--:-- [Theme music fades out]
--:-- Sean Rameswaram: You know how the United States is in desperate need of infrastructure work? It's got some serious work with its digital infrastructure, too. Just look at Baltimore.
--:-- [Sound effects: City sounds]
--:-- Sean Rameswaram: Tonight, it's a huge headache to complete a home sale in Baltimore. The city's computer system that looks for property liens or debts to check for a clear title is locked up. For the last three weeks, city employees in Baltimore haven't been able to get into their email accounts. Residents haven't been able to pay water and electric bills. Home sales have been significantly delayed. And it's all because of some hackers. Hackers demanded 13 bitcoins worth about $100,000 for the code to unlock the system. But Baltimore City Council president says the city won't pay the ransom.
--:-- [Sound effects: City sounds]
--:-- Sean Rameswaram: People who pay ransoms, they can leave something in the system and come back and shut you down again. And I just have to take the advice of the law enforcement and the professionals. This situation in Baltimore isn't a one-off. This is something that's been happening for a while now all over the country, all over the world. This is ransomware.
--:-- Renee Dudley: Ransomware is a type of malicious software. When it enters your computer, your files are encrypted. A ransom note pops up on your screen, and you need to pay a ransom, generally speaking, to get those files back.
--:-- Sean Rameswaram: How often is stuff like this happening? Actual statistics are hard to come by. But there are estimates posted by the Department of Homeland Security that estimate about 1.5 million attacks occur annually.
--:-- Renee Dudley: The FBI does collect statistics on reports of ransomware, but even the FBI itself admits that this is far below what's actually happening. So, for example, in 2018, there were only something like 1,400 victims who reported ransomware incidents to the FBI. That is so far below what's actually happening.
--:-- Sean Rameswaram: I have a Google Alert set up for ransomware, and every day you see new attacks. But these victims don't necessarily report that to law enforcement. And there are a few reasons for that. One of them is that they may be reluctant to disclose to law enforcement that they've been hit because they don't want people to know about potential vulnerabilities or gaps in their IT security, or they may be embarrassed.
--:-- Renee Dudley: And another reason, of course, is they may have the perception that law enforcement may not be able to help them. And there's a few reasons for that. One is that they are mostly overseas and in some cases in countries that are hostile to the U.S. that don't have extradition treaties. So even if federal law enforcement would go after them, they wouldn't necessarily be returned to the U.S.
--:-- Sean Rameswaram: Another reason, of course, is that the criminals typically request payment in Bitcoin, you know, the digital online currency. And that's notoriously hard to trace.
--:-- Renee Dudley: So if this is so common, I assume it's not just happening to cities like Baltimore. Is this something that's happening to regular people too? Anybody who is connected to the Internet is potentially vulnerable to ransomware.
--:-- Sean Rameswaram: Home users, big companies, municipalities, even local law enforcement. Anybody can be a victim of ransomware. But what we're seeing is increasingly businesses and municipalities and law enforcement agencies are being hit more so than your typical home user because those are organizations that would suffer disruption to day-to-day activities when they're subject to a ransomware incident.
--:-- Renee Dudley: And you may be more willing to quickly pay the ransom. And also you may have deeper pockets. What kind of deep pockets are we talking about? What's the average ransomware request like?
--:-- Sean Rameswaram: According to cyber research firms, the average ransom ask is in the several thousands of dollars range. But as you can see from the recent news, demands to companies and municipalities have stretched into the six-figure range.
--:-- Renee Dudley: How do they get in exactly to, you know, hack our data? One way is that they will send out blanket spam email attachments and hope somebody clicks on an attachment that they're not supposed to.
--:-- Sean Rameswaram: Another way is through brute force tools. You see oftentimes small businesses are attacked and those are organizations that may outsource their IT to a remote professional who uses remote desktop protocol to get onto their computer networks And those are filled with vulnerabilities like weak passwords and unpatched software
--:-- Renee Dudley: So it's all the people who made their password like password123? Potentially. And the security vulnerabilities are an issue here as well. People who fail to upgrade to the latest software, people who haven't patched the vulnerabilities that are known to exist. And hackers will get through those vulnerabilities.
--:-- Sean Rameswaram: So before this situation in Baltimore, what were some of the biggest instances of ransomware attacks? Well, one of the most famous ones is the SamSam attack that raged from 2015 to 2018.
--:-- Renee Dudley: And this was a big deal around this time last year when the city of Atlanta was attacked. Atlanta suffered far-ranging consequences from the attack. A cyber attack brought city services there to a virtual standstill. Court proceedings were slowed down. The city couldn't process court payments. Online billing systems went down. down, people actually faced things like delayed and canceled doctor's appointments and medical treatments.
--:-- Sean Rameswaram: It was one of the most crippling cyber attacks ever unleashed in the United States, wreaking havoc across a swath of American companies and major city agencies for nearly three years. Other victims of the Sam Sam attacks included the city of Newark, the Port of San Diego, the Colorado Department of Transportation, which called in the National Guard.
