NUCLEAR INDUSTRY - Nuclear Ore Extraction

"Residents in the Southwest struggle with the health effects of nuclear ore extraction" PBS NewsHour 8/8/2022

Excerpt

SUMMARY:  Residents of the Southwest including many Indigenous people have for years been exposed to high levels of radiation from uranium extraction and refining, a toxic legacy from the Cold War's weapons program and nuclear power generation.  Stephanie Sy reports in partnership with investigative news outlet ProPublica on a community’s fight for survival and to hold a company and government accountable.

PROPUBLICA - Homestake Uranium Mills

"A Uranium Ghost Town in the Making" Propublica 8/8/2022

ProPublica is a nonprofit newsroom that investigates abuses of power.  This piece was originally published in The Weekly Dispatch, a newsletter that spotlights wrongdoing around the country.

The “death map” tells the story of decades of sickness in the small northwest New Mexico communities of Murray Acres and Broadview Acres.  Turquoise arrows point to homes where residents had thyroid disease, dark blue arrows mark cases of breast cancer, and yellow arrows mean cancer claimed a life.

Neighbors built the map a decade ago after watching relatives and friends fall ill and die.  Dominating the top right corner of the map, less than half a mile from the cluster of colorful arrows, sits what residents believe is the cause of their sickness: 22.2 million tons of uranium waste left over from milling ore to supply power plants and nuclear bombs.

“We were sacrificed a long time ago,” said Candace Head-Dylla, who created the death map with her mother after Head-Dylla had her thyroid removed and her mother developed breast cancer.  Research has linked both types of illnesses to uranium exposure.

Beginning in 1958, a uranium mill owned by Homestake Mining Company of California processed and refined ore mined nearby.  The waste it left behind leaked uranium and selenium into groundwater and released the cancer-causing gas radon into the air.  State and federal regulators knew the mill was polluting groundwater almost immediately after it started operating, but years passed before they informed residents and demanded fixes.

The contamination continued to spread even after the mill closed in 1990.

The failures at Homestake are emblematic of the toxic legacy of the American uranium industry, one that has been well-documented from its boom during the Cold War until falling uranium prices and concerns over the dangers of nuclear power decimated the industry in the 1980s.  Uranium mining and milling left a trail of contamination and suffering, from miners who died of lung cancer while the federal government kept the risks secret to the largest radioactive spill in the country’s history.

But for four decades, the management of more than 250 million tons of radioactive uranium mill waste has been largely overlooked, continuing to pose a public health threat.

ProPublica found that regulators have failed to hold companies to account when they missed cleanup targets and accepted incorrect forecasts that pollution wouldn’t spread.  The federal government will eventually assume responsibility for the more than 50 defunct mills that generated this waste.

At Homestake, which was among the largest mills, the company is bulldozing a community in order to walk away.  Interviews with dozens of residents, along with radon testing and thousands of pages of company and government records, reveal a community sacrificed to build the nation's nuclear arsenal and atomic energy industry.

Time and again, Homestake and government agencies promised to clean up the area.  Time and again, they missed their deadlines while further spreading pollution in the communities.  In the 1980s, Homestake promised residents groundwater would be cleaned within a decade, locals told the Environmental Protection Agency [EPA] and ProPublica.  After missing that target, the company told regulators it would complete the job around 2006, then by 2013.

In 2014, an EPA report confirmed the site posed an unacceptable cancer risk and identified radon as the greatest threat to residents’ health.  Still, the cleanup target date continued shifting, to 2017, then 2022.

Rather than finish the cleanup, Homestake’s current owner, the Toronto-based mining giant Barrick Gold, is now preparing to ask the Nuclear Regulatory Commission [NRC], the independent federal agency that oversees the cleanup of uranium mills, for permission to demolish its groundwater treatment systems and hand the site and remaining waste over to the U.S. Department of Energy to monitor and maintain forever.

Before it can transfer the site to the Department of Energy, Homestake must prove that the contamination, which exceeds federal safety levels, won’t pose a risk to nearby residents or taint the drinking water of communities downstream.

Part of Homestake’s strategy: buy out nearby residents and demolish their homes.  Local real estate agents and residents say the company’s offers do not account for the region’s skyrocketing housing costs, pushing some who accept them back into debt in order to buy a new home.  Those who do sell are required to sign agreements to refrain from disparaging Homestake and absolve the company of liability, even though illnesses caused by exposure to radioactive waste can take decades to manifest.

Property records reveal the company had, by the end of 2021, purchased 574 parcels covering 14,425 acres around the mill site.  This April, Homestake staff indicated they had 123 properties left to buy.  One resident said the area was quickly becoming a “ghost town.”

Even after the community is gone, more than 15,000 people who live nearby, many of them Indigenous, will continue to rely on water threatened by Homestake’s pollution.

The company said it has produced models showing that its waste won't imperil the region's water if it walks away.  The NRC says it will only grant a groundwater cleanup exemption if that’s the case.

But while Homestake and other mining companies have polluted the region, it’s been the NRC and various other agencies that stood by as it happened.  ProPublica found the NRC has issued exemptions from groundwater cleanup standards to uranium mills around the country, only to see pollution continue to spread.  This has occurred as climate change hammers the West, making water ever scarcer.

“Groundwater moves.  Groundwater doesn’t care about regulations,” said Earle Dixon, a hydrogeologist who reviewed the government’s oversight of uranium cleanup and pollution around Homestake for the New Mexico Environment Department and the EPA.  Dixon and other researchers predict contamination at Homestake will likely spread if cleanup ends.

The company has denied that its waste caused residents’ illnesses, and judges ruled in Homestake’s favor in a case residents filed in 2004 alleging the site caused cancer.  Doctors testified that the pollution was a substantial factor contributing to residents’ cancers, but tying particular cases to a single source requires communitywide blood, urine and other testing, which hadn’t been done.

“We are proud of our work done in remediating the Homestake Uranium Mill site,” Patrick Malone, Homestake's president, said in a letter responding to questions from ProPublica.  He said Homestake was entering the final stages of cleanup because “the site is at a point where it is not technically feasible to provide additional, sustainable improvements to water quality.”

David McIntyre, an NRC spokesperson, attributed cleanup delays to the area’s complex groundwater system.  “We understand and share the concern that remediation is taking so long,” McIntyre said, adding that the agency’s priority is to protect public and environmental health rather than meet particular deadlines.

The EPA has oversight of the former mill’s cleanup under its Superfund program that aims to clean the country’s most toxic land.  The EPA regional office did not respond to questions.

Larry Carver has implored an endless stream of regulators to take action since his family moved to Murray Acres in 1964, and neighbors defer to him to tell the community’s story.  The 83-year-old leaned against his Chevrolet pickup on a blustery spring morning, peering from beneath a baseball cap at Homestake’s 10-story pile of waste.  He lamented that the community would be sacrificed so uranium waste could remain.

For Carver, arrows on a map don’t tell the full story of uranium’s impact.  His wife’s aunt and uncle owned the home closest to the waste piles.  Her aunt died of liver cancer when she was 66 years old, and her son, who grew up playing in unfenced waste ponds, died of colon cancer when he was 55 years old.  Now, Carver and his wife both have spots on their lungs, with hers recently requiring radiation treatment.

“All the houses are going to be gone.  The wells are being plugged.  The septic systems are being torn up,” Carver said.  “There will be nothing.”

Homestake Has Bought More Than 14,000 Acres Surrounding the Mill

Larry Carver, who has lived in his home since 1970, has refused to sell his property to the company.

“A Long Time to Keep the Secret”

Saturday, April 26, 1958, was a momentous day in the towns of Grants and Milan, New Mexico.

Full-page newspaper ads announced the opening of Homestake’s new uranium mill.  A military flyover kicked off the festivities, a high school band played, and the New Mexico secretary of state unveiled a plaque commemorating the occasion.  An estimated 6,000 people, nearly three times Grants’ population at the beginning of that decade, toured the mill, the local newspaper, the Grants Beacon, reported.  Grants would be the Carrot Capital of America no more.  It was running headlong into the Atomic Age.

But the celebration was short-lived: Less than a year and a half after operations began, state and federal regulators, with the company’s help, began investigating whether contaminants were leaking from Homestake’s waste.

ProPublica found that, as with most uranium mills in the U.S., Homestake built no liner between the earth and the sandy waste left over from milling, known as tailings.  This happened even though an engineer with the New Mexico Department of Health warned the company only weeks after the mill opened that it needed to at least compact the soil underneath its waste to prevent leaks.  Without a liner, pollution seeped into aquifers that supplied drinking water.  In 1961, the same engineer wrote that groundwater samples showed radium 226, a radioactive and cancer-causing element, at levels as much as 31 times higher than naturally occur in the area, indicating “definite pollution of the shallow ground water table by the uranium mill tailings’ ponds.”

