Listen: What To Know About Solarwinds Hack : The NPR Politics Podcast A major hack of federal government computer systems appears to be state-sponsored espionage. And we talk through Joe Biden's latest cabinet picks.

This episode: congressional correspondent Susan Davis, election security editor Phil Ewing, justice correspondent Ryan Lucas, political correspondent Scott Detrow, and White House reporter Ayesha Rascoe.

Subscribe to the NPR Politics Podcast here.
Email the show at
Join the NPR Politics Podcast Facebook Group.
Listen to our playlist The NPR Politics Daily Workout.
Subscribe to the NPR Politics Newsletter.
Find and support your local public radio station.

Federal Government Systems Hacked

  • Download
  • <iframe src="" width="100%" height="290" frameborder="0" scrolling="no" title="NPR embedded audio player">
  • Transcript


Hey there. It's Susan Davis. And before we start the show, we want to ask you to support your local NPR station. By supporting them, you're supporting all of us on this podcast. Our lives were upended this year, and we at NPR and all of your local stations have tried to cut through the noise to make sure you know the facts about the election, the coronavirus and so many other stories. So if you've got some dollars to spare, head to to get started. And thank you.

LISA: (Speaking Spanish). This is Lisa (ph) in Albuquerque, N.M., where I'm finishing up my very first semester of medical school. Today, I'm really excited because I'm getting ready to go to the hospital right now to give some of the first COVID vaccines to our essential health care workers. This podcast was recorded at...

DAVIS: 12:39 p.m. on Friday, December 18.

LISA: Things may have changed by the time that you hear this. Take care, everyone, and enjoy the show.


DAVIS: I think this is our second vaccine timestamp this week, and I can't get enough of them. Bring on the vaccine timestamps.

PHILIP EWING, BYLINE: (Laughter) I've never looked forward to getting a shot so much.

DAVIS: Hey there. It's the NPR POLITICS PODCAST. I'm Susan Davis. I cover Congress.

RYAN LUCAS, BYLINE: I'm Ryan Lucas. I cover the Justice Department.

EWING: And I'm Phil Ewing, election security editor.

DAVIS: And the Department of Homeland Security says a sophisticated cyberattack is posing a serious threat to national security. The agency says the attack began around March and is still ongoing, meaning the malware that's been placed on computers may still be capturing secret government information. Phil, can we start with how this hack was discovered?

EWING: This is what's called a supply chain attack, where you start five or six steps away from the target - in this case, with a company called SolarWinds - and get one of its systems to take your malware. And then as it provides updates to its customers, which include U.S. government agencies, big businesses and others, they are ingesting the malware that you seeded a couple of those steps away. And then in this case, from the way it appears, the attackers were able to use that patience that they showed to finally begin to exploit their ultimate target networks. But right now, we still don't know the full extent of that - how many networks have been compromised or how widespread this is. We're not even sure if the attack has been contained at this point. It could still be going on.

DAVIS: The hack was brought to the attention of the federal government by a private company.

EWING: Yeah, that's right. Because there are ways to watch network operations and look at the way these bills of these software products are working as they update over time. And so someone along the line observed that this was not behaving in the way that they expected, which led to further investigation and, all of a sudden, the discovery that this unexpected vector, these unusual techniques, had been used for this cyberattack.

DAVIS: Is the fact that the government didn't detect it on its own sort of an embarrassment for our intelligence apparatus?

EWING: In one sense, we pay quite a bit of money to the U.S. intelligence community, special agencies, including the FBI and the National Security Agency - the NSA - to try and keep a lookout for these things. Plus, billions of dollars are spent kind of more generally on cybersecurity across the board in the United States. But the other dimension here with cyber is that defense is just not as strong as attack. And if an attacker is determined enough and has enough sophistication and resources in a way that a nation state might through its intelligence agencies, it's probably going to find a way to get inside of a target and get what it wants to get or do what it wants to do.

DAVIS: Ryan, can you talk about the scope of this attack? How widespread is it, and how vulnerable is the U.S. defenses here?

