00:16:02,080 Speaker 1: at the keyboard and actually doing it or a confession, 288 00:16:02,960 --> 00:16:07,440 Speaker 1: you're you're relying on that circumstantial evidence. This all comes 289 00:16:07,440 --> 00:16:09,680 Speaker 1: down to Mike's days as a cop. Can you prove 290 00:16:09,720 --> 00:16:12,920 Speaker 1: to a jury beyond a reasonable doubt that the Russians 291 00:16:12,960 --> 00:16:16,720 Speaker 1: did this? And his answer was yes. And now the 292 00:16:16,800 --> 00:16:20,480 Speaker 1: US government has come out and officially blame the Russian government. 293 00:16:22,920 --> 00:16:25,640 Speaker 1: And there are lots of reasons potentially for that happening. 294 00:16:26,160 --> 00:16:28,240 Speaker 1: There are ways that the government can really know what's 295 00:16:28,240 --> 00:16:32,520 Speaker 1: going on intercepted phone calls, intercepted emails, human and signals 296 00:16:32,520 --> 00:16:36,840 Speaker 1: intelligence sources in a way that no private cybersecurity could 297 00:16:36,840 --> 00:16:39,880 Speaker 1: ever match. Sounds a little sinister, Well, we don't know 298 00:16:39,960 --> 00:16:42,040 Speaker 1: for sure. But here's what Rob Owens, who was an 299 00:16:42,040 --> 00:16:45,480 Speaker 1: industry analyst at Pacific Press Securities, told me. Nation States 300 00:16:45,520 --> 00:16:48,880 Speaker 1: do hack. I think the US government hacks as well. 301 00:16:49,880 --> 00:16:54,920 Speaker 1: A well known fact within the industry that, uh, everybody's 302 00:16:54,960 --> 00:16:59,640 Speaker 1: hacking everybody to some degree. So maybe the US government 303 00:16:59,760 --> 00:17:02,880 Speaker 1: was buying on Russia while Russia was buying on the 304 00:17:02,960 --> 00:17:06,280 Speaker 1: d n C. Well, we know that both countries fired 305 00:17:06,320 --> 00:17:07,960 Speaker 1: each other all the time, but in this case, we 306 00:17:08,000 --> 00:17:10,360 Speaker 1: don't know exactly what the evidence is. But it's fair 307 00:17:10,400 --> 00:17:12,479 Speaker 1: to assume that that's the case. And that's why at 308 00:17:12,480 --> 00:17:14,520 Speaker 1: the top of the show today you called it an 309 00:17:14,560 --> 00:17:19,520 Speaker 1: information war like the Cold War of our generation exactly. 310 00:17:20,520 --> 00:17:22,720 Speaker 1: So if we've managed to keep our listeners till now 311 00:17:22,800 --> 00:17:25,760 Speaker 1: through this complicated journey inside the d n C hack, 312 00:17:26,160 --> 00:17:30,040 Speaker 1: first of all, thanks for sticking with us. And second 313 00:17:30,040 --> 00:17:33,000 Speaker 1: of all, I think the burning question everyone has now 314 00:17:33,160 --> 00:17:37,440 Speaker 1: is what's next. So far, it's been about introducing turmoil 315 00:17:37,520 --> 00:17:40,680 Speaker 1: into the democratic process. And you know, I'm not a 316 00:17:40,760 --> 00:17:43,360 Speaker 1: US citizen, but my girlfriend is, and I don't think 317 00:17:43,400 --> 00:17:47,040 Speaker 1: I know anyone who's more excited about voting in November 318 00:17:47,119 --> 00:17:50,879 Speaker 1: as she is. Could these Russian hackers, could they tamper 319 00:17:50,960 --> 00:17:54,000 Speaker 1: with her vote. That's one really really important point here. 320 00:17:54,240 --> 00:17:57,720 Speaker 1: In reality, it's very hard to hack actual votes. That 321 00:17:57,720 --> 00:18:01,200 Speaker 1: that's why information warfare like we are potentially seeing here 322 00:18:01,640 --> 00:18:04,160 Speaker 1: is so much easier to do. To do any real 323 00:18:04,280 --> 00:18:06,840 Speaker 1: damage to the votes, you'd have to actually hack the 324 00:18:06,920 --> 00:18:11,440 Speaker 1: vote tabulators, and these are computers that sit inside county 325 00:18:11,520 --> 00:18:15,320 Speaker 1: and state offices counting votes, and those are never supposed 326 00:18:15,320 --> 00:18:17,800 Speaker 1: to be connected to the Internet. Does that mean you 327 00:18:17,840 --> 00:18:20,119 Speaker 1: can't hack them ever? Of course not. It would just 328 00:18:20,200 --> 00:18:23,320 Speaker 1: be a huge undertaking. So I wouldn't worry too much 329 00:18:23,320 --> 00:18:26,280 Speaker 1: about the hacker stealing your vote. It could happen, it's 330 00:18:26,359 --> 00:18:28,879 Speaker 1: just not the most