SUMMARY: The blockbuster exhibit of the year celebrates Leonardo da Vinci, 500 years after his death. People are flocking to the Louvre Museum in Paris to see the work of the master, who was born in Italy, died in France and personified the expression Renaissance man. Jeffrey Brown went to see firsthand why da Vinci's art is drawing massive crowds.
SUMMARY: It's been 30 years since one of the 20th century's biggest historic events: the fall of the Berlin Wall. Although the East German dictatorship subsequently collapsed, cultural and political divisions remain, more than a generation after reunification. Special correspondent Malcolm Brabant reports on the wall's legacy, the polarizing issue of immigration and the lingering stain of anti-Semitism.
SUMMARY: A toxic brew lingers in the skies over India, created by everything from agricultural burning to industrial pollution. Cars are also a major contributor, with roughly 1400 vehicles added to the roads daily. Special correspondent Fred de Sam Lazaro examined this problem roughly two years ago and returns with this update on the cultural and economic challenges of making Indian air safer to breathe.
SUMMARY: Health care is a top 2020 political issue. Democratic candidates are debating whether to build upon the Affordable Care Act, or 'Obamacare,' or replace it with Medicare for All. Meanwhile, President Trump wants to dismantle the ACA entirely. As millions of Americans enter the time of year when they choose their health plans, Amna Nawaz gets the latest from Margot Sanger-Katz of The New York Times.
SUMMARY: During California’s recent wildfires, the intentional blackouts PG&E implemented to reduce danger frustrated residents. The utility’s poorly maintained infrastructure is blamed for at least five previous fires. Now, the mayors of over a dozen California cities are suggesting PG&E should be sold to its customers. William Brangham talks to San Jose Mayor Sam Liccardo, who first proposed the plan.
SUMMARY: The Department of Justice alleges that the government of Saudi Arabia is surveilling people living in the United States — by leveraging Twitter. Specifically, the indictment charges that a Saudi official is recruiting Twitter employees to share personal details of critics of the Saudi government, so that those dissidents can be targeted for persecution. Nick Schifrin talks to Judy Woodruff.
SUMMARY: A new podcast from the NewsHour examines the public defender system in the United States — and the enormous gaps and problems that undermine its effectiveness. Amna Nawaz and producer Frank Carlson reported from Missouri for this five-part series, and they join Judy Woodruff to discuss the heartbreaking stories they heard and what the flawed system says about American criminal justice.
SUMMARY: In 2019, American law enforcement agencies have identified over 70 suspects using a new technique called genetic genealogy, which California detectives leveraged in 2018 to identify the Golden State Killer. In the first of a two-part series, William Brangham shares the story of the first genetic genealogy case to go to trial — and how the science behind it solved a 32-year-old double murder.
SUMMARY: Genetic genealogy, the technique millions of people are using to learn about their family history, has now become a potent tool with which law enforcement can solve crimes. But the method has major privacy implications that are prompting some critics to urge that we slow down in our adoption of it. William Brangham shares a "cautionary tale" of how one person's DNA testing can have a wide impact.
SUMMARY: Tuesday's election outcomes represented successes and failures for both parties. In Kentucky, Democrat Andy Beshear beat Republican Gov. Matt Bevin by a very slim margin, while Mississippi elected a Republican governor. And Virginia voters put both houses of the state's legislature under Democratic control. Amna Nawaz reports and Judy Woodruff speaks with the University of Virginia’s Kyle Kondik.
SUMMARY: According to the FBI, hate crimes are on the rise in the U.S. Studies also suggest white nationalist and white supremacist ideologies are spreading. Derek Black was raised in a household that espoused such beliefs, but during college, his views gradually evolved. Special correspondent Charlayne Hunter-Gault talks with Black about his journey and the best way to help others find a similar path.
SUMMARY: A college admissions scandal involving several celebrities has cast an ugly spotlight on how entry into higher education can be gamed. Standardized tests like the ACT and SAT are a key point in the saga, and they now face renewed scrutiny over their value — and their correlation to economic background. John Yang reports and talks to Jeff Selingo, author of several books on higher education.
SUMMARY: In Oklahoma, 462 people left prison Monday in the largest single-day commutation in U.S. history. Republican Governor Kevin Stitt had signed off on their release based on the recommendation of the state’s Pardon and Parole Board. Oklahoma has the nation’s highest incarceration rate, and its officials are now considering other criminal justice reforms. Gov. Stitt joins William Brangham to discuss.