LUCAS: I mean, I think the best way to put this is it's very wide in scope, to the extent that we don't even know quite how wide in scope it is. The list of affected government agencies at this point in time - we know that the Commerce Department, the Department of Homeland Security, the Department of Defense, the Treasury Department, Postal Service, Energy Department, National Institutes of Health have all been affected in some way, shape or form. Now, sources tell me that at this point in time, this appears to only be on the unclassified side of government networks, which means the most closely held secrets have not been compromised as far as we know.

But again, what sources are telling me is that the government is still scrambling to figure out all of the agencies within the U.S. government that have been affected. And that is going to take some time. And then once they figure out who actually - which agencies have this software update, they then have to try to find out whether the hackers are still in there. And that may take some time because of just how sophisticated these hackers were. And they've been very good, experts say, at kind of embedding themselves and hiding to the point that it's very difficult to determine whether they're there or not.

DAVIS: The finger is being pointed at Russia for this hack, but what evidence do we have to confirm that it really is them?

LUCAS: Well, first off, the U.S. government has not made an official attribution at this point in time, which is not necessarily unusual, although cybersecurity experts and sources of mine say that the signs do indeed point to the Russians. One source said that this bears all the hallmarks of a Russian intelligence operation, and in particular, Russia's foreign intelligence service, known as the SVR.

Now, the Russians have, of course, been behind some of the very high-profile hacks that we've seen in recent years. The one that would come to mind would be the 2016 hack of the DNC during the 2016 campaign. Now, there were two Russian intelligence agencies that actually hacked the DNC. One was the SVR and the other was Russia's military intelligence agency, known as the GRU. And what the SVR did with the information that they hacked from the DNC was hold it. They didn't do anything with it that we're aware of. What the other Russian intelligence agency did was leak it through WikiLeaks, online. They weaponized it. And there's an important difference between the two. One is more for traditional espionage purposes and the other would be termed, I think, more of an attack.

DAVIS: Has the president or the Trump administration weighed in on this yet, Phil? Or how is the Trump administration responding to this threat?

EWING: Well, national security agencies have said that they're aware that this is taking place, that this is a massive and potentially even unprecedented compromise in terms of its scale, as we heard from Ryan a moment ago. But we haven't yet heard specifically from the president himself. Some of the president's critics in the Congress, including Democrats in the Senate, are blaming him for not drawing more attention to this and not sending a clear message to, in this case, the Russians, because they're suspected of being responsible about how he won't stand for it and about how the United States will take some kind of countermeasures.

At the time we're talking, we still haven't heard anything from Trump or the White House. And one of our big questions going forward is what, if anything, will they say? And then, obviously, what follows after that is, what, if anything, will they do? Or will this be one of the things for which the administration doesn't act until we have the administration of the incoming president, President-elect Joe Biden?

DAVIS: Yeah, I mean, it may be the kind of espionage that is happening all over the world. But once it's exposed like this, once the public's made aware of it, once it's sort of a public embarrassment, it does seem like the U.S. government has to respond to it in some way. You can't just, as a country, let this kind of cyberattack happen and say, well, this is espionage. That's the way the world works.

EWING: Right. And the other challenge is you have to be able to get these agencies to a point where they can operate again. If you're the Treasury Department, the Postal Service, the Commerce Department, all the agencies we heard Ryan talk about, how do you get to the point where you can just trust that you can operate within your own network, that you can make plans or create documents or send emails, and they're not going to be stolen by a foreign government?

LUCAS: One thing that I would say referencing back to your point, though, Sue, is that after - if you recall the hack of the Office of Personnel Management in 2014, 2015 by the Chinese, the then director of National Intelligence, James Clapper, essentially said something to the effect of, you know, that's a really good intelligence operation by the Chinese. If we could have done it to them, we would have. And there has been no public pushback against the Chinese for that. Certainly, the U.S. has charged Chinese state hackers for cyberattacks that they have carried out. But for the OPM attack in particular, there has been no public pushback, no public response in a forceful sense from the U.S. government. Because it is the sort of thing that intelligence agencies do. It doesn't mean the U.S. has to like it. But it also means that, you know, this is the sort of thing that the U.S. is doing as well.

