深入调查：FBI 敏感人事系统惨遭黑客入侵的内幕与余震

Michael Barbaro: From the New York Times, I'm Michael Barbaro. This is The Daily.

A little over a decade ago, after hackers broke into the US government and stole the personnel records of millions of federal workers, US officials vowed that it would never happen again. It just did. This time to the FBI.

Today, my colleague, cybersecurity reporter Dustin Volz, tells the story of this devastating attack, the group behind it, and what now happens to the hypersensitive data that those hackers have stolen. It's Wednesday, September 30th.

Dustin, welcome back to The Daily.

Dustin Volz: Thank you. Good to be here.

Michael Barbaro: Good to have you. You cover the world of hacking, cyber attacks, and this hack is a doozy. So, can you just describe the scale of what just happened at the FBI?

Dustin Volz: It is a doozy. And I think more important than the scale, which could be tens of thousands of current and former FBI employees affected here, I think the scope of it is what's really important because the hackers were able to break into a government jobs portal the FBI uses and not just steal names and phone numbers and emails, but far more sensitive details about these officials, including their spouse's names in some cases, their children's names, their addresses, their secretive job titles, and even details that could be used to help a hacker follow them during their travels.

Michael Barbaro: Let me just zero in on one of these staggering things you just said, job titles at the FBI. What kind of job titles were revealed in this hack?

Dustin Volz: So, the FBI is a pretty secretive organization. A lot of the work they do is public, but a lot of it is behind the scenes. And so the job titles might not be classified, but they are very, very sensitive and they might reveal things such as an agent working in counterintelligence against foreign spies or working on a China desk or a Russia desk. And these are FBI officials that you sort of never really hear about. You never meet. And they spend oftentimes decades of their lives working behind the scenes to try to pursue various alleged criminals. So this hack accessed information so detailed that the hackers who now have it can see which people within the FBI are assigned to which of our foreign adversaries. That's very intrusive.

Dustin Volz: It is. And it's not just their job titles. It's also in many cases their supervisors. And in many ways you almost can build a map of the FBI's workforce and see what people are doing, learn more about their investigations and potentially respond in other ways depending on what your pursuit or interests are.

Michael Barbaro: Right? And your pursuit could be to end such an FBI investigation. Your pursuit could be to seek revenge on an FBI agent, to extort them. Who knows? This information would seem to arm you to do any number of those things.

Dustin Volz: Absolutely. One of the top concerns that I've been hearing for the past week from a number of former FBI officials that I've spoken to, including senior officials who worked on cybersecurity issues, is that these are going to be FBI agents who maybe put violent criminals behind bars, prosecuted the mafia and are now, if the data surfaces publicly, exposed to forms of retaliation. I think it's important for people to understand that these types of FBI agents zealously guard their privacy. They do everything they can to make sure their addresses are not listed. These people are not on social media and now you have this database that is out there that reveals all sorts of intimate details.

Michael Barbaro: Mhm. So given the scale of what you're laying out here, how does this stack up against previous hacks into the United States government?

Dustin Volz: So about 12 years ago, US officials this morning are blaming foreign hackers for another serious data breach. The foreign government hacked the Office of Personnel Management, also known as OPM, and stole more than 20 million records of US government employees and contractors, as well as something like 5 million fingerprints. As one official told us, Charlie, this is bad. There is no way to put lipstick on this pig. And that was kind of considered a historic hack of epic magnitude that the foreign intelligence services would be dining out for years, if not decades.

Michael Barbaro: Right. I remember it. Why wasn't this information encrypted?

Dustin Volz: Um the encryption is one of the many tools that systems can use. I'll look to my colleagues at DHS for their response. No, I want to know from you why the information wasn't encrypted. It was a huge deal and it prompted all sorts of congressional hearings. The status quo is unacceptable and leadership has to resign. Resignation from the director. This was during the Obama administration and a lot of vows to better protect data, put it behind lock and key to make sure this never happened again.

Michael Barbaro: Obviously, they failed.

