--:-- Ryan Knudsen: Welcome to The Journal, our show about money, business, and power. I'm Ryan Knudsen. It's Tuesday, October 8th.
--:-- Ryan Knudsen: Late last month, the Wall Street Journal broke a story about a major hack into critical U.S. infrastructure. Cybersecurity experts believe it was carried out by a Chinese group called Salt Typhoon.
--:-- Dustin Volz: The Wall Street Journal reported that China-linked hackers have breached U.S. internet providers. It's aimed at accessing sensitive information and gaining footholds in critical broadband networks.
--:-- Ryan Knudsen: Hackers potentially access the network the federal government uses to request court-authorized wiretapping for criminal and national security investigations.
--:-- Dustin Volz: Our colleague Dustin Volz was one of the reporters on the story. He says the hack has U.S. officials freaking out.
--:-- Ryan Knudsen: This hack is particularly alarming to government officials and security investigators because they not only had deep access, but they were extraordinarily stealthy and were inside the networks for months, we've been told, potentially even far longer than that.
--:-- Dustin Volz: And there's deep concerns about the sensitive nature of data that was potentially compromised in these breaches.
--:-- Ryan Knudsen: So how big of a deal is this?
--:-- Dustin Volz: This is potentially catastrophic. That is what we are hearing from officials and investigators familiar with the reaches.
--:-- Ryan Knudsen: The sort of level of panic is extremely unusual.
--:-- Dustin Volz: From my 10 years reporting on cybersecurity issues, this is sort of very much ranking at the top of the list for what seemingly people are concerned about.
--:-- Ryan Knudsen: They're putting this very much at the top of the list.
--:-- Ryan Knudsen: Welcome back to The Journal. Coming up on the show, what we know about China's monster hack.
--:-- Ryan Knudsen: We'll be right back.
--:-- Ryan Knudsen: Alright, so let's talk about this hack. What happened exactly?
--:-- Dustin Volz: So we don't know a lot about the hack, and that's in part because the Biden administration and cybersecurity investigators are still very much in the midst of figuring out what exactly happened here.
--:-- Ryan Knudsen: It's sort of unusual that details emerge publicly so early during a discovery of a major breach like this.
--:-- Dustin Volz: But what we do know is that at least three major broadband providers in the United States, Verizon, AT&T, and Lumen, were all compromised by a Chinese-linked group called Salt Typhoon.
--:-- Ryan Knudsen: This appears to be espionage related, and it appears to be something that has potentially been going on for many months, if not longer.
--:-- Dustin Volz: And all the individuals we've spoken to have described the attacks as extraordinarily stealthy extremely sophisticated and sort of a stunning level of deep intrusions into these compromised networks
--:-- Ryan Knudsen: Verizon, AT&T, and Lumen declined to comment on the hack.
--:-- Dustin Volz: A spokesman of the Chinese embassy in Washington said China opposes cyber attacks in all forms.
--:-- Ryan Knudsen: By infiltrating U.S. networks, Chinese spies could potentially get access to all kinds of communication, like text messages and internet traffic, even phone calls.
--:-- Dustin Volz: On top of that, these Chinese hackers targeted one of the systems the U.S. government uses for domestic surveillance.
--:-- Ryan Knudsen: There are signs that they targeted sensitive U.S. surveillance systems that are used to comply with court-authorized wiretappings that the companies in question have to provide to the FBI and other agencies for criminal and national security investigations.
--:-- Dustin Volz: For the past 30 years, there has been a federal law known as the Communications Assistance Law Enforcement Act that has required telecommunications companies to essentially allow the U.S. government to access communications data on their networks if they get a court order related to a targeted criminal or national security investigation.
--:-- Ryan Knudsen: Over time, Congress has modernized this, so it's not just about phone calls, but also about digital traffic. Think, text messages and other sorts of Internet traffic.
--:-- Dustin Volz: And we're talking about wiretapping, just like kind of the classic police investigation movie that you think of is the cops need to wiretap a suspect so they can listen in on their phone calls and then they can use that to build a case.
--:-- Ryan Knudsen: Exactly. Wiretap is maybe not the best term of art in the modern 21st century digital age, but that is essentially what we're talking about here is a way for the government to access pieces of data on particular suspects related to national security and criminal investigations that these companies are obligated to comply with assuming the government gets a court order.
--:-- Dustin Volz: Getting into this wiretap network means the Chinese could have access to whatever U.S. officials are investigating.
--:-- Ryan Knudsen: The Chinese were essentially able to spy on what the U.S. government was spying on.
--:-- Dustin Volz: So you might think, well, why do the Chinese care about, law enforcement access requests related to, routine criminal investigations happening in the United States?
