Speaker 1: Hi everyone, This is Brad. We're hard at work on
Speaker 1: a series of new episodes for the fall, and so
Speaker 1: this week will be re airing a shortened version of
Speaker 1: a very topical episode we first ran almost a year
Speaker 1: ago in October two thousand and sixteen. At the end
Speaker 1: will update you with everything that's happened since then. On Friday,
Speaker 1: October seven, the U S. Department of Homeland Security in
Speaker 1: the Office of the Director of National Intelligence released a
Speaker 1: statement and it was a pretty stunning announcement. Barely two
Speaker 1: and a half months after a cyber attack was revealed
Speaker 1: on the Democratic National Committee, the Obama administration laid the
Speaker 1: blame at the feet of Russia's President Vladimir Putin with
Speaker 1: a strongly the US government publicly blaming a foreign country
Speaker 1: for attacking a U S entity. That's an incredibly rare thing.
Speaker 1: I was surprised when I saw this statement come out,
Speaker 1: even though it's something that the private cybersecurity experts have
Speaker 1: been talking about for a while. Uh, the government formally
Speaker 1: blaming a foreign entities only happened a handful of times,
Speaker 1: and specifically here, the US was accusing Russia of hacking
Speaker 1: the Democratic Party right as voters prepared to go to
Speaker 1: the polls on November eight. It's a scary prospect. Could
Speaker 1: hackers tamper with or even obliterate our votes. So here's
Speaker 1: my question. We are so close now to election day,
Speaker 1: and you can tell because that's really all you see
Speaker 1: on TV right now. So how do we know for
Speaker 1: sure what we think we know about these hacks? This
Speaker 1: is a perpetual problem in cybersecurity, and it reminds me
Speaker 1: of the famous New Yorker cartoon that goes on the internet.
Speaker 1: Nobody knows you're a dog, But when you're investigating a
Speaker 1: cybersecurity breach, uh, nobody knows whether you're a Russian hacker
Speaker 1: or a Chinese hacker pretending to be a Russian hacker,
Speaker 1: or even a US hacker pretending to be a Chinese
Speaker 1: hacker pretending to be a Russian hacker. Or, as Donald
Speaker 1: Trump put it so delicately, I don't think anybody knows
Speaker 1: it was Russia that broke into the d n C.
Speaker 1: She's saying Russia, Russia, Russia, but I don't know. Maybe
Speaker 1: it was. I mean, it could be Russia, but it
Speaker 1: could also be China, could also be lots of other people.
Speaker 1: It also could be somebody sitting on their bed that
Speaker 1: weighs four hundred pounds, Okay, And how is the US
Speaker 1: or anyone else for that matter, so certain that the
Speaker 1: Russians are trying to hijack our elections? What should an
Speaker 1: ordinary voter do? And should we even care? Hi, am Akito,
Speaker 1: and I'm George Robertson, and this week on Decrypted, we're
Speaker 1: going to take you inside the hunt for the people
Speaker 1: who have the Democratic National Committee. It's a sort of
Speaker 1: tale of how two of the world's great superpowers have
Speaker 1: found themselves locked in an escalating information war just weeks
Speaker 1: before millions of Americans go to the polls, and the
Speaker 1: stakes they really couldn't be any higher. Not only is
Speaker 1: this the most divisive election we've seen in recent memory,
Speaker 1: with Hillary Clinton and Donald Trump advocating for completely print
Speaker 1: visions of America, but also hanging in the balance is
Speaker 1: the democratic process itself. What happens to a country's sovereignty
Speaker 1: in the age of the Internet. Our story today starts
Speaker 1: in April when the I T staff at the Democratic
Speaker 1: National Committee noticed something a little weird going on in
Speaker 1: their network. For our non American listeners, this is the
Speaker 1: official organization behind the Democratic Party, the d n C,
Speaker 1: and the i T staff there, they escalated their concerns
Speaker 1: to their executives and a cyber security firm called CrowdStrike
Speaker 1: was called in to investigate. So CrowdStrike is one of
Speaker 1: a small group of digital forensics firms that really all
Speaker 1: they do is investigate data breaches. And they went in.
