GOVERNMENT RESPONSE TO DEAL WITH
NOW AS THIS ONGOING ATTACK
STRETCHES INTO ITS FOURTH DAY.
JOINING US NOW IS "NEW YORK
TIMES" CYBER SECURITY REPORTER
NICOLE PERLROTH WHO HAS BEEN
COVERING THE RANSOMEWARE ATTACK
ON COLONIAL ENERGY AND HAS
COVERED MANY BEFORE THIS.
NICOLE, IT’S REALLY NICE TO SEE
YOU TONIGHT.
THANK YOU SO MUCH FOR MAKING
TIME.
>> THANKS, RACHEL.
THANKS FOR THE GREAT SETUP.
YOU LAID IT OUT PRETTY CLEARLY
THERE.
>> OH, WELL, I WANTED TO ASK YOU
IF I’VE MISSED ANYTHING EITHER
IMPORTANT IN TERMS OF CONTEXT OR
ANYTHING NEW.
I KNOW YOU’VE BEEN COVERING THIS
RIGHT THROUGH TO TONIGHT, YOU
AND YOUR COLLEAGUES AT "THE
TIMES."
>> SO WE’RE JUST LEARNING MORE
ABOUT THE GROUP THAT’S
RESPONSIBLE.
WE THINK THAT THEY’RE AN
OFFSHOOT OF THIS OTHER RUSSIAN
GROUP CALLED REVEALED THAT HAS
BEEN AROUND A WHILE AND WAS THE
GROUP RESPONSIBLE FOR HACKING A
COMPANY CALLED QUANTA INC. WHICH
IS A MAIN SUPPLIER OF APPLE
PRODUCTS.
SO IN ADDITION TO HOLDING UP
QUANTA, THEY THREATENED TO
RELEASE DESIGNS FOR ALL THE
LATEST APPLE PRODUCTS.
AND IN THAT CASE, THEY’RE MAKING
A RANSOM DEMAND OF SOMETHING
LIKE $50 MILLION, WHICH IS ONE
OF THE HIGHEST RANSOM DEMANDS
I’VE EVER HEARD.
SO WE THINK THAT DARKSIDE, THE
GROUP RESPONSIBLE POUR THIS
PIPELINE HACK IS AN OFFSHOOT OF
THAT GROUP.
AND THEY ARE A LITTLE QUIRKY.
THEY CLAIM THEY WON’T HACK
HOSPITALS, ET CETERA.
AND IT LOOKS LIKE THEY MIGHT
HAVE NOT EVEN INTENDED TO HACK A
COMPANY THAT WOULD HAVE HAD SUCH
STRONG DOWN-STREAM EFFECTS LIKE
COLONIAL PIPELINE.
THEY PUT OUT A STATEMENT TODAY
SAYING WE DON’T LIKE TO GET
INVOLVED IN GEOPOLITICS.
AND SO WE’RE TRYING TO
UNDERSTAND WHAT TO MAKE OF THIS.
AND I THINK REALLY WHAT WE’RE
SEEING AS A GROUP THAT IS TRYING
TO SEPARATE ITSELF AS MUCH AS
POSSIBLE FROM RUSSIA, PERHAPS
BECAUSE THEY’RE SCARED OF SOME
KIND OF RETALIATION LIKE THE
KIND YOU SAW THE PENTAGON CYBER
COMMAND PULL OFF AHEAD OF THE
ELECTION IN 2020 WHEN THEY WERE
AFRAID THAT A RANSOMEWARE GROUP
WOULD HOLD CRITICAL ELECTION
SYSTEMS HODGE.STAGE.
AND THERE TOO THEY WOULDN’T
NECESSARILY KNOW IF IT WAS
RUSSIA PROPER DOING THAT OR IF
IT WITH US A CYBER CRIMINAL THAT
COULD MAINTAIN SOME SORT OF
PLAUSIBLE DENIABILITY FROM
VLADIMIR PUTIN.
IN ANY EVENT, U.S. CYBER COMMAND
TOOK THEM OFF LINE.
I THINK WE SAW TODAY WAS THE
GROUP REALLY COMING OUT AND
TRYING TO SEPARATE ITSELF FROM
RUSSIA AND RUSSIAN OPERATIONS
AND RUSSIA AS A SAFETY VENT FOR
SO MANY CYBER CRIMINALS AND
RANSOMEWARE GROUPS WE’RE SEEING
THESE DAYS.
>> THE DEPUTY NATIONAL SECURITY
ADVISER TODAY AND NEUBERGER
DESCRIBED THIS AS RANSOMEWARE AS
A SERVICE, WHICH TO ME WAS A
FAMILIAR IDEA BECAUSE OF YOUR
BOOK, BUT IT SEEMED TO ME TO
POTENTIALLY ADD ANOTHER LAYER OF
PLAUSIBLE DENIABILITY IN TERMS
OF ATTRIBUTION FOR THIS ATTACK.
DOES THAT MEAN THAT ESSENTIALLY
THE FBI AND THE U.S. GOVERNMENT
CAN IDENTIFY THE TOOLS THAT ARE
BEING USED HERE AND WHO MAY HAVE
DEVELOPED THOSE TOOLS OR INDEED
SOLD THOSE TOOLS, BUT THE PERSON
WIELDING THEM TO CARRY OUT THIS
ATTACK MIGHT STILL BE YET
ANOTHER BAD ACTOR, A DIFFERENT
PARTY?