--:-- Ryan Knudsen: And they might not care about, a New Mexico drug trafficking case that the FBI is working on or something like that.
--:-- Dustin Volz: But other kinds of investigations could be of much greater interest to the Chinese government.
--:-- Ryan Knudsen: What they would care about, presumably, are counterintelligence investigations on Chinese spies who are living and working in the United States, at maybe various research institutions or technology companies.
--:-- Dustin Volz: You know, over the past several years, we've seen any number of cases come from the Justice Department related to Chinese espionage in the U.S.
--:-- Ryan Knudsen: And if you're the Chinese intelligence services, you would have deep interest in knowing about the sort of surveillance that's being done on these targets to be able to understand what the U.S. knows and be able to respond to that and potentially better conceal your espionage assets who are living within the United States.
--:-- Dustin Volz: Behind the hack is a group known as Salt Typhoon.
--:-- Ryan Knudsen: We don't know that much about Salt Typhoon, other than the fact that cybersecurity researchers have linked its activities to the Chinese government.
--:-- Dustin Volz: How does a Salt Typhoon hack compare to other Chinese hacks that we've seen in the past?
--:-- Ryan Knudsen: So this is one of a barrage of Chinese-linked cyber attacks targeting major U.S. critical infrastructure and major U.S. companies over the last several years.
--:-- Dustin Volz: They're sort of getting in everywhere, and they're doing all sorts of really, really alarming things.
--:-- Ryan Knudsen: What's notable here is that the Chinese used to be kind of considered the loud, drunken burglars of hacking.
--:-- Dustin Volz: Russia was sort of really, really stealthy, really adept.
--:-- Ryan Knudsen: China you know 10 years ago was stealing enormous amounts of data from the United States but they were getting caught
--:-- Dustin Volz: They were sort of loud They were smashing in the front window and waking everybody up
--:-- Ryan Knudsen: Exactly. And they, steal your car, but they would drive through the garage door on the way out.
--:-- Dustin Volz: Knock over a long gnome. Yeah, they knock over a long gnome and, hit the mailbox down the street, and then, the police would arrive and catch them.
--:-- Ryan Knudsen: So that was what the Chinese were known for.
--:-- Dustin Volz: This attack and other recent ones attributed to the Chinese have instead been a lot more like what we've seen from Russia over the years, which is just incredibly stealthy, incredibly sophisticated, using complex attacks that involve a variety of different techniques that only sort of the most sophisticated hackers could really engineer to achieve persistent months or years-long access into networks, evade detection, and create ways in which they can sort of come and go in networks and conceal their traffic.
--:-- Ryan Knudsen: So essentially there's no way of knowing what they're doing or how long they've been inside.
--:-- Dustin Volz: But while the Salt Typhoon hack was about gathering intelligence, China has also been pursuing another type of hack, one that's aimed at causing chaos in American society.
--:-- Ryan Knudsen: That's next.
--:-- Voiceover: Mint is still $15 a month for premium wireless. And if you haven't made the switch yet, here are 15 reasons why you should.
--:-- Voiceover: One, it's $15 a month. Two, seriously, it's $15 a month. Three, no big contracts. Four, I use it. Five, my mom uses it.
--:-- Ryan Knudsen: Are you playing me off? That's what's happening, right? Okay, give it a try at mintmobile.com slash switch.
--:-- Voiceover: Upfront payment of $45 for three-month plan, $15 per month equivalent required. New customer offer first three months only. Then full price plan options available. Taxes and fees extra. See mintmobile.com.
--:-- Ryan Knudsen: Running a business comes with a lot of what-ifs. But luckily, there's a simple answer to them.
--:-- Voiceover: Shopify. It's the commerce platform behind millions of businesses, including Thrive Cosmetics and Momofuku.
--:-- Ryan Knudsen: And it'll help you with everything you need. From website design and marketing to boosting sales and expanding operations, Shopify can get the job done and make your dream a reality.
--:-- Voiceover: Turn those what-ifs into...
--:-- Ryan Knudsen: Sign up for your $1 per month trial at shopify.com slash special offer.
--:-- Ryan Knudsen: The ambition and scale of Chinese cyber attacks has been growing. Until recently, U.S. officials thought China was mainly focused on stealing corporate and scientific secrets.
--:-- Dustin Volz: But it's become clear that China is also trying to hack into different types of critical U.S. infrastructure.
--:-- Ryan Knudsen: You know, think transportation systems like airports, oil and gas systems, water sanitation facilities, the power grid, and basically maintain quiet access for the purposes of later detonating the, cyber equivalent of bombs in these networks to cripple them in the event of a major conflict with China.