A federal report a year later identified even higher levels of radium 226 in groundwater.

Residents drank that water, fed it to livestock and applied it to crops.  They weren’t told of the issue or supplied with bottled water until the mid-1970s, neighbors said.  “A long time to keep the secret,” Carver said.

The EPA in the 1970s found elevated levels of selenium, which can damage the nervous system at high doses.  Homestake disputes what levels of contaminants are attributable to the mill versus other sources, a question regulators are currently studying.  The company confirmed in 1976 that its waste had created a plume of contamination in the groundwater but waited another decade to connect residents to an uncontaminated water system, only doing so after pressure from the EPA.

Seventeen years after pollution was first detected, Homestake began a series of ultimately unsuccessful attempts to clean the groundwater.  The company pumped contaminated water out of aquifers and evaporated it aboveground, treated it in filtration systems and dumped hundreds of millions of gallons of clean water on the waste to flush uranium out of the pile, collecting the newly contaminated water for disposal.

Homestake was still left with more polluted water than it could process, so the company irrigated crops, applying more than 3.1 billion gallons to farmland in the subdivisions.  As a result, the topsoil contained elevated levels of uranium and selenium.  The state and the NRC halted the practice, which the NRC said the company had done without its approval.

Much of the now-fallow farmland has turned to dust that’s an incessant headache for residents.  Windstorms whip it up, piling it on roadways and pushing it through the slightest cracks in homes.  Regulators have issued dozens of violation notices to the company, including for failing to fence off contaminated land and for exposing workers to high uranium levels without alerting them.

At the state level, New Mexico regulators waited until 2009, 49 years after first finding water pollution, to issue a formal warning that groundwater included substances that cause cancer and birth defects.  They waited another nine years before barring people from drilling new or replacement wells in aquifers near the cleanup effort, but the order did not require existing wells to be plugged.  A spokesperson for the New Mexico Office of the State Engineer said authorities had issued a “relatively small” number of domestic or livestock well permits in the contaminated area.  That number, the spokesperson said, is 122.

Uranium exposure is pervasive in this part of the world.

Miners who worked before 1971, when the government was the sole purchaser of uranium, are eligible for compensation under the Radiation Exposure Compensation Act.  In June, President Joe Biden signed a bill postponing its expiration for two years.  But miners who worked in the industry after other uranium buyers entered the market, as well as residents of communities that were impacted by uranium extraction and processing, like those next to Homestake, still receive no benefits.  Spearheaded by the New Mexican delegation, bills pending before Congress would expand the legislation to include more miners and appropriate funds to study the health impacts of living near these sites.

Linda Evers is waiting on those reforms.  She worked in the area’s mines and mills, including Homestake, after the 1971 cutoff.  She stayed on the job through two pregnancies, removing trash from the ore until hours before she gave birth to her son.  Both her children have birth defects, and she now lives with kidney failure, cysts on her organs and a degenerative bone disease.

“You worked in a never-ending dirt storm,” Evers remembered.  “You were supplied a paper mask that was worthless in about 20 minutes.”

She also dealt with contamination at home.  For more than 15 years, Evers lived across the street from Homestake.  Her well water was so foul it stunted the plants in her garden, she said.  Evers eventually accepted the company’s buyout offer and moved to a new home farther from the waste.  A half-built greenhouse sits in her former backyard, her once-lively home stripped of its porch and part of the roof.

“I’m Just Left on the Ground to Seep”

Down the road, John Boomer doesn’t know where he’ll go if he sells to Homestake.  An artist who paints with a Southwestern palette of sand and soil, he lives in an art studio and home he shares with his partner, Maggie Billiman, a member of the Navajo Nation and fellow artist.

The consequences of uranium production are constantly on the couple’s minds.  More than 500 abandoned uranium mines pockmark the Navajo Nation, and Billiman’s father, a Navajo Code Talker in World War II, died of stomach cancer, an illness associated with downwind exposure to nuclear tests.  Boomer has written the story of uranium into lyrics, singing about the harm caused by the waste that was left behind.

Those corporate little creeps

Will cause many a widow to cry and weep

While I’m just left on the ground to seep

Homestake is working on requests to both the NRC and the EPA for groundwater cleanup waivers, arguing it’s done all it can to clean up the area.

The company excavated soil from more than 3,500 acres where wind had carried contaminants off-site.  Homestake also collected about 1.3 million pounds of uranium and 75,000 pounds of selenium by treating or evaporating more than 10 billion gallons of groundwater, according to company data.

Other uranium mines and mills polluted the area’s main drinking water aquifer upstream of Homestake.  Residents worry what will happen to contamination from those sites and from Homestake when the company halts its water treatment.

Homestake says it has built a hydrological model that shows the former mill’s contamination will stay close to the site.  (The model won’t be released until the company files its formal application for cleanup exemptions, likely in August.)

But researchers who have studied the hydrology around Homestake said the contamination will head downstream.  “Would it keep on moving? Yes, that’s nature,” said Dixon, the hydrogeologist.  The real question, he said, one that modeling can’t answer, is how quickly the pollution will migrate.

ProPublica identified sites across the West where regulators approved waivers based on modeling, only to later discover the predictions were flawed.

At a site in Wyoming called Bear Creek, the NRC found concentrations of uranium in groundwater more than 10 times higher than a model had predicted.  At a site along the banks of the Colorado River, in Rifle, Colorado, the NRC approved a cleanup plan based on groundwater modeling that predicted uranium would fall to safe levels within 10 years.  Monitoring showed concentrations remained dangerously high about a decade later, and new modeling predicted uranium levels wouldn't reach safe levels for more than a century.

There’s also the cleanup of another Wyoming mill named Split Rock, which Homestake has compared its site to as it seeks a cleanup exemption.  Regulators granted a waiver in 2006 after the responsible company presented a model showing contamination wouldn’t reach downstream wells for 1,000 years.  “The recent data, however, have shown results that are not consistent with the model predictions,” the NRC wrote seven years later.  Nitrates, which are sometimes used in the uranium refining process, were measured in a downstream monitoring well at more than four times approved limits.

McIntyre, the NRC spokesperson, said that in those cases, “NRC staff reviewed groundwater monitoring results and verified that the levels were and remain protective of public health and safety,” adding that the agency requires models used in waiver requests be conservative in their predictions.

Leaders of communities downstream from Homestake, including the Pueblo of Acoma, fear that wishful thinking could allow pollution from the waste to taint their water.  The Acoma Reservation, about 20 miles from Homestake’s tailings, has been continuously inhabited since before 1200.  Its residents use groundwater for drinking and surface water for irrigating alfalfa and corn, but Donna Martinez, program coordinator for the pueblo’s Environment Department, said the pueblo government can’t afford to do as much air and water monitoring as staff would like.

“There are always going to be concerns with the plumes,” Martinez said.

Most days, Billiman contemplates this “poison” and whether she and Boomer might move away from it as she prays to Mother Earth and Father Sky toward Mount Taylor, one of the four sacred Diné peaks, which rises just east of the subdivisions.

“I tell her, gosh, we did this to you.  I’m sorry,” Billiman said.  “Then, we just say ‘hózho náhásdlii, hózho náhásdlii’ four times.”

“All will be beautiful again,” Boomer roughly translated.

As they prayed one recent morning, the dawn light tumbled over the mountain, illuminating the nearby Haystack Mountain, where a Diné man named Paddy Martinez discovered economically recoverable uranium in 1950 and ignited the region’s mining boom.  The light cascaded over Homestake’s tailings piles, across the valley and onto the five subdivisions.

“Doing It Right… …Right to the End”

The smell of pizza wafted through a Village of Milan government building down the road from the mill site, as about 20 locals trickled in to meet with Homestake one April evening.  They caught up while JoAnne Martinez, a community liaison for Homestake, beseeched them to tuck into the food she had set out.  A map taped to the wall showed the location of groundwater contamination, and a stack of glossy booklets celebrated the company’s reclamation project with the slogan: “Doing it right… …Right to the end.”

Tensions rose when residents spoke about the company’s offers to buy their properties.  Homestake, whose parent company Barrick had nearly $12 billion in revenue last year, pays market value based on past sales prices of comparable properties, rather than the cost to replace what residents have, which is ballooning rapidly amid the housing crunch.  Over the past five years, prices for residential properties around New Mexico have increased about 59%, while they’ve spent about half as long on the market, according to data from real estate companies Zillow and Redfin, respectively.