Dustin Volz: They failed. And a lot of officials are telling me that this current hack could be as bad or in some ways worse than what happened with the OPM breach because of the granularity of the data at issue and because of who took it.

Michael Barbaro: Well, talk about that, who took it. What do we know about the hackers who did this? Why they did it and precisely how they did it?

Dustin Volz: So the hackers in this case are not a foreign intelligence agency. Instead, they are a loose collective of young criminal hackers believed to be operating in countries around the world. And these hackers go by the name ShinyHunters.

Michael Barbaro: Hackers often have very interesting names. Analysts say that this one seems to be a reference to the popular video game Pokémon in which gamers go after extremely rare and exotic shiny Pokémon. Got it. So, the ShinyHunters are out there not to just get everyday paydays, but to score big hits, to bring home big game, and they are breaking into hundreds of organizations to extort them in some cases for payments of millions of dollars. So they're basically in the business of ransomware.

Dustin Volz: Yes. But it's not a traditional ransomware group. Instead of breaking into an organization and locking up their files and demanding payment, what they do instead is they break into an organization, steal all of that data, and then threaten to do things with it like publish it online unless they're given a payment via Bitcoin in oftentimes as little as 72 hours. And they go after all sorts of companies no matter how big: AT&T, Ticketmaster, educational software used by students around the country and the world. I mean, these are just a few names that stick out.

Michael Barbaro: So, this would seem to be a real departure from this group's normal MO of going after companies, threatening to release things, getting paid. The FBI is not Ticketmaster and it's not an education software company. So why target the premier law enforcement agency of the United States?

Dustin Volz: That's a great question. It is certainly audacious to go after the FBI and it really surprised a lot of people. It surprised me. It surprised a lot of security researchers and it certainly surprised I think the FBI and a lot of former officials who work there. The hackers said when they disclosed this hack that essentially they were doing this as a form of revenge.

Michael Barbaro: Huh, for what?

Dustin Volz: They said they were seeking retribution from the FBI for a public service advisory that the bureau issued back in May of this year where they warned that the ShinyHunters hackers are very, very serious and doing a lot of damage. And in that they detailed their tactics. The FBI said that they engage in harassment and intimidation of victims to try to secure payment.

Michael Barbaro: Such as?

Dustin Volz: Such as revealing private photos that they've stolen from victims, launching swatting attacks where local law enforcement is called into the address of a victim to scare them maybe with guns drawn. All sorts of harassment-type activities that the ShinyHunters group says, "Hey, look, we extort victims, but we don't do those kinds of things, and the FBI needs to correct the record."

Michael Barbaro: So, basically, they're mad that they're not being seen by the FBI for the honorable thieves they see themselves to be. They feel like the FBI has incorrectly maligned them as something even worse than they are.

Dustin Volz: Yes. They view themselves as honorable thieves. At least some of them do. They talk about their work as if it's almost a business that they are running and they are very good at what they do. And in this case, what they did or what they've claimed to have done is to find a zero-day computer flaw. This is a type of flaw that is unknown to the world that has not been previously disclosed to attack a Oracle PeopleSoft product that is used for helping with HR and financial records and data management for companies. And what they have said is that they used this zero-day to compromise the FBI to get this historic and current data from the jobs portal and walk away with it.

Dustin Volz: And so the world learns about this hack last Tuesday when the group posts on its dark web forum that they have hacked the FBI. And in their statement which calls out Director Kash Patel as well as the cyber leader of the FBI, they say, "We need you to fix this public service alert or else essentially." And in that statement they also include conveniently a email to contact them.

Michael Barbaro: Huh.

Dustin Volz: So being a reporter as I am want to do I reached out to them. I sent them a note and said, "Hi, I hear that you have hacked the FBI."

Michael Barbaro: What a funny position to be in.

Dustin Volz: It was. I honestly did not expect them to respond at all, but they were eager to do so and got back to me I think within about 10 minutes.

Michael Barbaro: Wow.

Dustin Volz: And that's when they sent me a sample of data that they said was from the hack of the individuals who had their data compromised.

Michael Barbaro: They send you essentially a sample of the hack material to prove that they've done what they say they have done.

