Inside the Devastating Hack of the F.B.I.

The Daily

The episode details a significant cybersecurity breach targeting the FBI's personnel records via a government jobs portal. Reporter Dustin Vo

Key takeaways

• The hack targeted an FBI jobs portal, exposing names, addresses, and secretive job titles like 'China desk' or 'Russia desk'.
• Sensitive details about agents' spouses and children were also compromised in the breach.

Main topics

• FBI cybersecurity breach
• Shiny Hunters hacking group

Notable quotes

It is a doozy.

Conclusion

This episode highlights the persistent vulnerability of government inf

Transcript preview

Speaker 2 (0:00) Hey, it's Anna Martin from The New York Times. What if I told you you'll never have to hear this line again? Speaker 4 (0:06) Wherever you get your podcasts. Speaker 2 (0:08) Yeah, no, I actually can't tell you that. But you know what I can tell you? A place I think you might want to go. It's the Shows tab in The New York Times app. The place to listen to and now watch full episodes of New York Times shows. The Shows tab. Find it in The New York Times app. Explore The Shows tab and follow a show today. Speaker 6 (0:30) From The New York Times, I'm Michael Barbaro. This is The Daily. A little over a decade ago, after hackers broke into the U.S. government and stole the personnel records of millions of federal workers, U.S. officials vowed that it would never happen again. It just did. This time, to the FBI. Speaker 6 (0:58) Today, my colleague, cybersecurity reporter Dustin Volz, tells the story of this devastating attack, the group behind it, and what now happens to the hypersensitive data that those hackers have stolen. It's Wednesday, September 30th. Speaker 6 (1:23) Dustin, welcome back to The Daily. Speaker 5 (1:26) Thank Speaker 6 (1:26) you. Speaker 5 (1:26) Good to be here. Speaker 6 (1:27) Good to have you. You cover the world of hacking, cyber attacks, and this hack is a doozy. So can you just describe the scale of what just happened at the FBI? Speaker 5 (1:42) It is a doozy. And I think more important than the scale, which could be tens of thousands of current and former FBI employees affected here, I think the scope of it is what's really important because the hackers were able to break into a government jobs portal the FBI uses and not just steal names and phone numbers and emails, but far more sensitive details about these officials, including their spouses' names, in some cases their children's names, their addresses. their secretive job titles, and even details that could be used to help a hacker follow them during their travels. Speaker 6 (2:25) Let me just zero in on one of these staggering things you just said, job titles. At the FBI, what kind of job titles were revealed in this hack? Speaker 5 (2:34) So the FBI is a pretty secretive organization. A lot of the work they do is public, but a lot of it is behind the scenes. The job titles might not be classified, but they are very, very sensitive. And they might reveal things such as an agent working in counterintelligence against foreign spies or working on a China desk or a Russia desk. And these are FBI officials that you sort of never really hear about. You never meet. And they spend oftentimes decades of their lives working behind the scenes to try to pursue various alleged criminals. Speaker 6 (3:10) So this hack accessed information so detailed that the hackers who now have it can see which people within the FBI are assigned to which of our foreign adversaries. That's very intrusive. It Speaker 5 (3:26) is, and it's not just their job titles. It's also, in many cases, their supervisors. And in many ways, you almost can build a map of the FBI's workforce and see what people are doing. learn more about their investigations, and potentially respond in other ways, depending on what your pursuit or interests are. Speaker 6 (3:46) Right, and your pursuit could be to end such an FBI investigation. Your pursuit could be to seek revenge on an FBI agent, to extort them. Who knows? This information would seem to arm you to do any number of those things. Speaker 5 (3:59) Absolutely. One of the top concerns that I've been hearing for the past week from a number of former FBI officials that I've spoken to, including, you know, senior officials who worked on cybersecurity issues, is that these are going to be FBI agents who maybe put violent criminals behind bars, you know, maybe prosecuted the mafia and are now, you know, if the data surface is publicly exposed to. forms of retaliation. You know, I think it's important for people to understand that these types of FBI agents zealously guard their privacy. They do everything they can to make sure their addresses are not listed. These people are not on social media. And now you have this database that is out there that reveals all sorts of intimate details. Speaker 6 (4:40) So, given the scale of what you're laying out here, where does this, how does this stack up against previous hacks into the United States government? So, About 12 years ago... Speaker 1 (4:54) U.S. officials this morning are blaming Chinese hackers for another serious data breach. Speaker 5 (4:58) The Chinese government hacked the Office of Personnel Management, also known as OPM, and stole more than 20 million records of U.S. government employees and contractors, as well as something like 5 million fingerprints. As Speaker 4 (5:14) one official told us, Charlie, this is bad. There is no way to put lipstick on this pig. Speaker 5 (5:20) And that was kind of considered a historic hack of epic magnitude that the Chinese intelligence services would be dining out for for years, if not decades. I Speaker 3 (5:31) remember it. Why wasn't Speaker 1 (5:33) this Speaker 3 (5:33) information encrypted? Speaker 1 (5:35) The encryption is one of the many tools that systems can use. I'll look to my colleagues at DHS for their response. Speaker 3 (5:42) No, I want to know from you why the information wasn't encrypted. It Speaker 5 (5:46) was a huge deal. And it prompted all sorts of congressional hearings. Speaker 3 (5:50) The status quo is unacceptable and leadership Speaker 5 (5:52) has to resign. Resignation from the director. This was during the Obama administration. And a lot of vows to better protect data, put it behind lock and key, to make sure this never happened again. Speaker 6 (6:09) Obviously, they failed. Speaker 5 (6:10) They failed.