DAVIS: But then I think about after the 2016 elections, when there was Russian interference, and the Obama administration did do quite a number of slap-back actions - there were sanctions, they kicked some diplomats out of the country. It was sort of a - it wasn't a super escalating act, but it was sort of, like, a chess bump. Like, you can't just do this to us without some repercussions.

LUCAS: Here's the difference, though. Remember what I said earlier about the SVR and the GRU both hacked the DNC during 2016? The U.S. pushed back. The U.S. brought charges against GRU officers, which are the ones who weaponized the information that was stolen. SVR officers were not charged at all. They never did anything publicly with the information. They appear to take that information for intelligence purposes. And that's an important distinction.

DAVIS: That's really interesting. All right. Well, thanks to you both. We're going to take a quick break. And when we get back, we'll talk about Biden's latest Cabinet picks and his inaugural plans.


DAVIS: And we're back with Ayesha Rascoe and Scott Detrow. Hey, guys.



DAVIS: So President-elect Joe Biden, he's got some more Cabinet picks out this week. Let's start with the climate folks, Scott.

DETROW: Yeah, and the way that you describe them is exactly how the Biden administration is talking about them, and that, you know, at a starting point, is such an enormous difference from the Trump administration. Biden has repeatedly said that climate change is one of the four top priorities of his incoming administration. And he has clearly thought of this as something that every single department is going to deal with. That is why Gina McCarthy, who used to head the EPA, is going to be the national climate adviser in charge of making sure every agency is working to address climate change.

Michael Regan is going to head the EPA. He is a North Carolina state regulator. Jennifer Granholm, former Michigan governor, is heading the Department of Energy. She's somebody who, as governor and since, has really pushed hard to try and get the auto industry to shift to clean cars, to electric vehicles. You also have Deb Haaland as interior secretary. This is a big pick on a lot of different fronts. She would be the first Native American to run the Interior Department. And that's a real landmark that is worth just pausing on and reflecting on.

RASCOE: Yeah. I mean, a lot of people may not know about the Interior Department, but they deal with all of the public lands. And it's like one of - it's a very old department, too. It's been around for a long time. But they also have the Bureau of Indian Affairs. And so they deal with a lot of not only, like, energy production on native lands, but they also deal with, like, their accounts and income. And obviously with the history of this country and the interactions with, you know, native populations, there have been, you know - there was just a settlement in the past decade of billions of dollars that were not properly accounted for in Indian trust accounts. Just as an example, the Interior Department was one of the departments involved or the main department involved in that. So there's been a lot of reasons for mistrust with the government from native populations and the Interior Department. And now you have a native at the head of the department.

DAVIS: The Haaland nomination was notable to me because we've heard so much grumbling from the progressive left that Biden's Cabinet picks, frankly, haven't been that progressive. But with Haaland, a lot of progressive groups - Alexandria Ocasio-Cortez, the Democratic congresswoman from New York, yesterday told reporters she was over the moon about this election. It really seems like the first pick that progressives are truly, deeply thrilled about.

DETROW: Yeah. And they'd been getting pretty frustrated. I mean, Bernie Sanders told NPR earlier this week he was getting pretty frustrated with the lack of progressives in the Biden Cabinet. He said that he had spoken directly to the president-elect about this.

Haaland, you know, we talk through the milestones that she would bring policy-wise. You know, she's someone who's been on the frontlines of protesting pipelines, oil and gas drilling, fracking, things like that. And, you know, we talk so much about would Biden or would Biden not ban fracking. The one thing he is promising to do is ban fracking on public lands. That is a decision that will be up to the Interior Department. So she'll be playing a lead role in that.

But, you know, I was surprised that this pick came out for a few reasons. You know, I think top among them, the House majority for Democrats is getting smaller and smaller. And now this is - what? - the third member of the House that is going to resign and leave their seat empty until it can be filled to go join the Biden administration. Like, what is Nancy Pelosi's working majority right now?

