Speaker 1: July twelve, sixteen started out, It's just another day from
Speaker 1: Matt Emmons. At the time, Matt was an I T
Speaker 1: technician with the Illinois Board of Elections, and just as
Speaker 1: everyone in the office was getting settled into the workday,
Speaker 1: I think it was about one of his colleagues noticed
Speaker 1: something strange with the state's voter registration system. It essentially
Speaker 1: was at a dead stop. You couldn't do anything. So
Speaker 1: Matt's colleague went about troubleshooting and found that the server
Speaker 1: hosting the voter database was running on overdrive. Something was
Speaker 1: jamming the system, so he took a look at the
Speaker 1: request coming in. What's normally a trickle of orderly requests
Speaker 1: like five times per second was suddenly more like a flood.
Speaker 1: It was shortly after that that I believe I got
Speaker 1: called over there. It didn't take long for Matt's team
Speaker 1: to realize they were under attack. Within an hour they
Speaker 1: found him fixed the security hole that the hackers used
Speaker 1: to get into their system, and then for good measure,
Speaker 1: they took the whole system offline while they started looking
Speaker 1: for the culprits of the hack. Breaking news out of Washington,
Speaker 1: twelve Russian intelligence officers indicted. Today, we now know this
Speaker 1: is part of Russia's attempt to meddle with the sixteen
Speaker 1: elections here in the United States, which of course has
Speaker 1: dominated our headlines. Ever sank into and while we continue
Speaker 1: to talk about what happened back then, the next election
Speaker 1: is just around the corner, facing off government backed hackers
Speaker 1: from Russia, Iran, North Korea, and even China. Our states
Speaker 1: and municipalities ready for the next one. Am Ito, you're
Speaker 1: listening to Decrypted stay with us? So, Cardike, you are
Speaker 1: a cybersecurity reporter here at Bloomberg, brand new to our
Speaker 1: tech team. Welcome to the show. Thanks so much. You're
Speaker 1: just getting started on an incredibly complicated beat here. I
Speaker 1: am it's been about a month. I am totally overwhelmed,
Speaker 1: and I think I think I should be, because there's
Speaker 1: just so much to understand in the world of cybersecurity. Um,
Speaker 1: there's so many threat actors that pose risks to companies
Speaker 1: and states and political parties. Fortunately, my focus will be
Speaker 1: on election security and so I can narrow down my
Speaker 1: attention reporting on that, and hopefully we'll have a lot
Speaker 1: of interesting conversations to have in the weeks to come.
Speaker 1: So this is the thing that you're going to dedicate
Speaker 1: the next year to the next year. I hope to
Speaker 1: be your guy on election security for our listeners who
Speaker 1: don't quite remember all of the details of what happened
Speaker 1: back in and this actually includes me. Can you go
Speaker 1: over what Russian hackers actually succeeded in doing back then?
Speaker 1: What they succeeded in most was disinformation and we're going
Speaker 1: to set that aside. What we're going to talk about
Speaker 1: are the three major hacks of election systems in the
Speaker 1: United States. We are learning more about the hat into
Speaker 1: the Democratic National Committee, including the first was of the
Speaker 1: Democratic National Committee, which I think everyone knows the most
Speaker 1: about on believe of the convention. Wiki leaks released thousands
Speaker 1: of emails from the time. There are a number of
Speaker 1: emails in which senior officials can be seen conspiring against
Speaker 1: Bernie Sanders, the chair of the d n C, Congresswoman
Speaker 1: Debbie Wasserman Schultz, has announced her resignation. It comes after
Speaker 1: those leaked emails. We actually ran an episode about this
Speaker 1: three years ago, so our listeners are well versed, very good.
Speaker 1: The other two hacks they may not know as much about.
Speaker 1: Justin Governor Rhonda Santis now says Russian hackers gained access
Speaker 1: to voter databases into Florida counties ahead of the presidential election.
Speaker 1: The first one is Florida, which nobody knows much about.
Speaker 1: The DHS and the state officials have been a secretive
Speaker 1: about this one. The governor can't say the names of
Speaker 1: the counties involved because he signed a confidentiality agreement with
Speaker 1: the FBI. Hackers sent phishing emails to county officials. Two
Speaker 1: of them clicked on the links and allowed Russian hackers
Speaker 1: access to their database. All we know is that votes
Speaker 1: weren't changed. Then there's Illinois, which you know in a
Speaker 1: lot more about because they've been forthcoming about what happened.
Speaker 1: And briefly, what happened was that in the middle of
Speaker 1: June of two thousand sixteen, hackers found an unlocked door
Speaker 1: in the voter registration database, got in and downloaded as
Speaker 1: much information as they could. After three weeks of unloading
Speaker 1: and trying to change information, they said, Hi, Illinois, we've
Speaker 1: been here all along, and they shut down their system.
