Speaker 1: Bloomberg Audio Studios, podcasts, radio news.
Speaker 2: Seventeen hundred miles off the coast of Taiwan in the
Speaker 2: middle of the Pacific Ocean, Melvin Quek is hard at
Speaker 2: work at the Guam Power Authority or GPA.
Speaker 1: My role is a Chief Information Technology officer for Guampaw Authority.
Speaker 2: A few months ago, he showed Bloomberg reporter Katrina Manson around.
Speaker 3: So where are we now?
Speaker 1: We're going to process some control center.
Speaker 2: GPA is the only power utility on the small tropical island.
Speaker 2: In addition to the roughly six hundred thousand tourists who
Speaker 2: flock there for its white sand beaches each year, GWAM
Speaker 2: is home to about one hundred seventy thousand people, and
Speaker 2: over twenty one thousand of them are US service members
Speaker 2: and their families. Nearly a third of the island is
Speaker 2: taken up by Air Force, Marines, naval and other military bases.
Speaker 2: Everyone on the island depends on GPA paws, including the military.
Speaker 1: They're one of our top customers. We supply constant and
Speaker 1: reliable powers in him.
Speaker 2: Six years into the job, Melvin was pretty happy with
Speaker 2: his work. He'd made progress on connecting GPA's customers to
Speaker 2: a remote digital grid. But in twenty twenty two, US
Speaker 2: federal agents ky knocking. It seemed they wanted to check
Speaker 2: GPA's network for signs of foul play. The US government
Speaker 2: is increasingly concerned about hackers getting access to civilian critical
Speaker 2: systems that the US military relies on, particularly hackers from China.
Speaker 2: In recent weeks, US officials say Chinese hackers infiltrated Treasury
Speaker 2: Department computers, and a state sponsored Chinese hacking campaign breached
Speaker 2: nine telecommunications firms. Some officials have been raising the alarm
Speaker 2: for the past year or so that hackers may have
Speaker 2: already breached systems in Guam, and you're preparing for an
Speaker 2: attack not just on its data, but on its critical infrastructure.
Speaker 2: The island, which is a US territory, is three times
Speaker 2: clear to Shanghai than it is to Los Angeles. So
Speaker 2: for Melvin and his four person cybersecurity team, keeping the
Speaker 2: lights on is a matter of national security.
Speaker 1: Of China's access to this, then that would be a
Speaker 1: really bad situation because then they could disrupt communications.
Speaker 3: And do you have the sense that you all a
Speaker 3: target for China?
Speaker 1: Oh, I'm sure we are. We see on our network
Speaker 1: every day, multiple ips trying to come in, trying to
Speaker 1: get into our network.
Speaker 3: Do you feel like if you've got it on the
Speaker 3: control bigs?
Speaker 2: I hope. So this is the big take DC from
Speaker 2: Bloomberg News. I'm David Gura today on the show Inside
Speaker 2: the cybersecurity threats that are impacting Guam and what's at
Speaker 2: stake for the rest of the country if the US
Speaker 2: government's worst fears about the island's vulnerabilities come true. To
Speaker 2: understand Guam's significance to the US right now, it's important
Speaker 2: to understand how it's related to the ongoing conflict between
Speaker 2: China and Taiwan. For decades, China has claimed Taiwan as
Speaker 2: part of its territory and denied the island's self governing status.
Speaker 2: China's president Chi Chimping has said he wants his military
Speaker 2: to be capable of taking Taiwan by twenty twenty seven,
Speaker 2: without saying that he intends to do so by then.
Speaker 2: According to Bloomberg Katrina Manson, if China tried to invade Taiwan,
Speaker 2: Guam could be a kind of staging post for the
Speaker 2: US to push back if it decided to, Katrina says
Speaker 2: one Washington think tank has gained out what could happen.
Speaker 3: In twenty four out of the twenty four scenarios they modeled.
Speaker 3: China sents a missile direct to Guam, and in fact
Speaker 3: these missiles are nicknamed the Guam Keller. North Korea has them,
Speaker 3: China has them. The point is they can reach Guam,
Speaker 3: so Guam is a target, and of course for the island,
Speaker 3: that's very fraud.
Speaker 2: Gwam holds a lot of strategic importance to the US.
Speaker 2: It's the country's westernmost point. The US is building a
Speaker 2: new marine base there and planning a network of missile
Speaker 2: des systems. The island is often considered by military strategists
Speaker 2: as a critical piece of US influence in Asia, and
Speaker 2: the people who live there often feel that geopolitical pressure.
Speaker 4: There are people that are concerned about increased militarization here.
Speaker 2: That's Guam's governor, Lord is Afflequis Leon Guerrero.
Speaker 4: Gwam geographically is in a line of commerce and trade
Speaker 4: in the waters, and superpowers are fighting for that control.