Speaker 1: They installed sophtware in the DNC servers, essentially allowing them
Speaker 1: to spy on the spies, and it didn't take them
Speaker 1: long to pin the attacks on two groups of hackers
Speaker 1: associated with the Russian government. They called these groups Cozy
Speaker 1: Bear and Fancy Bear. Cozy Bear and Fancy Bear. Is
Speaker 1: this some kind of industry inside joke? Yeah, the hypersecurity
Speaker 1: industry has a lot of kind of goofy, funny names
Speaker 1: for groups. They're thematic, often associated with a region. Uh.
Speaker 1: Some others are called deep Panda and things like that.
Speaker 1: I love that. Then CrowdStrike closed all the security holes
Speaker 1: that had allowed the attackers to breach the DNC servers,
Speaker 1: and so the hackers wouldn't be able to read the
Speaker 1: staff emails anymore. Now, normally you don't really disclose this
Speaker 1: kind of thing unless you absolutely have to. It's certainly
Speaker 1: embarrassing for the d n C, especially when, as we
Speaker 1: learned later, they were warned about their networks vulnerabilities and
Speaker 1: ended up ignoring those early warnings. But the DNC may
Speaker 1: have had a hint that some of this information was
Speaker 1: about to be leaked on the internet, so they dropped
Speaker 1: this bomb show. But first, the Democratic National Committee said
Speaker 1: today Russian government hackers have penetrated its computer network. Breaches
Speaker 1: by two separate groups allowed hackers to access emails, internal chats,
Speaker 1: and the opposition Research Democrats have compiled unpresumptive Republican nominee
Speaker 1: Donald Trump. That's PPS News Hour reporting the hack on
Speaker 1: June four, the day this all became public, and it
Speaker 1: hit the US political system like a bolt of lightning.
Speaker 1: People were furious, how dare Russia try to mess with
Speaker 1: America that type of thing. And then one day after
Speaker 1: the DNC announcement, someone or a group of people who
Speaker 1: go by the name Goose Offer too Dato came out
Speaker 1: in a blog post and basically laughed in the d
Speaker 1: n c's face. This person was like, no, you idiots,
Speaker 1: I am the lone hacker that infiltrated the d n C.
Speaker 1: And this had nothing to do with the Russians and
Speaker 1: Goosefer too. Dato released a bunch of documents that he
Speaker 1: claimed he had stolen from the d n C as
Speaker 1: evidence that he was behind it, and from there it
Speaker 1: was chaos. Was it the Russians with some lunar kid
Speaker 1: who had too much time on his hands, And that's
Speaker 1: when crowd Strike called in this guy for help. My
Speaker 1: name is Mike Burtaski. I'm the senior vice president of
Speaker 1: cybersecurity Services at Fidela Cybersecurity here in Maryland. I lead
Speaker 1: a incident response team of about thirty individuals and we've
Speaker 1: handled some of the largest breaches that have have occurred
Speaker 1: over the past decade or so. So I've known Mike
Speaker 1: for several years now, and he's a really interesting guy.
Speaker 1: Used to be a cop with the Montgomery County Police
Speaker 1: Department in Maryland, and he looks like at X cop.
Speaker 1: He's got the short cropped haircut, solidly built guy at
Speaker 1: very friendly and uh, you know, very genial. Even before
Speaker 1: his time in the private sector, he had this long
Speaker 1: experience of tracking down criminals. Mike's now an incident responder
Speaker 1: in cybersecurity speak, that means he flies out at the
Speaker 1: drop of a hat two companies that believe they've been breached,
Speaker 1: and he helps investigate and fix their networks. So like
Speaker 1: the computer nerd version of c s I or Law
Speaker 1: and Order right, and Mike and Fideli's his job was
Speaker 1: too independently VERI by the group of people who attack
Speaker 1: the DNC, and this cybersecurity version of the who done
Speaker 1: it investigation. It's called attribution in the industry, and CrowdStrike
Speaker 1: had asked Fidelis and to other firms to check their work.