DAVIS: Yeah. Biden is not doing Speaker Pelosi any favors at the moment. With those - the other two are Cedric Richmond and Marcia Fudge. And, you know, these are safe Democratic seats, along with Haaland's seat. They will be filled by Democrats. But we could be looking at months and months and months of those three seats being vacant. And depending on how it shakes out, I think we might have one or two races that are still not completely certified.

But Pelosi is looking at, like, a one- or two-seat majority. I mean, there's just absolutely zero margin for error. I think, though, realistically, the difference between, like, a five-seat majority and a two-seat majority, it's not, like, a world of difference. But it just does speak to how much difficulty Democrats are going to face getting an agenda through the House. 'Cause there's going to be only two paths, right? Complete party unity, which is not going to be easy or working with Republicans, which isn't going to be easy either.

RASCOE: Does this empower the moderates or the progressives or, you know, all of - you know, who does this empower?

DAVIS: Who wins?


DAVIS: That's a good question. I don't know yet. I think there is some hope, especially right now when you're looking at this COVID deal that's trying to get through Congress that was sort of put together by the center. There's some hope that in a new Congress, that tight majorities mean sort of the centrist rise. But always good to be skeptical of that because the centrists more often are getting rolled. But that's one of the big questions. And obviously, as we've said a million times, what happens in these Georgia special elections will determine a lot of that, too.


DAVIS: We also need to talk about Mayor Pete. Mayor Pete finally got a job.

RASCOE: Pete Buttigieg.

DETROW: Possibly Secretary Pete.

RASCOE: Yes (laughter).

DAVIS: Got to admit, Secretary of Transportation was not probably in my, like, top three to five jobs for Pete Buttigieg. But apparently, he has a great long personal love of transportation I did not know about.

DETROW: Yeah. It was a classic moment in the way that Pete Buttigieg often frames things. You know, you heard things like this a lot when he was campaigning - talking about his deep, long love for Amtrak, how he used to take Amtrak rides for fun. He talked about the fact that he proposed to his husband at an airport terminal.

But this was an interesting pick. Biden had promised that Buttigieg was going to be somebody in his government. Buttigieg, of course, you know, kind of won the Iowa caucuses. He, you know - as best as we can tell in the mess that was the Iowa caucuses. But then, you know, faded quickly and ended up endorsing Joe Biden before Super Tuesday and was a big Joe Biden surrogate. And he is somebody, like a lot of Democrats, who has a rocky time having a political path forward based on the state that they happen to be from. It's hard to see somebody like Buttigieg being elected U.S. senator from Indiana. So this is a big status boost for him.

And the thinking here is, obviously, there are a lot more transportation wonky (ph) people in the world that Biden could have picked. But the thinking from Biden's camp seems to be they actually do want to push infrastructure deals. They feel like Pete Buttigieg is a really skilled communicator, a charismatic person...

DAVIS: Yeah.

DETROW: ...Who could go out and make the case for this.

DAVIS: And Buttigieg is history-making in his own way.

RASCOE: You know, it is historic to have president-elect Biden nominate an openly gay man for his Cabinet. That is a history-making moment.

DETROW: Yeah. And that's actually something that - the day that this pick was announced, Joe Biden, announcing Buttigieg, really dwelled on and seemed a little defensive on.

You know, we've talked about all of the criticism that he's gotten from progressives and other groups, a lot of the early criticism that a lot of these top posts were long-time Biden usual suspects and a lot of white men in them. Biden ticking through all of the barrier-breaking picks that he's made so far.

And there are a lot. You know, just to name a few - the first Black nominee to run the Pentagon. Regan will be the first Black man to run the EPA. There's a whole host of other - of course, Kamala Harris, the first woman and the first person of color as vice president. And Biden really spent a few minutes saying, look at all these picks. And you could tell it was another moment of him being frustrated with some of the feedback he's been getting.

DAVIS: Yeah. That's true. Before we go, a little bit of news this week about planning for Joe Biden's inauguration. It's going to look a whole lot different than what we're used to.

RASCOE: Yeah. So they're asking people to not show up basically because of the pandemic.

DAVIS: Yeah. Don't come was basically their message.

RASCOE: Yeah, don't come here. And so - but they are going to, you know, take the oath of office. It's in front of the Capitol, right?