Speaker 1: This was the thing that Matt Emmons and his colleagues
Speaker 1: discovered all the way out in July. That's right. So
Speaker 1: three weeks after they got in in the middle of
Speaker 1: July in two thousand and sixteen, Matt Emmons and his
Speaker 1: colleagues discovered that Russian hackers have been in their system
Speaker 1: all along, trying to gain access to social security numbers,
Speaker 1: driver's license numbers, names addresses, phone numbers, anything related to
Speaker 1: your voter registration information. They found that seventy six thousand
Speaker 1: people's data had been accessed by Russian hackers in a
Speaker 1: way that they could relate these data points to actual people,
Speaker 1: and do these people know who they are? They do so.
Speaker 1: They all received notifications in the mail shortly after the
Speaker 1: hack informing them that their data had been compromised. Nothing
Speaker 1: that's followed indicated that Russia did something with these names,
Speaker 1: but they do have the information. But they do have
Speaker 1: the information, that's right, So Illinois says nothing happened, No
Speaker 1: data was changed because Russian hackers only had read access
Speaker 1: to the data. They could download as much of it
Speaker 1: as they wanted to, but they couldn't actually change anything.
Speaker 1: They didn't have right permissions. The Department of Homeland Security
Speaker 1: told the Senate Intelligence Committee earlier this year on the
Speaker 1: report that we saw that they could have done more,
Speaker 1: and they stayed quote. Why they didn't is an open
Speaker 1: ended question. Yeah, it's weird. If if they were able
Speaker 1: to go further, why wouldn't they The answer to that
Speaker 1: is pure speculation, both on my part and the Department
Speaker 1: of Homeland Security. They don't know the answer. But the
Speaker 1: worst case scenario there is that they were seeking intelligence
Speaker 1: for the future so that next time they really want
Speaker 1: to access a database and change something they know how to,
Speaker 1: or that they were there to drop secret malware that
Speaker 1: they can trigger in the future when they want to.
Speaker 1: Officials on both the federal and state level believe that
Speaker 1: there is no malware in the Illinois voter registration database. Theoretically,
Speaker 1: if hackers decided to do more than just download names
Speaker 1: and addresses from the voter database, if they actually made
Speaker 1: changes to that database, what could they do Because this
Speaker 1: is different from going into the voting machines, for example,
Speaker 1: and changing the ballots themselves. So the worst case scenario
Speaker 1: here is that when you arrive to vote, the poll
Speaker 1: book that has all the voter registration information wouldn't match
Speaker 1: up with your own information. You couldn't verify that you
Speaker 1: are the person who registered to vote, and you may
Speaker 1: not be able to vote immediately, or you may have
Speaker 1: to cast a provisional ballot that might be verified and
Speaker 1: might not in the future. And why would hackers from
Speaker 1: say Russia wants something like that. Well, there's a couple
Speaker 1: of reasons. One, it's a form of voter suppression. There
Speaker 1: might be fewer ballots cast if the registration system has
Speaker 1: been altered b you, so mistrust in the election system.
Speaker 1: There are fewer people coming out to vote if they
Speaker 1: believe that even by registering to vote, when they arrive
Speaker 1: they can actually vote or vote in the way that
Speaker 1: they expect to. So they're creating roadblocks and mistrust in democracy.
Speaker 1: So what is Illinois doing this time to better protect
Speaker 1: their systems? So all states got a portion of million
Speaker 1: dollars from the federal government in grants and they match
Speaker 1: that with a small portion of their own, So thirteen
Speaker 1: million in federal funds and five million from the state
Speaker 1: to hire a new staff. The biggest hiring push has
Speaker 1: been in a program called cyber Navigators, which is probably
Speaker 1: the coolest name in election security since in the it
Speaker 1: is kind of nerdy election security as Canton nerdy. So
Speaker 1: they've spent a large chunk of change hiring these nine
Speaker 1: cyber navigators who oversee different pockets of Illinois, and a
Speaker 1: lot of these counties don't have much I T support,
Speaker 1: so these individuals are meant to be the front lines
Speaker 1: for these counties and ensuring that any vulnerabilities that currently
Speaker 1: exist are plugged. So they're going to go through cycles
Speaker 1: of assessment between now and over and over again to
Speaker 1: ensure that there are no new vulnerabilities between now and
Speaker 1: an election day. Are they doing anything else? Illinois has
Speaker 1: a couple of things going on. They have what are
Speaker 1: called Albert sensors installed. They allow both state and federal
Speaker 1: officials to monitor Illinois voting apparatus, so if there's any
Speaker 1: outside infiltration, both the state and the Department of Homeland
Speaker 1: Security will know and should be able to respond. They
Speaker 1: also have the National Guard on call and and what
Speaker 1: the National Guard do. The National Guard is available in
Speaker 1: the event of a hack on election day, so if
Speaker 1: a remote county in Illinois is infiltrated, the National Guard
Speaker 1: can call on their cyber warriors to get in a
Speaker 1: chopper and fly to DeKalb County to respond to any
Speaker 1: hack to protect the integrity of the election. We'll be
Speaker 1: right back. So before the break Cardike. You walked us
Speaker 1: through the different things that Illinois is doing to better
Speaker 1: protect itself. It actually sounded like quite a bit to me.