likely attack. So what should we 331 00:18:28,960 --> 00:18:32,359 Speaker 1: be worried about, Well, the biggest threat is actually that 332 00:18:32,400 --> 00:18:35,360 Speaker 1: the hackers could try to mess with your voter registration records, 333 00:18:35,400 --> 00:18:38,560 Speaker 1: not your actual vote. If you wanted to actually tamper 334 00:18:38,640 --> 00:18:41,680 Speaker 1: with the election results, you drop people from the voter 335 00:18:41,880 --> 00:18:44,760 Speaker 1: rolls and make it harder for them to vote, you know, 336 00:18:44,800 --> 00:18:47,800 Speaker 1: you change their polling locations to someplace far away, those 337 00:18:47,880 --> 00:18:50,399 Speaker 1: kinds of things. But I wonder, you know, are the 338 00:18:50,480 --> 00:18:53,320 Speaker 1: Russians what they want to do? Is it really tampering 339 00:18:53,359 --> 00:18:57,000 Speaker 1: with these results or is it more about traditional espionage. 340 00:18:57,520 --> 00:19:01,840 Speaker 1: Is it more about influencing the public perception of these 341 00:19:01,920 --> 00:19:05,679 Speaker 1: really important people in our democracy. My sense is that 342 00:19:06,280 --> 00:19:09,080 Speaker 1: if the goal here was to inject kind of chaos 343 00:19:09,240 --> 00:19:12,800 Speaker 1: into the into the system and to undermine confidence in 344 00:19:12,920 --> 00:19:16,720 Speaker 1: the democratic system. Uh, you know, then that's a really 345 00:19:16,800 --> 00:19:20,159 Speaker 1: powerful weapon. And it's been wielded pretty effectively here. And 346 00:19:20,200 --> 00:19:22,680 Speaker 1: in the meantime, Wiki leaks is saying that it still 347 00:19:22,760 --> 00:19:25,520 Speaker 1: has more emails at paint Hillary Clinton in a pretty 348 00:19:25,520 --> 00:19:28,560 Speaker 1: bad light. And I think we're all on edge here 349 00:19:28,560 --> 00:19:31,480 Speaker 1: waiting for that bombshell to drop. Yeah, we hear all 350 00:19:31,600 --> 00:19:33,560 Speaker 1: kinds of things about you know, it won't be an 351 00:19:33,600 --> 00:19:35,880 Speaker 1: October surprise. It will be a November surprise. There will 352 00:19:35,920 --> 00:19:38,960 Speaker 1: be more emails, and you know, with with hacked communications, 353 00:19:39,000 --> 00:19:45,639 Speaker 1: you almost never know what you're gonna get. All right, Well, Mike, 354 00:19:45,640 --> 00:19:47,680 Speaker 1: anything else you wanted to say about the the industry 355 00:19:47,760 --> 00:19:50,480 Speaker 1: or specifically, you know, what we what what voters should 356 00:19:50,480 --> 00:19:53,679 Speaker 1: expect going into November. Um, I would expect it will 357 00:19:53,720 --> 00:19:55,560 Speaker 1: be a wild rug. Yeah, that's what I was going 358 00:19:55,600 --> 00:19:57,360 Speaker 1: to say. Put your seat belt on, because you never 359 00:19:57,400 --> 00:19:59,800 Speaker 1: know what's gonna what's gonna turn up. You know, hopefully 360 00:19:59,840 --> 00:20:03,439 Speaker 1: it'll beyond eventful, but uh, it wouldn't surprise me if 361 00:20:03,480 --> 00:20:10,280 Speaker 1: it wasn't. Well, that's it for this week's episode of Decrypted. 362 00:20:10,400 --> 00:20:12,840 Speaker 1: Thanks for listening, and if you have an iPhone, be 363 00:20:12,880 --> 00:20:14,920 Speaker 1: sure to subscribe to the show on iTunes or any 364 00:20:14,960 --> 00:20:18,120 Speaker 1: of your favorite podcast apps out there. And while you're there, 365 00:20:18,200 --> 00:20:20,320 Speaker 1: please take a moment to rate and review our show. 366 00:20:20,720 --> 00:20:22,840 Speaker 1: These ratings and reviews really help get our show in 367 00:20:22,880 --> 00:20:24,840 Speaker 1: front of more listeners and let us know what you 368 00:20:24,880 --> 00:20:27,960 Speaker 1: thought of today's show. I'm on Twitter at Aki seven 369 00:20:28,359 --> 00:20:31,680 Speaker 1: and I met at Jordan's Are one thousand and Our 370 00:20:31,720 --> 00:20:35,600 Speaker 1: technology team here at Bloomberg is on Twitter at Technology. 371 00:20:35,720 --> 00:20:39,359 Speaker 1: This episode was produced by Pierre Getkari Magnus Hendrickson, and 372 00:20:39,440 --> 00:20:42,159 Speaker 1: Liz Smith, with help from Emily A view So. Alec 373 00:20:42,240 --> 00:20:45,360 Speaker 1: McCabe is head of Bloomberg Podcasts. We'll see you next week.