RASCOE: Yes. So they're going to take the oath of office in front of the Capitol. But it's going to be a much pared down because we're in the midst of this pandemic where, you know, thousands of people are dying every day. And so that's why they're doing that. It will be, I think, really crystallizing the huge shift in approach from Trump to Biden. Because Trump, if re-elected, almost certainly would have had a huge parade and had, you know, bussed in everyone that he could get and, you know, urged everyone to come because that's the way he has handled the pandemic. But here, you have Biden at his big moment saying, no, I don't want the crowds.

DAVIS: Scott, Biden is very clearly doing this for public health reasons. But I do wonder if that visual of an empty or emptier National Mall - of a less-populated inaugural - is going to provide some political ammunition to Trump and his allies to sort of criticize or try to delegitimize Biden more than he's already tried to do.

DETROW: Ceremonies have meaning and purpose, right? This is a transfer of power from one president to the next. We have now had a month of President Trump baselessly, falsely, endlessly saying that the election was stolen. You know, as we've said a zillion times on this podcast, it wasn't. But you have a large chunk of the country who believes that, who isn't going to stop believing that. And now, if the transfer of power legitimizing ceremony is scaled down, I wonder if that's just kind of, you know, another factor in all of this as Biden tries to kind of make a case for himself to more skeptical people.

I mean, and it's also got to be a bummer to wait your entire adult life to be president, run repeatedly. And then you're going to...

DAVIS: Yeah.

DETROW: ...You don't have - but Biden's talked about this before. He said, look, he understands the challenge. And he's trying to turn the country around, and that's what he's focused on.

DAVIS: All right. Let's take a quick break. And when we get back, it's time for Can't Let It Go.


DAVIS: And we're back. And before we end the show, like we always do, we wanted to remind you that you can support this podcast by supporting your local NPR station. We worked hard to keep you up to date on the biggest stories this year - and also with the stories we just can't let go. Just head to to get started.

Now it's really time to end the show with Can't Let It Go. Ayesha, what can't you let go of this week?

RASCOE: So this week, I can't let go of, you know, this news. And I have to preface this by saying I'm not a, you know - I'm not a big sports fan. You know, I'm a big Cardi B fan, big Beyonce fan. I'm not a big sports fan. But I did find this notable - and, you know, and I'm sure, Scott, you could probably talk about this, too - that Major League Baseball announced that they are going to include the Negro League statistics in the official, you know, stats for baseball. And I felt like that was a big deal just because I've always heard about the Negro League players. And you have all of these legends like Satchel Paige and others who played in the Negro Leagues. And, you know, I've kind of been in awe of that. And now they are going to get kind of the recognition that they deserve for all this time.

DETROW: Yeah, I thought that was really cool. And, you know, as this modern conversation about whether steroids taint the Major League record books happens, you know, people will often point out, well, what about the asterisks of, like, decades and decades of the best players in America not being allowed - some of the best players in America not even being allowed in the major leagues? Because that probably affected the statistics, too. I thought this was really cool. You know, you have players like Washington, D.C.'s Josh Gibson, who people thought, you know, was the equal to Babe Ruth in a lot of different ways. I think it's kind of like a statistically tricky thing because the records aren't as complete. But I thought it was a really cool symbolic acknowledgment. And it kind of culminates the last few years the Negro Leagues have been taken more seriously and put into the center of the conversation about baseball history more.

DAVIS: Cool fact that I don't think either one of you know - my husband's grandfather, who my daughter is named after, was a photojournalist who shot the Negro Leagues. And we have many of his original photographs in our home.

DETROW: That is very cool.

RASCOE: Oh, wow. That is very cool.

DAVIS: Yeah. Yeah. If we ever go back into the office again, Ayesha, I'll bring in a couple so you can see them.


RASCOE: That would be awesome. I would love to see that.

DETROW: Since I live a few blocks away, sure, when I'm next in your house in four years, I'll take a look.

DAVIS: (Laughter) Just drop...

RASCOE: Well, you can drive by.

DAVIS: ...Drive in front. I'll go out on the porch and hold them up for you.