Speaker 1: I guess the big question is will that be enough?
Speaker 1: I talked to a lot of people in the last
Speaker 1: month and a half and it's a little more complicated
Speaker 1: than just yes or no. One expert I talked to
Speaker 1: is an analyst at fire Eye. His name is Luke McNamara.
Speaker 1: I think you have with the states and many of
Speaker 1: them playing catch up with the resources they have, and
Speaker 1: I think it's a very difficult place to be in
Speaker 1: when trying to reach a more coroactive footing to deal
Speaker 1: with this threat. As the threat evolve, are these states
Speaker 1: in a perpetual cycle of playing catch up? I think
Speaker 1: some are are putting the right resources in place, that
Speaker 1: putting the right investments in place, But it is a
Speaker 1: very difficult problem to address, uh. And there's there's some
Speaker 1: amount of irony here in that. A lot of the
Speaker 1: threat vectors, a lot of the methodologies that we see,
Speaker 1: even some of the more advanced threat actors utilizing, are
Speaker 1: very simple in nature. When we look at how the
Speaker 1: majority of intrusions begin, the majority of attacks begin, they
Speaker 1: begin with spear fishing for the most part, and I
Speaker 1: think even helping those county clerks, those election administrators understand
Speaker 1: how to look for signs of spearfish and how to
Speaker 1: identify that that I think can pay dividends and that
Speaker 1: doesn't necessarily need to involve the deployment of expensive technology.
Speaker 1: By the way, Luke's employer, fire I is helping at
Speaker 1: least fifteen states along with municipalities and counties, the bigger
Speaker 1: counties that can actually afford to pay fire EYE prepare
Speaker 1: for And so we just heard Luke talk about spear fishing.
Speaker 1: This is when hackers send county officials an email with
Speaker 1: an attachment something like a click here exactly. They shouldn't
Speaker 1: be clicking, but when they do, they allow the infiltraders
Speaker 1: access to their networks. So fire I is trying to
Speaker 1: make sure that county clerks aren't clicking. One of the
Speaker 1: other things they're doing is offering intelligence to local officials
Speaker 1: about their attackers. Fire I believe is that the best
Speaker 1: way to prepare foreign adversary is to understand your adversary,
Speaker 1: to know exactly why they want to infiltrate your system
Speaker 1: and how they'll do it. I think certainly Russia, from
Speaker 1: what we've seen UM they are have shown themselves to
Speaker 1: be the most aggressive and going after democratic institutions and processes,
Speaker 1: and I think as a result, it's very important for
Speaker 1: us to pay attention to what we see, particularly with
Speaker 1: European elections between now and UM. But I think that
Speaker 1: maybe more hasn't been said about that there are other
Speaker 1: threat groups that are active in the space. We've seen
Speaker 1: China target elections Cambodia last year, certainly the case probably
Speaker 1: as well for Iran. What's at stake when we talk
Speaker 1: about election hacking? Are you worried about hackers hijacking election results?
Speaker 1: Are we talking about the credibility of results? Or is
Speaker 1: it something else altogether? Yeah? I think in many respects
Speaker 1: it's the activity that falls short of actually compromising votes
Speaker 1: that concerns me more. Um, they could do a repeat
Speaker 1: of what we've seen them do in Ukraine in previous years,
Speaker 1: where they compromised the central election commissioned website and then
Speaker 1: posted out erroneous results. None of the actual results themselves
Speaker 1: were changed, but it was sufficient enough to cause some
Speaker 1: people probably to question what is is really real in
Speaker 1: the situation. So I think those sorts of intrusions, those
Speaker 1: sorts of attacks, the sorts of disinformation campaigns that maybe
Speaker 1: fall short of actual compromising and deletion or destruction of
Speaker 1: voter data, but I can still be effective at causing infusion.