Speaker 1: So so we had, um, you know, we got five
Speaker 1: pieces of mal where we had a team of four
Speaker 1: reverse engineers. That's all they do is reverse engineering, so
Speaker 1: we had them bang on it. Jordan, I think we
Speaker 1: should explain this to our listeners. Sure, So CrowdStrike sent
Speaker 1: Mike's team five files of the computer code that was
Speaker 1: on the DNC servers and was responsible for stealing information
Speaker 1: from the emails. And the job of Fidelis and these
Speaker 1: two other firms was to look at this code in
Speaker 1: what's called a virtual environment, like a parallel universe. Right,
Speaker 1: It's a simulated computer system where the code can't do
Speaker 1: any damage on the real servers. Hackers used all kinds
Speaker 1: of tricks to prevent their malware from even opening in
Speaker 1: that kind of hall of mirrors. So a key job
Speaker 1: of an investigator is decoding all of those techniques to
Speaker 1: see how the attack code actually behaves. Okay, and then
Speaker 1: Mike's team they compared that behavior to documented quode in
Speaker 1: the past that was linked to the two hacker groups
Speaker 1: associated with the Russian government and crowd Strait called these
Speaker 1: two groups Cozy Bear and Fancy Bear, and the clues
Speaker 1: surface immediately. You know, really there were a couple of
Speaker 1: things that that we looked at, So you look at
Speaker 1: the complexity of of what the malware was able to do.
Speaker 1: The fact that it had the ability to m basically
Speaker 1: terminate itself and wipe its its tracks, hide its tracks.
Speaker 1: You know, that's not stuff you see in commoditized malware. Really,
Speaker 1: it kills itself. It kills itself. Yeah, And actually one
Speaker 1: of the functions within the one of the pieces of malware,
Speaker 1: UM had had a terminology for essentially Harry Carey UM
Speaker 1: to kill itself. So this automatic suicide switch, this is
Speaker 1: something that's incredibly sophisticated, right, I mean, this is one
Speaker 1: of the reason that Fidelist and CrowdStrike and the other
Speaker 1: forensics researchers were so taken aback by this malware. You know,
Speaker 1: there's a there's a black market for pre built malware
Speaker 1: on the Internet that even somebody like me can piece together,
Speaker 1: so like malware can be like legos. But this feature
Speaker 1: of killing yourself to avoid getting detected, that's really complicated stuff.
Speaker 1: And that's when Mike's team knew they were dealing with
Speaker 1: real pros here. You know, there aren't a ton of
Speaker 1: people around the world who have this level of sophistication,
Speaker 1: and there were a bunch of other things that backed
Speaker 1: up this conclusion. To the level of access that the
Speaker 1: malware gave the malicious user UM was pretty astonishing. Uh.
Speaker 1: It was also written very very um well, I I
Speaker 1: guess elegant is probably a good way to to say it.
Speaker 1: It was not sloppy by any stretch of the imagination. UM.
Speaker 1: And again, so you start looking at, Okay, who would
Speaker 1: have had the capability to do that? And you know
Speaker 1: we talked earlier how you know, yeah, you can have
Speaker 1: somebody on the inside do something, but they may not
Speaker 1: be the best at it. So you have, uh, you've
Speaker 1: got to have people who are a lot of experience
Speaker 1: doing it, or a lot of training to do it,
Speaker 1: and um, it was. It was a very complex piece
Speaker 1: of malware that the average person probably couldn't use. Uh.
Speaker 1: It's also not something that we've seen out in the
Speaker 1: wild necessarily. It's very targeted pieces of malware, very limited.
Speaker 1: Can't buy it on the black market. You can't buy
Speaker 1: these components. Not that. No, not that we've come across. Okay, okay,
Speaker 1: So so far we know that this attack was orchestrated
Speaker 1: by someone really really good, someone really really experienced, and
Speaker 1: that immediately limited the pool of people who could be
Speaker 1: responsible for this. It really limited the pool of people
Speaker 1: to someone with the kind of resources, with backing from
Speaker 1: an entire government. And on top of that, there were
Speaker 1: a bunch of things that pointed to the code being
Speaker 1: written in Russia. Yeah, some of these details are really interesting.
