Speaker 1: On Friday, October seven, the U S Department of Homeland
Speaker 1: Security and the Office of the Director of National Intelligence
Speaker 1: released a statement, and it was a pretty stunning announcement.
Speaker 1: Barely two and a half months after a cyber attack
Speaker 1: was revealed on the Democratic National Committee, the Obama administration
Speaker 1: laid the blame at the feet of Russia's President Vladimir
Speaker 1: Putin with a strongly the US government publicly blaming a
Speaker 1: foreign country for attacking a U S entity, that's an
Speaker 1: incredibly rare thing. I was surprised when I saw the
Speaker 1: statement come out, even though it's something that the private
Speaker 1: cybersecurity experts have been talking about for a while. Uh,
Speaker 1: the government formally blaming a foreign entities only happened a
Speaker 1: handful of times, and specifically here, the US was accusing
Speaker 1: Russia of hacking the Democratic Party right as voters prepared
Speaker 1: to go to the polls on November eight. It's a
Speaker 1: scary prospect. Could hackers tamper with or even obliterate our votes.
Speaker 1: So here's my question. We are so close now to
Speaker 1: election day, and you can tell because that's really all
Speaker 1: you see on TV right now. So how do we
Speaker 1: know for sure what we think we know about these hacks.
Speaker 1: This is a perpetual problem in cybersecurity, and it reminds
Speaker 1: me of the famous New Yorker cartoon that goes on
Speaker 1: the internet. Nobody knows you're a dog, But when you're
Speaker 1: investigating a cybersecurity breach, uh, nobody knows whether you're a
Speaker 1: Russian hacker or a Chinese hacker pretending to be a
Speaker 1: Russian hacker, or even a US hacker pretending to be
Speaker 1: a Chinese hacker pretending to be a Russian hacker, or,
Speaker 1: as Donald Trump put it so delicately, I don't think
Speaker 1: anybody knows it was Russia that broke into the d
Speaker 1: n C. She's saying Russia, Russia, Russia, but I don't
Speaker 1: Maybe it was. I mean, it could be Russia, but
Speaker 1: it could also be China, could also be lots of
Speaker 1: other people. It also could be somebody sitting on the
Speaker 1: bed that weighs four hundred pounds. Okay, And how is
Speaker 1: the US or anyone else, for that matter, so certain
Speaker 1: that the Russians are trying to hijack our elections? What
Speaker 1: should an ordinary voter do? And should we even care? Hi,
Speaker 1: am Akito, and I'm George Robertson and this week on Decrypted,
Speaker 1: we're going to take you inside the hunt for the
Speaker 1: people who have the Democratic National Committee. It's a sort
Speaker 1: of tale of how two of the world's great superpowers
Speaker 1: have found themselves locked in an escalating information war just
Speaker 1: weeks before millions of Americans go to the polls, and
Speaker 1: the stakes they really couldn't be any higher. Not only
Speaker 1: is this the most divisive election we've seen in recent memory,
Speaker 1: with Hillary Clinton and Donald Trump advocating for completely different
Speaker 1: visions of America, but also hanging in the balance is
Speaker 1: the democratic process itself. What happens to a country's sovereignty
Speaker 1: in the age of the Internet. Our story today starts
Speaker 1: in April when the i T staff at the Democratic
Speaker 1: National Committee noticed something a little weird going on in
Speaker 1: their network. For our non American listeners, this is the
Speaker 1: official organization behind the Democratic Party, the d n SEE,
Speaker 1: and the i T staff there. They escalated their concerns,
Speaker 1: their executives and a cyber security firm called CrowdStrike what's
Speaker 1: called in to investigate so CrowdStrike is one of a
Speaker 1: small group of digital forensics firms that really all they
Speaker 1: do is investigate data breaches, and they went in they
Speaker 1: installed software in the DNC servers, essentially allowing them to
Speaker 1: spy on the spies, and it didn't take them long
Speaker 1: to pin the attacks on true groups of hackers associated
Speaker 1: with the Russian government. They called these groups Cozy Bear
Speaker 1: and Fancy Bear. Cozy Bear and Fancy Bear. Is this
Speaker 1: some kind of industry inside joke. Yeah, The cybersecurity industry
Speaker 1: has a lot of kind of goofy, funny names for groups.
