How China Hacked America’s Phone Network
32:31 Share

Wells Fargo seeks broad impact in their communities. They're focused on building a sustainable, inclusive future for all by supporting housing affordability, small business growth, financial health, and other community needs. That's why they've donated nearly $2 billion to strengthen local communities over the last five years.

From The New York Times, I'm Sabrina Tavernisi, and this is The Daily. An alarming new hack by China has penetrated the nerve center of the United States, our phone network.

Today, my colleague David Sager on what the scope of this new attack tells us about the growing power of one of America's biggest adversaries. It's Thursday, December 12th.

David Sanger, you're back. I am, and delighted to be here. So, David, you are here today to talk about a hack. And close listeners of the show will know that this is a topic you do sometimes talk about on The Daily. We counted. You have done three shows on hacking in recent years.

But this particular hack, this one you're looking into right now, this one is different, you say? It is, Sabrina. It's the big one. It's from China. It was run by the Chinese Ministry of State Security and hackers working for them.

It's got a strange name. It's called Salt Typhoon. Okay. But the key thing to know here is that this is a hack of America's telecommunication systems. It's a hack of AT&T and Verizon. It's a hack of all of the smaller communication systems.

And what's remarkable about it is that the Chinese were able, by spending millions of dollars and a lot of time, to figure out how to get into the core of what binds the United States together, which gives them access to so much more. What's really striking to me is the degree to which this has freaked out American officials.

The head of the Senate Intelligence Committee, Senator Mark Warner, who was himself a telecoms executive in a previous life, told me it is the worst intrusion into the United States he has ever seen in his career. Wow. Jake Sullivan, the national security advisor.

organized in the Situation Room a meeting with the chief executive officers of each of the major telecommunications companies. They dragged them to Washington and said, we are going to have to figure out an emergency way to get the Chinese out of your systems and to rebuild those systems so they can't get back in.

So the critical question that this hack raises is how could it be this late in the cyber wars, which have been going on for two decades, that China has managed once again to pierce America's defenses? Okay. So this hack really shook Washington and also it shook a number of important American companies, these telecoms, as you're saying.

Tell me, David, what we know about it. So the first thing we know is that telecom companies were clueless for a year, maybe two years, that the Chinese were in their system. In other words, they had their radars off. In fact, for some parts of their systems, they never had radars on at all. And the second thing is that Microsoft researchers put the telecom companies onto this for the first time.

The telecoms missed it entirely, but Microsoft noticed that Chinese hacking groups that they follow were targeting these companies, AT&T and Verizon and many others. And suddenly they realized that the Chinese were inside an American system, and they were the first ones to send up the alert. Not only were the Chinese hackers there,

they had figured out a way to go target some very specific national security officials and politicians, including President-elect Trump and Vice President-elect Vance. Then they discovered that the Chinese could actually listen to some conversations. Wow. Were they actually listening to Trump and Vance's phone calls? We don't know for sure what they listened to or whether they actually tuned into some of those conversations.

But American investigators seemed to have a pretty high certainty that they did. And then we also learned that these hackers could read open, unencrypted texts. That would be, for example, if you were sending a text from an iPhone to an Android. So it's not staying within the Apple network and it's going out as an SMS message. The Chinese could read those.

That's amazing. I mean, that is really a violation of American security. It really is. And it tells you how effective they are. And initially, the American investigators thought that the Chinese were just really focusing on Washington and Washington players only.

But the more they dug in, the more they discovered, no, they were in the entire system around the country. And then it got worse because it turns out that the telecom companies run for the U.S. government the lawful taps that are put on the phones of suspected criminals or spies. Basically, the way that the U.S. government phone taps people it thinks are spying for other countries. That's right. And of course,

The government can go get the warrant, but the government doesn't run the phone system. So then they have to take that warrant to AT&T or Verizon or another company and say, we need to tap this phone number. Well, the Chinese got in so deeply that they could figure out which phone numbers they were listening to.

And then they could figure out, wow, they're on to this suspected Chinese spy and they're on to this one, but they don't know about this third one. Wow. So the Chinese actually saw with this kind of, you know, see-through glasses they got in this hack who the U.S. suspected was a Chinese spy. That's right. So just think about this. If the Chinese know that

which Chinese spies we're onto and which ones we aren't, it gives them a huge advantage. They begin to know if they need to send more spies in. So there's a huge counterintelligence factor to the salt typhoon hack as well. Interesting. But to what extent does it affect everyday Americans? Like, should I be worried about it?