Speaker 1: So one of the most fascinating for me is, you know,
Speaker 1: from the way the code was written, it was clear
Speaker 1: that it was written on a Russian language keyboard, and
Speaker 1: the dates and times that the code was compiled was
Speaker 1: during normal business hours in Russia, and that's consistent with
Speaker 1: the code that's already been traced back to the Russian
Speaker 1: government backed hackers in the past, and that's not something
Speaker 1: that you can easily fake, right, like change the time
Speaker 1: stamps or something. Yeah, that was my question too, But
Speaker 1: Mike said, there's so many different things that you'd have
Speaker 1: to consistently change to successfully pull off that spoof. You're
Speaker 1: dealing with a situation that if it was a one
Speaker 1: off easier to change. You know, same same thing with
Speaker 1: you know, you can change the date and time on
Speaker 1: your computer. Absolutely, you can do that, and it would
Speaker 1: potentially throw an investigator off consistently across five pieces of
Speaker 1: mour Okay, you know, probably a little more difficult across
Speaker 1: x number of pieces of hour across how many incidents
Speaker 1: and to all have them point to the same place.
Speaker 1: And that's why Mike doesn't buy Trump's theory of this
Speaker 1: four man sitting on the bed orchestrating this incredibly sophisticated attack.
Speaker 1: And while he doesn't buy goose offer Toodato's claim that
Speaker 1: he was a lone hacker. Okay, is it a script, kiddiers,
Speaker 1: it's somebody who bought a piece of malware, or is
Speaker 1: it you know, somebody drinking mountain doing it in twinkies
Speaker 1: and mom's basement. No, it really needs a level of
Speaker 1: operational discipline that you don't see really in the wild.
Speaker 1: And you're right, the number of people who could pull
Speaker 1: it off, it becomes dramatically narrower. So Icky, are you convinced?
Speaker 1: I mean I think so. I don't know. I keep
Speaker 1: on expecting a twist, like you're you're tricking me, Like
Speaker 1: in Law and Order when the guy who seems really
Speaker 1: suspicious turns out to be innocent in the end. I
Speaker 1: like that. Well, here's maybe the most important part. Then
Speaker 1: you need to look at the target, the victim of
Speaker 1: this hack, which was the d n C, and it
Speaker 1: later turned out a broad cross section of the U.
Speaker 1: S political system, everyone from lobbyists to lawyers to Hillary
Speaker 1: Clinton's campaign. Going back to Mike's background of working in
Speaker 1: law enforcement, you have to ask who would have had
Speaker 1: the motive to pour this kind of effort into spying
Speaker 1: on key members of American politics. Sure, an opportunistic hacker,
Speaker 1: you know, putting a feather in their caps, saying hey,
Speaker 1: we you know we broke into the d n C. Okay, yeah,
Speaker 1: I mean that that could potentially happen um, But then
Speaker 1: releasing the emails the evening before the convention started. Well
Speaker 1: then again, now you now you're looking at it, okay, Well,
Speaker 1: you know that really smacks like an information operation. And
Speaker 1: here I think we should remind our listeners of the
Speaker 1: chronology of the events that took place just a few
Speaker 1: weeks after the d n C announced the hack in
Speaker 1: mid June. I mean, this was a time when the
Speaker 1: Republican Party was still in complete disarray, but things were
Speaker 1: looking pretty good for the Democrats. This was a time
Speaker 1: when Hillary Clinton UM was trying to solidify her support
Speaker 1: and you have this forest fire raging on the internet
Speaker 1: about this issue. You have Wiki leaks and Goosea for
Speaker 1: Todato publishing a stream of emails that turned out to
Speaker 1: be really embarrassing for the d n C. At you
Speaker 1: know what couldn't have been a worse time for them, Yeah,
Speaker 1: like that one from when Bernie Sanders was still in
Speaker 1: the primary race with Hillary Clinton and a senior staff
Speaker 1: were at the DNC talked about how they should try
Speaker 1: to paint Sanders as an atheist, try to question his
Speaker 1: Jewish faith and the party itself is supposed to be neutral,
Speaker 1: and that led to a lot of turmoil within the party.
