How Equifax Missed Its Chance to Prevent the Massive Hack

Podcast on Apple Podcasts, SoundCloud, and Bloomberg dot Com. Well, there's a debate over the National Flood Insurance Program in the wake of the damage by Hurricanes Harvey and Her and Irma, and here to explain exactly what the program does and its future is David Sampson. He is the chief executive of the Property Casualty Insurers Association of America and he's also the former Deputy Secretary of the U. S Department of Commerce under George W. Bush. David Samson,

thank you for being with us. Can you just describe for people what is the National Flood Insurance Program, how does it work, and what are some of the challenges it faces. Well, the National Flood Insurance Program is in existence because your regular homeowners or business policy UH doesn't

cover flood insurance. That dates it dates back to the nineteen sixties where there was problems with flood maps and and UH being able to underwrite flood risk, and so the National Flood Insurance Program was created UH in the nineteen sixties as a supplement to your regular homeowners policy, and we emphasize all the time with homeowners and business owners that your regular policy doesn't cover flood, and to be covered for flood, you need to buy that that

separate policy. UM. The policy UM no pun intended is underwater. It's twenty five billion dollars UH in debt. It's not run on an actuarily sound basis UH like your private sector infurence insurance companies would be required to do. The premiums are heavily subsidized by the taxpayer, and as a result of that, after Katrina and UH Sandy, the program is now about twenty five billion dollars in debt. So there's a lot of discussion in Congress about what reforms

need to be made to the program. It was set to expire September UM we supported a um an extension of that in the wake of Harvey and IRMA. It's now extended through December eight, but long term, there needs to be a discussion in Congress about how to put that program on more sound financial footing. David, you represent about a thousand companies that of the US is home, auto, and business insurance. I'm wondering what rule they could or would be willing to lay. In the flood insurance market.

Do you expect that there will be some kind of convergence of public and private insurance plans to cover flooding, especially as the expectation for these types of storms increases. Yeah, well, there's always going to be a need for a federal backstop for the flood insurance. So I think there's going to need to be a long term reauthorization of the flood in National Flood Insurance program. But clearly there is increasing appetite in the private sector among private insurers and

reinsurers UH to write some flood coverage. The flood mapping technology is much better today than it was in nineteen sixty eight. You can just imagine the advances there UH,

and UH underwriting is much more advanced. Insurance underwriting is more advanced today than it was in the nineteen sixties, and so we do think that there is financial capacity out there and appetite among UH insurers, some insurers and reinsurers to take on some of this risk and to be able to take some of the risk away from the federal government and the and the federal taxpayer. David Sampson, what is being done or what can be done to avoid the scams and the frauds that are perpetrated on

people who are rebuilding their lives, their homes and their neighborhoods. Well. Uh. First of all, the insurers number one priority right now is getting checks into the hands of policy holders to get families back in their homes and cars back on the road and businesses opened again. UM. We're surging um an army of claims adjusters into uh Florida just as soon as the local officials UM uh say it's safe to get back in and allow us in. But consumers

need to be very uh, you know, careful. The first thing that consumers need do, UH is to call their insurance agent or their insurance company, report the damage, photograph, take video of all household items that are damaged or

destroyed in the storm. Unfortunately, we know that there are some bad actors who prey on storm victims, and so we encourage folks to be very very careful of riffing companies or contractors or restoration companies that just come walking down the neighborhood and UH put pressure on people to sign to sign a contract right now and tell them that if you don't sign up right now, you're gonna be at the back of a line. UH. Consumers need to be very very suspicious of that kind of activity.

Check professional references, be sure you before you sign a contract, be sure you know the scope of the work that they're going to do, the time frame, the cost um. And the good news is today that a lot of insurers are deploying a lot of technology to make it easier for policy holders to file their claims. There's mobile apps, there's online applications. Insurers will be using drones in Florida

to try to assess rooftop damage. UH. And you can always ask for good references from your claims adjuster as well.

David Samson, thank you so much for joining us. David Sampson is chief executive Officer of the Property Casualty Insures Association of America, also the former Deputy Secretary of the U. S Department of Commerce under George W. Bush, and he has based in Washington, d C. Equifax has been in the news, shares dropping further today, bonds as well falling after they specified that they had a particular software vulnerability that they knew about or were warned about before their

whole system was breached and one hundred million US consumers data we were exposed and potentially put into the hands of mallet intended people. Jordan Robertson joins us now his technology reporter for Bloomberg News, as well as Viny Troy, a chief executive officer of night Lion Security in St. Louis. Jordan, can you just set this up for us? What is the latest development in this story and how damaging is