In the meeting, residents explained what that trend, coupled with Homestake’s offers, has meant for their own housing searches.  “It’s like you spit on me,” one resident said of the company’s proposal to buy the property where she has lived for 61 years.  Another neighbor told ProPublica she had asked a builder to assess the cost of constructing a nearly identical home and got an estimate $60,000 higher than what Homestake offered.  But Homestake didn’t budge.

Neighbors have worried about Homestake’s impact on their property value for decades.  They filed a class-action lawsuit against the company in 1983 for alleged property damages, later settling the case for what they deemed to be small payouts.  In exchange, those residents agreed to release the company from further liability.

More recently, the company has rejected residents’ requests to move the waste to a lined disposal cell, which could prevent additional groundwater contamination and radon exposure and possibly allow them to stay in their homes.  So far, cleanup has cost more than $230 million, including about $103 million that came from taxpayers through the Department of Energy.  Homestake estimates it could cost as much as $2 billion more to move the entire pile.  Buying out five subdivisions is the cheaper option.

Homestake argues capping the site and walking away is safer, citing reports that conclude moving the pile would lead to at least one workplace traffic-related death and a high likelihood of workers and residents developing cancer.  The reports used calculations from the Department of Energy, which is moving 16 million tons of uranium waste off of a site in Moab, Utah.  The department’s report found it posed far less risk to workers than later estimates for Homestake.  Department of Energy staff said they could not comment on why there are such different risks for the Homestake and Moab sites.

As more neighbors at the meeting demurred about the company’s offers, Orson Tingey, a land manager for Homestake and Barrick, explained that the company has continued to offer the same rates for properties as it did before the COVID-19 pandemic to remain consistent.  “We know that doesn’t necessarily work for everybody,” he said.

“I Don’t Even Know How You Fight It”

Jackie Langford set a radon detector on her kitchen table and shooed away her inquisitive 12-year-old, who was more interested in talking uranium policy than finishing his homework.  She recalled when her family moved in a decade ago for her husband’s job.  No one mentioned the risks posed by Homestake’s tailings pile, which looms less than a mile away.Now, as a registered nurse tending to former uranium miners, Langford knows too much about the dangers.  When it’s inhaled, radon breaks down in the lungs, releasing bursts of radiation that can damage tissue and cause cancer.  Her patients have respiratory issues as well as lung cancer.  They lose their breath simply lifting themselves out of a chair.

Radon, the radioactive gas formed as uranium decays, poses Homestake’s main cancer threat to residents, according to the EPA’s 2014 study.  It is more concentrated in outdoor air near Homestake than in a nearby community with a former uranium mill that has fully covered its waste.

It hasn’t helped that the company has struggled to control radon emanating from its larger waste pile, exceeding federal safety standards each of the last six years, according to company readings reported to the NRC.  This year, Homestake requested permission to add a new cover to the pile to reduce radon emissions, which the NRC is now reviewing.

During the pandemic Langford and her family began thinking more about Homestake’s possible impact on their respiratory health, driving them to buy a radon detector.  The gas can seep into buildings through cracks in foundations.  Indoor radon exposure is the second-leading cause of lung cancer in the United States, behind smoking.

When Langford measured levels in her home, the radon detector registered 4 picocuries per liter and rose as high as 7 pCi/L, she said — levels high enough that the EPA recommends remediation.

She brought her concerns to Homestake, but “for the longest time, they wouldn’t talk to me,” she said.  The company eventually connected her with one of their consultants, who told her not to worry because his own home tested above 4 pCi/L and the results did not concern him.  He also told Langford, as well as ProPublica, that he is not a radon expert and suggested she complete a longer-term radon test and contact people better versed on the topic.

In 2010, before Langford moved in, EPA contractors placed radon detectors in homes near Homestake and found unsafe radon levels in a dozen homes.

While independent researchers suggested the uranium waste could be a source of indoor radon, the EPA has not determined that is the case, instead identifying naturally occurring gas seeping from the soil.  The agency required Homestake to fund radon mitigation in homes but has not done any more radon testing or mitigation since.

“Best practice would be retesting at least every other year to assure things have not gotten worse,” said Michael Murphy, who is retired from the EPA’s indoor air quality team.

ProPublica spoke with eight households the EPA monitored, and all said they were never retested or advised to retest on their own.  An EPA staffer told one resident the agency had no plans to conduct follow-up studies.

Because the EPA did not return to test, ProPublica did, placing certified indoor radon kits in nine area households.  Three returned readings that exceeded the EPA’s threshold for mitigation, while a fourth registered above the World Health Organization’s lower suggested mitigation level.  Langford’s tests averaged 6.95 pCi/L.

She immediately thought about her son.  Children are more vulnerable to radon.

Early this spring, Homestake approached Langford and her husband with an offer to purchase their home.  They wavered.  The family loved the area and knew neighbors who had sold, only to find it impossible to buy a similar property elsewhere.

“I don’t think that’s fair,” Langford said, “but at this point I don’t even know how you fight it.”

With the results from their radon testing front of mind, Langford’s husband signed Homestake’s buyout deal.  The family had made a decision.  Their health was too important to remain in their home.

How We Reported the Story

Methodology:  To report on the Homestake uranium mill’s impact on the area, ProPublica worked with residents to crowdsource indoor radon levels, home purchasing contracts and health-related documents.

Radon Testing:  Indoor radon levels were collected using Air Chek 3- to 7-day radon test kits placed in nine houses in Milan and Grants, New Mexico.  Air Chek’s devices and laboratories are included on the National Radon Proficiency Program’s approved device and analysis provider list.

Radon levels vary day to day and season to season, so ProPublica followed EPA recommendations to conduct two sequential short-term tests.  A ProPublica reporter helped install the first test at each house to ensure the testing locations adhered to EPA testing protocols.  After about five days, residents took down each test and sent the kits to Air Chek’s laboratory.  Residents immediately placed the second Air Chek 3- to 7-day test in the same location.  About five days later, residents shipped the second test to the lab.  We averaged the results of the two tests to obtain an estimated indoor radon level for each house.

Three households were only able to obtain one result.  In one case, this was because a test was not properly sealed and could not be analyzed; in another, a test had a manufacturing defect; due to a shipping delay the third arrived at the laboratory beyond the necessary time frame for testing.  For these three households, we relied on the readings from one test.  Each of the households that received only one test showed levels below the EPA and World Health Organization thresholds for radon mitigation.

Before placing the tests, we interviewed seven professionals with radon testing expertise and reviewed the EPA and American Association of Radon Scientists and Technologists’ testing guidelines.  These independent experts reviewed ProPublica’s methodology and provided feedback.  After testing, ProPublica presented the results to the same experts.

We also discussed the results with residents of each household that hosted tests.

Outreach Methodology:  To interview as many households living near the mill site as possible, we mirrored community engagement efforts conducted by federal and state authorities during previous environmental health studies.  This included:

• publishing advertisements in the Cibola Citizen and Gallup Independent

• sending letters to every household in the area

• following up with phone calls and text messages to numbers associated with every area household

• door-knocking at households that did not respond to the ads, letters and phone calls

PROPUBLICA - Nonprofit College Spending

Baker College promises students a better life.  But few ever graduate, and even those who do often leave with crushing debt and useless degrees.  No one — not the board, nor the accreditors, nor the federal government — has intervened.

"The Nonprofit College That Spends More on Marketing Than Financial Aid" Anna Clark (ProPublica) and David Jesse (Detroit Free Press), ProPublica 1/12/2022

Baker College sells itself as a place where students thrive and lives are transformed: “a haven for those who dream big.”

From humble beginnings as a small business school in Flint, Baker rose to become the largest private college in Michigan, forging a presence in online learning and in Michigan towns where many students thought a college degree was beyond their grasp.  For decades, the school’s marketing touted low costs and employment rates of nearly 100% for job-seeking graduates — making the dream seem both affordable and achievable.

But for many the Baker reality is neither, an investigation by the Detroit Free Press and ProPublica found.

What the college’s ads don’t say is that less than one-quarter of its students graduate — far below the national average for private four-year schools, according to federal data.  Baker has the third-lowest graduation rate among 26 private four-year schools in Michigan.

The ads also don’t point out that 70% of Baker students who took out federal student loans have problems making payments two years after leaving college.  An exceptionally large number of former Baker students with loans have filed claims with the federal government that they were defrauded or misled by the college.

