Speaker 1: The US government has accused Russia of directing some of
Speaker 1: the world's most notorious cyber criminals to break into half
Speaker 1: a billion accounts at Yahoo in a sweeping criminal conspiracy
Speaker 1: that married illicit profits with intelligence gathering. The federal indictment
Speaker 1: charges to Russian intelligence officers and two hackers with conspiring
Speaker 1: to carry out one of the largest cyber intrusions in
Speaker 1: US history. The government was sending a clear message to
Speaker 1: Moscow that cyber attacks would not be tolerated. Here's Acting
Speaker 1: Assistant Attorney General Mary McCord. The involvement and direction of
Speaker 1: FSB officers with law enforcement responsibilities makes this conduct that
Speaker 1: much more egregious. There are no four free passes for
Speaker 1: foreign state sponsored criminal behavior. The Russians targeted a diverse
Speaker 1: crew from the White House and military officials, two executives
Speaker 1: at banks and global companies. Our guests are and mckennack,
Speaker 1: professor at Penn State Law School, and John reid Stark,
Speaker 1: founder of John reid Stark Consulting and founder of the
Speaker 1: SEC's Office of Internet Enforcement. John. In the announcement, the
Speaker 1: government made its case to the public that Moscow is
Speaker 1: orchestrating criminal hacks with cyber criminals tell us more about
Speaker 1: the Russian cyber spying regime. Sure, Jean, how are you
Speaker 1: this afternoon? And thanks for inviting me to talk to you. Uh.
Speaker 1: You know, when I read this, I thought, like Captain
Speaker 1: Renault and Casablanca. Remember, I'm shocked, shocked to find the
Speaker 1: gambling is going on. It's this kind of hacking in
Speaker 1: this kind of scheme has been going on for quite
Speaker 1: some time, dating back to when I was at the SEC. Remember,
Speaker 1: there have been cyber attacks on the federal government dating
Speaker 1: back that are documented, dating back to two thousand nine,
Speaker 1: two twelves, all over the place and by various different
Speaker 1: state sponsored terrorist regimes. So I don't know that this
Speaker 1: is anything new. But what's amazing is that these people
Speaker 1: were finally caught, and I think the FBI has really
Speaker 1: got to be commended here. I'm sure this investigation took
Speaker 1: quite some time. It's the first time, as far as
Speaker 1: I can tell, that actual Russian intelligence officials were indicted
Speaker 1: right along with the hackers that they had engaged to
Speaker 1: carry on these arts. On that last point, what what
Speaker 1: is the significance of that The fact that for the
Speaker 1: first time Russian FSB agents were included in an indictment.
Speaker 1: It's thanks for having me, folks. It's really it's significant
Speaker 1: just because we've heard so much in the news. Our
Speaker 1: election cycle was filled with these you know, allegations of
Speaker 1: Russian hacking, um and interference with the election, and so
Speaker 1: to see the FBI and the Department of Justice come
Speaker 1: out so clearly with you know, very strong charges both
Speaker 1: based on economic espionage for foreign as well as our
Speaker 1: federal laws for computer fraud and abuse, UM, it's really
Speaker 1: it's significant, and it shows that, you know, they were
Speaker 1: very careful I'm sure before making these charging documents public.
Speaker 1: It shows that they are really ready to back up
Speaker 1: and and to to prosecute this. You know. What's going
Speaker 1: to be the trick here though, is one of the
Speaker 1: one of the hackers involved has already you know, been
Speaker 1: on the list to be extradited from Russia, and Russia
Speaker 1: of course has not extra extradited that hacker. So what
Speaker 1: remains to be seen now is what's the fallout going
Speaker 1: to be for US Russian relations when US demands extradition
Speaker 1: of these two FSB officers. As I think where we're
Speaker 1: really going to see things get sticky, particularly with you know,
Speaker 1: current presidential politics John that that is one of the
Speaker 1: questions here. What if you've got the Russian government involved,
Speaker 1: and you've got hackers who you can extradite, How effective
Speaker 1: can it be to bring indictments and situations like this.
