keskiviikko 8. helmikuuta 2023

How America Took Out The Nord Stream Pipeline


How America Took Out The Nord Stream Pipeline

The New York Times called it a “mystery,” but the United States executed a covert sea operation that was kept secret—until now



The U.S. Navy’s Diving and Salvage Center can be found in a location as obscure as its name—down what was once a country lane in rural Panama City, a now-booming resort city in the southwestern panhandle of Florida, 70 miles south of the Alabama border. The center’s complex is as nondescript as its location—a drab concrete post-World War II structure that has the look of a vocational high school on the west side of Chicago. A coin-operated laundromat and a dance school are across what is now a four-lane road.

The center has been training highly skilled deep-water divers for decades who, once assigned to American military units worldwide, are capable of technical diving to do the good—using C4 explosives to clear harbors and beaches of debris and unexploded ordinance—as well as the bad, like blowing up foreign oil rigs, fouling intake valves for undersea power plants, destroying locks on crucial shipping canals. The Panama City center, which boasts the second largest indoor pool in America, was the perfect place to recruit the best, and most taciturn, graduates of the diving school who successfully did last summer what they had been authorized to do 260 feet under the surface of the Baltic Sea.

Last June, the Navy divers, operating under the cover of a widely publicized mid-summer NATO exercise known as BALTOPS 22, planted the remotely triggered explosives that, three months later, destroyed three of the four Nord Stream pipelines, according to a source with direct knowledge of the operational planning.

Two of the pipelines, which were known collectively as Nord Stream 1, had been providing Germany and much of Western Europe with cheap Russian natural gas for more than a decade. A second pair of pipelines, called Nord Stream 2, had been built but were not yet operational. Now, with Russian troops massing on the Ukrainian border and the bloodiest war in Europe since 1945 looming, President Joseph Biden saw the pipelines as a vehicle for Vladimir Putin to weaponize natural gas for his political and territorial ambitions.

Asked for comment, Adrienne Watson, a White House spokesperson, said in an email, “This is false and complete fiction.” Tammy Thorp, a spokesperson for the Central Intelligence Agency, similarly wrote: “This claim is completely and utterly false.”

Biden’s decision to sabotage the pipelines came after more than nine months of highly secret back and forth debate inside Washington’s national security community about how to best achieve that goal. For much of that time, the issue was not whether to do the mission, but how to get it done with no overt clue as to who was responsible.

There was a vital bureaucratic reason for relying on the graduates of the center’s hardcore diving school in Panama City. The divers were Navy only, and not members of America’s Special Operations Command, whose covert operations must be reported to Congress and briefed in advance to the Senate and House leadership—the so-called Gang of Eight. The Biden Administration was doing everything possible to avoid leaks as the planning took place late in 2021 and into the first months of 2022.

President Biden and his foreign policy team—National Security Adviser Jake Sullivan, Secretary of State Tony Blinken, and Victoria Nuland, the Undersecretary of State for Policy—had been vocal and consistent in their hostility to the two pipelines, which ran side by side for 750 miles under the Baltic Sea from two different ports in northeastern Russia near the Estonian border, passing close to the Danish island of Bornholm before ending in northern Germany.

The direct route, which bypassed any need to transit Ukraine, had been a boon for the German economy, which enjoyed an abundance of cheap Russian natural gas—enough to run its factories and heat its homes while enabling German distributors to sell excess gas, at a profit, throughout Western Europe. Action that could be traced to the administration would violate US promises to minimize direct conflict with Russia. Secrecy was essential.

From its earliest days, Nord Stream 1 was seen by Washington and its anti-Russian NATO partners as a threat to western dominance. The holding company behind it, Nord Stream AG, was incorporated in Switzerland in 2005 in partnership with Gazprom, a publicly traded Russian company producing enormous profits for shareholders which is dominated by oligarchs known to be in the thrall of Putin. Gazprom controlled 51 percent of the company, with four European energy firms—one in France, one in the Netherlands and two in Germany—sharing the remaining 49 percent of stock, and having the right to control downstream sales of the inexpensive natural gas to local distributors in Germany and Western Europe. Gazprom’s profits were shared with the Russian government, and state gas and oil revenues were estimated in some years to amount to as much as 45 percent of Russia’s annual budget.

America’s political fears were real: Putin would now have an additional and much-needed major source of income, and Germany and the rest of Western Europe would become addicted to low-cost natural gas supplied by Russia—while diminishing European reliance on America. In fact, that’s exactly what happened. Many Germans saw Nord Stream 1 as part of the deliverance of former Chancellor Willy Brandt’s famed Ostpolitik theory, which would enable postwar Germany to rehabilitate itself and other European nations destroyed in World War II by, among other initiatives, utilizing cheap Russian gas to fuel a prosperous Western European market and trading economy.

Nord Stream 1 was dangerous enough, in the view of NATO and Washington, but Nord Stream 2, whose construction was completed in September of 2021, would, if approved by German regulators, double the amount of cheap gas that would be available to Germany and Western Europe. The second pipeline also would provide enough gas for more than 50 percent of Germany’s annual consumption. Tensions were constantly escalating between Russia and NATO, backed by the aggressive foreign policy of the Biden Administration.

Opposition to Nord Stream 2 flared on the eve of the Biden inauguration in January 2021, when Senate Republicans, led by Ted Cruz of Texas, repeatedly raised the political threat of cheap Russian natural gas during the confirmation hearing of Blinken as Secretary of State. By then a unified Senate had successfully passed a law that, as Cruz told Blinken, “halted [the pipeline] in its tracks.” There would be enormous political and economic pressure from the German government, then headed by Angela Merkel, to get the second pipeline online.

Would Biden stand up to the Germans? Blinken said yes, but added that he had not discussed the specifics of the incoming President’s views. “I know his strong conviction that this is a bad idea, the Nord Stream 2,” he said. “I know that he would have us use every persuasive tool that we have to convince our friends and partners, including Germany, not to move forward with it.”

A few months later, as the construction of the second pipeline neared completion, Biden blinked. That May, in a stunning turnaround, the administration waived sanctions against Nord Stream AG, with a State Department official conceding that trying to stop the pipeline through sanctions and diplomacy had “always been a long shot.” Behind the scenes, administration officials reportedly urged Ukrainian President Volodymyr Zelensky, by then facing a threat of Russian invasion, not to criticize the move.