Nor is there mention of the Baker students who find themselves struggling long-term after leaving the school.  Ten years after enrolling, according to federal data, fewer than half of former Baker students made more than $28,000 a year, the lowest rate among schools of its kind in the state.

All this has occurred under the watch of a college oversight structure with unusually close ties to Baker’s leadership, the Free Press and ProPublica found.  The joint investigation relied on public records, internal reports and more than 50 interviews, including with current and former students, faculty and employees.

The president of the college, records show, serves on its Board of Trustees, which is supposed to provide a check on the decisions of the school administration.  And a retired Baker president served as chair of that board until very recently — at the same time being paid more than a million dollars from the college for five years of part-time work.

Education experts caution nonprofits against compensating board members, saying it can lead to decisions that are not in the best interest of students or the college.

“I’ve never seen the president of an institution become the chairman of the board after he retires,” said James Finkelstein, a professor emeritus of public policy at George Mason University who has studied higher education finances for decades.  “It certainly is not doing best practices by any stretch of the imagination.”

The new board chair is another longtime Baker executive who previously served as the institution’s top academic officer and a campus president.

Some former students have no regrets about their time at Baker; they’re grateful for a teacher or adviser who came through for them when they needed it.  “I think it is a great place for adult learners to engage,” said Jules Tarrant, who earned degrees from both Baker’s Flint campus and its online program.  Thanks to a scholarship, the school helped her transition from a tumultuous home life.  She now lives in Northern Virginia and manages a grocery store.  “My friends and family can’t believe how successful I’ve been,” she said.

But others express frustration after seeing what was supposed to be a life-enhancing experience become a lifelong financial burden.  They describe confusion about shifting academic requirements and a lack of career counseling.  Or dismay about not getting their degrees.  Sometimes, it’s pure anger.

After graduating from high school in 2013, Daniel Church pursued an ambitious bachelor’s/master’s degree program in computer technology at Baker but said the department began to lose faculty and fell into disarray.  Intent on sticking it out, he took out loans to stay in school and navigated unexpected graduation requirements.  Then, after six years, he gave up in defeat.

Today, Church drives a truck cross-country, with the hope that someday he can erase more than $30,000 he said he borrowed for a degree he never received.

“I will never get that time in my life back,” he said.

Baker officials, in response to questions, traced the school’s low graduation rate to its open enrollment policy of accepting virtually any applicant with a high school degree or GED.  They also said the college is not allowed to restrict student borrowing.

In a statement to reporters, Baker emphasized a continuing commitment to improving student outcomes and reducing student loan debt, though it did not provide specifics.  It did not comment for this story on the students or the experiences they described.

Bart Daig, Baker’s president and chief executive, talked to reporters last summer before declining additional interviews.  He said he believes Baker’s marketing efforts — costing $9.7 million in the 2019-20 school year, more than the college spent on financial aid — are necessary because its breadth of educational opportunities are not well-known.

“We’ve been extremely modest over the years,” he said.

Baker Spends More on Marketing Than Student Aid

In the 2019-20 school year, Baker College’s marketing spending outstripped what it devoted to financial aid.

In 2019, Chief Operating Officer Jacqui Spicer gave a rare response to critiques of Baker when residents in Ferndale, outside Detroit, pushed back against the college’s plan to move its main campus there.  Some complained at public meetings about Baker’s academic reputation and called the school predatory.

“Being predatory, I don’t think that’s the way in which we operate,” Spicer told a reporter at the time, adding: “We always put our students first, and I think it’s just disappointing people think that we’re predatory, because we really do have the students — they’re top of mind for us.”

Baker began as a for-profit school in 1911 but became a nonprofit in 1977, then entered a period of rapid growth.  Since the recession, however, enrollment has been in a tailspin.

Competition in the online education market contributed to the erosion, as did its own decisions to close five campuses, including those in historically industrial communities like Flint and Allen Park, while eliminating most certificate and associate degree programs.  It is now Michigan’s second-largest four-year private college by enrollment, after Davenport University.

The school’s search for a new campus signaled a major pivot, with Baker trying to appeal to more traditional students, especially those seeking bachelor’s degrees right out of high school.

After failing in Ferndale, Baker found a warmer welcome in Royal Oak, a well-off Detroit suburb, where it is building a $51 million flagship campus scheduled to open later this year.  The marketing strikes a familiar theme of hope, tailored to a new audience.  A YouTube ad highlights sophisticated labs and experienced instructors, along with disc golf, live music and sushi.

“Your path to your dream career begins at Baker College,” the ad declares.

Student Debt

Baker has long made affordability its selling point.  Full-time undergraduate tuition is around $11,000 a year, cheaper than most of the state’s other private colleges.

That makes Baker “quite attractive for students who are concerned over the cost of college,” Daig said.  One glossy ad champions a “quality education minus the long-term financial sacrifice.”

But most Baker students are low-income or the first in their families to attend college.  They often turn to federal and private loans to pay a large chunk of their costs.

“We can’t stop them from taking a federal loan, which — it is not within our authority,” Daig said.  “We can strongly encourage them not to do it, and we can package them with that institutional aid so they don’t need it.  But a lot of times, they took it.”

Several students interviewed for this story portrayed their interactions with the school differently, saying Baker officials didn’t urge caution.

Bart Bechtel said he took out more than $40,000 in student loans while pursuing an online associate degree, with encouragement from Baker — even though the amount surpassed what he needed for tuition.

Financial aid officers, he recalled, told him he was eligible, so he might as well take advantage of the full amount.  He said they talked about how he might need money for family expenses, his son and Christmas presents.

“We were going through a lot at the time with our son getting diagnosed as autistic, and Baker was very quick to suggest more and more financial aid to pay for things,” Bechtel said, referring to student loans.  “So we became sort of dependent on them for that.

“It was not a good time or situation, and I feel like they took advantage of that.”

Dan Nowaczyk, who graduated from Baker’s Flint campus in 2016, recalled students talking about the extra spending money they could get from loans.

Once, he said, some students were talking about aid disbursement and one asked the others: “How much money did you guys get back?”

Nowaczyk recalled saying that he took out only enough money for classes and books.  When the student said he came away with more than $10,000 beyond that, Nowaczyk said he felt obligated to tell him these were loans that had to be paid back — because the student didn’t seem to know.

“The financial aid department was not very good at explaining student loans,” he said.

Nowaczyk finished with a bachelor’s degree in information system security and $60,000 in debt, “less than I was expecting, so I’m not too upset,” he said.  He now works at Kettering University in Flint as head coach of esports.

Jacqueline Tessmer, who taught digital media at Baker’s Auburn Hills campus for 14 years, saw the Baker experience backfire for low-income students who weren’t prepared for college.  (Tessmer’s relationship with the school ended with a settlement after she filed a lawsuit for breach of contract and retaliation; in a countersuit, Baker disputed her claims.)

“Anybody got in,” she said.  “If they could get financial aid, and they had a pulse, you could become a Baker student.”

But getting in was no guarantee of success, she said, and retention was a constant problem in her program.  Students, she said, “were promised a better life but ended up with debt and no degree and no job in their chosen field.”

She added: “Baker College has ruined a lot of people’s lives.”

Low Earnings for Baker College Students

In its response to questions from the Free Press/ProPublica, Baker said financial aid award letters and loan request forms list each student’s maximum eligibility for federal loans, as regulations require, as well as “the reduced amount recommended to cover their institutional charges.  This was done to reduce over-borrowing.” The college also provides students with aggregate loan totals and estimated monthly payments.

Baker also noted that if students took out private loans, these were disbursed without the college’s “awareness or involvement.”

If students don’t repay federal loans after leaving Baker, the government can garnish their wages, tax refunds and Social Security benefits.  It can also hire collection agencies and file lawsuits to pursue payment.  Unlike other forms of debt, federal student loans are extremely difficult to discharge in bankruptcy.

For Baker, the loans pose no risk or obligation.  In fact, they provide a steady source of government-guaranteed revenue.

About 51% of Baker’s tuition revenue comes from federal student loans.  Add in Pell Grants given to low-income students, which don’t have to be paid back, and about 72% of Baker’s tuition is backed by taxpayers.

By comparison, in the years before it shut down following federal penalties for predatory practices, ITT Technical Institute, a for-profit college system, relied on federal funds for about 76% of its revenue.  Studies by several researchers have concluded that having a large percentage of tuition money coming from federal funds can be an indicator of a predatory for-profit school.

Davenport University, which Baker officials say is similar to their school, isn’t as reliant on public coffers.  Only about 37% of Davenport’s tuition comes from federal loans.  Including Pell Grants, about 49% of its tuition comes from the federal government.