It's a great question because the Chinese have shown from this that they could get into most of these ordinary phone calls. The question is, would they want to, right? They seem to be quite focused on national security officials, politicians, and

Now, I can imagine, Sabrina, that for you, they may want to go in and figure out what's going to be on the daily in a couple of days. But in case they're not interested in that, you know, they're probably not going in to listen to ordinary Americans talk about how much milk and eggs to go pick up on the way home from work. Right. But the fact that they have the capability to go do this throughout the system is pretty shocking. Right.

Now, there's an exception to this. When you're talking on an ordinary phone line, the phone conversation is largely unencrypted. But if you're talking over WhatsApp...

or signal, or even if you are talking from iPhone to an iPhone or messaging between iPhones, then those are usually encrypted. And the Chinese would be able to see that there was a conversation underway, but they couldn't listen in or look at or read the content. Interesting. So if I'm doing a WhatsApp call, then that is off limits because that's encrypted.

That's right. And, you know, there are some encrypted conversations that with a lot of work you can pierce, but by and large, you're a lot safer on an encrypted line. And last week, the U.S. government, for the first time that I can ever recall, came out and told Americans, you should use encrypted apps to communicate until we have this problem solved.

And that's a big change because it was only back in the Obama administration that the FBI was complaining about encrypted apps because they couldn't listen in if there was a criminal case underway or a kidnapping. Exactly. It needed access to people's phones to be able to see what the conversations had been. That's right. And basically they've decided now because of the severity of this hack to reverse their advice and tell Americans,

Go use encryption. So how did China actually pull it off? The best I can discern from telecom executives and other experts is they took advantage of the fact that our phone systems are actually the amalgam of really new, sleek digital equipment and really old, creaky equipment that's been sitting around for 40 years. Okay. So how does that make it vulnerable?

Because these old systems have been embedded in the telecom system for the longest time, from an age that goes back before hacking. And so there's almost no way to build modern protections into them because these systems were built so long ago, it was before anybody had protections in mind.

So let me give you an example. Yeah, please. If you're going to do a banking transaction over your phone,

You frequently get a code that comes back from the bank that you have to insert first so that they're sure that they're talking to you on your phone. And you insert it, and we've gotten used to it. It drives us crazy, but we all understand why we need to do it. In the cyber world, that's called multi-factor authentication. So it's something other than just your password to make sure that it's really you. Right.

But inside these telecom systems, there was no multi-factor authentication. So once they got the master password, they were in the system. They were able to roam freely across the system without ever being challenged again.

for credentials or identification. Imagine this. Imagine that you showed your ID once at the airport. Right. But before you got on an international flight, no one asked to see your passport one more time. That's sort of what happened here. So basically, these hackers kind of tried every door, found one that was open, and then was never challenged once they got inside that door. That's right. But they did something even more strategic. Right.

They realized that our systems were old and rickety, and they looked for the seams between that old equipment and the new equipment because they knew the older equipment was going to be their way inside. Okay, David, so you've explained how this hack was really the biggest anyone in Washington and you had ever seen. It compromised really vital stuff.

I understand all that, but haven't the U.S. and China been spying on each other for a long time? Like, is there a reason for us to think that this is actually worse than those other times? We've been spying on each other for decades. And it's always been an article of faith that we can hack into systems better than any other country can.

That's always been the assumption. And it was backed up 10 years ago when Edward Snowden, who you'll remember was a contractor for the National Security Agency, revealed a huge trove of documents that exposed that the NSA was getting inside the Chinese telecommunications systems and particularly aiming at Huawei, the Chinese telecommunications giant that's been supported by the government.

And for years, the U.S. government has been banning Huawei equipment from the U.S. for fear that if Huawei was inside our networks, they would have an easy way of diverting phone calls, texts, all kinds of computer data back to Beijing. So what did we learn here? We've learned here that

even without Huawei in our system, because most of Huawei's equipment has been banned,

the Chinese found a way in anyway. And we've learned that at this point, they are essentially as good as the NSA. No one will say this in public to you, but you get people off the record and they say to me, David, this is the first time I've come to the conclusion the Chinese are completely in the major leagues here and they can do what we can do. We'll be right back.