--:-- Renee Dudley: Across the country, people's lives were disrupted because of the Sam Sam strain. Were any of the people behind Sam Sam ever caught? They were never caught, but they were indicted. In November of 2018, the U.S. Justice Department indicted two Iranian men accused of operating and distributing Sam Sam ransomware.
--:-- Sean Rameswaram: The conspirators collected more than $6 million in extortion payments and caused more than $30 million in losses. But they have not been returned to the U.S. They've remained fugitives. How about all the people and companies that SamSam affected or who were targeted in this attack? Did they get their files back?
--:-- Renee Dudley: It's unclear what exactly happened with all of them. The Justice Department declined to answer questions about specific victims. But in general, ransomware victims can only get their data back by paying the ransom.
--:-- Sean Rameswaram: For a city like Baltimore, paying the ransom might be the only option, but it's not as easy as it seems because there's a whole industry of companies trying to take a cut.
--:-- Renee Dudley: That's in a minute. So, bill nye you know him you love him he's on tv but he's also in the podcast he's got a new one. It's called Science Rules.
--:-- Sean Rameswaram: In it, Bill Nye takes calls from listeners and answers all their weird, embarrassing, funny, and occasionally sometimes serious questions like, how do we go about putting colonies on Mars? How often should I really be washing my pillowcase? Or how will we prevent another Flint River crisis?
--:-- Renee Dudley: On Science Rules, Bill Nye answers such questions with his co-host Corey S. Powell, who's a science writer, editor, and Bill's trusty friend. No word yet on whether Corey is wearing a bow tie the whole time, but you'll have to listen to find out.
--:-- Sean Rameswaram: There's also a bunch of field experts and special celebrity guests. Bill is on a mission to explain how science rules everything in the universe, and you'll have to listen to the podcast to find out what other questions people are asking him.
--:-- Renee Dudley: The first episode of Science Rules is out now. You can check it out right after you finish listening to this here episode of Today Explained. Enjoy and subscribe so you never miss an episode.
--:-- Sean Rameswaram: Renee, when people get attacked with ransomware, what is the process of getting their data back? Could you sort of walk us through it?
--:-- Renee Dudley: Typically, when you are hit with ransomware, a ransom note will pop up on your computer screen, and there will be instructions of how to pay. Like straight up pop up, like interrupt whatever you're doing, something will just pop up.
--:-- Sean Rameswaram: Yep. And the two main ways that I've seen the instructions go down are, number one, there will be some email addresses on how to contact the hacker for further instruction including the amount of Bitcoin they want and how they would like it to be transacted They send you a Bitcoin wallet number to send it to and things like that
--:-- Renee Dudley: The other way is that some of them will set up sites on the dark web and you have to download a dark web browser You'll have to log on to their site. And there's typically a portal where they'll instruct you how much they want. And then if you do that, everything goes back to normal and everything's great?
--:-- Sean Rameswaram: It depends. If everything goes well, then you'll send the Bitcoin and they'll send the decrypter and the key that you can use to decrypt your files.
--:-- Renee Dudley: And from what I understand, sources told me that while sometimes hackers fail to live up to their end of the bargain, they usually don't because they need to have a reliable product, if you will, to stay in business. They need people to believe that they're going to get something if you pay them.
--:-- Sean Rameswaram: So does everyone just pay the ransom then? Or is there another way? Law enforcement? Good hackers? You know, some organizations find this particularly unpalatable. They don't want to deal with criminals. They don't want to use taxpayer money to pay ransom.
--:-- Renee Dudley: And in some cases, they've been allured by data recovery firms who've promised to recover their files using their own technology. What kind of firms are those? Is that like a whole business?
--:-- Sean Rameswaram: Yeah, this is the industry that is at the center of our reporting. On one end of the spectrum, there are firms that are completely transparent with their clients. clients. They know that there's usually only one way to decrypt ransomware stricken files, and that's to pay the hacker. Their business model is we can help people who are uncomfortable dealing with hackers directly, people who don't know how to use Bitcoin, and our service is to handle that for them.
--:-- Renee Dudley: On the other side of the spectrum, there are firms that claim to use their own quote-unquote trade secrets and their own technology to decrypt ransomware. But as we found, they're just paying the ransom.
--:-- Sean Rameswaram: What do you mean? They're lying?
--:-- Renee Dudley: The main issue is that clients believe that these firms are using their own technology to decrypt files without having to deal with hackers. When in reality, they're dealing with the hackers and adding a fee.
--:-- Sean Rameswaram: So these third-party firms are just like charging you an extra fee to pay the hackers their ransom?
--:-- Renee Dudley: Correct. One example is with the SamSam ransomware strain. Proven data, one of the firms had what became a mutually beneficial relationship with the SamSam attackers. to the point that the SamSam attackers actually started recommending that victims work with proven data.
--:-- Sean Rameswaram: The SamSam attackers knew that proven data was a recovery firm and that their business model is to pay ransoms on behalf of clients. And they had a relationship in which once a victim came in with SamSam ransomware, proven data could go to the portal where the SamSam hackers corresponded and say, we've got a client, we'd like you to suspend the timer for payment, because usually they had a timer of seven days or else your files would be permanently deleted.