Most nonprofit schools fundraise, seeking donations from successful alumni and others to reduce dependence on student debt.  Not Baker.  Its website states that “tuition is our sole source of income” — it doesn’t solicit donations.

Student reliance on loans can also be reduced through generous financial aid, often supported by college endowments.  And Baker, in fact, has a sizable one.

The Jewell Educational Fund, a nonprofit affiliated with Baker to help with financial aid and capital projects, has nearly $300 million in net assets.  That gives Baker a wealthier endowment than Kalamazoo College in western Michigan, Seton Hall University or Gonzaga University.

But it hasn’t lessened the need for Baker students to go into debt, because Baker hasn’t aggressively spent the money on scholarships.  Baker spends about 3% of the Jewell endowment earnings annually.  Davenport, with an endowment of about $28 million, has a policy to spend 5% of its earnings each year.

In search of relief, former students can file claims with the U.S. Department of Education, saying they were misled when they borrowed the money.  As of December 2020, according to data published by Yahoo Finance, of the 266 institutions with more than 100 “borrower defense” claims of deception, only five were nonprofits.  The rest are for-profits and “covert for-profits,” where the moneymaking mission is clearer.  “Covert for-profits” is a term that has been applied to colleges that very recently changed from for-profit to nonprofit, with little difference in how they actually operate.  Among the five nonprofits that had a high number of claims, three are shuttered colleges, and one recently regained accreditation 20 years after losing it.  The other is Baker.

Claims are not proof of wrongdoing, and Baker’s written response to reporters said the college has never been alerted to a successful application for borrower relief.  Students file the claims under penalty of perjury.  The Department of Education declined to answer questions about the claims against Baker, but it recently revived a borrower defense enforcement unit that had been dormant during the Trump administration.

Robert Niles, a former student with more than $83,000 in debt incurred while getting two associate degrees at Baker’s Cadillac campus, is preparing a borrower defense claim against the school.

He said he is citing Baker’s claims of 99% employment in the job market, which persuaded him to enroll because he believed it would give him his “best chance” at a better life.  He will contend the training he received was insufficient for more than changing oil on cars.

For about three decades, Baker ads cited a “graduate employment rate” of nearly 100%.  Its website, too, promoted this; it still claims “one of the highest available graduate employment rates in the country.”

When asked about the source for these numbers, Daig cited the National Association of Colleges and Employers.  However, NACE said it does not evaluate individual institutions.  It collects information that colleges self-report, often based on surveys.  It would not comment on Baker’s claims.  Baker’s public disclosure forms for certain programs say it calculates the employment rate using responses to a survey sent by the school to graduates.

It uses the same survey to estimate that its 2020 graduates with bachelor’s degrees make about $52,000 a year.

Niles first studied computer-aided drafting and design but said he couldn’t find a job in the field.  Hoping to enhance his earning potential, he returned to Baker for training in automotive services.  He graduated cum laude for both associate degrees.

But even with those credentials, he said, he earned just pennies more than what he had made previously as an auto mechanic intern.  After graduating, he had to study on his own to obtain certifications for the skills he needed to make more.  “It has nothing to do with any of those degrees,” Niles said.

One lesson from his time at Baker, he said, is this: “It’s just a business, you know.  I mean, all Baker is a business.”

College Structure

College presidents sit at the top of a management flowchart, but they do not typically operate without oversight.  Independent boards of trustees serve as a check on decision-making and a judge of performance.

Recently, for example, the president of the University of Michigan announced he will leave the job sooner than expected — a move that coincided with rising tensions with the school’s Board of Regents, which questioned how he handled the pandemic and sexual misconduct scandals.

At Baker, Daig, the president, is actually a trustee, too.  And the chair of the board through August was Daig’s predecessor as president, F. James Cummins.

Having ex-presidents as members of the board is a red flag, higher education experts said, because they are too closely tied to the operations of the college and their former colleagues.

“Essentially, this would make them their successor’s boss,” said Finkelstein, the higher education expert.  “Regardless of whether they are being paid as a board chair, a university employee or just serving as a volunteer, this seems to be a unique situation and runs against virtually any principles of good governance.”

Baker did not answer repeated questions about whether Daig voted as a trustee.  In its statements to reporters, Baker described its board as knowledgeable and involved, citing “constructive discourse and feedback.”

Meanwhile, the role of former president can be lucrative at Baker.  In every tax filing by the college since Cummins retired in 2016 and joined the board, he has been one of the school’s most highly compensated individuals.

Cummins’ compensation for 2019-20 was $202,000 for a reported 22 hours of work a week.  The tax filing said he played multiple roles, serving on the systemwide Board of Trustees and the Board of Regents, which provided guidance for branch campuses.  Some state and federal filings also list him in a “secretary” position.

Ed Kurtz was 26 years old and Baker was still a for-profit school when it hired him as president in 1968.  He led the school until 2002 and went on to serve about 13 years on Baker’s Board of Trustees, holding various titles, including chairman and vice-chairman.

During Kurtz’s time on the board — which overlapped with his two controversial stints as the state-appointed emergency financial manager of Flint — the college paid him more than $2.2 million for a reported 1 to 40 hours of work a week, for an average of about $170,000 a year.

Baker bylaws examined by reporters say that “no stated salary shall be paid to trustees, as such, for their services.”  The bylaws do permit payment to a trustee who works for Baker College itself.

Former presidents have served as board chair since at least 1986, according to Cummins in a 2006 Flint Journal story.

Their leadership roles can stretch for decades.  Robert Jewell, now 91, is a past president who owned Baker when it was a for-profit college.  On documents, he was listed as a member of the Board of Regents of the Muskegon campus as recently as 2019.  That year, the college paid him $10,450.  Jewell could not be reached for comment.  Baker said in its written responses that “Ed Kurtz and Jim Cummins received deferred compensation which was paid while serving on the board.  Also, the Board Chair is an employee of Baker College.”

Demetri Morgan, assistant professor of higher education at Loyola University Chicago, said this type of arrangement is problematic.

“Board members are supposed to be free of any real or apparent conflicts of interests,” said Morgan, who studies how colleges are run.  “Being a paid employee of Baker potentially impedes a board member from carrying out their fiduciary roles because the threat (perceived or real) of employment termination is more than enough to circumscribe one’s actions.”

Kurtz could not be reached for comment; Cummins declined to comment for this story.

Baker told ProPublica and the Free Press that as of Aug. 31 — three weeks after reporters asked questions about a possible conflict of interest — Cummins’ board tenure came to an end.

The new board chair is Denise Bannan, who retired in 2020 after 35 years as a top Baker executive.  She has been provost, vice president for academics, president of the Owosso campus and Baker’s liaison to its accreditors.  She made more than $300,000 in 2019-20, her last full year as an administrator, records show.

As for the other trustees, Baker doesn’t list them anywhere on its website or its student handbook — a potential problem for a student or anybody else who wants to contact the board with concerns about the way the college is run.  When reporters asked who the current board members were, Baker declined to provide a list and instead recommended looking in the organization’s tax filings, which provide information for 2020 but nothing more recent.

Experts in higher education governance who reviewed Baker’s bylaws questioned whether any real checks and balances exist at Baker.  “This is very atypical,” said Morgan.

So much so that when the Free Press/ProPublica asked Morgan to review Baker’s governance documents, he texted fellow researchers to see if they could think of any institution that was similar.  They couldn’t.

Baker’s nonprofit status gives the college tax advantages, wider access to gifts and government aid and the ability to promote itself as having a public service mission.

But, George Mason’s Finkelstein said, “this looks more like a legacy structure for a for-profit enterprise.  I have never seen a nonprofit college set up this way.”

Baker said its governance documents “have been and continue to be reviewed by accreditors, attorneys, accounting firms, etc.  The articles of incorporations, bylaws, and governance structure are the result of professional advice designed to enable Baker College to fulfill its mission.”

The Higher Learning Commission, a private accreditation agency, found no flaws in oversight when it gave its most recent stamp of approval to Baker in 2020.  “The Board operates independently,” it declared in its review.

The commission, which declined to comment for this story, based its conclusion on interviews and written documents, including the school’s bylaws.  It also cited the minutes of trustee meetings, which describe the proceedings tersely.

The meetings reviewed by the commission occurred during a time of some of the most significant changes in Baker’s 111-year history, including the decision to close and sell four campuses and build a new one.  Votes on all matters were unanimous.

Baker’s Many Incarnations

Baker prides itself on a long history of pivoting quickly and changing with the times.