it for Equifax? Sure, as everyone knows by now, Equifax was the victim of a breach that affected you know, more than a hundred and forty million people social security numbers and other details of their consumer credit accounts. And what Equifax announced last night was it confirmed some earlier reporting that had gotten out that it was The way the attackers got in was through a particular software vulnerability UH in software used to build websites. Many large companies

use this. It's called Apache strut software. It's open source software UH and the key thing about this software is that there was a critical vulnerability in it, but that vulnerability was patched or it was fixed, was two months ago, but Equifax apparently didn't apply that fix by the time the hackers got in in mid May. There's a caveat there, though, is that many organizations take you know, can take weeks even months to apply patches. However, uh, you know, for

critical vulnerabilities like this one. Uh, you know, that's that's an off a long time and and Equifax is going to take some heat, uh you know, and have to answer some questions about you know, what caused that delay. Well, the stock of equifaxes down another one percent after falling more than fourteen percent yesterday. If any Troy, maybe you could describe for us if you went to visit Equifax,

what would you see. Would you see a you know, the most modern, the most up to date and secure cyberg prevention facility, or just see people that are racing around to try to put their fingers in the dike? Yeah, I mean, you know, and I could tell you kind of firsthand. I mean, Equifax had recently, you know a number of job postings um regarding you know, different security

positions that they were looking for. And I mean I know firsthand some of employees over Equifax that had a number of legacy systems, all these kind of um legacy means old in technology speak, right, Yeah, that's all right. So they had all these old systems with you know, basically there's all these different technology stacks running around there, and they were trying very hard to consolidate them all. But many of those systems, from what I understand, simply

we're going unchecked or unpatched. You know, they weren't updated for any of these critical vulnerabilities, and they were just left to kind of, you know, fend for themselves. And I think that's the problem. You know, that's where we ended up today. Vinny. What was the motivation behind not patching up these problems? Was it motivated from saving money or was it just simply that the problem didn't seem that urgent. I don't, to be honest, I don't. I

think it was just a lack of resources. I mean, when you have all these different systems, with all these different technology stacks and not enough people to maintain them. I mean, I know they were in progress to try to consolidate all of them, so that they could maintain them all. Um, but I just don't think they were caught up to that point yet, Vinnie. I'd love to get a sense of how widespread this lack of taking

care of business is among big corporate America. Are there other companies that have similar problems and vulnerabilities that aren't being patched simply because they don't know the resources or they're trying to do too much with too little. I mean, I think this applies to everybody. I mean, I don't think there's a large company out there that I've seen that doesn't do this. Um. You know, lack of good security resources is a is a very widespread problem right now.

And organizations, I mean even if sometimes even if they are willing to spend the money, just can't find the people to do the work. I mean, there's definitely a shortage of good security people right now. Jordan's speak to the issue of the response on the part of Equifax, because there have been stories that the website tool that would let consumers see if their individual information had been breached,

uh doesn't work. Also, I understand for there's been a directive that was sent out by the Federal Trade Commission earlier today saying that there are now scammers. There are people impersonating credit bureau staff. They are calling people telling them that they are from Equifax looking to verify their account information, and the FTC says, don't tell them anything. No one from Equifax is going to call you. What

have you learned? Yeah, you know, my assessment is Equifax is really blown it when it comes to the response to this breach. You know, people feel very vulnerable when this type of information leaks. Uh. You know, as you mentioned Equifax's website for trying to determine if you you know, were affected, Uh, it really didn't seem to work. People punched in all kinds of random characters and codes and still got responses back that they will breach. It didn't

seem to be like a very functional website. You know. In addition, Equifax originally had a language on that website saying, you know, if you sign up for these protections and if if you are a victim, you know, you remove all rights to sue the company in any class action suit. And on top of that, the thing that really kind of sticks in my cross is, you know, when companies get breached like this, there's a very standard response. There's a playbook now, which is, you know, you offer people

a year or two a free credit monitoring protection. These are paying These are pay services that normally cost uh, you know, fifteen dollars a month. Uh, you know, and that that shields companies from liability. In other words, if you can't prove damages and you can't prove you were harmed, and the company says, hey, we offered these slee protections,

then you can't sue. So it's illegal. Is illegal shield What Equifax did in this case is they didn't go with a third party company to provide that service all clear ideas a big company that does this LifeLock and others. They went with their own service. They're signing people up for for credit fraud monitoring, you know, from one of their own services, which you know, in theory at the end of the year, which is their their their monitoring period, you know, they're going to try to sign you up

for the service. You're already of the database. It's very cynical. I understand why the company would do it. Uh, you know, it's a service under their control and they can they can account for that. But from a public relations and a perspective, a perception standpoint. You know, it's really it's it's deeply cynical to be a victim of their breach and then have to go sign up for one of