There were immediate consequences. Senate Republicans, led by Cruz, announced an immediate blockade of all of Biden’s foreign policy nominees and delayed passage of the annual defense bill for months, deep into the fall. Politico later depicted Biden’s turnabout on the second Russian pipeline as “the one decision, arguably more than the chaotic military withdrawal from Afghanistan, that has imperiled Biden’s agenda.” 

The administration was floundering, despite getting a reprieve on the crisis in mid-November, when Germany’s energy regulators suspended approval of the second Nord Stream pipeline. Natural gas prices surged 8% within days, amid growing fears in Germany and Europe that the pipeline suspension and the growing possibility of a war between Russia and Ukraine would lead to a very much unwanted cold winter. It was not clear to Washington just where Olaf Scholz, Germany’s newly appointed chancellor, stood. Months earlier, after the fall of Afghanistan, Scholtz had publicly endorsed French President Emmanuel Macron’s call for a more autonomous European foreign policy in a speech in Prague—clearly suggesting less reliance on Washington and its mercurial actions.

Throughout all of this, Russian troops had been steadily and ominously building up on the borders of Ukraine, and by the end of December more than 100,000 soldiers were in position to strike from Belarus and Crimea. Alarm was growing in Washington, including an assessment from Blinken that those troop numbers could be “doubled in short order.”

The administration’s attention once again was focused on Nord Stream. As long as Europe remained dependent on the pipelines for cheap natural gas, Washington was afraid that countries like Germany would be reluctant to supply Ukraine with the money and weapons it needed to defeat Russia.

It was at this unsettled moment that Biden authorized Jake Sullivan to bring together an interagency group to come up with a plan. 

All options were to be on the table. But only one would emerge.

PLANNING

In December of 2021, two months before the first Russian tanks rolled into Ukraine, Jake Sullivan convened a meeting of a newly formed task force—men and women from the Joint Chiefs of Staff, the CIA, and the State and Treasury Departments—and asked for recommendations about how to respond to Putin’s impending invasion.

It would be the first of a series of top-secret meetings, in a secure room on a top floor of the Old Executive Office Building, adjacent to the White House, that was also the home of the President’s Foreign Intelligence Advisory Board (PFIAB). There was the usual back and forth chatter that eventually led to a crucial preliminary question: Would the recommendation forwarded by the group to the President be reversible—such as another layer of sanctions and currency restrictions—or irreversible—that is, kinetic actions, which could not be undone?

What became clear to participants, according to the source with direct knowledge of the process, is that Sullivan intended for the group to come up with a plan for the destruction of the two Nord Stream pipelines—and that he was delivering on the desires of the President.

THE PLAYERS Left to right: Victoria Nuland, Anthony Blinken, and
Jake Sullivan.


Over the next several meetings, the participants debated options for an attack. The Navy proposed using a newly commissioned submarine to assault the pipeline directly. The Air Force discussed dropping bombs with delayed fuses that could be set off remotely. The CIA argued that whatever was done, it would have to be covert. Everyone involved understood the stakes. “This is not kiddie stuff,” the source said. If the attack were traceable to the United States, “It’s an act of war.”

At the time, the CIA was directed by William Burns, a mild-mannered former ambassador to Russia who had served as deputy secretary of state in the Obama Administration. Burns quickly authorized an Agency working group whose ad hoc members included—by chance—someone who was familiar with the capabilities of the Navy’s deep-sea divers in Panama City. Over the next few weeks, members of the CIA’s working group began to craft a plan for a covert operation that would use deep-sea divers to trigger an explosion along the pipeline.

Something like this had been done before. In 1971, the American intelligence community learned from still undisclosed sources that two important units of the Russian Navy were communicating via an undersea cable buried in the Sea of Okhotsk, on Russia’s Far East Coast. The cable linked a regional Navy command to the mainland headquarters at Vladivostok.

A hand-picked team of Central Intelligence Agency and National Security Agency operatives was assembled somewhere in the Washington area, under deep cover, and worked out a plan, using Navy divers, modified submarines and a deep-submarine rescue vehicle, that succeeded, after much trial and error, in locating the Russian cable. The divers planted a sophisticated listening device on the cable that successfully intercepted the Russian traffic and recorded it on a taping system.

The NSA learned that senior Russian navy officers, convinced of the security of their communication link, chatted away with their peers without encryption. The recording device and its tape had to be replaced monthly and the project rolled on merrily for a decade until it was compromised by a forty-four-year-old civilian NSA technician named Ronald Pelton who was fluent in Russian. Pelton was betrayed by a Russian defector in 1985 and sentenced to prison. He was paid just $5,000 by the Russians for his revelations about the operation, along with $35,000 for other Russian operational data he provided that was never made public.

That underwater success, codenamed Ivy Bells, was innovative and risky, and produced invaluable intelligence about the Russian Navy's intentions and planning.

Still, the interagency group was initially skeptical of the CIA’s enthusiasm for a covert deep-sea attack. There were too many unanswered questions. The waters of the Baltic Sea were heavily patrolled by the Russian navy, and there were no oil rigs that could be used as cover for a diving operation. Would the divers have to go to Estonia, right across the border from Russia’s natural gas loading docks, to train for the mission? “It would be a goat fuck,” the Agency was told.

Throughout “all of this scheming,” the source said, “some working guys in the CIA and the State Department were saying, ‘Don’t do this. It’s stupid and will be a political nightmare if it comes out.’”

Nevertheless, in early 2022, the CIA working group reported back to Sullivan’s interagency group: “We have a way to blow up the pipelines.”

What came next was stunning. On February 7, less than three weeks before the seemingly inevitable Russian invasion of Ukraine, Biden met in his White House office with German Chancellor Olaf Scholz, who, after some wobbling, was now firmly on the American team. At the press briefing that followed, Biden defiantly said, “If Russia invades . . . there will be no longer a Nord Stream 2. We will bring an end to it.”

Twenty days earlier, Undersecretary Nuland had delivered essentially the same message at a State Department briefing, with little press coverage. “I want to be very clear to you today,” she said in response to a question. “If Russia invades Ukraine, one way or another Nord Stream 2 will not move forward.”

Several of those involved in planning the pipeline mission were dismayed by what they viewed as indirect references to the attack.