Speaker 1: Their thematic often associated with a region. Uh. Some others
Speaker 1: are called deep Panda and things like that. I love that.
Speaker 1: Then CrowdStrike closed all the security holes that had allowed
Speaker 1: the attackers to breach the DNC servers, and so the
Speaker 1: hackers wouldn't be able to read the stay ask emails anymore. Now,
Speaker 1: normally you don't really disclose this kind of thing unless
Speaker 1: you absolutely have to. It's certainly embarrassing for the d
Speaker 1: n C, especially when, as we learned later, they were
Speaker 1: warned about their networks vulnerabilities and ended up ignoring those
Speaker 1: early warnings. But the d n C may have had
Speaker 1: a hint that some of this information was about to
Speaker 1: be leaked on the internet, so they dropped this bomb show.
Speaker 1: But first, the Democratic National Committee said today, Russian government
Speaker 1: hackers have penetrated its computer network. Breaches by two separate
Speaker 1: groups allowed hackers to access emails, internal chats, and opposition research.
Speaker 1: Democrats have compiled unpresumptive Republican nominee Donald Trump. That's PPS
Speaker 1: News Hour reporting the hack. On June fourteenth, the day
Speaker 1: this all became public, and it hit the US political
Speaker 1: system like a bolt of lightning. People were furious, how
Speaker 1: dare Russia try to mess with America that type of thing?
Speaker 1: And then one day after the DNC announcement, someone or
Speaker 1: a group of people who go by the name goose
Speaker 1: offer Too Datto came out in a blog post and
Speaker 1: basically laughed in the DNC's face. This person was like, no,
Speaker 1: you idiots, I am the lone hacker that infiltrated the
Speaker 1: DNC and this had nothing to do with the Russians.
Speaker 1: And goosefer Too Datto released a bunch of documents that
Speaker 1: he claimed he had stolen from the d n C
Speaker 1: as evidence that he was behind it, and from there
Speaker 1: it was chaos. Was it the Russians with some lunar
Speaker 1: kid who had too much time on his hands? And
Speaker 1: that's when crowd Strait called in this guy for help.
Speaker 1: My name is Mike Bartowski. I'm the senior vice president
Speaker 1: of cybersecurity services at Fidela Cybersecurity here in Maryland. I
Speaker 1: lead a incident response team of about thirty individuals and
Speaker 1: we've handled some of the largest breaches that have have
Speaker 1: occurred over the past decade or so. So I've known
Speaker 1: Mike for several years now, and he's a really interesting guy.
Speaker 1: Used to be a cop with the Montgomery County Police
Speaker 1: Department in Maryland, and he looks like at X cop.
Speaker 1: He's got the short cropped haircut, solidly built guy at
Speaker 1: very friendly and uh, you know, very genial. Even before
Speaker 1: his time in the private sector, he had this long
Speaker 1: experience of tracking down criminals. Mike's now an incident responder
Speaker 1: in cybersecurity speak, that means he flies out at the
Speaker 1: drop of a hat to companies that believe they've been
Speaker 1: breached and he helps investigate and fix their networks. So,
Speaker 1: like the computer nerd version of c s I or
Speaker 1: Law and Order right and Mike and Fidelis, his job
Speaker 1: was to independently verify the group of people who attack
Speaker 1: the DNC, and this cybersecurity version of the who done it? Investigation.
Speaker 1: It's called attribution in the industry, and CrowdStrike had asked
Speaker 1: Fidelis and to other firms to check their work. So
Speaker 1: so we had, um, you know, we got five pieces
Speaker 1: of now where we had a team of four reverse engineers.