--:-- Renee Dudley: And the SamSam attackers would suspend the timer and allow the client whatever time they needed to get the payment to them. Now, it raises some interesting legal questions because, you know, As one lawyer I talked to put it, the SamSam hackers are recommending that the client work with proven data because they know that proven data will pay the ransom in the manner that they prescribed.
--:-- Sean Rameswaram: It raises the question of whether that relationship between proven data and the SamSam attackers is too close. Because they know proven data is like a surefire way to get their ransom money quickly?
--:-- Renee Dudley: Yes, exactly. They know that Proven Data is a data recovery firm and that their business is to pay the ransom. It's just so funny because I feel like most people's notion of data recovery is like, I pay someone who knows hard drives and computers better than I do to rescue my information.
--:-- Sean Rameswaram: And this is I pay like a third party to like broker a cash transaction or a Bitcoin transaction.
--:-- Renee Dudley: Exactly. We looked at a case in Safford, Arizona that was interesting. And because it a public entity of course we were able to get the email correspondence between the city and proven data So what had happened there was the city of Safford was hit by a strain of ransomware that was not decryptable at the time.
--:-- Sean Rameswaram: Their files were down. It was affecting operations. They needed to get back on their feet. So they called proven data. Proven data, according to the emails we have, said that they would be able to recover the data using their own technology.
--:-- Renee Dudley: The city paid $4,000 and the data was recovered. Savard was a fairly satisfied client until they realized about a month later that not all of the files had been recovered.
--:-- Sean Rameswaram: Their network administrator began to get a little suspicious because when he went back to Proven Data, Proven Data wanted to charge another $4,000 to decrypt the rest of the data. And he asked the question in an interview with me, if their algorithms could decrypt the first set of files, why wouldn't it work on the second set?
--:-- Renee Dudley: So he began to believe that they might have just been working with the hackers and adding their own fee on top. And his hunch was correct.
--:-- Sean Rameswaram: I spoke with two security researchers who are some of the foremost specialists in ransomware. And they said that the strain that affected the city of Safford at that time was not decryptable except by paying a hacker.
--:-- Renee Dudley: So if cities are attacked and then these firms paid ransoms to these hackers, does that mean that taxpayer money was used to like pay off a ransom?
--:-- Sean Rameswaram: Theoretically, yes. The example of Safford highlights that they unknowingly paid the hackers because, of course, they believe that proven data was using its own technology.
--:-- Renee Dudley: But on the other side, proven data was paying the ransom. And while Safford's costs were mostly covered by their insurer, at the end of it, taxpayer dollars indeed were used to pay a ransom.
--:-- Sean Rameswaram: Is it legal to pay a ransom using taxpayer money? Or are normal people who get hacked allowed to be paying ransoms?
--:-- Renee Dudley: I'm not really sure about the legality there. So there are no U.S. laws that prohibit the payment of ransom.
--:-- Sean Rameswaram: Publicly, the FBI says ransom payment, quote, encourages continued criminal activity, leads to other victimizations, and can be used to facilitate serious crimes.
--:-- Renee Dudley: But in 2015, an FBI special agent in charge of the FBI's cyber program in Boston told people at a cybersecurity conference that the FBI will often advise people just to pay the ransom.
--:-- Sean Rameswaram: If not illegal, is it a bad idea? Isn't it just giving the hackers exactly what they want?
--:-- Renee Dudley: Well, it is what keeps the ransomware hackers in business. So if the FBI is admitting that even they often pay ransoms, whose job is it to make these things go away? Individuals? Cities? Someone else?
--:-- Sean Rameswaram: Well, it's an interesting question. Law enforcement hasn't been entirely effective. On the federal level, you have the FBI. And the issue with the FBI is it has limited resources. And the average ransom is only a few thousand dollars.
--:-- Renee Dudley: But at the local level, meanwhile, the issue of ransomware is too complex of an area for local law enforcement to do anything about.
--:-- Sean Rameswaram: So as one attorney I talked to said, it's sort of a legal gray area where there's no great remedy for ransomware victims.
--:-- Renee Dudley: As long as people will pay ransoms, ransomware is profitable for the people who are deploying it.
--:-- Sean Rameswaram: Renee Dudley is a senior reporter at ProPublica. She reported her story on ransomware with Jeff Cow.
--:-- Sean Rameswaram: Baltimore still hasn't solved its ransomware problem. And to add another wrinkle to the situation, reporting from the New York Times suggests that the malware used to hack the city may have come from the NSA.
--:-- Renee Dudley: The NSA developed stuff like this as tools for the United States government, and this particular stuff leaked. Which is to say, taxpayer dollars may have funded a government agency to create malware that was then used by some hackers to hijack a U.S. city.
--:-- Sean Rameswaram: And taxpayers may end up being the ones who have to fix it, too.
--:-- Sean Rameswaram: I'm Sean Ramos from This is Today Explained. Thank you.