“It was like putting an atomic bomb on the ground in Tokyo and telling the Japanese that we are going to detonate it,” the source said. “The plan was for the options to be executed post invasion and not advertised publicly. Biden simply didn’t get it or ignored it.”

Biden’s and Nuland’s indiscretion, if that is what it was, might have frustrated some of the planners. But it also created an opportunity. According to the source, some of the senior officials of the CIA determined that blowing up the pipeline “no longer could be considered a covert option because the President just announced that we knew how to do it.”

The plan to blow up Nord Stream 1 and 2 was suddenly downgraded from a covert operation requiring that Congress be informed to one that was deemed as a highly classified intelligence operation with U.S. military support. Under the law, the source explained, “There was no longer a legal requirement to report the operation to Congress. All they had to do now is just do it—but it still had to be secret. The Russians have superlative surveillance of the Baltic Sea.”

The Agency working group members had no direct contact with the White House, and were eager to find out if the President meant what he’d said—that is, if the mission was now a go. The source recalled, “Bill Burns comes back and says, ‘Do it.’”


“The Norwegian navy was quick to find the right spot, in the shallow water a few miles off Denmark’s Bornholm Island . . .”


THE OPERATION
 

Norway was the perfect place to base the mission.

In the past few years of East-West crisis, the U.S. military has vastly expanded its presence inside Norway, whose western border runs 1,400 miles along the north Atlantic Ocean and merges above the Arctic Circle with Russia. The Pentagon has created high paying jobs and contracts, amid some local controversy, by investing hundreds of millions of dollars to upgrade and expand American Navy and Air Force facilities in Norway. The new works included, most importantly, an advanced synthetic aperture radar far up north that was capable of penetrating deep into Russia and came online just as the American intelligence community lost access to a series of long-range listening sites inside China.

A newly refurbished American submarine base, which had been under construction for years, had become operational and more American submarines were now able to work closely with their Norwegian colleagues to monitor and spy on a major Russian nuclear redoubt 250 miles to the east, on the Kola Peninsula. America also has vastly expanded a Norwegian air base in the north and delivered to the Norwegian air force a fleet of Boeing-built P8 Poseidon patrol planes to bolster its long-range spying on all things Russia.

In return, the Norwegian government angered liberals and some moderates in its parliament last November by passing the Supplementary Defense Cooperation Agreement (SDCA). Under the new deal, the U.S. legal system would have jurisdiction in certain “agreed areas” in the North over American soldiers accused of crimes off base, as well as over those Norwegian citizens accused or suspected of interfering with the work at the base.

Norway was one of the original signatories of the NATO Treaty in 1949, in the early days of the Cold War. Today, the supreme commander of NATO is Jens Stoltenberg, a committed anti-communist, who served as Norway’s prime minister for eight years before moving to his high NATO post, with American backing, in 2014. He was a hardliner on all things Putin and Russia who had cooperated with the American intelligence community since the Vietnam War. He has been trusted completely since. “He is the glove that fits the American hand,” the source said.

Back in Washington, planners knew they had to go to Norway. “They hated the Russians, and the Norwegian navy was full of superb sailors and divers who had generations of experience in highly profitable deep-sea oil and gas exploration,” the source said. They also could be trusted to keep the mission secret. (The Norwegians may have had other interests as well. The destruction of Nord Stream—if the Americans could pull it off—would allow Norway to sell vastly more of its own natural gas to Europe.)

Sometime in March, a few members of the team flew to Norway to meet with the Norwegian Secret Service and Navy. One of the key questions was where exactly in the Baltic Sea was the best place to plant the explosives. Nord Stream 1 and 2, each with two sets of pipelines, were separated much of the way by little more than a mile as they made their run to the port of Greifswald in the far northeast of Germany.

The Norwegian navy was quick to find the right spot, in the shallow waters of the Baltic sea a few miles off Denmark’s Bornholm Island. The pipelines ran more than a mile apart along a seafloor that was only 260 feet deep. That would be well within the range of the divers, who, operating from a Norwegian Alta class mine hunter, would dive with a mixture of oxygen, nitrogen and helium streaming from their tanks, and plant shaped C4 charges on the four pipelines with concrete protective covers. It would be tedious, time consuming and dangerous work, but the waters off Bornholm had another advantage: there were no major tidal currents, which would have made the task of diving much more difficult.


After a bit of research, the Americans were all in.

At this point, the Navy’s obscure deep-diving group in Panama City once again came into play. The deep-sea schools at Panama City, whose trainees participated in Ivy Bells, are seen as an unwanted backwater by the elite graduates of the Naval Academy in Annapolis, who typically seek the glory of being assigned as a Seal, fighter pilot, or submariner. If one must become a “Black Shoe”—that is, a member of the less desirable surface ship command—there is always at least duty on a destroyer, cruiser or amphibious ship. The least glamorous of all is mine warfare. Its divers never appear in Hollywood movies, or on the cover of popular magazines.

“The best divers with deep diving qualifications are a tight community, and only the very best are recruited for the operation and told to be prepared to be summoned to the CIA in Washington,” the source said.

The Norwegians and Americans had a location and the operatives, but there was another concern: any unusual underwater activity in the waters off Bornholm might draw the attention of the Swedish or Danish navies, which could report it.  

Denmark had also been one of the original NATO signatories and was known in the intelligence community for its special ties to the United Kingdom. Sweden had applied for membership into NATO, and had demonstrated its great skill in managing its underwater sound and magnetic sensor systems that successfully tracked Russian submarines that would occasionally show up in remote waters of the Swedish archipelago and be forced to the surface.

The Norwegians joined the Americans in insisting that some senior officials in Denmark and Sweden had to be briefed in general terms about possible diving activity in the area. In that way, someone higher up could intervene and keep a report out of the chain of command, thus insulating the pipeline operation. “What they were told and what they knew were purposely different,” the source told me. (The Norwegian embassy, asked to comment on this story, did not respond.)

The Norwegians were key to solving other hurdles. The Russian navy was known to possess surveillance technology capable of spotting, and triggering, underwater mines. The American explosive devices needed to be camouflaged in a way that would make them appear to the Russian system as part of the natural background—something that required adapting to the specific salinity of the water. The Norwegians had a fix.