>> NO, IT’S A CRITICAL
OBSERVATION.
THEY ARE RANSOMEWARE AS A
SERVICE OPERATOR.
THEY WILL LEASE OUT THEIR ACCESS
TO VICTIMS’ NETWORKS TO OTHER
RANSOMEWARE GROUPS THAT THEN USE
THEIR ACCESS TO HOLD THESE
SYSTEMS HOSTAGE, AND THEY’LL
TAKE A CUT.
IN THEIR STATEMENT TODAY, THEY
ALMOST SEEMED TO SAY THIS WASN’T
US, THIS WAS SOMEONE WE HAD
LEASED OUR SERVICE TOO, BECAUSE
THEY SAID IN THE FUTURE, WE’LL
MODERATE WHO WE’RE LEASING THESE
SYSTEMS TO MORE CLEARLY.
DIDN’T SAY IN THOSE WORDS, BUT
THAT WAS ESSENTIALLY THE
MESSAGE.
BUT I THINK WHAT WE SAW AND WHAT
YOU DESCRIBED JUST NOW WITH THE
BIDEN ADMINISTRATION REALLY
COMING OUT IN FULL FORCE ON THIS
IS A GOOD THING.
I THINK IN THE BACKGROUND WHAT
WE’RE SEEING IS AN
ADMINISTRATION THAT WANTS TO
TAKE RUSSIA ON AS A SAFE HAVEN
FOR CYBER CRIME AND RANSOMEWARE
AND POSSIBLY MORE.
YOU KNOW, WE UNDERSTAND THAT
RUSSIA AS A SAFE HAVEN FOR CYBER
CRIMINALS.
THEY DON’T TRAVEL TO COUNTRIES
ANYMORE WHERE THEY COULD
POSSIBLY BE EXTRADITED TO THE
UNITED STATES.
RUSSIA WILL NEVER EXTRADITE
THEM.
IT REALLY IS ONE OF THE WORLD’S
BIGGEST SAFETY EVENTS FOR THIS
ACTIVITY.
SO EVEN IF THIS IS NOT NATION
STATE-BACKED, IT IS NATION STATE
ENABLED.
AND WE’VE GOTTEN TO A POINT
WHERE SANCTIONING AND INDICTING
CYBER CRIMINALS IS NOT ENOUGH.
SO THESE DAYS OFFICIALS ARE
TALKING ABOUT THINGS LIKE
RESTRICTING TRAVEL VISAS FOR
RUSSIAN CITIZENS OR ANY CITIZENS
IN COUNTRIES THAT PROVIDE SAFE
HARBOR FOR RANSOMEWARE
CRIMINALS.
BECAUSE THE PROBLEM HAS JUST
BECOME SO CRAZY.
JUST IN THE LAST TWO WEEKS, WE
SAW THE WASHINGTON POLICE
DEPARTMENT HELD UP WITH
RANSOMEWARE.
A FEW WEEKS AGO HONEYWELL WAS
HELD UP WITH RANSOMEWARE.
WE SAW THIS AT APPLE SUPPLIER
HELD UP WITH RANSOMEWARE.
AND THESE RANSOMEWARE GROUPS ARE
NOW SPILLING OUT STOLEN DATA
ONLINE, WHICH MAKES BACKUPS --
WE TELL VICTIMS BACK UP YOUR
DATA SO THAT IF YOU’RE HIT WITH
RANSOMEWARE, YOU’LL BE OKAY.
WELL, WHEN CRIMINALS ARE NOW
SAYING WE’RE ALSO GOING TO DUMP
YOUR DATA ONLINE, BACKUPS DON’T
REALLY MITIGATE AGAINST THAT.
WE’RE FACING AN INNOVATIVE AND
VERY CLEVER ADVERSARY, AND THERE
SO MANY OF THEM.
THERE ARE ABOUT 30 RANSOMEWARE
GROUPS OUT THERE THAT ARE
HACKING AMERICAN COMPANIES NOT
JUST TO HOLD THEIR DATA HOSTAGE,
BUT TO LEAK IT OUT ONLINE.
>> AND IN THIS CASE TOO, BRING
ABOUT THE SHUTDOWN OF THE
LARGEST FUEL PIPELINE IN THE
COUNTRY FOR AN ATTACK THAT SEEMS
LIKE AT MINIMUM IS GOING TO TAKE
THAT DOWN FOR AT LEAST A WEEK.
NICOLE PERLROTH, CYBER SECURITY
REPORT FOR "THE NEW YORK TIMES,"
AUTHOR OF THE NEW BOOK "THIS IS
HOW THEY TELL ME THE WORLD ENDS:
THE CYBER WEAPONS ARMS RACE."
NICOLE, THANK YOU AS ALWAYS FOR
YOUR CLARITY AND TOLERANCE FOR
WALKING US THROUGH SOME OF THIS
MORE COMPLICATED STUFF.
IT’S GREAT TO HAVE YOU HERE.
>> THANK YOU SO MUCH.
LAST TIME WE SPOKE IT WAS OVER
THE WATER TREATMENT FACILITY
HACKS.
SO HOPEFULLY THE NEXT TIME WE
SPEAK THINGS WILL HAVE IMPROVED
A LITTLE BIT.
BUT I DON’T HAVE MUCH HOPE FOR
THAT.
>> YEAH, EXACTLY.