This podcast is supported by the Partnership to Fight Chronic Disease. We're working to fight Alzheimer's disease and science is advancing to help. Innovative FDA-approved treatments can slow early disease progression, giving people more time with loved ones and to live independently. But Medicare is taking that time away. Limiting access to these treatments and saying review of new data will take years.

That's time families cannot afford. Medicare must do better. Learn more at pfcdalz.org. Every day, thousands of Comcast engineers and technologists put people at the heart of everything they create. Like Kunle, a Comcast engineer who began to approach work differently after becoming a father. With two teenage boys at home, Kunle thinks about the generation that he is building technology for.

This continues to inspire him and his team to build a fast and reliable in-home Wi-Fi solution for millions of families like his, so everyone can work, learn, and play together under one roof. Learn more at ComcastCorporation.com. So David, how did we get to the point where China got so good at hacking? Well, China's invested in it, practiced in it, trained people in it. And you know, it's like anything else in superpower competition.

20, 25 years ago, the Chinese were almost nowhere in space, right? Now they've got space satellites that can grab our space satellites. And the same is true in cyber. It's just another area where they know they need to be able to dominate the superpower competition in surveillance.

And the big improvements in their capability started after Xi Jinping came to power in 2012. The current Chinese leader. The current Chinese leader. And, you know, at the time when Xi came in, the American intelligence reports were, this is not a man who is going to challenge the United States militarily or for intelligence purposes. He's got to focus on building up his own expertise.

economic capabilities. Well, it turns out all those reports were wrong. And it was another of the mistakes we made in sort of assessing where the new Cold Wars were emerging. So he's the one who decided to make the investments in space. And he's the one who has invested millions, if not billions of dollars in

in cyber capabilities. So where was China in terms of its ability in surveillance when he came in? They were pretty clunky. They put most of their cyber capability into the hands of the People's Liberation Army. It's China's main military operation. You know, 10 years ago, I was writing about a People's Liberation Army unit, Unit 61398.

that was based out of a big white office tower near the Shanghai airport. And they had officers who would go break into American companies and try to steal their secrets and their designs and bring them back to Chinese state-owned or other companies. And were they successful at doing that?

Partly, they stole the design for the F-35, the U.S. stealth fighter, and then produced one that looks very much like it, but they make it a lot more cheaply than we do.

But along the way, Sabrina, they got caught pretty easily. A company called Mandiant found them breaking into U.S. companies and were able to identify the specific hackers who later got indicted by the United States. There were wanted posters with these hackers' pictures on them, even though they were PLA officers. So like Keystone Cops kind of thing? Better than Keystone Cops, but not the best picture.

cat burglars you ever met. So they started working hard on being stealthy, on hiding their tracks. They began to study how the American systems work in great detail. And then they did something even smarter. They moved a lot of this hacking out of the hands of the army.

and handed it to the Ministry of State Security. And what does it mean that it goes from the Army to the Ministry of State Security? Why is that important? It means that they're going to a group that has more money to invest on intelligence assets that are trained at a higher level

that have the ability because they're working in secret to go out and hire and train much more effective hackers who would not be caught as easily. And they learned many more innovative ways to get into American, European, African, Latin American systems.

They began to sell telecommunications equipment, as we were discussing earlier, that would enable them to own the infrastructure and therefore get in. And they learned how to be much more effective at stealing master passwords so that they didn't have to actually write code and malware, but instead could pretend like they were legitimate operators inside a system.

David, what's an example of the Chinese getting better? If you think back to the turning points in surveillance in China, what's an example? We are starting to get some context as to how big a massive data breach has been against the U.S. government. I think, Sabrina, the first time that we realized how good they were. It appears that hackers based in China have broken into U.S. government computer networks.

gaining access to information of federal workers. Was when they got into the Office of Personnel Management at the end of the Obama administration. This would likely be the largest theft of U.S. government data in the history of the United States. So here's what we know.

Now, this is seemingly the most boring bureaucracy in Washington, right? They are basically the government's HR manager. Okay. And they keep the security clearance files for 22 million Americans who have secret, top-secret, compartmentalized clearances and so forth. And the Americans who get clearances have to fill out these enormously detailed documents

forms that describe their financial condition, their medical histories, every relationship they've been in, every foreigner they've ever met and had long interactions with. So this is not just your name and your social security number.