The Norwegians also had a solution to the crucial question of when the operation should take place. Every June, for the past 21 years, the American Sixth Fleet, whose flagship is based in Gaeta, Italy, south of Rome, has sponsored a major NATO exercise in the Baltic Sea involving scores of allied ships throughout the region. The current exercise, held in June, would be known as Baltic Operations 22, or BALTOPS 22. The Norwegians proposed this would be the ideal cover to plant the mines.

The Americans provided one vital element: they convinced the Sixth Fleet planners to add a research and development exercise to the program. The exercise, as made public by the Navy, involved the Sixth Fleet in collaboration with the Navy’s “research and warfare centers.” The at-sea event would be held off the coast of Bornholm Island and involve NATO teams of divers planting mines, with competing teams using the latest underwater technology to find and destroy them.

It was both a useful exercise and ingenious cover. The Panama City boys would do their thing and the C4 explosives would be in place by the end of BALTOPS22, with a 48-hour timer attached. All of the Americans and Norwegians would be long gone by the first explosion. 

The days were counting down. “The clock was ticking, and we were nearing mission accomplished,” the source said.

And then: Washington had second thoughts. The bombs would still be planted during BALTOPS, but the White House worried that a two-day window for their detonation would be too close to the end of the exercise, and it would be obvious that America had been involved.

Instead, the White House had a new request: “Can the guys in the field come up with some way to blow the pipelines later on command?”

Some members of the planning team were angered and frustrated by the President’s seeming indecision. The Panama City divers had repeatedly practiced planting the C4 on pipelines, as they would during BALTOPS, but now the team in Norway had to come up with a way to give Biden what he wanted—the ability to issue a successful execution order at a time of his choosing.  

Being tasked with an arbitrary, last-minute change was something the CIA was accustomed to managing. But it also renewed the concerns some shared over the necessity, and legality, of the entire operation.

The President’s secret orders also evoked the CIA’s dilemma in the Vietnam War days, when President Johnson, confronted by growing anti-Vietnam War sentiment, ordered the Agency to violate its charter—which specifically barred it from operating inside America—by spying on antiwar leaders to determine whether they were being controlled by Communist Russia.

The agency ultimately acquiesced, and throughout the 1970s it became clear just how far it had been willing to go. There were subsequent newspaper revelations in the aftermath of the Watergate scandals about the Agency’s spying on American citizens, its involvement in the assassination of foreign leaders and its undermining of the socialist government of Salvador Allende.

Those revelations led to a dramatic series of hearings in the mid-1970s in the Senate, led by Frank Church of Idaho, that made it clear that Richard Helms, the Agency director at the time, accepted that he had an obligation to do what the President wanted, even if it meant violating the law.

In unpublished, closed-door testimony, Helms ruefully explained that “you almost have an Immaculate Conception when you do something” under secret orders from a President. “Whether it’s right that you should have it, or wrong that you shall have it, [the CIA] works under different rules and ground rules than any other part of the government.” He was essentially telling the Senators that he, as head of the CIA, understood that he had been working for the Crown, and not the Constitution.

The Americans at work in Norway operated under the same dynamic, and dutifully began working on the new problem—how to remotely detonate the C4 explosives on Biden’s order. It was a much more demanding assignment than those in Washington understood. There was no way for the team in Norway to know when the President might push the button. Would it be in a few weeks, in many months or in half a year or longer?

The C4 attached to the pipelines would be triggered by a sonar buoy dropped by a plane on short notice, but the procedure involved the most advanced signal processing technology. Once in place, the delayed timing devices attached to any of the four pipelines could be accidentally triggered by the complex mix of ocean background noises throughout the heavily trafficked Baltic Sea—from near and distant ships, underwater drilling, seismic events, waves and even sea creatures. To avoid this, the sonar buoy, once in place, would emit a sequence of unique low frequency tonal sounds—much like those emitted by a flute or a piano—that would be recognized by the timing device and, after a pre-set hours of delay, trigger the explosives. (“You want a signal that is robust enough so that no other signal could accidentally send a pulse that detonated the explosives,” I was told by Dr. Theodore Postol, professor emeritus of science, technology and national security policy at MIT. Postol, who has served as the science adviser to the Pentagon’s Chief of Naval Operations, said the issue facing the group in Norway because of Biden’s delay was one of chance: “The longer the explosives are in the water the greater risk there would be of a random signal that would launch the bombs.”)

On September 26, 2022, a Norwegian Navy P8 surveillance plane made a seemingly routine flight and dropped a sonar buoy. The signal spread underwater, initially to Nord Stream 2 and then on to Nord Stream 1. A few hours later, the high-powered C4 explosives were triggered and three of the four pipelines were put out of commission. Within a few minutes, pools of methane gas that remained in the shuttered pipelines could be seen spreading on the water’s surface and the world learned that something irreversible had taken place.

FALLOUT

In the immediate aftermath of the pipeline bombing, the American media treated it like an unsolved mystery. Russia was repeatedly cited as a likely culprit, spurred on by calculated leaks from the White House—but without ever establishing a clear motive for such an act of self-sabotage, beyond simple retribution. A few months later, when it emerged that Russian authorities had been quietly getting estimates for the cost to repair the pipelines, the New York Times described the news as “complicating theories about who was behind” the attack. No major American newspaper dug into the earlier threats to the pipelines made by Biden and Undersecretary of State Nuland.

While it was never clear why Russia would seek to destroy its own lucrative pipeline, a more telling rationale for the President’s action came from Secretary of State Blinken.

Asked at a press conference last September about the consequences of the worsening energy crisis in Western Europe, Blinken described the moment as a potentially good one:

“It’s a tremendous opportunity to once and for all remove the dependence on Russian energy and thus to take away from Vladimir Putin the weaponization of energy as a means of advancing his imperial designs. That’s very significant and that offers tremendous strategic opportunity for the years to come, but meanwhile we’re determined to do everything we possibly can to make sure the consequences of all of this are not borne by citizens in our countries or, for that matter, around the world.”

More recently, Victoria Nuland expressed satisfaction at the demise of the newest of the pipelines. Testifying at a Senate Foreign Relations Committee hearing in late January she told Senator Ted Cruz, “​Like you, I am, and I think the Administration is, very gratified to know that Nord Stream 2 is now, as you like to say, a hunk of metal at the bottom of the sea.”

