A former Washington, DC, Metro transit system contractor retained access to “critical and sensitive” Metro data from his computer in Russia after he left his job in a breach that raises broader security concerns about one of the nation’s largest transit systems, according to a report released Wednesday.
The cybersecurity vulnerabilities of the Washington Metropolitan Area Transit Authority are “a cause of grave concern” that the authority’s networks are “at unacceptable risk” of hacking or other forms of compromise, a report from the WMATA’s inspector general concluded.
It’s the latest in a series of warnings from auditors over years that a transit system that serves hundreds of thousands of people each day in the nation’s capital could be susceptible to sabotage or data theft.
Advertisement
The report comes as the WMATA continues to embrace digital technologies that, if unsecured, could open up further avenues for hackers. In 2019, US lawmakers blocked WMATA from using Chinese made rail cars out of concerns that they presented cybersecurity risks.
In response to the new inspector general report, WMATA said it had made “measurable improvements” to its cybersecurity in recent years. WMATA also said Microsoft, which it hired to investigate the remote login from Russia, found no sign of ongoing malicious cyber activity on the network.
The Washington Post first reported on the inspector general’s findings.
Officials from the inspector general’s office have in recent weeks raised their concerns about the WMATA’s cybersecurity practices with congressional committees and multiple federal agencies, a person familiar with the matter told CNN.
The top security incident flagged in the report came in January, when WMATA’s cybersecurity team found “abnormal” activity on the transit authority’s network that they traced to Russia. There, an ex-contractor was still accessing sensitive data on the network, according to the inspector general report.
Advertisement
WMATA hired the contractor through a US-based firm to work on sensitive applications, including the app that customers used to pay for trips. The contractor’s supervisor allowed the Russia-based worker to retain the high-level access to WMATA networks out of hope that the contract would be renewed, investigators found.
WMATA did not immediately respond to CNN’s question of whether anyone at the transit authority had been disciplined over the incident.
The inspector general report did not identify the US-based company working with WMATA that had outsourced its IT work to Russia. That practice is unusual at a time when many Western tech companies have left Russia over the Kremlin’s war on Ukraine.
The inspector general’s office said it wasn’t done investigating WMATA’s cybersecurity practices. The watchdog plans to review how WMATA handles background investigations after discovering that the transit authority outsources those investigations to contractors.
Washington’s public lands commissioner, Hilary Franz, is voicing skepticism about a federal proposal to kill thousands of barred owls in the Pacific Northwest to help the threatened northern spotted owl.
Franz wrote in a letter sent this week to Interior Secretary Deb Haaland that she’s concerned about “unintended consequences” and that the plan “could be unworkable given the scale of the overlapping habitat for barred owls and spotted owls.”
The U.S. Fish and Wildlife is proposing to kill about 500,000 barred owls, living on millions of acres of land between California and Washington, over three decades.
Hunters would shoot the owls with shotguns in most cases, according to a draft environmental impact statement released in November.
Advertisement
“The Commissioner doesn’t oppose the plan but has concerns about the cost, the scope, and potential impacts to habitat,” Franz spokesman Michael Kelly said in an email on Thursday.
He also said Franz isn’t convinced the plan represents a solution to reducing threats to the spotted owl that’s “viable, affordable, or achievable.”
Franz, who is also running for a U.S. House seat in western Washington, asked to meet with Department of Interior staff but had not received a response from Haaland as of Thursday.
The U.S. Fish and Wildlife Service in November sought public comment on its draft barred owl management plan, noting that the owls are prolific hunters that decades ago moved beyond their traditional range in the eastern U.S., into western forests.
This leaves them competing against northern spotted owls, the species known for its central role in the battles in the 1980s and 1990s over logging Northwest forests. The Fish and Wildlife Service plan also aims to prevent barred owl incursions into California spotted owl habitat.
Advertisement
Washington state designated the spotted owl as endangered in 1988 and the federal government listed the bird as threatened under the Endangered Species Act in 1990.
The latest plan for reversing losses at The Washington Post prompted the departure of its top editor, while raising questions about CEO Will Lewis, whose plan was cobbled together during months of discussions with owner Jeff Bezos. The plan itself remains largely a mystery and what little has been revealed isn’t reassuring.
When Bezos bought the Post for $250 million in 2013, the Amazon founder sought to assure staffers and customers that “the values of The Post do not need changing.” Bezos has consistently championed editorial independence since then, and has accepted the financial and reputational risks of owning a publication dedicated to covering politics and government.
Despite former President Donald Trump’s efforts to punish Amazon for coverage in the Post that he disliked, Bezos has never publicly complained about the Post’s critical coverage of the White House or of Amazon and himself.
Few questioned whether Bezos, whom Warren Buffet had called “the ablest CEO in America,” could fix the Post’s business. Under the Graham family’s leadership, the company had remained profitable by cutting expenses, but it lacked the resources to invest in the Post’s future. So, it was sold to Bezos, who promised the money and patience needed to ensure a turnaround.
Advertisement
Amazon founder and Washington Post owner Jeff Bezos delivers remarks during the opening ceremony of the media company’s new location January 28, 2016 in Washington, DC.
Chip Somodevilla/Getty Images
But after a decade of investing in technology and expanded coverage, the Post says it lost $77 million in 2023 and that it has lost half its audience since 2020. The losses have continued this year. The results are consistent with those reported by other large urban publications.
Under Bezos and the Grahams, The Washington Post has sought to compete with The New York Times. It frequently does so editorially—it was awarded three Pulitzers this year and was a finalist in three other categories—but not as a business. The Times had net income of $232 million in 2023, up from $65 million in 2013. More impressively, at the end of 2023, the Times had 9.7 million digital-only subscribers, compared with only 760,000 digital subscribers a decade earlier. Acquisitions including The Athletic and Wirecutter, together with expanded sections devoted to recipes, gardening, and puzzles have buttressed the Times’ news coverage.