Speaker 1: That's all they do is reverse engineering, so we had
Speaker 1: them bang on it. Jordan, I think we should have
Speaker 1: slain the store listeners. Sure, So crowd Strike sent Mike's
Speaker 1: team five files of the computer code that was on
Speaker 1: the DNC servers and was responsible for stealing information from
Speaker 1: the emails. And the job of Fidelis and these two
Speaker 1: other firms was to look at this code in what's
Speaker 1: called a virtual environment, like a parallel universe. Right, it's
Speaker 1: a simulated computer system where the code can't do any
Speaker 1: damage on the real servers. Hackers used all kinds of
Speaker 1: tricks to prevent their malware from even opening in that
Speaker 1: kind of hall of mirrors. So a key job of
Speaker 1: an investigator is decoding all of those techniques to see
Speaker 1: how the attack code actually behaves. Okay, and then Mike's
Speaker 1: team they compared that behavior. Two documented code in the
Speaker 1: past that was linked to the two hacker groups associated
Speaker 1: with the Russian government and crowd Strait called these two
Speaker 1: groups Cozy Bear and Fancy Bear, and the clues surface immediately.
Speaker 1: You know, really there were a couple of things that
Speaker 1: that we looked at, So you look at the complexity
Speaker 1: of of what the malware was able to do. The
Speaker 1: fact that it had the ability to m basically terminate
Speaker 1: itself and wipe its its tracks, hide its tracks. You know,
Speaker 1: that's not stuff you see in commoditized malware. Really, it
Speaker 1: kills itself. It kills itself. Yeah, and actually one of
Speaker 1: the functions within the one of the pieces of malware
Speaker 1: UM had had a terminology for essentially Harry Carey UM
Speaker 1: to kill itself. So this automatic suicide switch, this is
Speaker 1: something that's incredibly sophisticated, right, I mean, this is one
Speaker 1: of the reasons that Fidelist and CrowdStrike and the other
Speaker 1: forensics researchers were so taken aback by this malware. You know,
Speaker 1: there's a there's a black market for pre built malware
Speaker 1: on the Internet that even somebody like me can piece together,
Speaker 1: so like malware can be like legos. But this feature
Speaker 1: of killing yourself to avoid getting detected, that's really complicated stuff.
Speaker 1: And that's when Mike's team knew they were dealing with
Speaker 1: real pros here. You know, there aren't ton of people
Speaker 1: around the world who have this level of sophistication. And
Speaker 1: there were a bunch of other things that packed up
Speaker 1: this conclusion to the level of access that the malware
Speaker 1: gave the malicious user, UM was pretty astonishing. Uh. It
Speaker 1: was also written very very um well, I think I
Speaker 1: guess elegant is probably a good way to to say it.
Speaker 1: It was not sloppy by any stretch of the imagination. UM.
Speaker 1: And again, so you start looking at, Okay, who would
Speaker 1: have had the capability to do that? And you know,
Speaker 1: we we talked earlier how you know, Yeah, you can
Speaker 1: have somebody on the inside do something, but they may
Speaker 1: not be the best at it. So you have, uh,
Speaker 1: you've got to have people who are a lot of
Speaker 1: experience doing it or a lot of training to do it.
Speaker 1: And um, it was. It was a very complex piece
Speaker 1: of malware that the average person probably couldn't use. Uh.
Speaker 1: It's also not something that we've seen out in the
Speaker 1: wild necessarily, it's very targeted pieces of malware, very limited
Speaker 1: and can't buy it on the black market. You can't
Speaker 1: buy these components not that. No, not that we've come across. Okay, okay,
Speaker 1: so so far we know that this attack was orchestrated
Speaker 1: by someone really really good, someone really really experienced, and
Speaker 1: that immediately limited the pool of people who could be
Speaker 1: responsible for this. It really limited the pool of people
Speaker 1: to someone with the kind of resources with backing from
Speaker 1: an entire government. And on top of that, there were
Speaker 1: a bunch of things that pointed to the code being
Speaker 1: written in Russia. Yeah, some of these details are really interesting.