The source had a much more streetwise view of Biden’s decision to sabotage more than 1500 miles of Gazprom pipeline as winter approached. “Well,” he said, speaking of the President, “I gotta admit the guy has a pair of balls.  He said he was going to do it, and he did.”

Asked why he thought the Russians failed to respond, he said cynically, “Maybe they want the capability to do the same things the U.S. did.

“It was a beautiful cover story,” he went on. “Behind it was a covert operation that placed experts in the field and equipment that operated on a covert signal.

“The only flaw was the decision to do it.”

Subscribe to Seymour Hersh

Launched 6 hours ago

Independent reporting from the world's leading investigative journalist

https://seymourhersh.substack.com/p/how-america-took-out-the-nord-stream

__
eof


maanantai 6. helmikuuta 2023

Critical U.S. Election Systems Have Been Left Exposed Online Despite Official Denials



Exclusive: Critical U.S. Election Systems Have Been Left Exposed Online Despite Official Denials

The top voting machine company in the country insists that its election systems are never connected to the internet. But researchers found 35 of the systems have been connected to the internet for months and possibly years, including in some swing states.

For years, U.S. election officials and voting machine vendors have insisted that critical election systems are never connected to the internet and therefore can’t be hacked.

But a group of election security experts have found what they believe to be nearly three dozen backend election systems in 10 states connected to the internet over the last year, including some in critical swing states. These include systems in nine Wisconsin counties, in four Michigan counties, and in seven Florida counties—all states that are perennial battlegrounds in presidential elections.

Some of the systems have been online for a year and possibly longer. Some of them disappeared from the internet after the researchers notified an information-sharing group for election officials last year. But at least 19 of the systems, including one in Florida’s Miami-Dade County, were still connected to the internet this week, the researchers told Motherboard.

The researchers and Motherboard have been able to verify that at least some of the systems in Wisconsin, Rhode Island, and Florida are in fact election systems. The rest are still unconfirmed, but the fact that some of them appeared to quickly drop offline after the researchers reported them suggests their findings are on the mark.

“We … discovered that at least some jurisdictions were not aware that their systems were online,” said Kevin Skoglund, an independent security consultant who conducted the research with nine others, all of them long-time security professionals and academics with expertise in election security. Skoglund is also part of an advisory group, not associated with the research, that is working with the National Institute of Standards and Technology to develop new cybersecurity standards for voting machines. “In some cases, [the vendor was] in charge [of installing the systems] and there was no oversight. Election officials were publicly saying that their systems were never connected to the internet because they didn't know differently."

The systems the researchers found are made by Election Systems & Software, the top voting machine company in the country. They are used to receive encrypted vote totals transmitted via modem from ES&S voting machines on election night, in order to get rapid results that media use to call races, even though the results aren’t final.

Generally, votes are stored on memory cards inside the voting machines at polling places. After an election, poll workers remove these and drive them to county election offices. But some counties want to get their results faster, so they use wireless modems, either embedded in the voting machines or externally connected to them, to transmit the votes electronically. The system that receives these votes, called an SFTP server, is connected to the internet behind a Cisco firewall.

For security reasons, the SFTP server and firewall are only supposed to be connected to the internet for a couple of minutes before an election to test the transmission, and then for long enough after an election to transmit the votes. But the researchers found some of the systems connected to the internet for months at a time, and year-round for others, making them vulnerable to hackers.

Hacking the firewall and SFTP server would allow an attacker to potentially intercept the results as they’re transmitted and send fake results to the FTP server, depending on how securely the ES&S system authenticates the data. Although the election results that are transmitted via modem are unofficial—official votes are taken directly from the voting machine memory cards when they arrive at county offices—a significant discrepancy between the unofficial tallies and the official ones would create mistrust in the election results and confusion about which ones were accurate.

"These are all secure technologies that if [configured] correctly work just fine. It’s just that we have no faith that they are done correctly."

But Motherboard has learned that connected to the firewalls are even more critical backend systems—the election-reporting module that tabulates the unofficial votes as well as the official ones, and the election-management system that is used in some counties to program voting machines before elections. The researchers said that gaining access through the firewall to these systems could potentially allow a hacker to alter official election results or subvert the election-management system to distribute malware to voting machines through the USB flash drives that pass between this system and the voting machines.

*

Online, the researchers can only see the firewalls configured in front of these systems and cannot see anything behind them—a federal law makes it illegal for them to probe beyond the firewall. But ES&S documents posted online in various counties show that these critical backend systems are connected to the firewall, and ES&S also confirmed to Motherboard that this is the correct architecture in counties that want to transmit results electronically.

ES&S has long insisted that election-management systems are air-gapped—that is, not connected to the internet or connected to any other system that is connected to the internet—and the company insists to Motherboard that the diagram it provided isn’t showing them connected to the internet.

“There’s nothing connected to the firewall that is exposed to the internet,” Gary Weber, vice president of software development and engineering for ES&S, told Motherboard. “Our [election-management system] is not pingable or addressable from the public internet.” This makes them invisible to bad actors or unauthorized users, he said.

1565282528251-image3

But Skoglund said this “misrepresents the facts.” Anyone who finds the firewall online also finds the election-management system connected to it.

“It is not air-gapped. The EMS is connected to the internet but is behind a firewall,” Skoglund said. “The firewall configuration [that determines what can go in and out of the firewall]… is the only thing that segments the EMS from the internet.”

And misconfigured firewalls are one of the most common ways hackers penetrate supposedly protected systems. The recent massive hack of sensitive Capital One customer data is a prime example of a breach enabled by a poorly configured firewall.

“If they did everything correctly [with the ES&S systems] as they say they do, there is no danger,” Robert Graham, CEO of Errata Security, told Motherboard. “These are all secure technologies that if [configured] correctly work just fine. It’s just that we have no faith that they are done correctly. And the fact that [election officials are] saying they aren’t on the internet and yet they are on the internet shows us that we have every reason to distrust them.”

Even proper configurations won’t secure a firewall if the firewall software itself has security vulnerabilities that allow intruders to bypass all the authentication checks, whitelisting rules, and other security parameters set in the firewall’s configuration file.

“If this system hasn’t been patched and has a critical vulnerability… you may be able to subvert any kind of security scheme that you’ve put in place,” Skoglund told Motherboard.