“While there may be a global audience for The Post’s coverage of politics, it is unclear what else readers outside the Beltway will pay for.”
Advertisement
Lewis announced on June 3 that Matt Murray—former editor in chief of The Wall Street Journal—had replaced Executive Editor Sally Buzbee, and that Murray would serve as interim editor through November’s presidential election. Murray will then lead a new unit, reportedly focused on local service journalism, and Robert Winnett—deputy editor of London’s Telegraph Media Group—will become the editor responsible for core coverage, including politics, international investigations, and business news.
The Washington Post Building at One Franklin Square Building on June 5, 2024 in Washington, DC.
Andrew Harnik/Getty Images
Anguished editorial staffers questioned Lewis about Buzbee’s departure, and also about reports that surfaced following the announcement that Lewis had sought to kill stories in the Post and on NPR about allegations of improper behavior years earlier, while working for Rupert Murdoch in London during Britain’s notorious phone-hacking scandal.
Lewis denied the allegations, but may have made matters worse by questioning the NPR writer’s integrity. The New York Times and others reported he also questioned Buzbee’s competence for thinking the allegations newsworthy.
I don’t know Lewis and I have rarely spoken to Bezos since TIME named him its Person of the Year in 1999. It may come as a surprise to journalists, but Bezos—like other billionaires I have known or worked for—doesn’t like losing money. Bezos’ net worth is close to $200 billion, but he has no interest in funding Post losses for the next 2,000 years, or, for that matter, the next 2,000 days.
Advertisement
Like other billionaires, Bezos has diverse interests and he has rarely been a visible presence in the Post’s newsroom. He has also shown a penchant for relying on his instincts. He chose Fred Ryan, Lewis’ predecessor, on the recommendation of Jean Case, a friend and a former technology executive.
Lewis reached out to Bezos last fall while in London trying to line up financing to buy his old newspaper, the Telegraph. He has told friends that Bezos turned him down, saying that owning one money-losing publication was enough. Lewis has said Bezos then encouraged Lewis to speak to Patty Stonesifer, an Amazon board member who was running the Post while leading the search for a permanent CEO to succeed Fred Ryan.
The Post is one of many investments that require Bezos’ attention. He remains executive chair of Amazon, the company he founded that now has more than 1.5 million employees and annual revenues of more than $500 billion. He has invested in Uber, X (formerly Twitter), Business Insider, and Airbnb, as well as several private companies, including Blue Origin, an aerospace and defense company, and he has launched philanthropic organizations, including the Bezos Earth Fund.
Bezos and Stonesifer retained Sucherman, a well-regarded advisory firm to vet Lewis and other candidates for the job. Even if concerns about substance and style had surfaced, it is unlikely they would have deterred Bezos from hiring Lewis. Amazon has never shown an aversion to managers with sharp elbows.
Matt Murray, named as a new top editor of The Washington Post, pledged to lead a new era of innovation during a staff meeting Monday, June 3, 2024. The meeting that turned contentious when employees peppered publisher and CEO William Lewis with questions about the abrupt replacement of executive editor Sally Buzbee
Advertisement
Robert Miller/The Washington Post via Getty Images
When Bezos announced Lewis’ appointment several weeks later, he said he thought Lewis was “an exceptional, tenacious industry executive whose background in fierce, award-winning journalism makes him the right leader at the right time.”
While a renewed emphasis on service journalism and local news makes sense, separating service from news does not. The Post had a separate newsroom for digital for several years. It did little to improve its fortunes, and Marcus Brauchli, who served as executive editor from 2008 to 2012, made consolidating the newsroom a condition of his taking the job.
In my opinion, Matt Murray should be responsible for both newsrooms, while keeping the editorial and opinion pages under the control of David Shipley. Bezos should also review the recent decision to kill the Post’s Sunday Opinion section and the Post’s weekly magazine. While neither seemed attractive to advertisers, both were valued by readers accustomed to paying for content. While there may be a global audience for the Post’s coverage of politics, it is unclear what else readers outside the Beltway will pay for.
Bezos was right to keep his Post purchase separate from Amazon and he deserves credit for never asking the Post to do anything at Amazon’s behest. His desire to serve readers’ needs, however, would have benefited from Amazon’s experience with customers. Why not offer Amazon’s pharmacy and other services to Post subscribers?
If Bezos is serious about making The Washington Post profitable, he will need to reduce the number of journalists on staff from its current level of about 1,000 employees. I cannot say by how much, but it will be hard to reconcile the new number with Bezos’ stated commitment to quality.
Advertisement
Norman Pearlstine led newsrooms at The Wall Street Journal, Time Inc., when it published more than 150 titles, and The Los Angeles Times. He also held senior editorial positions at Bloomberg LP and Forbes and is the author of OFF THE RECORD: The Press, the Government, and The War over Anonymous Sources.
BLUESTEM, Wash. — Two men died in a helicopter crash in eastern Washington state, authorities said.
Lincoln County Fire District 6 Chief Brandon Larmer told KREM-TV that the helicopter had two people aboard when it crashed Wednesday afternoon.
The men who died were identified Thursday as 68-year-old Ryan Sandvig, of Spokane, and 63-year-old Mark Manteuffel, of Coeur d’Alene, Idaho, according to the Lincoln County coroner.
The Robinson R-44 helicopter went down near Bluestem, Washington, according to the National Transportation Safety Board. The agency, along with the Federal Aviation Administration, is investigating.