DETROW: Like a boombox overhead. I'll take a look.


DAVIS: Scott, what can't you let go?

DETROW: So it's been - you know, every week is like this. I had a moment this morning where I said to my wife, like, did the Electoral College vote this week or last week? And she was like, no, no, that was this week.


DETROW: I was like, really? Wow. So in that mindset, The New York Times had this really cool profile that posted last night about the Carthusians monks who live in the French Alps and...


DETROW: ...They live in solitary cells. They make their herbal liquor. And that's all they do. And pandemic life hasn't affected them because they've been doing their thing for a millennium.

RASCOE: (Laughter) Do they know?

DAVIS: Do they even know the pandemic is happening?

DETROW: They're aware because it's affected their liquor sales. They've had to kind of change...


DETROW: ...They have not changed their marketing, but the people who market for them. But like, I read this and I was like, I don't think I'm supposed to be as jealous of this lifestyle as I am right now, but this seems appealing.


DAVIS: I feel like they've been much more productive than I've been during pandemic.


RASCOE: Oh, sure.

DAVIS: Think of all the alcohol we could have brewed by now.


DETROW: That's what I can't let go of - how jealous I was of monastic people in the French Alps.

RASCOE: They've got it figured out. And so, Sue, what can't you let go of?

DETROW: (Laughter).

DAVIS: The thing I can't let go this week is politics adjacent, I think I would say. I don't know if you saw this, but there was a bunch of videos that popped up a couple of days ago of Senator Lamar Alexander. He's a Republican from Tennessee. He's retiring this year. And he sat alone in the atrium of the Hart Building, which is one of the big Senate office buildings - it's kind of like a mausoleum inside. It's all marble. And he's a classically trained musician. And he just sort of serenaded the office building with Christmas carols on the piano.


DAVIS: And it was such this, like, earnest moment in what has been an otherwise very cynical political year. And all these staffers came out and they're, you know, socially distanced and masked. All these other senators came out. Susan Collins was, like, filming him on her iPhone. And Amy Klobuchar was standing off to the side just watching him play. And then Senator Tim Kaine came out with his harmonica and started having this little, like, jam session with Lamar Alexander. And it was just such a - I felt like a Tiny Tim moment for me, for Congress. It just was like, oh, God bless us everyone.

RASCOE: (Laughter) Yeah, yeah.

DAVIS: Like, it was so kind. And it just reminded you that, like, these are real people. And it was kind of sad to hear this music echoing through the chamber and the pandemic. And I've watched the video like 10 times. I don't know why. It just kind of, like, spoke to me. It made me feel like my Congress heart grew three sizes watching it.

RASCOE: Wow. Aw.

DAVIS: And that's the spirit I want to bring in to this as we head into Christmas week.


DETROW: You know what? This podcast has been kind of mean to Congress lately, so it's a nice moment.

DAVIS: Yeah, we're always mean to Congress. So that's why I can't let it go. I actually felt good about Congress for 30 seconds.

RASCOE: (Laughter) Wait. No. That - and how long had Lamar Alexander been in Congress?

DAVIS: Oh, God, a long time. I mean, he was governor of Tennessee, and I mean, he's been in public service for the better part of the last 30 years or more. And he was - he's also seen as one of the, like great, nice guys of the Senate so - and he learned how to play music. He used to play in, like, Bourbon Street nightclubs before he got into politics. So he's cooler than you think he is.

RASCOE: Oh, wow. Wow, wow.

DAVIS: All right. I think that's a wrap for us today. Our executive producer is Shirley Henry. Our editors are Muthoni Muturi and Eric McDaniel. Our producers are Barton Girdwood and Chloee Weiner. Thanks to Lexie Schapitl, Elena Moore, Dana Farrington and Brandon Carter.

I'm Susan Davis. I cover Congress.

RASCOE: I'm Ayesha Rascoe. I cover the White House.

DETROW: And I'm Scott Detrow. I'm covering the Biden transition.

DAVIS: And thank you for listening to the NPR POLITICS PODCAST.


Copyright © 2020 NPR. All rights reserved. Visit our website terms of use and permissions pages at for further information.

NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.