As it grew, it began issuing not only certificates, but associate, bachelor’s, master’s and doctoral degrees.  It expanded by buying business schools and Bible colleges across the state, while also making inroads in new communities and then broadening further through online education.  In recent years, it bought a California-based online law school that it’s bringing under the Baker brand.

In 1999, Forbes applauded the college’s online efforts and revenue gains.  “Such growth is impressive given that it has been achieved despite a complete absence of state or federal funding — even any fund-raising,” the magazine wrote.

John Matonich, a former member of the Board of Regents for Baker’s Flint campus, said one thing he always admired was the school’s nimble approach.  “They recognized things pretty quickly, and they made changes when they needed to,” said Matonich, a retired CEO of Rowe Professional Services, a civil engineering consulting company.

Driven in large part by a massive online program, Baker grew from just shy of 4,000 students in 2000 to about 26,000 in 2015, dwarfing other Michigan private colleges.

Then, as more schools entered the online marketplace and demographic shifts meant fewer high school graduates, enrollment dropped.  It slid to about 6,000 students in 2020, according to federal data.  Enrollment for 2021 has not yet been reported.

Fewer students means less money.  The school brought in $96 million in tuition for the 2017-18 academic year, according to audited financial statements.  Two years later, it was $55 million.

This coincided with dramatic changes.

Baker shut down its campuses in Flint, Allen Park and Clinton Township in 2020, and will soon close one in Auburn Hills.  The Port Huron campus quietly ceased operations two years earlier.  Many campuses had received millions of dollars in recent renovations, including new dorms built at Port Huron three years before it closed.  Baker also closed extension campuses in rural communities.  A 2020 report delivered to accreditors affirmed that the school wanted to target “a more traditional student market that is academically prepared to succeed at the college level.”

Spicer told the Free Press in 2019: “We recognized that our business model wasn’t sustainable, and that’s one of the reasons that we’re making this shift.”  She also said the school had “a lot of students who were at-risk,” which went “hand-in-hand with how our campuses have historically operated.”

The change in strategy at Baker doesn’t sit right with everyone.

Cleamon Moorer Jr., a former administrator and faculty member, observed with dismay as Baker shut down campuses and sought to attract different kinds of students.

“I think it’s insulting.  I do,” said Moorer Jr., who served about three years as Baker’s first dean of a consolidated school of business.  “Because now it’s almost as if you’re blaming the students for your institutional failures.”

Students Lost in the Shuffle

Baker’s dismal graduation rate almost certainly has something to do with the “at-risk” students Spicer mentioned — people who may come from low-income backgrounds, who didn’t excel in high school or who are balancing school, parenting and a full-time job.“

Open enrollment institutions generally do not have high graduation rates,” Baker officials noted to reporters in a written statement.

But for many students, the biggest hurdles placed in their way came from Baker itself.

Baker often starts programs, then changes them, moves them or shuts them down before students finish.  It opened a campus in Reading, Pennsylvania, in 2016 that closed nine months later.

A common criticism among students is the lack of guidance once they begin school about everything from internships to graduation requirements.  Students said they were on their own to find required internships.  Baker once promoted “free lifetime placement service,” but recent graduates said they were simply referred to Handshake, an online platform.

“Baker College does have a Career Services department that continues to offer both current students and alumni assistance with social media profiles, resume writing, and career search and placement services,” Baker said in its response.

The department has four full-time and two part-time staffers.  Davenport, which has roughly the same student population as Baker, employs 12 people full-time.  It also makes use of Handshake and offers lifetime services.

Bechtel, the student who took on $40,000 in loans, earned an associate degree in web design but found his experience disappointing.  Required courses, he said, taught computing languages he considered obsolete.  When he reached out to student services — tutoring, tech support, career counseling — “they never returned my phone calls,” he said.

A year in, Bechtel said, Baker changed the requirements for his web design program without exempting current students.  He’d taken required courses that no longer counted toward his degree.  It bothered him, but he decided it wasn’t worth a fight.

More changes to the requirements came a year later, and then again the year after that.  “I raised a whole lot of hell,” he said, until Baker waved him through with his existing credits.

Bechtel graduated in 2011.  Neither the coursework nor the degree proved useful, he said.  At home, he taught himself the programming language SQL, which got him jobs.  He and his wife make decent salaries, he said, but his student debt — now up to $58,750 — has them living “paycheck to paycheck.”

“I’m not going to be able to retire because I’ll be paying these off,” Bechtel said.

Daniel Church, who enrolled out of high school as a full-time student in Flint, ran into trouble when Baker switched from quarters to semesters in 2017 to better align with other college calendars.  In a booklet, Baker pledged the change would be cost-neutral and would “not disrupt your academic progress or increase your time to graduation.” But for Church, it did.

Church said he needed more time and money to finish getting bachelor’s and master's degrees in Baker’s tech program.  So he quit to work as a long-haul trucker, driving cross-country and saving paychecks.

He “didn’t go home,” he said, and “didn’t see anyone in my family.  I worked my arse off.”

Church put aside thousands of dollars to pay for school.  But when he got back to Flint, he learned he’d have to effectively repeat some of his quarter-based classes in the new semester system and complete an internship, costing him more than he had saved.

Baker gave him a list of leads, he said, but the companies he contacted weren’t taking interns.  He decided it was time to give up on Baker.

“At that point, I just threw my hands up and laughed, because it was just so unbelievable,” said Church, who is now 27 and said he has more than $30,000 in loans.  “How could any institution that expects itself to be taken seriously do this to people?”

After living in his parents’ house during the pandemic, he’s back to driving the truck.

HELD FOR RANSOM - Colonial Pipeline and U.S. Infrastructure

"The Colonial Pipeline Ransomware Hackers Had a Secret Weapon: Self-Promoting Cybersecurity Firms" by Renee Dudley and Daniel Golden, ProPublica 5/24/2021

This story was co-published with MIT Technology Review.

On Jan 11, antivirus company Bitdefender said it was “happy to announce” a startling breakthrough.  It had found a flaw in the ransomware that a gang known as DarkSide was using to freeze computer networks of dozens of businesses in the U.S. and Europe.  Companies facing demands from DarkSide could download a free tool from Bitdefender and avoid paying millions of dollars in ransom to the hackers.

But Bitdefender wasn’t the first to identify this flaw.  Two other researchers, Fabian Wosar and Michael Gillespie, had noticed it the month before and had begun discreetly looking for victims to help.  By publicizing its tool, Bitdefender alerted DarkSide to the lapse, which involved reusing the same digital keys to lock and unlock multiple victims.  The next day, DarkSide declared that it had repaired the problem, and that “new companies have nothing to hope for.”

“Special thanks to BitDefender for helping fix our issues,” DarkSide said.  “This will make us even better.”

DarkSide soon proved it wasn’t bluffing, unleashing a string of attacks.  This month, it paralyzed the Colonial Pipeline Co., prompting a shutdown of the 5,500 mile pipeline that carries 45% of the fuel used on the East Coast, quickly followed by a rise in gasoline prices, panic buying of gas across the Southeast and closures of thousands of gas stations.  Absent Bitdefender’s announcement, it’s possible that the crisis might have been contained, and that Colonial might have quietly restored its system with Wosar and Gillespie’s decryption tool.

Instead, Colonial paid DarkSide $4.4 million in Bitcoin for a key to unlock its files.  “I will admit that I wasn’t comfortable seeing money go out the door to people like this,” CEO Joseph Blount told The Wall Street Journal.

The missed opportunity was part of a broader pattern of botched or half-hearted responses to the growing menace of ransomware, which during the pandemic has disabled businesses, schools, hospitals and government agencies across the country.  The incident also shows how antivirus companies eager to make a name for themselves sometimes violate one of the cardinal rules of the cat-and-mouse game of cyber-warfare: Don’t let your opponents know what you’ve figured out.  During World War II, when the British secret service learned from decrypted communications that the Gestapo was planning to abduct and murder a valuable double agent, Johnny Jebsen, his handler wasn’t allowed to warn him for fear of cluing in the enemy that its cipher had been cracked.  Today, ransomware hunters like Wosar and Gillespie try to prolong the attackers’ ignorance, even at the cost of contacting fewer victims.  Sooner or later, as payments drop off, the cybercriminals realize that something has gone wrong.

Whether to tout a decryption tool is a “calculated decision,” said Rob McLeod, senior director of the threat response unit for cybersecurity firm eSentire.  From the marketing perspective, “You are singing that song from the rooftops about how you have come up with a security solution that will decrypt a victim’s data.  And then the security researcher angle says, ‘Don’t disclose any information here.  Keep the ransomware bugs that we’ve found that allow us to decode the data secret, so as not to notify the threat actors.’”