Speaker 1: I mean, the Democratic Convention that took place at the
Speaker 1: end of July. That was kind of a mess, at
Speaker 1: least at the beginning. All these Bernie supporters were protesting
Speaker 1: and booing down speakers on stage, and ultimately d n
Speaker 1: C Chairwoman Debbie Wasserman Schultz, who was a rising young
Speaker 1: star in the party, she resigned. And bringing this back
Speaker 1: to our story today, like you said, Jordan's, this really
Speaker 1: does point to motive. I mean, who would really want
Speaker 1: to introduce this kind of termal well to the democratic
Speaker 1: process itself in America, which is, you know, really the
Speaker 1: sacristanc thing. Who would want to do this thing that
Speaker 1: would make you question the fairness of the system that
Speaker 1: we've developed over the years. Yeah, this project has been
Speaker 1: interesting to me because I consider myself, you know, a
Speaker 1: pretty serious skeptic on a lot of these claims. It's
Speaker 1: it's just way too easy for a hacked entity to
Speaker 1: throw out, oh the Russians did this and the Chinese
Speaker 1: did that or whatever. Yeah, kind of like this get
Speaker 1: at a jail free card when your company has been hacked? Right,
Speaker 1: these really sophisticated organized hackers backed by a whole government.
Speaker 1: If if someone like that tries to target you, what
Speaker 1: could you have possibly done. It's like when we reported
Speaker 1: about Yahoo's breach, which was this massive, you know, more
Speaker 1: than five million customer accounts getting hacked. We reported that
Speaker 1: the company's claim of the attack being state sponsored, you know,
Speaker 1: isn't so iron clad. But this one with the d
Speaker 1: n C. After talking to Mike, after talking to all
Speaker 1: these other experts, Jordan, are you convinced. Yeah, I'm pretty convinced.
Speaker 1: I mean, it takes a lot to clear that hurdle
Speaker 1: of you've got this piece of malware and this is
Speaker 1: evidence that the Russians did it. Uh, you know, but
Speaker 1: Mike will be the first to tell you this. Well,
Speaker 1: it's it's always risky. I mean, you know, when you're
Speaker 1: when you're you're doing attribution, you're really never saying a
Speaker 1: hundred percent that it's this person, because, you know, barring
Speaker 1: seeing somebody at the keyboard and actually doing it or
Speaker 1: a confession, you're you're relying on that circumstantial evidence. This
Speaker 1: all comes down to Mike's days as a cop. Can
Speaker 1: you prove to a jury beyond a reasonable doubt that
Speaker 1: the Russians did this? And his answer was yes. And
Speaker 1: now the US government has come out and officially blame
Speaker 1: the Russian government, and there are lots of reasons potentially
Speaker 1: for that happening. There are ways that the government can
Speaker 1: really know what's going on, intercepted phone calls, intercepted emails,
Speaker 1: human and signals intelligence sources in a way that no
Speaker 1: private cybersecurity could ever match. Sounds a little sinister. Well,
Speaker 1: we don't know for sure, but here's what Rob Owens,
Speaker 1: who's an industry analyst at Pacific Press Securities, told me.