Speaker 1: So one of the most fascinating for me is, you know,
Speaker 1: from the way the code was written, it was clear
Speaker 1: that it was written on a Russian language keyboard, and
Speaker 1: the dates and times that the code was compiled was
Speaker 1: during normal business hours in Russia, and that's consistent with
Speaker 1: the code that's already been traced back to the Russian
Speaker 1: government backed hackers in the past. And that's not something
Speaker 1: that you can easily fake, right, like change the time
Speaker 1: stamps or something. Yeah, that was my question too, but
Speaker 1: Mike said, there's so many different things that you'd have
Speaker 1: to consistently change to successfully pull off that spoof. You're
Speaker 1: dealing with a situation that if it was a one off,
Speaker 1: easier to change, you know, same same thing with you know,
Speaker 1: you can change the day in time on your computer. Absolutely,
Speaker 1: you could do that, and it would potentially throw an
Speaker 1: investigator off consistently across five pieces of hour, okay, you know,
Speaker 1: probably a little more difficult across x number of pieces
Speaker 1: of malware across how many incidents and to all have
Speaker 1: them point to the same place. And that's why Mike
Speaker 1: doesn't buy Trump's theory of this four pound man sitting
Speaker 1: on the bed orchestrating this incredibly sophisticated attack, and why
Speaker 1: he doesn't buy Gooseifer two Dato's claim that he was
Speaker 1: a lone hacker. Okay, is it a script, kiddiers, it's
Speaker 1: somebody who bought a piece of malware? Or is it
Speaker 1: you know, somebody drinking mountain doing, eating twinkies and mom's basement. No,
Speaker 1: it really needs a level of operational discipline that you
Speaker 1: don't see really in the wild. And you're right, the
Speaker 1: number of people who could pull it off it becomes
Speaker 1: dramatically narrower. So Icky, are you convinced? I mean I
Speaker 1: think so. I don't know. I keep on expecting a twist,
Speaker 1: like you're you're tricking me, Like in law and order
Speaker 1: when the guy who seems really suspicious turns out to
Speaker 1: be innocent in the end. Yeah, I like that. Well,
Speaker 1: here's maybe the most important part. Then you need to
Speaker 1: look at the target, the victim of this hack, which
Speaker 1: was the d n C, and it later turned out
Speaker 1: a broad cross section of the U. S political system,
Speaker 1: everyone from lobbyists to lawyers to Hillary Clinton's campaign. And
Speaker 1: going back to Mike's background of working in law enforcement,
Speaker 1: you have to ask who would have had the motive
Speaker 1: to pour this kind of effort into spying on key
Speaker 1: members of American politics. Sure, an opportunistic hacker, you know,
Speaker 1: putting a feather in their caps, saying, hey, we you know,
Speaker 1: we broke into the d n C. Okay, yeah, I
Speaker 1: mean that that could potentially happen. Um. But then releasing
Speaker 1: the emails the evening before the convention started, Well then again,
Speaker 1: now you now you're looking at it, Okay, Well, you
Speaker 1: know that really smacks like an information operation. And here
Speaker 1: I think we should remind our listeners of the chronology
Speaker 1: of the events that took place just a few weeks
Speaker 1: after the d n C announced the hack in mid June.
Speaker 1: I mean, this was a time when the Republican Party
Speaker 1: was still in complete disarray, but things were looking pretty
Speaker 1: good for the Democrats. This was a time when Hillary
Speaker 1: Clinton UM was trying to solidify her support and you
Speaker 1: have this forest fire raging on the internet about this issue.
Speaker 1: You have Wiki leaks and Goosea for Toutato publishing a
Speaker 1: stream of emails that turned out to be really embarrassing
Speaker 1: for the d n C. At you know what couldn't
Speaker 1: have been a worse time for them, Yeah, like that
Speaker 1: one from when Bernie Sanders was still in the primary
Speaker 1: race with Hillary Clinton and a senior staff were at
Speaker 1: the DNC talked about how they should try to paint
Speaker 1: Sanders as an atheists, try to question his Jewish faith
Speaker 1: and the party itself is supposed to be neutral. And
Speaker 1: that led to a lot of turmoil within the party.