Speaker 2: But beyond Guam's geographically vulnerable position, Governor Guerrero told Katrina
Speaker 2: there is another concern at the top of her mind.
Speaker 4: My biggest priority is cybersecurity.
Speaker 2: And she isn't alone. A missile strike is a concern.
Speaker 3: But Rare Admiral Huffman, who's the top military commander on
Speaker 3: the island, told me, and we think cyber attacks are
Speaker 3: more likely. This is a more effective way to undermine
Speaker 3: the US military's ability to move about to stage any
Speaker 3: kind of defense turn posture. When it comes to Taiwan.
Speaker 2: Cyber threats on the island aren't just theoretical. There's one
Speaker 2: campaign that has experts particularly concerned. Researchers have dubbed it
Speaker 2: volt Typhoon. Katrina says. Cybersecurity experts first noticed it in
Speaker 2: twenty twenty one when Microsoft researchers were investigating a cyber
Speaker 2: attack on a port in Texas.
Speaker 3: And several months later, in January twenty twenty two, they
Speaker 3: started seeing similarities at a telecommunications company on Guam, and
Speaker 3: then they kept pulling on the thread, and in summer
Speaker 3: that year there was another telco that seemed to have
Speaker 3: been affected by the same thing. And then some other
Speaker 3: security researchers saw that this same kind of pattern was
Speaker 3: occurring on the Guam government's network and also another ISP.
Speaker 3: So there was a particular concentration on telecommunications companies on Guam,
Speaker 3: and that started to get people.
Speaker 2: Thinking thinking about why hackers might want to infiltrate QUAM
Speaker 2: systems and what they could do if they decided to
Speaker 2: exploit that access. Vult Typhoon is not focused on stealing
Speaker 2: data like a typical hacker you might imagine. Instead, its
Speaker 2: hackers are targeting operational technology systems think water systems, satellites,
Speaker 2: and rail lines. They're gaining access to these systems that
Speaker 2: control critical infrastructure and they're just waiting, but for what.
Speaker 3: Eventually the government came to the conclusion that these hackers
Speaker 3: were there waiting for the moment that it might be
Speaker 3: useful to disrupt services. So you can disrupt a network
Speaker 3: and take things data from a network that's usually used
Speaker 3: for spying. Or you can try and move over to
Speaker 3: what's called the operational technology system and actually stop something
Speaker 3: from moving. Stop the sewage from working in the right way,
Speaker 3: poison the water, interrupt electricity supply, stop phones from working.
Speaker 3: These are the absolute daily pieces of critical infrastructure that
Speaker 3: daily life relies on, and also so do military bases,
Speaker 3: because maybe you can't go up against a military in war,
Speaker 3: but maybe you can undermine every single thing about how
Speaker 3: they work.
Speaker 2: And in a moment of crisis, like a potential invasion
Speaker 2: of Taiwan, those systems going down could compromise the US
Speaker 2: ability to react.
Speaker 3: And I think, as we've seen with the invasion of Ukraine,
Speaker 3: whether you are able to achieve your target or not
Speaker 3: may or may not come down to how quickly you
Speaker 3: can mobilize your forces. And so the idea that in
Speaker 3: the American mind, China might be able to impede a
Speaker 3: US military response simply by undermining its own ability to
Speaker 3: move a military because you can't call your forces, you
Speaker 3: can't get the planes going, you can't refuel them. Any
Speaker 3: of those things will be potentially very significant.
Speaker 2: The US has concluded that China was to blame for
Speaker 2: the hacking campaign, but it hasn't shared much information publicly
Speaker 2: about how it came to that conclusion. They've laid the
Speaker 2: blame at China. What has China said in reply?
Speaker 3: China has four years denied doing any kind of hacking
Speaker 3: campaigns of this sort. China has that actually this is
Speaker 3: ransomware actors, this is not US, and absolutely denied it.
Speaker 3: And in fact, I said, the US is making these
Speaker 3: claims just to try and convince Congress to send funding
Speaker 3: their way.
Speaker 2: With the threat of a large scale vault Typhoon attack
Speaker 2: on GWAM looming, what are lawmakers in the US doing
Speaker 2: to prevent the worst? That is after the break. US
Speaker 2: officials are worried that GWAM could face a crippling cyber
Speaker 2: attack that would put everything from its infrastructure to military
Speaker 2: capability in danger. They've been sounding the alarm about an
Speaker 2: ongoing hacking campaign dubbed vault Typhoon. Bloomberg reporting found that
Speaker 2: the US has already discovered more than one hundred intrusions
Speaker 2: across the country connected to the wide ranging campaign. Some
Speaker 2: cybersecurity experts say these hackers are slowly making their way
Speaker 2: into GUAM systems, waiting for the right moment to attack.