Speaker 1: Nation States do hack. I think the US government hacks
Speaker 1: as well. It's a well known fact within the industry that, uh,
Speaker 1: everybody's hacking everybody to some degree. So maybe the US
Speaker 1: government was spying on Russia while Russia was spying on
Speaker 1: the d n C. Well, we know that both countries
Speaker 1: spied each other all the time, but in this case,
Speaker 1: we don't know exactly what the evidence is. But it's
Speaker 1: fair to assume that that's the case. And that's why
Speaker 1: at the top of the show today you called it
Speaker 1: an information war like the Cold War of our generation exactly. So,
Speaker 1: if we've managed to keep our listeners till now through
Speaker 1: this complicated journey inside the d n C hack, first
Speaker 1: of all, thanks for sticking with us and second of all,
Speaker 1: I think the burning question everyone has now is what's
Speaker 1: not next? Okay, so Jordan's you and I are now
Speaker 1: in the present day. It's September two thousand seventeen, and
Speaker 1: this story has evolved in ways we never could have
Speaker 1: imagined over the last eleven months. Well since then, Donald
Speaker 1: Trump got elected. Yes, I do recall that happening, and
Speaker 1: Facebook took a lot of heat for not doing enough
Speaker 1: to stop the spread of fake news on its platform,
Speaker 1: the subject of another great episode of Decrypted. We ran
Speaker 1: in November last year, and there were quite a few
Speaker 1: reports connecting these fake news stories to Russian state funded organizations. Right,
Speaker 1: and then the CIA, FBI, and n s A came
Speaker 1: out and reported that Russia's meddling was meant to help
Speaker 1: Donald Trump and undermine Hillary Clinton, And of course Special
Speaker 1: Counsel Robert Mueller is now leading an investigation into Russia's
Speaker 1: tampering and possible ties to Donald Trump's campaign. It also
Speaker 1: turns out that Russia's attack went beyond an information in campaign.
Speaker 1: To my colleague Mike Riley and I report in June
Speaker 1: that Russia's hackers actually breached the voting systems in thirty
Speaker 1: nine states, for example, in Illinois, intruders tried to delete
Speaker 1: or alter voter data. And the most recent twist to
Speaker 1: hauld this is this Facebook announced that it found one
Speaker 1: hundred thousand dollars in ad spending connected to fake accounts
Speaker 1: that were probably run from Russia that aimed to stir
Speaker 1: political controversy in the election. Which is to say, this
Speaker 1: Jordan is a story that never ends. Just when you
Speaker 1: think you've got your arms around the entire story, there's
Speaker 1: yet another development. So what do you make of the
Speaker 1: most recent announcement from Facebook on that one grand in
Speaker 1: an ad spending? It just goes to show that, you know,
Speaker 1: this Russian information operation went further than really anybody understood,
Speaker 1: and in ways that subverted, you know, the very coin
Speaker 1: of the realm of silicon value, which is targeted digital ads.
Speaker 1: And you know, how do you disentangle yourself from that
Speaker 1: system if your Facebook or Google or you know, anybody
Speaker 1: else that relies on them. But hang on, because a
Speaker 1: lot of people when this news came out said a
Speaker 1: hundred thousands of small potatoes. I mean, do you think
Speaker 1: it's a small amount or do you think that there's
Speaker 1: more that we just don't know of yet? There definitely
Speaker 1: could be more that we don't know about yet, because
Speaker 1: the way that these things are tracked are you know,
Speaker 1: you go from known accounts that have been identified to
Speaker 1: you either by the company or the U. S. Government,
Speaker 1: and you work backwards from there. But these networks are
Speaker 1: so vast, these ad networks, you know that knowing really
Speaker 1: who is pumping money into these systems is uh is,
Speaker 1: you know, a pretty challenging test. But the hundred thousand
Speaker 1: signified something different to me. It's that one of my
Speaker 1: key takeaways from this information operation was that the Russians
Speaker 1: are learning, the hackers are learning. It's not that they've
Speaker 1: entered like a state of perfect execution. All of these
Speaker 1: things were tests, were trial runs, and that's the really
Speaker 1: concerning things. So in that context, a hundred thousand dollars
Speaker 1: may have gotten them what they needed, which was, you know,
Speaker 1: just a set of principles to operate on for the
Speaker 1: next time. What I found partly remarkable was that the
Speaker 1: culprit and all this was a shadowy organization based out
Speaker 1: of St. Petersburg called the Internet Research Agency, which is
Speaker 1: known for pushing Kremlin propaganda. And this was not this
Speaker 1: is actually not all that secretive and organization like these
Speaker 1: are known guys. There have been profiles in major media
Speaker 1: organizations about about this agency. Had you heard of them
Speaker 1: and what do you make of their involvement? Yeah? I have?