“Not only should ballot tallying systems not be connected to the internet, they shouldn’t be anywhere near the internet.”

While no one is suggesting that any of these systems have been manipulated or hacked, the findings highlight how little local and federal election officials understand how these critical election systems are really configured and connected, and the extent to which they are beholden to what the vendors tell them.

Senator Ron Wyden (D-Oregon) said the findings are “yet another damning indictment of the profiteering election vendors, who care more about the bottom line than protecting our democracy.” It’s also an indictment, he said, “of the notion that important cybersecurity decisions should be left entirely to county election offices, many of whom do not employ a single cybersecurity specialist.”

“Not only should ballot tallying systems not be connected to the internet, they shouldn’t be anywhere near the internet,” he added.



RON WYDEN (D-OR) SPEAKS AT A PRESS CONFERENCE ALONGSIDE SPEAKER OF THE HOUSE NANCY PELOSI (D-CA) ON PASSING THE AMERICA'S ELECTIONS ACT ON JUNE 26, 2019 IN WASHINGTON, DC. THE SAFE ACT BILL INCLUDES REFORMS TO SAFEGUARD VOTING SYSTEMS AND MODERNIZE ELECTION INFRASTRUCTURE IN AN EFFORT TO LOWER THE LIKELIHOOD OF HACKING. IMAGE: TASOS KATOPODIS/GETTY IMAGES

Wyden said two pieces of federal election security legislation that have stalled on Capitol Hill due to Republican leaders—the SAFE Act and a Wyden bill called PAVE Act—would effectively ban transmission of votes via modem and prohibit connecting any election-reporting or election-management system to the internet or to a telecommunications network at any time.

The ES&S firewalls are configured to only allow authenticated systems to connect and pass data through the firewall to the SFTP server; they also block outbound connections to the internet from systems behind the firewall. Authenticated systems include modem-enabled voting machines at voting precincts, or a computer at regional transmission sites. But even these authenticated systems, armed with passwords to communicate with the SFTP server, can only communicate with that server and cannot reach past this to the critical backend systems, according to ES&S. The passwords for the voting machines to communicate with the SFTP server are generated by the election-management system and passed to the voting machines on a USB flash drive when the systems are programmed before each election, and the passwords are also stored on the SFTP server to authenticate the machines.

The two backend systems—the reporting system that tabulates votes and the election-management system—sit on a local area network, which is connected to the Cisco firewall through a switch. The switch doesn’t provide additional security; it simply acts as a traffic cop to direct incoming data to the right system. To collect the encrypted votes the voting machines have deposited on the SFTP server, the backend reporting system reaches through the firewall to query the server every few minutes. If new files have arrived, the reporting system grabs those, decrypts them to read the votes inside, then tabulates them.

At least this is how the configuration in the diagram ES&S provided Motherboard works. But a different diagram the company submitted last year to Travis County, Texas, as part of a contract proposal, and which is available online, shows the reporting system and election-management system directly connected to the SFTP server through the switch, and all of them are connected to the firewall. This would mean the backend reporting system could bypass the firewall to reach the SFTP server directly, a less secure configuration. Weber of ES&S told Motherboard the Travis diagram is incorrect.

1565282630104-image1

ES&S DIAGRAM THE COMPANY SUBMITTED LAST YEAR TO TRAVIS COUNTY, TEXAS, AS PART OF A CONTRACT PROPOSAL SHOWS THE REPORTING SYSTEM AND ELECTION-MANAGEMENT SYSTEM DIRECTLY CONNECTED TO THE SFTP SERVER THROUGH THE SWITCH, AND ALL OF THEM ARE CONNECTED TO THE FIREWALL.

The backend systems in the ES&S configuration are only protected if the firewall rules ES&S has set up for controlling traffic are configured correctly, if the firewalls have no unpatched software vulnerabilities that would let an intruder bypass those protections to install malware on the SFTP server and the critical backend systems, and if the firewalls are also consistently maintained and monitored for rogue connections.

Unfortunately, there are a number of reasons to be concerned about the security of the firewalls and SFTP servers.

ES&S installs and configures the firewalls for the “majority” of its customers, the company told Motherboard. Counties then take over the maintenance or contract it out to a third party, which may even be ES&S in some cases.

Last year, the Cisco firewalls in Wisconsin failed to receive a patch for a critical vulnerability until six months after the vulnerability had been made public and the patch was released, Motherboard has learned. Patch delays aren’t unusual in states that require their election systems to be state certified as well as federally certified—a patch that needs to be applied to a certified system generally has to be reviewed for compliance with the certification requirements before it can be applied. But six months is a long time, and this means the systems were vulnerable to attack during a lengthy period before the 2018 midterm elections.

Another maintenance issue involves slow software upgrades. The researchers on Skoglund’s team discovered that seven of the SFTP servers on the ES&S systems they found are using outdated Cerberus FTP Server 6.0 software that the software maker stopped supporting in January 2017. This means that for the last two and a half years, the maker of that software has not updated it, and going forward will not produce patches if any vulnerabilities in the software are found. The current version is 10.0, and despite the fact that it has been available since November 2018, none of the ES&S SFTP servers the researchers found online are running it.

Not every ES&S backend election system is connected to the internet, because not every county opts to transmit election results. There are more than 33,000 ES&S DS200 optical scan machines with modems in use across eleven states and the District of Columbia. But ES&S told Motherboard it doesn’t know how many of its customers currently transmit results.

What’s not generally known by the public about ES&S election systems is that the company’s entire configuration for transmitting election results—from the modem to the SFTP server—is not certified by the Election Assistance Commission (EAC), which oversees the testing and certification of voting equipment at the federal level. ES&S voting machines are tested and certified, but the transmission configuration isn’t. The labs test them for functionality to make sure they transmit votes, and that’s it. In marketing literature, ES&S highlights the certified parts of its election system in blue and labels them "EAC Certified Configuration." The uncertified part is highlighted in white and labeled "Extended Configuration."

Weber told Motherboard that instead of federal certification, his company has focused on working with officials in states that allow modem transmission to test and certify the configuration under their own state certification programs. He said this includes a security assessment of the configuration. Asked which states do these security assessments, he cited Wisconsin, Florida, and Minnesota. But someone familiar with Wisconsin’s certification testing, who spoke on condition of anonymity, told Motherboard it doesn’t include a security assessment of the modem transmissions and configuration.