This is the details of your life. And obviously, for Chinese intelligence officials, if they could get that kind of understanding of the American elite who are working on every classified project, it's enormously beneficial.

And much as in this most recent hack, they were inside the Office of Personnel Management for a year before anyone even knew that they were stealing the files, encrypting them and broadcasting them back to Beijing. OK, so China is getting much better at all of this.

That extra funding and people and focus is really starting to pay off. But big picture here, David, what is China trying to do with all of this? Like, what's it really up to here? Well, this is the great mystery that the CIA's new or relatively new China operation is constantly trying to figure out, that the NSA is trying to figure out. So there are a couple of theories.

The first theory is they just want a complete map of everybody in the U.S. who works in the national security sphere and access to what they do. So it's, first of all, for great intelligence gathering. The second thing they're beginning to do, though, is learn how to plant their malware into critical infrastructure in the United States and

that may enable them to turn off water pipelines or electric grids if they got into a direct conflict with the US. And we really saw this last year, 2023,

with the Chinese hacking group named Volt Typhoon. It's a different group than the group that was just caught inside the telecom system, but their purpose was to be able to get into the utilities that feed American bases in Guam, in Hawaii, on the West Coast.

So that if there was ever a incident over Taiwan, say a Chinese invasion or just a slow choking off of Taiwan, that the Chinese could use the code they put in these systems to turn off the power or turn off the water and slow an American response, an ability to get troops to Taiwan. And that's critically important.

It's also got a psychological element, which is if there was a crisis in Taiwan and suddenly you were living in San Francisco and there was no water coming out of the tap, you're not thinking about Taiwan. Right. You're thinking about how you get water coming out of your tap for your family. So that's a huge step up, right? It's not just surveillance in this case. It's actually disrupting critical processes that are required for defense. That's absolutely right.

And the U.S. discovered this midway through the Biden administration. And through 2023, there were all these kinds of emergency meetings in the Situation Room, and they brought in the heads of the utilities, and they're trying to go clean out the Chinese malware. But the fact of the matter is, Sabrina, you just don't know what you don't know. And the Chinese are excellent at creating an access into a system

testing out whether it could work, and then pulling all the code out so that when somebody came looking for it, they may not find anything other than a little bit of evidence that Chinese hackers had been there.

Okay, so that brings us to today and to this SALT typhoon hack, which you say is still a problem because it's still lurking in our phone systems. That's right. And so I think to understand what has everybody so worried right now, you have to sort of back up enough to look at these two different kind of operations. So SALT typhoon, the one that we've been discussing in the telecom system, is a

gives the Chinese an enormous surveillance capability and a chance to monitor national security operations and whether or not we're on to Chinese spies and all that. And the earlier system they discovered, the one that got into the electric grid and the water systems, gives an ability to actually disrupt things.

When you add these together, you get a current surveillance capability and a prospective disruption capability, right? That what the Chinese can do now is listen in on President-elect Trump and national security officials if they're on that open line. What they could do in the future is shut down systems. Okay, so that's clearly a very serious problem.

What's the government doing about this? Well, they have begun to talk a little more publicly about these kinds of hacks and particularly about Salt Typhoon. That's what led to that warning last week that people should begin using encrypted apps. But that's a band-aid. It's not a solution, right? If you are really going to fix our telecom system,

You would either have to go shut it down and rebuild it with something more modern. Well, no one's going to do that. We need it every day. Or you're going to begin to make incremental fixes and then build a parallel system to it that you can begin to shift over to. You are going to have to go set

real standards for cybersecurity. Companies can't live in a world anymore in which it's sort of up to them how much they invest in these because what we've discovered about the telecom system is on the one hand, it's a commercial system. It's owned by companies, not the government.

But on the other hand, it's critical to our national security. Right. So we're trying to balance a lot of different complicated values here. One of them is keep the Chinese out of our system.

for which you'd want to design something entirely new. But the other is keep the U.S. economy going and keep people communicating, which means you're kind of stuck with the system that's been pasted together over the years. Yeah. It's not an easy engineering problem. So, David, just stepping back here for a second and thinking about this big picture,

This all comes at quite a moment of potential change. We're just weeks away from President-elect Trump's inauguration with all of the potential kind of change and chaos he might bring with him on China, on a lot of these issues. And I'm wondering how you see it right now, what all of this means. So first of all, the world has changed a lot since Donald Trump left office on January 20th, 2021.