Speaker 1: Then you know, I mean there are there are armies
Speaker 1: of these kind of professional trolls, kind of quasi spammers
Speaker 1: that are not necessarily breaking the law, but are certainly
Speaker 1: acting in many ways as hackers, even if they're not
Speaker 1: breaking into accounts. And you know, one thing that we
Speaker 1: can't forget is that in this current information ecosystem, it's
Speaker 1: all about headlines. And even if they're promoting fake headlines
Speaker 1: and half of your news feed or fake headlines that
Speaker 1: if you clicked on any any individual one of them
Speaker 1: you would recognize as bogus, it's the aggregate is the effect.
Speaker 1: So if you see enough of these things, you know,
Speaker 1: fake news, slanted news, propaganda, it actually psychologically can have
Speaker 1: an effect over time if you see enough of it.
Speaker 1: And that's that's the disturbing part. Is you're not breaking
Speaker 1: a law, but they're influencing the way you think about things,
Speaker 1: and happens on a subliminal level. Right, Well, so we're
Speaker 1: talking about changing people's minds but what about actually changing
Speaker 1: people's vote. So you mentioned tampering with the actual voting
Speaker 1: systems before. Is there any progress in the investigation into
Speaker 1: into this aspect of it and whether Russia might be
Speaker 1: trying to do that as well? You know, one of
Speaker 1: the most depressing parts about all this is the short
Speaker 1: answer is yes there. You know, the congressional committees are investigating.
Speaker 1: There's obviously a law enforcement investigation. The FBI is you know,
Speaker 1: investigating the hacks, and you know, potential collusion with you know,
Speaker 1: the Trump campaign, and then of course there's a special prosecutor.
Speaker 1: But one of the most depressing aspects is you talk
Speaker 1: to folks in and around the administration and you get
Speaker 1: the sense that this is this is something that is
Speaker 1: simply not addressed. You know that that our current president
Speaker 1: refuses to acknowledge this issue to a degree that at
Speaker 1: the administration level this is really not being discussed. It
Speaker 1: poses such a problem because hacking, hacking really isn't a
Speaker 1: partisan issue. Hacking effects everybody. It just happened to be
Speaker 1: targeted against Democrats, and it's not bringing it up here.
Speaker 1: It probably means it's not a factor in the diplomatic
Speaker 1: relationship with Russia and and their behavior won't change, absolutely not.
Speaker 1: And when it comes to to rigging votes, you know,
Speaker 1: everybody we talked to you says the same thing. They're like, actually,
Speaker 1: flipping votes is really hard. It requires a lot of work,
Speaker 1: a lot of hacking, a lot of precision in the endeavor.
Speaker 1: Changing people's voter registration is not hard and can cause
Speaker 1: extreme chaos. And you have the lesson again I keep
Speaker 1: coming back to, is all the data points that I've
Speaker 1: seen point to being literally a trial run. Is the
Speaker 1: most effective successful trial run and hacking history. But it
Speaker 1: was also a trial run. Like those thirty nine states
Speaker 1: that we talked about, those were not all super breaches.
Speaker 1: Those were like probes and tests and can we change addresses?
Speaker 1: Can we change people's voter retch just there were tests.
Speaker 1: And that's the thing I think has really gone really
Speaker 1: under disgust is that we've got these investigations. Everybody knows
Speaker 1: there was a big hack, uh, you know, but in
Speaker 1: terms of understanding the level to which this was not
Speaker 1: the best Russia has to offer, Russia is at our level, uh,
Speaker 1: when it comes to state sponsored hacking, And this was
Speaker 1: kind of a trial run. And that's the scary part. Okay,
Speaker 1: so what do you expect to see and say, Germany
Speaker 1: and the elections later this month or even in the
Speaker 1: U S midterms in two thousan eighteen. Well, Germany is
Speaker 1: a great subject because they're experiencing the same thing that
Speaker 1: we do, and obviously their electoral system is different. But
Speaker 1: Russia is getting better at this and there's no doubt,
Speaker 1: I mean, there's no doubt that this was Russia. Everybody
Speaker 1: agrees that that's who it was. And the thing that
Speaker 1: I really fear and I'm not one to fear monger
Speaker 1: when it comes to cybersecurity, even though it's an industry
Speaker 1: replete with it, is when it comes to you know,
Speaker 1: a lot of these breaches have not been cleaned up.