Hunting Election Systems

The researchers began looking for connected systems in July of 2018 after seeing repeated comments from state and local election officials as well as federal officials with the Election Assistance Commission, that voting machines and backend election systems are never connected to the internet.

Although these officials acknowledge that many voting machines use modems to transmit election results over cellular networks and landline connections, they have long insisted that modem transmissions don’t involve the internet. A New York Times story I wrote last year, however, showed that the modem transmissions do pass through the internet, and even an ES&S document that the company supplied to Rhode Island in 2015 calls the modem transmission of votes an “internet” transmission. A document for modem transmissions from voting machines made by Dominion Voting Systems—another top voting machine company in the country—similarly discusses TCP-IP and SSL, both protocols used for internet traffic.



AN ES&S DOCUMENT SUPPLIED TO RHODE ISLAND AND DATED 2015, WHICH CLEARLY SHOWS THE MODEM TRANSMISSION OF VOTES FROM THE COMPANY'S DS200 OPTICAL SCAN VOTING MACHINES GOING OVER THE INTERNET.


“The configurations show TCP-IP configuration and ‘SSL Optional,’ making it clear that at least the vendors know their systems are connecting through the internet, even if their election official customers do not realize it or continue to insist to the public that the systems are not connected to the internet,” Skoglund said.

Knowing the vote transmissions are going over the internet, the researchers decided to see if they could find the backend internet-connected systems that receive the transmitted votes. They discovered a method of searching for connected ES&S systems after one of their group stumbled across the IP address for an ES&S firewall in Rhode Island in a publicly available document.

After combing through other documents for ES&S systems published online, and finding technical specifications that show the systems use Cisco ASA 5500 series firewalls, and Cerberus FTP software and Cisco AnyConnect VPN for the vote transmissions, they used a specialized search engine called Censys to find connected systems that matched this configuration combination. Censys scans the internet weekly for connected devices and catalogues information about them, including their IP address, in a database. Their search led them to 35 connected systems over the last year, though Skoglund notes that there may actually be more ES&S systems connected to the internet that are not visible to Censys scans, since administrators can configure their connected devices to block automated scans. This doesn’t mean, however, that someone can’t still find the systems online.

When examining the ownership records for the IP addresses of the connected systems, at least four of them were registered to county governments in Michigan and Florida. This helped bolster the researchers’ belief that what they had found were county election systems. The other IP addresses were harder to trace, however, since they were registered to large internet service providers, and not the ISP customers using them.

The researchers found one or two systems online in Illinois, Indiana, Minnesota, Nebraska, Rhode Island, Tennessee, and Iowa. The Nebraska system, they surmise, is probably a demo or test system for ES&S, which has its headquarters in Omaha. They also found two systems in Canada, where ES&S has field offices and customers, that may also be demo or test systems.

Although only one system was found online in Rhode Island, this one was particularly problematic, the researchers note. Rhode Island, unlike other states, conducts its elections from a centralized office at the state Board of Elections, instead of farming out election administration to each county or jurisdiction. The election reporting system the researchers found online, therefore, was the reporting system for the entire state.

One of the most dense states for online election systems was Florida, where the researchers found a number of connected systems that they believe belong to Bradford, Charlotte, Flagler, Wakulla, Miami-Dade, and Pasco counties, and one other county they’re unable to identity from the IP address.

Florida is known for its knuckle-biting elections. Trump won the state by just 1.2 percentage points in 2016, and in 2018 the state had senate and gubernatorial races that were too close to call on election night. Miami-Dade county in particular, with 1.4 million registered voters, is one of the most intensely watched counties in federal elections—it was using ES&S machines with embedded modems in the 2016 elections.

None of this implies that the election systems in Miami-Dade or any other Florida county were manipulated in the 2016 elections. But the findings highlight what is at stake with critical election systems online.

Any election system connected to the internet creates potential vulnerabilities for elections. But the nine systems in Wisconsin and four in Michigan that the researchers found raise particular red flags since these were two states among three where Green Party presidential nominee Jill Stein sought a recount of the 2016 presidential votes. All three states, which included Pennsylvania, produced results that were contrary to election polls and prior state voting trends. Although there was no specific evidence suggesting the election systems had been manipulated, a recount could have helped provide assurance to the public that this wasn’t the case. A court, however, halted the Michigan recount after it began, and a Pennsylvania court declined to hear Stein’s case for a recount in that state.

"What you are describing is a bad behavior amplified by sloppiness and complete negligence of security."

Wisconsin’s recount was completed, but some counties that used optical scan machines didn’t do a true recount—they simply ran the paper ballots through the optical-scan machines a second time, instead of manually comparing them against the digital tallies to uncover discrepancies. If any problems existed in the scanner software to produce incorrect results during the first scan, they would reproduce the same incorrect results in the re-scan.

The researchers repeated their searches of the Censys database periodically to see when systems dropped out of visibility or new ones popped up online. This allowed them to see the systems connected for long periods of time, contrary to assertions by election officials that the systems for transmitting results only remain connected for a few minutes after elections. Some of the systems do pop up online only around election times, but they tend to remain online about a month before disappearing, not a few minutes.

“Rhode Island is one that kind of comes on and goes off,” Skoglund said. “They don’t stay on year round. But others do.”

Motherboard asked Errata Security CEO Graham, who created an internet-scanning tool called Masscan, to independently verify the methodology the researchers used to find the systems, and he confirmed that the method was sound, using the search parameters the researchers provided. Like the researchers, though, he was unable to explore further without breaking the law, so he could only see the firewalls and not what is behind them. An independent election security expert named Harri Hursti, who consults with election districts and helps run the annual Voting Machine Hacking Village at the Def Con security conference, also verified the methodology for Motherboard without being told how to find the systems. Hursti in fact told Motherboard that many other election systems are online that the researchers’ particular search parameters missed.

The researchers didn’t single out ES&S election systems for their hunt. They also attempted to search for connected systems for the other top two voting machine vendors in the country—Dominion Voting Systems and Hart InterCivic. But Skoglund said the configuration footprints for these systems are less distinctive than ES&S’s footprint, resulting in the team finding thousands of systems that were clearly not election infrastructure.

