Untitled episode

it's the largest distributed denial of service attack ever against a civilian agency centers for Medicare and Medicaid services the National Institutes of Health which researches vaccines and pandemics Food and Drug Administration right I mean this is the backbone of the US Healthcare uh system the entire time this is happening we're trying to communicate and prepare for full-on telework we know Corona virus is about to hit

the United States when we started to have the discussion that we may have to shut it down I felt that it was a nation state effort against our Network any attack against the healthcare system is a big deal the fact that we may not know what they were really looking for and how they were looking to extract that data is [Music] critical this was a huge

Cyber attack in the panicked early days of the covid-19 pandemic targeting a $1.8 trillion government agency the truth of it has never been reported this is the Department of Health and Human Services and on March 16th 2020 they were going to full remote work this was going to be the beginning of work from home for the entire Federal US Government HHS is a huge government agency

and it has a budget about the same size as the entire Russian economy back in March 2020 it had assumed a particular significance because this had just happened we expect to see the number of cases the number of deaths and the number of affected countries climbed covid-19 can be characterized as a pandemic my name is Jose aretta I was the Chief Information officer Chief data officer

of the Department of Health and Human Services during the coronavirus pandemic so 15 March 2020 was an interesting day I had had a friend stop by uh around noon uh and he actually brought over a really good bottle of scotch and he said you got to sip this uh and my phone rang the first words that we heard is uh Jose we have a serious issue

the fact that everybody was about to start working from home was significant when the federal government went to work from home network operators had to adjust all their firewall and security settings to allow hundreds of thousands of new unknown connections into their Network so they had to scale down their security all at the same time and that's when the attack dropped when the network was at

its most exposed they had slowly been increasing scanning activity at HHS so if you go from 300 million to 400 million that's not a massive change but once we went over a billion that was kind of a threshold we took notice to that which appeared to be an attempt to overwhelm the network and cause it to stop working at this critical juncture where the federal government

was moving to to work from home that's what it initially looked like uh it became alarming when we eclipsed over 6 billion scans and if you think of Health and Human Services as a house uh what scanning activity is is someone looking in the doors and windows of the house so imagine if you had a house with 200 doors and windows and 15,000 times a second

somebody was trying to enter those doors and windows it would make it very hard for someone inside the house to leave uh and that's what was happening to the HHS Network it was making it very hard for us to communicate via email making it very hard for us to collect data throughout the United [Music] States we had tested the system we had made Investments to prepare

for this moment and all of a sudden all of the additional capabilities that we put in place so that they could easily work from home all that additional bandwidth is now being consumed we were extremely confused as to what was actually happening arietta and his team initially thought it was what is known as a distributed denial of service or dos attack a denial service attack means

we deal with it right we know Corona virus is about to hit the United States and our ability to have command and control capabilities communicate with federal state local Community Partners is imperative to our ability to respond distribute Therapeutics predict hotspot outbreaks across the United States so that we can do testing so that we can bring a vaccine online and we need a network to actually

do that so the team set about trying to counter the attack re-rooting traffic and increasing network capacity we started to actually move the internet traffic across the HHS Network and something very abnormal happened the actor the adversary actually started fouling us as we moved the internet traffic no matter what they did the attacker adapted but it never took the network down entirely it always stopped just

short of the full capacity that's what made arietta rethink what if this wasn't just a Dos attack what if it was something else entirely they were trying to figure out what is your limit what is your pressure point Beyond which you will break let's be honest for their ability to scale to that amount of bandwidth usage in that period of time if they wanted to take

us down I I strongly believe that they could have but they didn't and that got them questioning then if this isn't an attempt to take down the network what is it about about and what they landed on was this was a scanning operation this was an attempt a successful attempt to map the entirety of the Health and Human Services Network in very very quick fashion the

Corona virus was happening it was spiraling out of control the adversary needed to know how do we get into the network what is on the network what are our potential points of entry and that's the value of a map I remember speaking to the leadership of HHS and the instruction was very clear the HHS Network will not go down so in the previous 24 hours we

saw a great deal of enhanced activity with relation to the HHS um HHS computer systems and website fortunately we have extremely strong barriers we had no penetration into our Network the source of this enhanced activity remains under investigations and we came to a point where there was nothing else we could do to keep it up that basically said look I think we're going to have to

take the network offline we're going to have to literally take the system completely offline let's do it in the evening when most people won't notice and it has to come back it like it has to come back within 10 minutes you know imagine all of this compute power from a million computers around the world are taking all this data and they're pushing it at this target

which is the HHS Network and the network is taken offline and now all of those computers are receiving error messages back saying hey we couldn't find the location that you sent us to and it overwhelms those computers just like we were being overwhelmed I I call it a weapon but it breaks the weapon essentially the network was down for 10 to 15 minutes and then we

brought it back online and all of that traffic all that pressure that we were experiencing was gone it didn't exist and we were able to function at a normal level I believe that the only two countries in the world that could could probably launch something at that scale with that level of planning and coordination are Russia or China now the reason an adversary would want a

map of a network like hhs's is to Target future attacks there are three main things that you could do with a map of the HHS Network the first is you would learn where its computers are and what those computers are doing and what they're connected to the second thing you could then do is identify vulnerabilities and install back doors which would allow the hackers to come

in and out out undetected as they please and the third most important thing is once you've enabled those capabilities they could potentially have learned what's in the network most crucially at that point what does the us know about the Corona virus and what does the us know about a potential vaccine at that time that would have been the most important intelligence that any intelligence agency in

the world was looking for this was like a nuclear weapon in the sense that a distributed denial of service attack that at the scale that we appeared to be experiencing would have ended our ability to function and operate but I don't think that was the purpose I think it was a head fake so that another action could be taken the question is what results were those

Bad actors trying to achieve when you look inside uh a patient care system you see all of these lights blinking and noises going and information flowing once you break those connections you start endangering patient health care and the idea that I like my healthc care records to be kept private ransomware an intrusion a data extraction compromises patient Integrity I think it's important that we have this

discussion because I think the population of the United States needs to understand that we are actively engage with adversaries that want to fundamentally change our way of life and we need to continually support and invest in uh securing our health care System we still don't quite know what exactly the attack achieved but the fact that they revealed they had this capability was in and of itself

massively [Music] significant [Music] [Music]