Speaker 1: Those are things that we should heavily consider and be
Speaker 1: prepared for. Okay, So to sum it up, the good
Speaker 1: news is that we now at least know to prepare
Speaker 1: for this, which is a big step. And we also
Speaker 1: know that the hackers gained access in pretty simple ways,
Speaker 1: which means the defenses could be pretty simple too. But
Speaker 1: then the bad news is that the hackers might step
Speaker 1: up their game this time, and there are now more
Speaker 1: potential adversaries than just Russia. Does that sound like a
Speaker 1: good summary. That's about right, and that's probably pretty daunting
Speaker 1: on its own. But that's only part of the problem.
Speaker 1: And so I called Illinois Governor J. B. Pritzker I
Speaker 1: riser Governor fritzger Good afternoon to talk through the other
Speaker 1: challenges he's facing. And the biggest one is probably the
Speaker 1: fact that he's trying to solve a federal security crisis
Speaker 1: on a state budget. It's a national security issue, um,
Speaker 1: and the federal government should be at the forefront. And
Speaker 1: I'm finding, at least for our state, that the state
Speaker 1: is at the forefront and the federal government is there
Speaker 1: for uh less than the leadership role. I'm not viewing
Speaker 1: myself as dependent upon Washington d C. I would say
Speaker 1: the states would like more help, and we are. Um,
Speaker 1: you know, we've expressed that by more help, is he
Speaker 1: talking about federal money. Yeah, he wants Congress and the
Speaker 1: Trump administration to approve new grants to give to states.
Speaker 1: So far, Illinois received thirteen million dollars in two thousand
Speaker 1: and eighteen. They matched five million of their own. But
Speaker 1: what they really say they need is a hundred and
Speaker 1: seventy five million dollars to gut their election apparatus and
Speaker 1: build a system they believe is safe and secure, not
Speaker 1: just for but for the future. So that's a major shortfall.
Speaker 1: There's a massive gap in what they have and what
Speaker 1: they need. And so aside from the shortfall and resources
Speaker 1: to rebuild the state's election infrastructure, state and local governments
Speaker 1: also don't have the money to hire the best engineers
Speaker 1: to protect their systems. Look think about what someone like
Speaker 1: Ron Garry, a with his background was probably earning in
Speaker 1: the private sector Ron Garry, A, by the way, is
Speaker 1: the state's Chief Information Officer and the Secretary of Innovation
Speaker 1: and Technology, And so he used to be the c
Speaker 1: i O at Farmers Insurance and Toyota of North America,
Speaker 1: and then in Illinois the you know the showeries which
Speaker 1: are published. So I'm not revealing anything that isn't publicly out.
Speaker 1: Got a salary that we're offering to a c i
Speaker 1: OH is in the neighborhood of a hundred and seventy
Speaker 1: thousand dollars a year. And I don't think that typical
Speaker 1: salaries that are offered for chief information officers or chief
Speaker 1: information security officers for state government are commencer with being
Speaker 1: competitive in any way with the private check Do you
Speaker 1: get the sense that the governor thinks Illinois is writing nonetheless?
Speaker 1: I don't think the governor of Illinois is going to
Speaker 1: put a target on his back and say, we're not
Speaker 1: prepared to come hack us, please please come hack us. No. Now,
Speaker 1: I think I think, uh, they've hired some some good
Speaker 1: people with their limited resources. The I T technician with
Speaker 1: the Illinois State Board of Elections, Met Emmons. What's he
Speaker 1: doing today? He's running the I T Department for the
Speaker 1: State Board of Elections, and they are working with the
Speaker 1: Department of Homeland Security and their own internal staff too
Speaker 1: pepper their system with tests to ensure that there's nobody
Speaker 1: in their system now who shouldn't be, and there's no
Speaker 1: malware in their system now. He spent the last month
Speaker 1: and a half reporting on this topic. Is America ready for?
Speaker 1: It's so hard to say is America ready for? Because
Speaker 1: the truth is that you have fifty states and all
Speaker 1: the counties within those states that are now tasked with
Speaker 1: defending the integrity of the presidential election. Is every county ready?
Speaker 1: We certainly know that Illinois has done everything they can
Speaker 1: in the last three and a half years to prepare for,
Speaker 1: but there's all these smaller swing states and counties that
Speaker 1: may not have the resources that a big state like
Speaker 1: Illinois has to prepare. The DHS is traveling the country
Speaker 1: to inform these and educate these county clerks, but to
Speaker 1: what extent are they going to take action to respond?
Speaker 1: And so is the entire country ready? Probably not, But
Speaker 1: there's time between now and November, and everyone with a
Speaker 1: stake in the game is probably doing everything they can
Speaker 1: to prepare. Card K Rotra. Thank you for your story today,
Speaker 1: Thank you for having Me Decrypted. Is produced by Meat
Speaker 1: and Ethan Brooks, Emily Buso and Ann vander May are
Speaker 1: story editors. Francesca Levi is the head of Bloomberg Podcasts.
Speaker 1: We'll see you next week. No Came.