Speaker 1: I mean the Democratic Convention that took place at the
Speaker 1: end of July that was kind of a mess, at
Speaker 1: least at the beginning. All these Bernie supporters were protesting
Speaker 1: and booing down speakers on stage, and ultimately d n
Speaker 1: C Chairwoman Debbie Wasserman Schultz, who was a rising young
Speaker 1: star in the party, she resigned. And bringing this back
Speaker 1: to our story, today. Like you said, Jordan's this really
Speaker 1: does point to motive. I mean, who would really want
Speaker 1: to introduce this kind of turmoil to the democratic process
Speaker 1: itself in America, which is, you know, really the sacristanic thing.
Speaker 1: Who would want to do this thing that would make
Speaker 1: you question the fairness of the system that we've developed
Speaker 1: over the years. Yeah, this project has been interesting to
Speaker 1: me because I consider myself, you know, a pretty serious
Speaker 1: skeptic on a lot of these claims. It's it's just
Speaker 1: way too easy for a hacked entity to throw out, oh,
Speaker 1: the Russians did this, and the Chinese did that or whatever. Yeah,
Speaker 1: kind of like is get at a jail free card
Speaker 1: when your company has been hacked? Right, these really sophisticated,
Speaker 1: organized hackers backed by a whole government. If if someone
Speaker 1: like that tries to target you, what could you have
Speaker 1: possibly done. It's like when we reported about Yahoo's breach,
Speaker 1: which was this massive, you know, more than five million
Speaker 1: customer accounts getting hacked, we reported that the company's claim
Speaker 1: of the attack being state sponsored, you know, isn't so
Speaker 1: iron clad. But this one with the d n C.
Speaker 1: After talking to Mike, after talking to all these other experts,
Speaker 1: Jordan Are you convinced. Yeah, I'm pretty convinced. I mean,
Speaker 1: it takes a lot to clear that hurdle of you've
Speaker 1: got this piece of malware and this is evidence that
Speaker 1: the Russians did it. Uh, you know, but Mike will
Speaker 1: be the first to tell you this. Well, it's it's
Speaker 1: always risky. I mean, you know, when you're when you're
Speaker 1: you're doing attribution, you're really never saying a hundred percent
Speaker 1: that it's this person, because, you know, barring seeing somebody
Speaker 1: at the keyboard and actually doing it or a confession,
Speaker 1: you're you're relying on that circumstantial evidence. This all comes
Speaker 1: down to Mike's days as a cop. Can you prove
Speaker 1: to a jury beyond a reasonable doubt that the Russians
Speaker 1: did this? And his answer was yes. And now the
Speaker 1: US government has come out and officially blame the Russian government.
Speaker 1: And there are lots of reasons potentially for that happening.
Speaker 1: There are ways that the government can really know what's
Speaker 1: going on intercepted phone calls, intercepted emails, human and signals
Speaker 1: intelligence sources in a way that no private cybersecurity could
Speaker 1: ever match. Sounds a little sinister, Well, we don't know
Speaker 1: for sure. But here's what Rob Owens, who was an
Speaker 1: industry analyst at Pacific Press Securities, told me. Nation States
Speaker 1: do hack. I think the US government hacks as well.
Speaker 1: A well known fact within the industry that, uh, everybody's
Speaker 1: hacking everybody to some degree. So maybe the US government
Speaker 1: was buying on Russia while Russia was buying on the
Speaker 1: d n C. Well, we know that both countries fired
Speaker 1: each other all the time, but in this case, we
Speaker 1: don't know exactly what the evidence is. But it's fair
Speaker 1: to assume that that's the case. And that's why at
Speaker 1: the top of the show today you called it an
Speaker 1: information war like the Cold War of our generation exactly.