Speaker 3: The US has been very front forward about brief and
Speaker 3: Congress about telling the security community, please go look for
Speaker 3: this and we need your help to see where it
Speaker 3: may be because it won't interrupt your systems until it's
Speaker 3: too late. So almost a year after vault Typhoon was
Speaker 3: announced to the world, a series of intelligence chiefs briefed
Speaker 3: Congress in January twenty twenty four, saying this could be
Speaker 3: an everything everywhere, all at once scenario.
Speaker 2: Here's Jenn Easterly, director of the Cybersecurity and Infrastructure Security Agency,
Speaker 2: testifying in front of Congress.
Speaker 5: This is a world where a major crisis halfway across
Speaker 5: the planet could well endanger the lives of Americans here
Speaker 5: at home through the disruption of our pipelines, the severing
Speaker 5: of our telecommunications, the pollution of our water facilities, the
Speaker 5: crippling of our transportation modes, all to ensure that they
Speaker 5: can incite societal panic and chaos and to deter our
Speaker 5: ability to marshal military might and civilian will.
Speaker 3: It really is the stuff of movies, the idea that
Speaker 3: not just at electricity, but also hospitals, also telecommunications, every
Speaker 3: single element that our lives rely on could go wrong.
Speaker 3: And their point is, please check your systems, Please work
Speaker 3: with us, Please let us check your systems. We really
Speaker 3: need to find this, and it's very difficult to find.
Speaker 2: The way Guam's networks are set up makes it particularly difficult.
Speaker 2: They're run by a patchwork of privately owned companies. Some
Speaker 2: of these companies, like Guampower Authority, have been cooperating with
Speaker 2: the federal government. Bud Katrina says companies are not always
Speaker 2: eager to invite the FBI to snoop around their systems,
Speaker 2: especially when the government isn't forthcoming with information about these
Speaker 2: threats because of security and legal concerns.
Speaker 3: US intelligence officials make the point, we are not able
Speaker 3: to get onto domestic networks. We cannot find where the
Speaker 3: enemy the adversary. Maybe we need private companies to do that.
Speaker 3: They own the domestic networks, and so there's a real
Speaker 3: appeal to private companies, which are often small, underresourced, or
Speaker 3: not thinking in terms of national security. What on earth
Speaker 3: should we do and why should we do it? And
Speaker 3: even the governor complained to me. I asked for a briefing.
Speaker 3: I asked Microsoft, I asked the government. I asked the
Speaker 3: telecommunications companies what has happened? And she said they shrugged
Speaker 3: it off. They said, something happened, but everything's fine now.
Speaker 4: They were very mum about it. Really, there was never
Speaker 4: any briefing. It was yes, it happened, but we've addressed it.
Speaker 3: And so even for the people whose job it is
Speaker 3: to come up with these plans, they often don't have
Speaker 3: the full picture. And that kind of coordination I think
Speaker 3: has proved really tricky.
Speaker 2: With Donald Trump's return to the White House US China
Speaker 2: relations and the government's approach to cybersecurity could be set
Speaker 2: to change. I asked Katrina what that might mean for
Speaker 2: Guam and the threat of volt typhoon.
Speaker 3: I think it'll be really interesting to see how the
Speaker 3: Trump administration handles the entire question of Taiwan. This is
Speaker 3: an administration that has set it really believes into terrence.
Speaker 3: It wants to make a big point with the US military.
Speaker 3: It doesn't want wars. But clearly President elect Trump has
Speaker 3: said he wants the US military to be the most
Speaker 3: lethal in the world, and he's very focused on China, obviously,
Speaker 3: So I think the idea that these kind of cyber
Speaker 3: threats will continue is clear, and wrangling this relationship between
Speaker 3: the private sector and the government interest will continue to
Speaker 3: be difficult. And of course, the Trump administration also doesn't
Speaker 3: really like regulation, so the idea that you'll be able
Speaker 3: to compel companies to participate also seems quite remote to me.
Speaker 3: I would imagine it remains rather difficult for national security
Speaker 3: people to get what they want in Guam.
Speaker 2: Thank you very much, thanks for having me. This is
Speaker 2: the Big Take DC from Bloomberg News. I'm David Gerra.
Speaker 2: This episode was produced by Julia Press. It was edited
Speaker 2: by Aaron Edwards, Josh to A Brustein, Andrew Martin, and
Speaker 2: Nick Wadhams. It was mixed and sound designed by Alex Sagura,
Speaker 2: fact checked by Andreana Tapia. Our senior producer is Naomi Shaven.
Speaker 2: Our senior editor is Elizabeth Ponso. Our executive producer is
Speaker 2: Nicole beemster Boor. Sage Bauman is Bloomberg's head of podcasts.
Speaker 2: If you liked this episode, make sure to subscribe and
Speaker 2: review The Big Take DC wherever you listen to podcasts.
Speaker 2: It helps people find the show. Thanks for listening. We'll
Speaker 2: be back tomorrow