their services. Indeed, well, I know you're gonna be following this story because it is nowhere near over talking about Equifax and a hundred and forty three million US consumers whose specific information, whether that is social security numbers, addresses, passwords, user ID numbers, have been breached. I want to thank

you very much. Jordan Robertson. Robertson is our technology reporter for Bloomberg News, joining us from our Washington, d C. Bureau, and you can follow Jordan's at Jordan's are one thousand on Twitter. And our thanks also to Any Troya, the chief executive of of night Lion Security. They're based in St. Louis. The Sheepa Corporation, the struggling Japanese conglomerate, has been trying to sell it's immensely valuable microchip business to a group

of American and Japanese buyers. Bain Capital has emerged as the leader, along with some other investors that are contributing money. And now we're getting news that Apple maybe joining that particular team to bid on this business. To discuss more, I want to bring in Alex Sherman, Technology Media and Telecom m and a reporter for Bloomberg News, as well as an On Street of Austin senior semiconductor and hardware

analyst for Bloomberg Intelligence. Alex, let's start with you. Is this a surprise Apple is joining this and what would be the structure of this arrangement. I don't think Apple joining it is necessarily. The surprise is they've been sort of hovering around this process the the you know, for

months and months. What's the surprise might be the number that they're thinking about investing in this Bain consortium, which we broke the story yesterday that they're in talks to invest about three billion dollars maybe even a little more um in Toshiba's memory chip business. The strategic logic here is simply that these chips are in iPhones, so you know, they their flash memory chips that store photos and video

clips and augmented reality. So Apple has a you know, has a big reason to to to to want to have control over the future of these chips and not to lose them um or at least lose pricing power over them. However, you know, three billion dollars that may not seem like a lot to Apple. You figure, what Apple has two hundred and sixty one billion dollars of cash on their balance sheet. What's three billion dollars? But Apple does not have a big track record of doing

investments in M and A like this. In fact, the largest deal they've ever done was the three billion dollar deal for Beats a few years ago. Uh and this may actually exceed that. So really, if you put it into those terms, it would be Apple's largest acquisition slash investment. Ever, I want to bring it on entrene of us and on speak to the actual hardware and semiconductor aspect. That is the technical sort of situation and the value that

this company has to to Apple and to Bain capital. Look, this is supply sourcing, right, so you moreant to lock up as many components of your supply in clear way as possible for as long as you can, so to the extent that you can relieve. The financing situation of a of a key component of yours is a wind for Apple in so far it's a commodity, right, So the fact that they're able to get a long term view on commodity clear sourcing. On a long term view, it's a wind for It's a wind for Apple. Yeah one.

But if you step back and look at the longer room carn text of Apple, Apple is fast becoming one of the largest semiconnector companies. To the extent that it's logic chips, highly differentiated chips with their substantial intellectual property, Apples designing and making those chips. To the extent that it's a commodity, it is trying to show up supply agreement. So depending on the value of that component in the

Apple food chain, Apple staking different steps. You know, given the importance to Apple of this business and that it's trying to lock up its supply chain, it is a commodity. I have to wonder, Alex, are there any other competing bids that could even be floated that could rival this composite bid that now includes Apple. Uh sure? So there have been there are three bits around this, and there

have been three bits around this for some time. Although the bit players have shifted, the biggest hurdle for a deal to get done here still is the presence of Western Digital which feels like it has some legal rights to the Toshiba memory chip business through a deal it

did with sand Disc a couple of years ago. So Western Digital has paired with KKR for a competing bid here and sort of continues to threaten UH litigation if in fact Toshiba decides to go with any other consortium in the bank consortium seems like the most likely one I mentioned earlier. Apple had been hovering around this for

a while. Initially, Apple actually back to bid from a consortium led by fox Con, which of course makes iPhones, But it became clear over the past few weeks that there was very strong political opposition, Japanese opposition towards fox Con winning a bid um given UH, you know, fox CON's presence in China and Taiwan and the political implications of losing a a gold star business like this UH and and and setting it over from Japan to a sort of you know, Chinese Taiwanese business UH that didn't

fly plow. So. So a couple of things that interesting. One is the deal price is very high. If you wanted the maximumount of money, you would have gone with han Hi. Obviously, the China Japan venture doesn't fly so easily. Western digitals interested in this in the Toshiba stake where sandsc It's acquired entities already a JB partner. Is also

about supply. Remember that the flash memory business is relatively consolidated with Samsung with share, so Toshiba sandes because the next in the in the thirties, so that wouldn't have flown that easily. So this is all about shoring up supply.