Speaker 1: So if we've managed to keep our listeners till now
Speaker 1: through this complicated journey inside the d n C hack,
Speaker 1: first of all, thanks for sticking with us. And second
Speaker 1: of all, I think the burning question everyone has now
Speaker 1: is what's next. So far, it's been about introducing turmoil
Speaker 1: into the democratic process. And you know, I'm not a
Speaker 1: US citizen, but my girlfriend is, and I don't think
Speaker 1: I know anyone who's more excited about voting in November
Speaker 1: as she is. Could these Russian hackers, could they tamper
Speaker 1: with her vote. That's one really really important point here.
Speaker 1: In reality, it's very hard to hack actual votes. That
Speaker 1: that's why information warfare like we are potentially seeing here
Speaker 1: is so much easier to do. To do any real
Speaker 1: damage to the votes, you'd have to actually hack the
Speaker 1: vote tabulators, and these are computers that sit inside county
Speaker 1: and state offices counting votes, and those are never supposed
Speaker 1: to be connected to the Internet. Does that mean you
Speaker 1: can't hack them ever? Of course not. It would just
Speaker 1: be a huge undertaking. So I wouldn't worry too much
Speaker 1: about the hacker stealing your vote. It could happen, it's
Speaker 1: just not the most likely attack. So what should we
Speaker 1: be worried about, Well, the biggest threat is actually that
Speaker 1: the hackers could try to mess with your voter registration records,
Speaker 1: not your actual vote. If you wanted to actually tamper
Speaker 1: with the election results, you drop people from the voter
Speaker 1: rolls and make it harder for them to vote, you know,
Speaker 1: you change their polling locations to someplace far away, those
Speaker 1: kinds of things. But I wonder, you know, are the
Speaker 1: Russians what they want to do? Is it really tampering
Speaker 1: with these results or is it more about traditional espionage.
Speaker 1: Is it more about influencing the public perception of these
Speaker 1: really important people in our democracy. My sense is that
Speaker 1: if the goal here was to inject kind of chaos
Speaker 1: into the into the system and to undermine confidence in
Speaker 1: the democratic system. Uh, you know, then that's a really
Speaker 1: powerful weapon. And it's been wielded pretty effectively here. And
Speaker 1: in the meantime, Wiki leaks is saying that it still
Speaker 1: has more emails at paint Hillary Clinton in a pretty
Speaker 1: bad light. And I think we're all on edge here
Speaker 1: waiting for that bombshell to drop. Yeah, we hear all
Speaker 1: kinds of things about you know, it won't be an
Speaker 1: October surprise. It will be a November surprise. There will
Speaker 1: be more emails, and you know, with with hacked communications,
Speaker 1: you almost never know what you're gonna get. All right, Well, Mike,
Speaker 1: anything else you wanted to say about the the industry
Speaker 1: or specifically, you know, what we what what voters should
Speaker 1: expect going into November. Um, I would expect it will
Speaker 1: be a wild rug. Yeah, that's what I was going
Speaker 1: to say. Put your seat belt on, because you never
Speaker 1: know what's gonna what's gonna turn up. You know, hopefully
Speaker 1: it'll beyond eventful, but uh, it wouldn't surprise me if
Speaker 1: it wasn't. Well, that's it for this week's episode of Decrypted.
Speaker 1: Thanks for listening, and if you have an iPhone, be
Speaker 1: sure to subscribe to the show on iTunes or any
Speaker 1: of your favorite podcast apps out there. And while you're there,
Speaker 1: please take a moment to rate and review our show.
Speaker 1: These ratings and reviews really help get our show in
Speaker 1: front of more listeners and let us know what you
Speaker 1: thought of today's show. I'm on Twitter at Aki seven
Speaker 1: and I met at Jordan's Are one thousand and Our
Speaker 1: technology team here at Bloomberg is on Twitter at Technology.
Speaker 1: This episode was produced by Pierre Getkari Magnus Hendrickson, and
Speaker 1: Liz Smith, with help from Emily A view So. Alec
Speaker 1: McCabe is head of Bloomberg Podcasts. We'll see you next week.