Speaker 1: It's always effective. I don't think it's obviously not as
Speaker 1: effective as getting someone locking them up. But when I
Speaker 1: was at the SEC for eleven years, we chased after
Speaker 1: people and we Jeff only froze their money, but we
Speaker 1: could never, only on very rare occasions, could we orchestrate
Speaker 1: an actual arrest in a foreign country, because there are
Speaker 1: so many issues of just not just judicial committy, but
Speaker 1: also being able to extradite, being able to execute a
Speaker 1: subpoena on someone in a foreign country is a very
Speaker 1: difficult thing. So I think that these these types of
Speaker 1: actions have a tremendous deterrent effect. I realize it's not
Speaker 1: going to stop a lot of actors from doing what
Speaker 1: they're doing, but I think and is exactly right because
Speaker 1: what's so unique here is this prosecution crosses over to
Speaker 1: the political arena. All the matters that I did when
Speaker 1: I was at the SEC many involved foreign nationals, but
Speaker 1: they were never tied explicitly to the government like this.
Speaker 1: So it was essentially a one dimensional prosecutor prosecutorial exercise.
Speaker 1: But now you're also going to going to be engaging
Speaker 1: in the State Department, the Defense Department, the Pentagon, and
Speaker 1: everyone else in helping to track these people down and
Speaker 1: bring a justice. And they targeted a wide range of
Speaker 1: people and companies both here and in Russia. Do we
Speaker 1: know what information they got, what damage they actually did. Yeah,
Speaker 1: we do from the helpful information provided by the Apartment
Speaker 1: of Justice. UM, It's it's fascinating here because Yahoo, when
Speaker 1: this story initially came out back in the fall of
Speaker 1: that there had been a breach, insisted that there was
Speaker 1: a limited amount of personally identifiable information that had been hacked.
Speaker 1: What's clear from these documents released by the Department of
Speaker 1: Justice is that Yahoo's user database was taken as well
Speaker 1: as Yahoo's account management tool. And if you think about that,
Speaker 1: that's like the keys to the you know, candy jar.
Speaker 1: That it enabled, um, these hackers to not just get
Speaker 1: folks you know, names, email addresses, and that kind of information,
Speaker 1: but actually because of the information that was taken using
Speaker 1: this proprietary information that Yahoo had and Yahoo's database UM
Speaker 1: and account management tools these hackers were actually able to
Speaker 1: get into the content of the communications, which is very
Speaker 1: unusual for a hack in the sense of they were
Speaker 1: actually able to read contents of emails from thousands of
Speaker 1: individuals who's you know, communications were hacked. Not only that
Speaker 1: in this case, um, which is in stark contrast to
Speaker 1: what y'ah who said initially for a very long time
Speaker 1: and continued to repeat, we also know that credit card
Speaker 1: and financial information was actually taken and used by one
Speaker 1: of the hackers. He used Yahoo's own account tools to
Speaker 1: gain individuals financial information and credit card informations. And so
Speaker 1: the flip side of this is that we're seeing a
Speaker 1: flew of lawsuits across the country being filed against Yahoo
Speaker 1: by individuals who are claiming their credit card information was compromised.
Speaker 1: We're talking about the federal indictment charging two Russian intelligence
Speaker 1: officers and two hackers with conspiring to carry out we're
Speaker 1: the largest cyber intrusions in US history. Our guests are
Speaker 1: and mchannic, professor at Penn State Law School, and John
Speaker 1: read Stark, founder of John Reid Stark Consulting, and Assistant
Speaker 1: Attorney General. Mary McCord said the charges are unrelated to
Speaker 1: the hacking of the Democratic National Committee and the FBI's
Speaker 1: investigation of Russian interference in the presidential campaign. But could
Speaker 1: what they learned here through their investigation helped them with
Speaker 1: those other investigations. Well, part of this is speculation, but
Speaker 1: there's you know, when we see the strength of this
Speaker 1: indictment against two known Russian intelligence officers, uh, that that
Speaker 1: is probably going to be a very helpful treasure trow
Speaker 1: of information. You know, we this this Russia has long
Speaker 1: been known to work directly with hackers, um and so
Speaker 1: I think that there's probably a lot more to this
Speaker 1: than well, it may not be directly connected, you know,
Speaker 1: just the activities of state spot INSERTD cyber hacking are
Speaker 1: going to reveal lots of useful data. And I'm sure
Speaker 1: John can add to this, and with what he's seen
Speaker 1: at the sec UM just in terms of you know,
Speaker 1: we're seeing a government that's involved in economic espionage against
Speaker 1: the United States citizens and the information really, you know,
Speaker 1: was personal information about the US government officials as well
Speaker 1: as private citizens. John, can you add to that, sure?