--:-- Dustin Volz: FBI Director Christopher Wray warned about the risks posed by the People's Republic of China, or the PRC, in congressional testimony earlier this year.
--:-- Ryan Knudsen: There has been far too little public focus on the fact that PRC hackers are targeting our critical infrastructure, our water treatment plants, our electrical grid, our oil and natural gas pipelines, our transportation systems, And the risk that poses to every American requires our attention now.
--:-- Dustin Volz: So while that's happening, and that's been sort of a 10 out of 10 on the panic scale for officials, along comes Salt Typhoon that we are just now learning about, which is quietly engaging in perhaps one of the most successful and most damaging cyber espionage campaigns.
--:-- Ryan Knudsen: So you take those two campaigns together and it just really sort of broadens the aperture for how serious and significant these Chinese attacks on the US are and how we really are probably only even seeing the tip of the iceberg in terms of the full extent of what they been able to do the networks that they been able to compromise and the preparations that they making for a future conflict with the United States
--:-- Dustin Volz: So the Chinese government and these Chinese hackers are really just like embedding themselves all inside the U.S. networks of all kinds and just sort of lying in wait.
--:-- Ryan Knudsen: That's right. You know, historically, we were concerned about, spies embedding themselves. In the Red Scare, there were all sorts of concerns about spies being everywhere in government and small towns across America.
--:-- Dustin Volz: Those spies being people. Yeah.
--:-- Ryan Knudsen: But this is essentially the 21st century equivalent of that, of the sort of the worst case scenario, where you have likely thousands of these digital spies embedded in networks, big and small, across the United States, ready at a moment's notice to either do something destructive or stealthily stealing critically valuable intelligence and information from these compromised networks.
--:-- Dustin Volz: Every time I talk to an American intelligence official, they're just gobsmacked by how serious this is and how widespread it is.
--:-- Ryan Knudsen: So is anybody at fault here for why these hackers were able to get in and stay undetected for so long?
--:-- Dustin Volz: It's hard to point a finger at any single provider or technology company and say, this is why this hack happened.
--:-- Ryan Knudsen: At the end of the day, the Chinese are so incredibly talented at what they're doing, and they have tens of thousands, if not more, hackers who are working day and night to infiltrate these networks that most people I speak to say this is inevitable.
--:-- Dustin Volz: This is inevitable that they're going to get in.
--:-- Ryan Knudsen: What we need to do is be as resilient as possible, as good at detecting it when it happens, and have systems in place to respond.
--:-- Dustin Volz: Is it going to be possible to get these hackers out? I hope so.
--:-- Ryan Knudsen: We don't know the full extent of the current level of compromise today within the networks of these providers.
--:-- Dustin Volz: Certainly efforts are underway to identify them and kick them out of the network.
--:-- Ryan Knudsen: But it's not easy to get these guys out. They are extremely good at what they do.
--:-- Dustin Volz: So this is not just sort of, finding a burglar, you know, stealing stuff from your living room and putting cuffs on them and kicking them out.
--:-- Ryan Knudsen: This is far more complicated than that.
--:-- Dustin Volz: And eventually, I'm sure the companies are confident that they're going to be able to secure their systems and get the hackers out.
--:-- Ryan Knudsen: But it remains to be seen how long that's going to take or if they've had that success so far.
--:-- Dustin Volz: Is there a way for the U.S. to defend itself better to prevent this sort of thing from happening?
--:-- Ryan Knudsen: So part of the issue here is that so much of our cybersecurity is reliant on the private sector.
--:-- Dustin Volz: So whether it's infrastructure like power plants or water systems or transportation systems or telecommunications firms, these are private companies.
--:-- Ryan Knudsen: and largely they, for the most part, with some exceptions, don't have a ton of cybersecurity requirements that are imposed on them by Congress.
--:-- Dustin Volz: There are a number of reasons why that hasn't happened over the years, but critics would say that these companies are sort of lax in their security standards because they're allowed to be.
--:-- Ryan Knudsen: That sort of system just makes it so that we are essentially a target-rich environment for hackers.
--:-- Dustin Volz: We are a highly digitized country. We love technology, and that makes it very easy for us to have these sort of single points of failure at these huge companies that can lead to potentially catastrophic risk when the hackers come knocking.
--:-- Ryan Knudsen: That's all for today, Tuesday, October 8th.
--:-- Ryan Knudsen: The Journal is a co-production of Spotify and The Wall Street Journal.
--:-- Ryan Knudsen: Additional reporting in this episode by Sarah Krause, Robert McMillan, and Aruna Vishwanatha.
--:-- Ryan Knudsen: Thanks for listening. See you tomorrow.