Dustin Volz: Yes. It was sort of like a, you know, we've stolen a lot of stuff and here's a receipt and they shared that information and said, you know, we have a deadline for the FBI to retract or remove this public statement, Tuesday, September 29th. And the officials and security experts that I spoke with were very much under the impression that they were going to leak some or all of the data that they had obtained online.

Michael Barbaro: They would publish all this very sensitive FBI personnel data if the FBI didn't meet their demand.

Dustin Volz: Yes. So the clock is ticking. I am emailing with the hackers. I ask them point blank, what are you going to do if the deadline passes and the FBI does not comply? They say no comment. But meanwhile, the fear and anxiety is growing in the security community, within the FBI, that come the deadline, they could do something very dramatic and just publish FBI names and titles and family members names, all of the data online for the whole world to see. And then on Monday, a day before the deadline comes to pass, the hackers reach out with a new message that twists the story on its head. We'll be right back.

Michael Barbaro: So Dustin, what did these hackers say right before this deadline that ultimately ends up really changing the whole direction of the story?

Dustin Volz: So the hackers reach out in a lengthy email and tell me we have a clarification. We are not going to publish this FBI data online. We are not going to do it. And anybody who thought otherwise was mistaken. So essentially nothing to see here. Let's all move on.

Michael Barbaro: I mean, how do you understand such a complete backing down from their normal tactics and a sudden claim that the thing everyone feared seemingly quite justifiably was, oh, kind of total misunderstanding?

Dustin Volz: Look, far be it from me to try to get inside the minds of a diffuse network of international hackers. (laughter) But here's what strikes me. The FBI says they are aggressively investigating this, working with third parties to go after the hackers. Essentially, they are treating this as a five-alarm fire internally.

Michael Barbaro: Mhm.

Dustin Volz: Meanwhile, the news of the hack is getting more and more attention. The hackers are doling out exclusives to various media outlets about exactly what they've taken. That drumbeat continues and you see the reaction building too from former FBI officials, security experts saying this is historically bad when we think about the theft of data from the government. And so all of this is building into a crescendo as this deadline approaches and that's when the hackers decide to issue this updated statement. Now, like I said, it's hard to know exactly what their motivations are. This is a loose collective of hackers. It's believed to be a bunch of different people working together from across the globe. And so, it is very possible that you have different factions that have different views about how hard they want to push this, right?

Michael Barbaro: Some might be saying, "Hey, let's milk this for all it's worth. Let's keep going." Others might think, you know, maybe we have gotten what we wanted. We got the attention and let's sit back.

Dustin Volz: Right? I mean, it's seems quite reasonable to speculate that perhaps one of the factions within this collective of diffuse hackers may have made the claim to the rest of them that what they did here was ultimately maybe just a little too ambitious. That this is not AT&T, this is not Ticketmaster, and that kicking this hornet's nest, the FBI, that that might be a huge mistake and that it would backfire and that it might even destroy this group. It's hard to know, but it's very possible. And I mean, think of, you know, the mafia or other criminal organizations over the years. Like, this is not an unusual situation where you do have competing factions that might have disagreements about what they should do, how they should carry out their business. However, if they thought they were going to get the FBI off their back by vowing to not publish the data, they were wrong.

Michael Barbaro: Wrong. How?

Dustin Volz: On Tuesday, Brett Leatherman, assistant director of the FBI's cyber division—Brett Leatherman, who has a great name for an FBI official, (laughter) came out in a public video today. "Our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters."

Dustin Volz: And he touts in this video the recent arrests in the Netherlands of a 24-year-old hacker believed to be a key figure in the ShinyHunters group. And he says essentially to the rest of the gang, "Now to the remaining members of ShinyHunters. Other groups believed anonymity or their friends would protect them and they were wrong. You know how to find us and we know how to find you. We are coming after you. I suggest you reach out first while the choice is still yours."

Michael Barbaro: Well, while the FBI issues these threats and no doubt is vigorously attempting to find all these hackers and arrest them, the reality is that all of this data is still floating around within the hackers' computer systems and I suppose even in the email of some reporters.