Speaker 1: You know, I I totally agree. I think to what
Speaker 1: it what it does is kind of answers the mysteries
Speaker 1: of data breach response. I do a lot of data
Speaker 1: breach response work where you sort of walked into the
Speaker 1: situation and everyone wants to know, well, what were the
Speaker 1: hacker looking for? What were their goals? But here, based
Speaker 1: on the digital forensics and and other inculpatory evidence, you
Speaker 1: can see that the hackers who were enlisted here had
Speaker 1: a broad range of goals. By the one thing they
Speaker 1: wanted to do was to search Yahoo user mail accounts
Speaker 1: for credit art and gift card account numbers. Another thing
Speaker 1: they did was they set up an online marketing scheme
Speaker 1: by manipulating Yahoo search results for erectile dysfunction drugs. And
Speaker 1: I think that demonstrates the range of the use of
Speaker 1: exceltrated data and in the broad range of the the
Speaker 1: hackers attack factor. In other words, it's just like a
Speaker 1: burglar who comes into a home. They rumage through, grab
Speaker 1: anything they can. It might be targeted, it might be not,
Speaker 1: it might not be. They just grab everything they kind,
Speaker 1: they take it away, and then they see what they
Speaker 1: can do with it to monetize it. So whether that
Speaker 1: sheds light on an actual motive of what these hackers
Speaker 1: were doing, certainly the indictment indicates that they had specific
Speaker 1: targets in mind. But the indictment also indicates that these
Speaker 1: guys just grabbed anything they could and then they went
Speaker 1: wound up doing any kind of scheme they could to
Speaker 1: enrich themselves. And what are some of the things we
Speaker 1: don't know yet based on We learned a lot from
Speaker 1: this indictment, but there are a lot of things we
Speaker 1: don't know. Tell us about some of those. So what
Speaker 1: we don't is and I haven't heard the news today,
Speaker 1: but I know the Canadian hacker. One of the hackers
Speaker 1: was a Canadian citizen, and we are waiting to hear
Speaker 1: if he is going to be extradited by the Canadian courts.
Speaker 1: Um appears the US government has requested that One of
Speaker 1: those things I think we can learn from this is
Speaker 1: going forward, how information can be used by state actors
Speaker 1: in terms of, you know, what who are they targeting,
Speaker 1: and what are they targeting? As John pointed out, they
Speaker 1: went in and tried to grab everything. But we know,
Speaker 1: because of the details provided in the indictment that these
Speaker 1: two Russian intelligence officers had specific targets, and not only
Speaker 1: that this conspiracy was an ongoing, evolving process based upon
Speaker 1: information that was discovered. So going forward, we may learn
Speaker 1: more details about individuals in the United States government as
Speaker 1: well as individuals in private industry who were targeted, specifically targeted.
Speaker 1: And when we see that that was directed by I
Speaker 1: Russian intelligence officers, I think we're going to learn a
Speaker 1: lot more. But we don't know those details. We just
Speaker 1: have this, you know, sort of santalizing figure off oh over.
Speaker 1: Individuals contents of their communications were specifically targeted by these
Speaker 1: Russian intelligence officers. So it's going to be interesting to see.
Speaker 1: We don't know where that's going to lead. It's certainly,
Speaker 1: it certainly will be and we'll be talking about it more.
Speaker 1: Thank you both for being on Bloomberg Law. That's and mccannic,
Speaker 1: professor at Penn State Law School, and John reid Stark,
Speaker 1: founder of John Reid Stark Consulting, coming up on Bloomberg Law,
Speaker 1: first in Hawaii then Maryland. A pair of judges halt
Speaker 1: President Donald Trump's revised travel band before it can be enforced.