Wosar said that publicly releasing tools, as Bitdefender did, has become riskier as ransoms have soared and the gangs have grown wealthier and more technically adept.  In the early days of ransomware, when hackers froze home computers for a few hundred dollars, they often couldn’t determine how their code was broken unless the flaw was specifically pointed out to them.

Today, the creators of ransomware “have access to reverse engineers and penetration testers who are very very capable,” he said.  “That’s how they gain entrance to these oftentimes highly secured networks in the first place.  They download the decryptor, they disassemble it, they reverse engineer it and they figure out exactly why we were able to decrypt their files.  And 24 hours later, the whole thing is fixed.  Bitdefender should have known better.”

It wasn’t the first time that Bitdefender trumpeted a solution that Wosar or Gillespie had beaten it to.  Gillespie had broken the code of a ransomware strain called GoGoogle and was helping victims without any fanfare, when Bitdefender released a decryption tool in May 2020.  Other companies have also announced breakthroughs publicly, Wosar and Gillespie said.

“People are desperate for a news mention, and big security companies don’t care about victims,” Wosar said.

Bogdan Botezatu, director of threat research at Bucharest, Romania-based Bitdefender, said the company wasn’t aware of the earlier success in unlocking files infected by DarkSide.  Regardless, he said, Bitdefender decided to publish its tool “because most victims who fall for ransomware do not have the right connection with ransomware support groups and won’t know where to ask for help unless they can learn about the existence of tools from media reports or with a simple search.”

Bitdefender has provided free technical support to more than a dozen DarkSide victims, and “we believe many others have successfully used the tool without our intervention,” Botezatu said.  Over the years, Bitdefender has helped individuals and businesses avoid paying more than $100 million in ransom, he said.

Bitdefender recognized that DarkSide might correct the flaw, Botezatu said.  “We are well aware that attackers are agile and adapt to our decryptors.”  But DarkSide might have “spotted the issue” anyway.  “We don’t believe in ransomware decryptors made silently available.  Attackers will learn about their existence by impersonating home users or companies in need, while the vast majority of victims will have no idea that they can get their data back for free.”

The attack on Colonial Pipeline, and the ensuing chaos at the gas pumps throughout the Southeast, appears to have spurred the federal government to be more vigilant.  President Joe Biden issued an executive order to improve cybersecurity and create a blueprint for a federal response to cyberattacks.  DarkSide said it was shutting down under U.S. pressure, although ransomware crews have often disbanded to avoid scrutiny and then re-formed under new names, or their members have launched or joined other groups.

“As sophisticated as they are, these guys will pop up again, and they’ll be that much smarter,” said Aaron Tantleff, a Chicago cybersecurity attorney who has consulted with 10 companies attacked by DarkSide.  “They’ll come back with a vengeance.”

At least until now, private researchers and companies have often been more effective than the government in fighting ransomware.  Last October, Microsoft disrupted the infrastructure of Trickbot, a network of more than 1 million infected computers that disseminated the notorious Ryuk strain of ransomware, by disabling its servers and communications.  That month, ProtonMail, the Swiss-based email service, shut down 20,000 Ryuk-related accounts.

Wosar and Gillespie, who belong to a worldwide volunteer group called the Ransomware Hunting Team, have cracked more than 300 major ransomware strains and variants, saving an estimated 4 million victims from paying billions of dollars.

By contrast, the FBI rarely decrypts ransomware or arrests the attackers, who are typically based in countries like Russia or Iran that lack extradition agreements with the U.S.  DarkSide, for instance, is believed to operate out of Russia.  Far more victims seek help from the Hunting Team, through websites maintained by its members, than from the FBI.

The U.S. Secret Service also investigates ransomware, which falls under its purview of combating financial crimes.  But, especially in election years, it sometimes rotates agents off cyber assignments to carry out its better-known mission of protecting Presidents, Vice Presidents, major party candidates and their families.  European law enforcement, especially the Dutch National Police, has been more successful than the U.S. in arresting attackers and seizing servers.

Similarly, the U.S. government has made only modest headway in pushing private industry, including pipeline companies, to strengthen cybersecurity defenses.  Cybersecurity oversight is divided among an alphabet soup of agencies, hampering coordination.  The Department of Homeland Security conducts “vulnerability assessments” for critical infrastructure, which includes pipelines.

It reviewed Colonial Pipeline in around 2013 as part of a study of places where a cyberattack might cause a catastrophe.  The pipeline was deemed resilient, meaning that it could recover quickly, according to a former DHS official.  The department did not respond to questions about any subsequent reviews.

Five years later, DHS created a pipeline cybersecurity initiative to identify weaknesses in pipeline computer systems and recommend strategies to address them.  Participation is voluntary, and a person familiar with the initiative said that it is more useful for smaller companies with limited in-house IT expertise than for big ones like Colonial.  The National Risk Management Center, which oversees the initiative, also grapples with other thorny issues such as election security.

Ransomware has skyrocketed since 2012, when the advent of Bitcoin made it hard to track or block payments.  The criminals’ tactics have evolved from indiscriminate “spray and pray” campaigns seeking a few hundred dollars apiece to targeting specific businesses, government agencies and nonprofit groups with multimillion-dollar demands.

Attacks on energy businesses in particular have increased during the pandemic — not just in the U.S. but in Canada, Latin America and Europe.  As the companies allowed employees to work from home, they relaxed some security controls, McLeod said.

Since 2019, numerous gangs have ratcheted up pressure with a technique known as “double extortion.”  Upon entering a system, they steal sensitive data before launching ransomware that encodes the files and makes it impossible for hospitals, universities and cities to do their daily work.  If the loss of computer access is not sufficiently intimidating, they threaten to reveal confidential information, often posting samples as leverage.  For instance, when the Washington, D.C., police department didn’t pay the $4 million ransom demanded by a gang called Babuk last month, Babuk published intelligence briefings, names of criminal suspects and witnesses, and personnel files, from medical information to polygraph test results, of officers and job candidates.

DarkSide, which emerged last August, epitomized this new breed.  It chose targets based on a careful financial analysis or information gleaned from corporate emails.  For instance, it attacked one of Tantleff’s clients during a week when the hackers knew the company would be vulnerable because it was transitioning its files to the cloud and didn’t have clean backups.

To infiltrate target networks, the gang used advanced methods such as “zero-day exploits” that immediately take advantage of software vulnerabilities before they can be patched.  Once inside, it moved swiftly, looking not only for sensitive data but also for the victim’s cyber insurance policy, so it could peg its demands to the amount of coverage.  After two to three days of poking around, DarkSide encrypted the files.

“They have a faster attack window,” said Christopher Ballod, associate managing director for cyber risk at Kroll, the business investigations firm, who has advised half a dozen DarkSide victims.  “The longer you dwell in the system, the more likely you are to be caught.”

Typically, DarkSide’s demands were “on the high end of the scale,” $5 million and up, Ballod said.  One scary tactic: If publicly traded companies didn’t pay the ransom, DarkSide threatened to share information stolen from them with short-sellers who would profit if the share price dropped upon publication.

DarkSide’s site on the dark web identified dozens of victims and described the confidential data it claimed to have filched from them.  One was New Orleans law firm Stone Pigman Walther Wittmann.  “A big annoyance is what it was,” attorney Phil Wittmann said, referring to the DarkSide attack in February.  “We paid them nothing,” said Michael Walshe Jr., chair of the firm’s management committee, declining to comment further.

Last November, DarkSide adopted what is known as a “ransomware-as-a-service” model.  Under this model, it partnered with affiliates who launched the attacks.  The affiliates received 75% to 90% of the ransom, with DarkSide keeping the remainder.  As this partnership suggests, the ransomware ecosystem is a distorted mirror of corporate culture, with everything from job interviews to procedures for handling disputes.  After DarkSide shut down, several people who identified themselves as its affiliates complained on a dispute resolution forum that it had stiffed them.  “The target paid, but I did not receive my share,” one wrote.

Together, DarkSide and its affiliates reportedly grossed at least $90 million.  Seven of Tantleff’s clients, including two companies in the energy industry, paid ransoms ranging from $1.25 million to $6 million, reflecting negotiated discounts from initial demands of $7.5 million to $30 million.  His other three clients hit by DarkSide did not pay.  In one of those cases, the hackers demanded $50 million.  Negotiations grew acrimonious, and the two sides couldn’t agree on a price.

DarkSide’s representatives were shrewd bargainers, Tantleff said.  If a victim said it couldn’t afford the ransom because of the pandemic, DarkSide was ready with data showing that the company’s revenue was up, or that COVID-19’s impact was factored into the price.

