Podcast: Will someone -- or some country -- steal the Covid-19 vaccine?

May 14, 2020

"We are being robbed...our intellectual property is all the U.S. has left, and we are being fleeced of it."

The news was easily lost in the Covid-19 fray, but earlier this year, U.S. authorities blamed China for what many consider the most important data heist in history -- the hack of Equifax. The Department of Justice indicted four members of the Chinese military, a remarkable escalation of the digital cold war between the two nations.

Since the Equifax incident, and the Anthem health data heist before it, and the theft of U.S. federal worker data before that, analysts have openly wondered what a nation-state might do with such a massive haul of American's personal information.

The most ominous observation about these large data heists: Whoever the hackers were, they didn't seem to be using the data. There were no outbreaks of identity theft related to the Equifax hack, for example. Rather, the criminals seemed to be holding onto the data for later use.

The general consensus has been that some enemy of America -- perhaps a nation-state, perhaps organized crime -- has been compiling detailed dossiers on U.S. citizens for use in some later intelligence operation. Think of it as a dark LinkedIn, or Facebook, or Ancestory.com, that could give an enemy combatant deep insights into how specific Americans lives, who they own money to, when they travel, and where their character flaws lie.

Now, that data might come in handy.

As nations around the world race to find a vaccine and a cure for Conoravirus, and with hundreds of simultaneous research experiments ongoing, one quick way to step in front of the line would be to steal the research. U.S. and U.K. agencies recently issued a warning about cyberattacks against healthcare providers and research institutions. So-called APT groups -- Advanced Persistent Threat groups -- are of particular concern. APT groups were blamed for much of the disinformation campain around the 2016 U.K. and U.S. elections.

"(Targeted) organizations include healthcare bodies, pharmaceutical companies, academia, medical research organizations, and local government," the governments said in a joint statement. "APT actors frequently target organizations in order to collect bulk personal information, intellectual property and intelligence that aligns with national priorities. The pandemic has likely raised additional requirements for APT actors to gather information related to COVID-19. For example, actors may seek to obtain intelligence on national and international healthcare policy or acquire sensitive data on COVID-19 related research."

I recently talked to Steve Moore, chief security strategist at cybersecurity firm Exabeam about this threat. Moore is well-versed in threats from China -- he led the response after Anthem's data was stolen. He thinks the stolen data is "a mechanism of influence" that can be used to aid data theft and espionage.

"They look more at moral flaws. ... They influence with lust, power, fame and greed," he told me. "It all connects. It's all related."

Listen to the interview by hitting play below, or by clicking on this link.

The Red Tape Chronicles

Discussion about this post