JUDY WOODRUFF: The federal government today confirmed that a Russian criminal group is
behind the hacking of a crucial energy pipeline.
The Biden administration said it is working with the Colonial Pipeline company to deal
with the cyber-hack and its effects. Colonial shut down its pipeline, the largest of its
kind in the U.S., after the company learned it was the victim of this cyber-extortion
attempt.
William Brangham is back now with the latest on that story.
WILLIAM BRANGHAM: Judy, the FBI said a group known as DarkSide is responsible for the this
cyberattack, which used what is known as ransomware.
Ransomware is malicious computer code that block an owner's access to their computer
network until a ransom gets paid. Colonial operates a 5,500-mile long pipeline that carries
almost half the jet fuel and gasoline that is delivered along the East Coast.
The company has so far refused to say whether it paid any ransom, but said it hopes to be
largely back online by the end of the week. So far, the impact on gas prices has been
small. But this attack is just the latest example of ransomware incidents in the U.S.
By one estimate, in just the past year, more than 113 federal, state and municipal agencies,
500-plus health facilities, and more than 1,600 schools, colleges and universities have
all been attacked with ransomware.
For more on this and the alarm bells it's sounding, I'm joined by Megan Stifel. She's
with the Global Cyber Alliance, which is a nonprofit dedicated to reducing cyber-risk.
Very good to have you on the "NewsHour."
This most recent attack on this pipeline, I think largely because it is such a major
piece of infrastructure, seems like a real escalation. Is this among the worst type of
ransomware attack we have seen so far?
MEGAN STIFEL, Global Cyber Alliance: Thanks very much for having me tonight.
In terms of its household recognition of this being an important issue, I would say yes.
But we have seen in the past -- for example, WannaCry that happened in 2017 hit victims
in 150 countries. So this is a major incident in terms of the impact it can have on the
East Coast and infrastructure distribution, but, sadly, more could come and has in the
past.
WILLIAM BRANGHAM: So, as I mentioned, ransomware is basically holding a computer network hostage
for money. And the company behind -- the hackers behind this said, yes, that was their goal.
But does ransomware software allow hackers to do more than just hold the system? Could
they sabotage it? Could they use it for nefarious purposes? Does it allow you to do that?
MEGAN STIFEL: In some cases, yes.
When an actor gains access to a network such as this, they could have the ability to have
very serious consequences on safety. But it also is against their interests to do so.
If an individual -- or if there's harm done, a significant impact, that in some ways can
ruin their brand, so to speak.
And in this case, and other networks, they say, oh, we're not going to target health
care sector. We -- I think we're seeing that these folks probably didn't mean to have the
impact in this instance that they did.
WILLIAM BRANGHAM: So, I touched on these huge, huge numbers. But is this a growing epidemic?
Are we seeing a rise in these types of attacks?
MEGAN STIFEL: Yes, particularly over the past year. You mentioned some figures that, to
me, I think add up to this one that well, which is 2,400 school systems, governments
and health care facilities in 2020 were reportedly the victims of ransomware.
And that's only the reported victims. The issue too that we see in this space is that
not all victims want to come forward to law enforcement. And that really hinders the ability
for law enforcement and the government to make an informed decision and develop the
best policy options that they have to try and counter this attack.
WILLIAM BRANGHAM: So, from a technical perspective, how does ransomware get into a computer network?
MEGAN STIFEL: Technically, in most cases, ransomware evolves from a suspicious e-mail.
Someone clicks on an e-mail that we call these phishing e-mails where someone who you think
is an associate or a colleague sends you an e-mail saying, I need you to open this, I
need you to do this right now, luring you into clicking on a link.
That link often reroutes the user to not the intended place they thought they were going,
but to a malicious Web site, that then is involved in downloading further malicious
software, allowing the perpetrators to gain access to that particular individual's computer
and thereby the organization's network.
And depending on how well the network is architected, they may have access then to a range of places
within the network, to very sensitive data, to, in some cases, not-so-sensitive data.
But, in most cases, these types of actors will look for data that they know is valuable,
and that they can then, again, hold it ransom, so that they can make money.
WILLIAM BRANGHAM: It's it's amazing how simple it is, that one click on a dubious e-mail
can set off this chain reaction and really imperil huge pieces of infrastructure.
MEGAN STIFEL: It is.
And it's -- we don't want to overplay the simplicity of it, right? There are a number
of steps that can be taken that can frustrate these actors ability to have such an outsized
impact, known best practices, such as using multifactor authentication on networks, making
sure that there are automatic backups to data, making sure that, as data is -- excuse me
-- software as kept up as up to date as possible, so that vulnerabilities, which is how these
exploits are able or these types of activities are able to take advantage of a weakness in
the network, making sure that those vulnerabilities are closed.
So, it takes a range of steps. And, in some cases, they have to be lucky once. And, in
some cases, they may have to take it -- spend additional time on a victim's network. And
the goal here is to make sure that everyone's using best practices, so that it's not their
network that's at risk; it's someone else's.
WILLIAM BRANGHAM: It seems like you're describing quite a few different holes to patch, both
our personal behavior, the way we build software, and then how companies operate this software.
Do you think that there's a role for the government to play in any of this, in helping these best
practices move along?
MEGAN STIFEL: Absolutely.
I was fortunate to lead a ransomware task force that actually convened our -- wrapped
up our concluding remarks just two weeks ago. And that group came together, over 50 organizations,
and identified a range of actions that could be taken, some involving the government.
In particular, in this -- in this instance, we recommended that the government, our government,
as well as a number of international partners and allies, work together and determine and
make public that the ransomware is an international and national security risk, and, therefore,
that they needed to also develop a coalition of governments working to enforce the laws
and to bring these perpetrators to justice.
But, also, in addition to doing investigative, taking -- undertaking investigative measures,
we have seen that ransomware is the latest symptom of a range of cybersecurity vulnerabilities
and weaknesses, as you mentioned, and we therefore think that there needs to be additional incentives.
And, potentially, there may need to be the need for regulation, particularly of components
of critical infrastructure, such as was a victim today. And that will be hopefully the
subject of public debate.
WILLIAM BRANGHAM: I mean, the Biden administration today pointed the finger at this particular
hacking group, DarkSide, but also hinted that they might be based in Russia, and that the
Russian government might have some responsibility in all this.
Do you have a sense of -- I mean, let's just say other governments are involved. That's
a much trickier nut, if you have to try to get other governments to crack down on actors
within their own borders.
MEGAN STIFEL: It is.
Unfortunately, we know, in many cases in ransomware, that the actors are operating from something
we call safe havens, governments who are unwilling or otherwise unable to help further an investigation
of this type.
And in that case, we have to work with other governments and the private sector to use
additional measures to try and bring these perpetrators to justice. That could involve
a range of actions, including, as we have already seen from this administration, additional
sanctions on Russia, as well as looking at other measures such as foreign military aid,
were recommendations from the task force that I was involved in, really looking at all elements
of national power to try and bring additional importance and really make an impact on this
growing threat.
WILLIAM BRANGHAM: All right, Megan Stifel of the Global Cyber Alliance, thank you very
much for being here.
MEGAN STIFEL: Thanks very much for having me.