Speaker 1: The thirty nine states that we wrote about. It would
Speaker 1: be naive to assume that those states just cleaned up
Speaker 1: their act and the infections are gone. I think the
Speaker 1: attackers are going to take the footholds that they created
Speaker 1: in and learn more and expand tinker more. And I
Speaker 1: mean they didn't just get away with it. They were successful.
Speaker 1: They're rewarded, you know, with the biggest prize maybe in
Speaker 1: hacking history, you know, the presidency of the United States.
Speaker 1: You know it was at stake. Uh So I suspect
Speaker 1: we're gonna not just see more of it, We're going
Speaker 1: to see more sophisticated tampering if if you know, the
Speaker 1: Russian state services feel it's needed, if that's you know,
Speaker 1: and it could be turned. This is a weapon that
Speaker 1: could be turned in any direction on any political party.
Speaker 1: And that's the thing I think a lot of folks
Speaker 1: missed right now. Well, Jordan, you certainly haven't made me
Speaker 1: feel better about all this, So let's try to end
Speaker 1: on a high note here. What what can ordinary voters
Speaker 1: do to prevent hackers from either altering their votes, their
Speaker 1: registration records, or just to inoculate themselves from these disinformation
Speaker 1: campaigns that are now so prevalent on social media. Sure,
Speaker 1: you know this is actually it's a really good question,
Speaker 1: because there's a really simple answer to a lot of
Speaker 1: this stuff. You know. The thing that concerns national security
Speaker 1: officials the most and concerned them the most in twenty sixteen,
Speaker 1: again was not that votes would be flipped. That's really hard.
Speaker 1: It is that voter registration records would be changed in
Speaker 1: mass so people didn't know where they were going on
Speaker 1: election day or they were going to the wrong place,
Speaker 1: or they did their names didn't appear on the roles
Speaker 1: when they showed up. Uh, you know, it's really simple.
Speaker 1: The same the same reason that these voter registration systems
Speaker 1: can be hacked is because they're online, and that means
Speaker 1: it's really easy for us to check, like literally a
Speaker 1: week or two before the election or on election day,
Speaker 1: you know, but if there's some lead time going into
Speaker 1: the election, let's call it a week or two, you
Speaker 1: go online, you check your voter registration information. As long
Speaker 1: as it's your same name, your same address, and a
Speaker 1: reasonable enough polling place, whether it's one you've you've voted
Speaker 1: at before or something in your neighborhood, as long as
Speaker 1: that looks fine. Like that's literally the best defense against
Speaker 1: this stuff, because if people go to the right places,
Speaker 1: it's really hard to manipulate the votes. As long as
Speaker 1: you're on the rolls, it's hard to tamper with these elections.
Speaker 1: But that that's a level of kind of you know,
Speaker 1: diligence that you know, not not a lot of folks
Speaker 1: you know might might be willing to employ. But that's
Speaker 1: the single best inoculation against that, and it's super easy
Speaker 1: and that's it for this week's episode of Decrypted. Thanks
Speaker 1: for listening. We always want to know what you think
Speaker 1: of the show. Get in touch at Decrypted at Bloomberg
Speaker 1: dot net or I'm on Twitter at Jordan's are one
Speaker 1: thousand and I'm at brad Stone. If you haven't already,
Speaker 1: subscribe to our show wherever you get your podcast, and
Speaker 1: while you're there, please leave us a rating in the review.
Speaker 1: This goes a long way to get this show in
Speaker 1: front of more listeners. The original episode we aired in
Speaker 1: was produced by Pia Gtkari, Liz Smith, and Magnus Hendrickson.
Speaker 1: Today's edition was produced also by Akuto and Sarah Patterson.
Speaker 1: We'll see you next week.