And the reason Apple is important is because they consume of nan memory supply and too Man thanks very much on answer us and our senior semi conductor hardware analysts for Bloomberg Intelligence and alex A. Sherman M and a reporter for Bloomberg speaking about Apple, Bain Capital and a

potential acquisition of Toshiba's chip business. Can we call upon Laura Litvin, our congressional reporter for Bloomberg News who can be followed on Twitter at Laura Litvin, l I t v A N and Laura maybe just begin with what was in the food last night? With the President's dinner with Nancy Pelosi, minority leader and the Bernard leader in the Senate, Senator Chuck Schumer. Were they eating from the same menu, because it seems as they came away with

two different versions of the meeting. Well, they apparently ate the same Chinese food at the meal, but they did certainly come away with very different representations of what happened. At least initially, UH. They seemed to pull a closure

together the UH. Senate Minority Leader Chuck Schumer and House Minority Leader Against Plosi said last night that they had a tentative deal with the President to marry UH protections against deportation for eight hundred thousand young immigrants brought whose kids with a worder security package, and they said there was an understanding there would not be funding for a

border wall as part of that. And then Trump this morning tweeted there was no deal UH, and but also tweeted in UH defending the young immigrants and the fairness of letting them stay here because their parents have brought them here. And then he later did make some comments to reporters where he said UH seemed to confirm the deal, and he said he wants to pursue a wall, but it would be later. The White House is really wrestling with this, though, they a White House spokes appointedly said

they will not be amnesty in this bill. Wanted to make that case this morning to reporters. Well, Laura, I want to also touch on President Trump's comments that he just made when he was on the tarmac in Florida. He talked about the wall being crucial important. If the wall doesn't get done, nothing gets done. Uh. You know, this is is clearly talking to his base, which has been expressing some uh dissatisfaction with his deals with the

Democrats recently. How realistic is it that he would come through on something like that and really kind of put the wall into some legislation. Well, I he's if you really look at it, he's not really saying necessarily has to be done this year or at this time when

he says that we're going to do a wall. Um. And but the fact is the fact that he keeps seeming to send different messages to people, and the fact that he's under pressure and is even being attacked by bart news headlines today that say he's amnesty don and is being attacked by tweets by uh conservative Republican Steve King in the House. These things are a lot of pressure and it makes people wonder where this is going and if things could fall apart, and um, there's some

prospect for that. But I did notice today that Republican leaders in the Senate, two of them told us that they do see some potential in doing something that marries um, what's called DOCCA, the Deportation Order, the protections that Obama put in place with a strong border security bill. Um. They said, there's negotiating to be done, but there's some

possible uh, you know, some possible agreement here. Well, we know that the President is also speaking in Fort Maris, Florida, as you mentioned, arriving to check on the reconstruction and the rescue operations related to Hurricane Irma. Do many Republicans, Republican senators who are represent the border states, do they really want this wall? Uh? No, there's been opposition from

border state lawmakers about a wall. Um. There's been a real effort by members like John Cornyn from Texas, Republican leader and the House Homeland Security Chairman might call both are from both from Texas. Both have really pushed the president very hard behind the scenes to treat levies that are down along the Rio Grand River as a wall and to put more money into those and then just move on to other things like fencing technologies, other things

that are needed. Um and you know there there may be some potential with the storms for Trump to pivot and do and call that a wall. We'll have to see how that comes together. You know, it's interesting. I'm wondering what President Trump's relationship will be with fellow congressman. There was quite an amazing Twitter post by Senator Chuck Grassley which is as uh one news outlet put in a post modern work of art um all in sort of acronyms. Morning News says, you made a deal with

Schumer and Dacca. Have you have your staff brief me? I know you undercut jud commission. It's like all not English effort for by party agreement is their dissent in just ten seconds. Do you think that Republican congressmen are getting sick of President Trump's working with Democrats. I think they're concerned about it. Uh In. Grassley is the chairman of the di Ugiciary Committee with with jurisdiction over this and seemed to be taken completely by surprise, and that

particularly is undercutting Trump's relationship with many of them. Thank you so much for joining us. Laura Litvin, Congressional reporter for Bloomberg. We will bring you more as we get it. At President Trump today, kind of giving some mixed messages trying to figure out how to move forward on the data issue. Thanks for listening to the Bloomberg P and L podcast. You can subscribe and listen to interviews at Apple Podcasts, SoundCloud, or whatever podcast platform you prefer. I'm

Pim Fox. I'm on Twitter at pim Fox. I'm on Twitter at Lisa Abramo. It's one before the podcast. You can always catch us worldwide on Bloomberg Radio