Obviously, there had been hacking and issues like this during his time. But the level of the Chinese sophistication and the sophistication of others, Russia, Iran, North Korea, has gone up considerably. And we don't know how the president's planning to go handle this.

In fact, whenever he's asked a question about China, his answer usually has to do with tariffs, as if that's going to solve our competition with the only competitor who can take us on militarily, economically, technologically, even culturally. The second big change that was going on, the biggest change since President Trump left office,

is that Russia and China, two giant cyber powers, have come together in a partnership that is basically opposing the United States around the world. Right. You've seen it, of course, first in Ukraine, but we're beginning to see it in the cyber world as well because they want to operate by a set of rules that they define and we want to operate by a set of global rules that we define.

And the third big change that's underway here, of course, is artificial intelligence, because that affects everything in the hacking world. You can build much better defenses to hacking using AI tools.

You can also find vulnerabilities in old systems like the telecom system we've been discussing here using those tools. So we have a new arms race underway that's AI-driven to go find or defeat this kind of code in our systems. And those big three things...

Trump, the new Cold Wars, the arrival of artificial intelligence is leading to an entirely new era and some real brewing problems. Well, David, it sounds like we're going to have you on for more episodes about hacking in the future. Well, this is probably more the beginning of a conversation on The Daily rather than the end of one. David, we look forward to it. Thanks, Sabrina. Great to be with you. We'll be right back.

Every day, thousands of Comcast engineers and technologists put people at the heart of everything they create. Like Kunle, a Comcast engineer who began to approach work differently after becoming a father. With two teenage boys at home, Kunle thinks about the generation that he is building technology for. This continues to inspire him and his team to build a fast and reliable in-home Wi-Fi solution for millions of families like his, so everyone can work, learn, and play together under one roof.

Learn more at ComcastCorporation.com. Support for this podcast comes from Instagram. Parents are having complicated conversations with their teens about how to safely use social media and technology. And Instagram teen accounts are designed to address parents' biggest concerns, including who their teens are talking to online. My name is Kareem, and I have a teenage son. I encourage him to be careful on social media, but also as a parent, you know, my job is to make sure he's doing the right thing.

With private by default accounts for teen users, teens need to accept new followers and people who don't follow them can't see their content or interact with them. Learn more at instagram.com slash teen accounts. From gift swaps with friends to office holiday parties to big family dinners, tis the season to spend with loved ones. Walgreens knows the holidays are busy, so they make getting vaccinated quick and easy.

Here's what else you should know today.

On Wednesday, FBI Director Christopher Wray said he'll step down from his role in the new year. This is not easy for me. I love this place. I love our mission. I love our people. But my focus is and always has been on us and on doing what's right for the FBI.

His decision comes after President-elect Donald Trump announced his intention to replace Wray with longtime loyalist Kash Patel. This is the best way to avoid dragging the Bureau deeper into the fray while reinforcing the values and principles that are so important

Under Wray, the FBI repeatedly investigated Trump, including by searching his Mar-a-Lago estate for classified documents. And more details have emerged about Luigi Mangione, the man charged with killing the CEO of UnitedHealthcare, Brian Thompson.

In a series of social media posts, Mangione described health problems, saying back pain that had once been a minor issue got worse before having surgery last year. Mangione stopped communicating with friends and family about six months ago. His mother filed a missing person report last month.

Mangione, who was arrested on Monday in Pennsylvania, now faces a murder charge and has been denied bail. He's fighting extradition to New York. Today's episode was produced by Stella Tan and Mary Wilson. It was edited by Maria Byrne and Paige Cowett, contains original music by Dan Powell, and was engineered by Chris Wood. Our theme music is by Jim Brunberg and Ben Lansford of Wonderly. ♪

That's it for The Daily. I'm Sabrina Tavernisi. See you tomorrow.

Support for this podcast comes from Instagram. My name's Nicole Lopez and I work at Metta. I oversee a team of subject matter experts in all things youth safety and well-being. There are thousands of parents at Metta, myself included, who care really deeply about creating age-appropriate experiences for teens. And that's why we rolled out Instagram teen accounts. These accounts come with safety features and content protections, all built in. Are you the parent of a teen? Get more information at Instagram.com slash teen account.

That's Instagram.com slash teenaccounts.