Although the researchers have not been able to confirm with elections officials in every state that all of the firewalls they spotted are connected to ES&S systems, they were able to verify enough of them that Skoglund says he feels confident their list is reliable. And all of the systems the researchers found share a configuration footprint that, as far as they can tell, is unique to ES&S systems. Furthermore, the IP addresses for the firewalls of the non-confirmed systems all appear to be in counties that also use ES&S voting machines, according to a crosscheck against a web tool operated by Verified Voting, a nonprofit that tracks voting machine use around the country. Although resolving IP addresses to precise geographical location is difficult to do, the researchers were able to pinpoint the addresses they found to a specific city or region in all cases except four of the systems.

ES&S did not dispute that the firewalls the researchers found are ES&S systems; the company said it had no way of knowing one way or the other. Motherboard offered to provide the company with the IP addresses the researchers found for the firewalls, but the company said in an email that it doesn’t store customer IP addresses and therefore wouldn’t be able to tell if the systems belong to its clients.

Because the researchers only began looking for the systems last year, it’s not known how long they’ve been online, but it’s likely that some have been connected to the internet for years, going back to whenever a county first began to use modems to transmit election results.

ES&S has been selling systems with modems to transmit results for more than a decade. Wisconsin approved the use of its current ES&S DS200 optical scan voting machines, with modem transmission capability, in September 2015, but its previous generation of ES&S optical scan machines also used modems for transmitting results. It’s not clear if they used the same firewall and backend configuration.

ES&S voting machines

IMAGE: SCOTT MCINTYRE/BLOOMBERG VIA GETTY IMAGES

Although election security experts oppose electronically transmitting votes at all, if a county is going to do it, the equipment set up to receive the results should not be connected to the internet when the system is not being used. It serves no other purpose than to receive results.

“While the [reporting systems] are secure, ES&S recommends that they only be connected to the internet when they are being tested or in use in order to minimize possible threats,” a statement sent to Motherboard from ES&S and the Wisconsin Election Commission says.

But Hursti told Motherboard it makes little difference how long election systems are connected; any connectivity at all opens them to potential attacks.

“For a skillful, motivated attacker, it doesn’t matter much if [the system is connected] two minutes or a whole year. But for a less skilled fool, less motivated attacker, the fact that they are there for a year, it lowers the bar,” he told Motherboard. “It actually buries the bar under the ground to carry out attacks with less skill. [And] you have a way longer time when the hack can be carried out and the evidence of the attacks [hidden]. What you are describing is a bad behavior amplified by sloppiness and complete negligence of security.”

A more skilled and motivated hacker—such as a Russia-backed nation-state hacker—could potentially compromise the firewall or SFTP server and plant malware that gets delivered to each voting machine that communicates with the server, Skoglund and Hursti said. This is similar to what security professionals refer to as a “watering hole” attack, named after predatory animals who lie in wait at watering holes for prey to arrive to drink.

And if hackers could push malware to the voting machines from the SFTP server, the malware could potentially reconfigure the modem on those machines to make them dial out to a system the attackers own, while preventing any evidence of these calls from showing up on the system’s log. This would give attackers time to subvert the machines for subsequent elections.

Findings Reported and Confirmed

The researchers reported the firewall IP addresses in August 2018 to the national Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC)—a 24-hour watch center funded by the Department of Homeland Security and operated by the Center for Internet Security, a nonprofit established to develop and promote best practices in cybersecurity. The EI-ISAC provides election officials with security threat information and warnings, and told the researchers they would pass the information to where it needed to go, but the researchers never got any follow-up from the EI-ISAC.

A spokesperson for the group would not tell Motherboard if the information was disseminated to the affected counties, but the researchers did see some county systems disappear from the internet. The Department of Homeland Security, which has been working with states and counties since 2016 to secure their election infrastructures, also declined to speak with Motherboard about the researchers’ findings.

The fact that half of the systems were still online last week, however, highlights how new efforts by the federal government and information-sharing groups to warn election officials about known threats and vulnerabilities don’t work if the message doesn’t get to the people who can actually take the systems offline or if local election officials simply don’t act on the information they receive. Last year the researchers gave four IP addresses to the EI-ISAC that the researchers confirmed were connected to election infrastructure in Michigan and Florida.

“The two in Florida were taken offline in the following week or two,” Skoglund said. But the systems in two Michigan counties, Kalamazoo and Roscommon, were still online this week. A third Michigan system is also online, though the researchers are unable to pinpoint the county in which the IP address is located.

Similarly, they reported half a dozen IP addresses to Tony Bridges, election security lead at the Wisconsin Election Commission, for connected systems in Outagamie, Dodge, Milwaukee, St. Croix, Columbia, and Waukesha counties. But despite initial friendly communication, Skoglund said they never received a response.

Bridges told Motherboard he did act on the information he received, advising all of the counties to disconnect their systems when not in use for elections. He was surprised to learn last week from Motherboard that there were still systems online. He contacted the counties again, and Skoglund’s group could see that all off them dropped off except Milwaukee County’s system and another county they had not reported to Bridges last year, Eau Claire County.

The director of elections in Milwaukee County told Skoglund this week that their system was online for a special election next week. Skoglund told Motherboard that when he told her the system had actually been online since September 2018, she said she only learned last week that the systems should not be connected to the internet between elections.

Skoglund has also witnessed another problems as systems dropped offline after his group’s disclosure to a county; some IT workers are simply turning off the SFTP server or switching it to standby mode so traffic can’t come into it. But as long as the firewall is online, the backend systems are still connected to the internet and can be found. And if the AnyConnect VPN is still enabled, this also provides a potential pathway into those backend systems.

Skoglund said he’s concerned that no one is monitoring all of these systems once they’re online, and that counties are trusting the configuration instructions ES&S gives them, or trusting ES&S to configure the systems securely for them, and are then ignoring the systems once they’re set up.

“When a corporation sets up a firewall and a VPN … there is someone who is applying patches and monitoring logs … and really actively ensuring the security of the device to make sure it doesn’t become a vulnerability,” Skoglund said. “That’s a real question with election infrastructure. Who manages this hardware after it’s deployed? And what oversight is there?”

https://www.vice.com/en/article/3kxzk9/exclusive-critical-us-election-systems-have-been-left-exposed-online-despite-official-denials


__
eof