DarkSide’s grasp of geopolitics was less advanced than its approach to ransomware.  Around the same time that it adopted the affiliate model, it posted that it was planning to safeguard information stolen from victims by storing it in servers in Iran.  DarkSide apparently didn’t realize that an Iranian connection would complicate its collection of ransoms from victims in the U.S., which has economic sanctions restricting financial transactions with Iran.  Although DarkSide later walked back this statement, saying that it had only considered Iran as a possible location, numerous cyber insurers had concerns about covering payments to the group.  Coveware, a Connecticut firm that negotiates with attackers on behalf of victims, stopped dealing with DarkSide.

Ballod said that, with their insurers unwilling to reimburse the ransom, none of his clients paid DarkSide, despite concerns about exposure of their data.  Even if they had caved in to DarkSide, and received assurances from the hackers in return that the data would be shredded, the information might still leak, he said.

During DarkSide’s changeover to the affiliate model, a flaw was introduced into its ransomware.  The vulnerability caught the attention of members of the Ransomware Hunting Team.  Established in 2016, the invitation-only team consists of about a dozen volunteers in the U.S., Spain, Italy, Germany, Hungary and the U.K.  They work in cybersecurity or related fields.  In their spare time, they collaborate in finding and decrypting new ransomware strains.

Several members, including Wosar, have little formal education but an aptitude for coding.  A high school dropout, Wosar grew up in a working-class family near the German port city of Rostock.  In 1992, at the age of 8, he saw a computer for the first time and was entranced.  By 16, he was developing his own antivirus software and making money from it.  Now 37, he has worked for antivirus firm Emsisoft since its inception almost two decades ago and is its chief technology officer.  He moved to the U.K. from Germany in 2018 and lives near London.

He has been battling ransomware hackers since 2012, when he cracked a strain called ACCDFISA, which stood for “Anti Cyber Crime Department of Federal Internet Security Agency.”  This fictional agency was notifying people that child pornography had infected their computers, and so it was blocking access to their files unless they paid $100 to remove the virus.

The ACCDFISA hacker eventually noticed that the strain had been decrypted and released a revised version.  Many of Wosar’s subsequent triumphs were also fleeting.  He and his teammates tried to keep criminals blissfully unaware for as long as possible that their strain was vulnerable.  They left cryptic messages on forums inviting victims to contact them for assistance or sent direct messages to people who posted that they had been attacked.

In the course of protecting against computer intrusions, analysts at antivirus firms sometimes detected ransomware flaws and built decryption tools, though it wasn’t their main focus.  Sometimes they collided with Wosar.

In 2014, Wosar discovered that a ransomware strain called CryptoDefense copied and pasted from Microsoft Windows some of the code it used to lock and unlock files, not realizing that the same code was preserved in a folder on the victim’s own computer.  It was missing the signal, or “flag,” in their program, usually included by ransomware creators to instruct Windows not to save a copy of the key.

Wosar quickly developed a decryption tool to retrieve the key.  “We faced an interesting conundrum,” Sarah White, another Hunting Team member, wrote on Emsisoft’s blog.  “How to get our tool out to the most victims possible without alerting the malware developer of his mistake?”

Wosar discreetly sought out CryptoDefense victims through support forums, volunteer networks and announcements of where to contact for help.  He avoided describing how the tool worked or the blunder it exploited.  When victims came forward, he supplied the fix, scrubbing the ransomware from at least 350 computers.  CryptoDefense eventually “caught on to us ... but he still did not have access to the decrypter we used and had no idea how we were unlocking his victims’ files,” White wrote.

But then an antivirus company, Symantec, uncovered the same problem and bragged about the discovery on a blog post that “contained enough information to help the CryptoDefense developer find and correct the flaw,” White wrote.  Within 24 hours the attackers began spreading a revised version.  They changed its name to CryptoWall and made $325 million.

Symantec “chose quick publicity over helping CryptoDefense victims recover their files,” White wrote.  “Sometimes there are things that are better left unsaid.”

A spokeswoman for Broadcom, which acquired Symantec’s enterprise security business in 2019, declined to comment, saying that “the team members who worked on the tool are no longer with the company.”

Like Wosar, the 29-year-old Gillespie comes from poverty and never went to college.  When he was growing up in central Illinois, his family struggled so much financially that they sometimes had to move in with friends or relatives.  After high school, he worked full time for 10 years at a computer repair chain called Nerds on Call.  Last year, he became a malware and cybersecurity researcher at Coveware.

Last December, he messaged Wosar for help.  Gillespie had been working with a DarkSide victim who had paid a ransom and received a tool to recover the data.  But DarkSide’s decryptor had a reputation for being slow, and the victim hoped that Gillespie could speed up the process.

Gillespie analyzed the software, which contained a key to release the files.  He wanted to extract the key, but because it was stored in an unusually complex way, he couldn’t.  He turned to Wosar, who was able to isolate it.

The teammates then began testing the key on other files infected by DarkSide.  Gillespie checked files uploaded by victims to the website he operates, ID Ransomware, while Wosar used VirusTotal, an online database of suspected malware.

That night, they shared a discovery.

“I have confirmation DarkSide is re-using their RSA keys,” Gillespie wrote to the Hunting Team on its Slack channel.  A type of cryptography, RSA generates two keys: a public key to encode data and a private key to decipher it.  RSA is used legitimately to safeguard many aspects of e-commerce, such as protecting credit numbers.  But it’s also been co-opted by ransomware hackers.

“I noticed the same as I was able to decrypt newly encrypted files using their decrypter,” Wosar replied less than an hour later, at 2:45 a.m. London time.

Their analysis showed that, before adopting the affiliate model, DarkSide had used a different public and private key for each victim.  Wosar suspected that, during this transition, DarkSide introduced a mistake into its affiliate portal used to generate the ransomware for each target.  Wosar and Gillespie could now use the key that Wosar had extracted to retrieve files from Windows machines seized by DarkSide.  The cryptographic blunder didn’t affect Linux operating systems.

“We were scratching our heads,” Wosar said.  “Could they really have fucked up this badly? DarkSide was one of the more professional ransomware-as-a-service schemes out there.  For them to make such a huge mistake is very, very rare.”

The Hunting Team celebrated quietly, without seeking publicity.  White, who is a computer science student at Royal Holloway, part of the University of London, began looking for DarkSide victims.  She contacted firms that handle digital forensics and incident response.

“We told them, ‘Hey listen, if you have any DarkSide victims, tell them to reach out to us, we can help them.  We can recover their files and they don’t have to pay a huge ransom,’” Wosar said.

The DarkSide hackers mostly took the Christmas season off.  Gillespie and Wosar expected that, when the attacks resumed in the new year, their discovery would help dozens of victims.  But then Bitdefender published its post, under the headline “Darkside Ransomware Decryption Tool.”

In a messaging channel with the ransomware response community, someone asked why Bitdefender would tip off the hackers.  “Publicity,” White responded.  “Looks good.  I can guarantee they’ll fix it much faster now though.”

She was right.  The next day, DarkSide acknowledged the error that Wosar and Gillespie had found before Bitdefender.  “Due to the problem with key generation, some companies have the same keys,” the hackers wrote, adding that up to 40% of keys were affected.

DarkSide mocked Bitdefender for releasing the decryptor at “the wrong time…., as the activity of us and our partners during the New Year holidays is the lowest.”

Adding to the team’s frustrations, Wosar discovered that the Bitdefender tool had its own drawbacks.  Using the company’s decryptor, he tried to unlock samples infected by DarkSide and found that they were damaged in the process.  “They actually implemented the decryption wrong,” Wosar said.  “That means if victims did use the Bitdefender tool, there’s a good chance that they damaged the data.”

Asked about Wosar’s criticism, Botezatu said that data recovery is difficult, and that Bitdefender has “taken all precautions to make sure that we’re not compromising user data” including exhaustive testing and “code that evaluates whether the resulting decrypted file is valid.”

Even without Bitdefender, DarkSide might have soon realized its mistake anyway, Wosar and Gillespie said.  For example, as they sifted through compromised networks, the hackers might have come across emails in which victims helped by the Hunting Team discussed the flaw.

“They might figure it out that way — that is always a possibility,” Wosar said.  “But it’s especially painful if a vulnerability is being burned through something stupid like this.”

The incident led the Hunting Team to coin a term for the premature exposure of a weakness in a ransomware strain.  “Internally, we often joke, ‘Yeah, they are probably going to pull a Bitdefender,’” Wosar said.