Dustin Volz: That's right. So, just because the hackers said they're not going to publish it, first of all, they could change their mind and decide to do that later, but also there's nothing to stop them from selling the hacked data to the highest bidder or multiple bidders, including Russian and Chinese intelligence agencies that might have deep interest in learning everything they can about the FBI's workforce. So the idea that this is the end of the story is definitely not the case because this is data that is now out there. They've shared it with several different news outlets, right? There are security researchers who have come forward and publicized that they have also obtained the sample data set as well. It's unclear how, but once you start sharing data with other people, it tends to take on a life of its own and it really can't be put back in the box.

Michael Barbaro: I have to ask Dustin because I'm genuinely curious and listeners maybe too. You said you got a sample of this hacked material. What do we the Times do with this? If I can ask?

Dustin Volz: You know, this was a difficult issue for us to deal with internally. Should we even look at it? And if we look at it, what should we do with it? Should we analyze it? Should we report on it? How much should we report on it? These were a lot of questions we had internally with our lawyers and our standards team about sort of how do we want to handle this material that is out there. We are not sharing it with anyone and we are securing it to the best of our ability.

Michael Barbaro: So what seems clear is that the FBI when it comes to this data is not at all out of the woods. And that makes me want to go back to Dustin, what you had described as the government's response to that infamous OPM hack all those years ago when it said, "We're never going to let this happen again." And it does happen again. Because ultimately this feels like a very meaningful not just security breakdown but a betrayal of people at the FBI who signed up for really sensitive law enforcement work within understanding that their personal information would be protected implicitly. That's a reasonable bargain to reach with your employer if your employer is the FBI. And instead the FBI left its personnel system so vulnerable that this hack happened and these workers are now in real unnecessary peril.

Dustin Volz: That's right. You know, I think there's a lot of current and former officials that we've been hearing from at the FBI who are very frustrated about the situation and made clear to us that they didn't even know that a data set like this existed and had questions about why it existed and why would there be a place where there's a repository of so much intimate information that seemingly is kept for years without being deleted, without being purged that a hacker could access and And a lot of these officials said, you know, working for the FBI can be a dangerous job. I sign up for this, but my family doesn't. And the fact that this data set includes emergency contacts, spouses, siblings, in some cases, children, that is, I think, what is especially alarming to a lot of the people who work at the FBI, that it's not just them that have to worry about it, but their entire families in some cases. And to me, this demonstrates that even though the government has come a long way since that last big hack, that hack of OPM, it still has a very long way to go to protect its systems and more importantly to protect its people.

Michael Barbaro: Well, Dustin, thank you very much. I appreciate it.

Dustin Volz: Thank you for having me.

Michael Barbaro: You can read more from Dustin Volz and all of our reporters on the New York Times app. If you don't already have the app, we want to let you know that if you download it right now, you'll get access to all of our journalism free for 1 month. So, give it a try. We'll be right back.

Here's what else you need to know today.

The Times reports that in the months before OpenAI's artificial intelligence went rogue and attacked the startup company Hugging Face, two OpenAI employees raised an alarm with their superiors, but were ignored. In emails, the employees worried that OpenAI's newest artificial intelligence models were not being appropriately monitored during testing. In response, their superiors said that testing needed to move ahead to meet deadlines and workers said that no new safety protocols were created.

And in a temporary victory for the Trump administration, the Supreme Court allowed the government to keep deporting people to countries they aren't from and may have no connection to. These so-called third-country deportations, including to authoritarian countries with human rights abuses, were the focus of Monday's episode of the show. And while the justices cleared the way for those deportations to continue for now, they fast-tracked a final ruling in the case for next year.

Today's episode was produced by Alex Stern, Olivia Natt, and Eric Krupke with help from Jack D'Isidoro. It was edited by Annie Midgley, contains music by Pat McCusker, Rowan Niemisto, and Diane Wong, and was engineered by Alyssa Moxley. Our theme music is by Wonderly.

That's it for The Daily. I'm Michael Barbaro. See you tomorrow.