SUMMARY: President Trump announced Monday that in a year, the U.S. will formally withdraw from the Paris Climate Agreement. The global accord was signed in 2015 by nearly 200 nations pledging to cut greenhouse gas emissions to slow the planet’s warming. Brookings Institution’s Todd Stern, who was chief climate negotiator during the Obama administration, joins William Brangham to discuss the fallout.
SUMMARY: In Nashville, the nonprofit Music for Seniors connects the city’s musicians with its older residents in an effort to build community and improve seniors’ quality of life. Now, the organization is teaming up with researchers at Vanderbilt University to see if the effects of its work can be measured -- and potentially leveraged to help patients with dementia and Alzheimer's. John Yang reports.
SUMMARY: Russia’s 2014 annexation of Ukraine's Crimean Peninsula was the largest European land grab since World War II. No shots were fired there, but in eastern Ukraine, a brutal war ensued, dragging on for nearly six years so far and killing 13,000. The conflict drew relatively little U.S. attention until the impeachment crisis surrounding President Trump. Special correspondent Simon Ostrovsky reports.
SUMMARY: The Kentucky governor’s race is one of three gubernatorial contests that will serve as key tests of Republican strength ahead of the 2020 presidential election. President Trump is campaigning there Monday for the incumbent, Matt Bevin, who’s facing a very tight race on Tuesday against Democrat Andy Beshear, the state’s attorney general. William Brangham reports from the Bluegrass State.
SUMMARY: Monday marked a milestone in the House impeachment inquiry, as almost 500 pages’ worth of transcripts from two of the investigation’s closed-door witness depositions were publicly released. Lisa Desjardins, Nick Schifrin and Yamiche Alcindor join Amna Nawaz to discuss new details revealed by the testimonies of former Amb. Marie Yovanovitch and former State Department official Michael McKinley.
SUMMARY: Transcripts were released Tuesday of testimonies from two central figures in the impeachment inquiry: Ambassador to the European Union Gordon Sondland and former Special Envoy to Ukraine Kurt Volker. Both men were on the July call between President Trump and Ukrainian president Volodymr Zelenskiy. Meanwhile, more White House officials declined to appear for interviews. Lisa Desjardins reports.
SUMMARY: House committees involved in the impeachment inquiry said Wednesday that the investigation will go public next week, with senior State Department officials scheduled for open hearings beginning November 13th. Meanwhile, Amb. William Taylor's deposition transcript illuminates why U.S. military aid to Ukraine was withheld. Nick Schifrin reports and talks to Yamiche Alcindor and Lisa Desjardins.
SUMMARY: In his impeachment inquiry testimony, career State Department official George Kent alleged that Rudy Giuliani, President Trump’s personal attorney, sought to manipulate U.S. policy on Ukraine and oust former Ambassador Marie Yovanovitch. Kent also said he had expressed concern over Hunter Biden's position on the board of a Ukrainian energy company in 2015. Nick Schifrin talks to Judy Woodruff.
SUMMARY: House committees involved in the impeachment inquiry have released nearly 2700 pages of closed-door deposition transcripts. Many of the officials interviewed echoed the whistleblower’s concerns about President Trump's policy toward Ukraine. Trump, meanwhile, renewed claims that the whistleblower was guilty of wrongdoing. Lisa Desjardins reports and joins Nick Schifrin and Judy Woodruff to discuss.
SUMMARY: Three officials will testify this week as the impeachment inquiry enters a new phase with public hearings. House Republicans on Saturday submitted their wishlist of witnesses which included Hunter Biden and the whistleblower — both names ruled out by the Democrats. NewsHour’s Lisa Desjardin joins Megan Thompson to discuss the latest.
Thanks to Michael Gillespie, an obscure programmer at a Nerds on Call repair store, hundreds of thousands of ransomware victims have recovered their files for free.
This story was co-published with the Chicago Sun-Times and The Pantagraph.
ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up for ProPublica’s Big Story newsletter to receive stories like this one in your inbox as soon as they are published.
About 10 years ago, Michael Gillespie and several classmates at Pekin Community High School in central Illinois were clicking on links on the school’s website when they discovered a weakness that exposed sensitive information such as students’ Social Security numbers. They quickly alerted their computer repair and networking teacher, Eric McCann.
“It was a vulnerability that nobody even knew about,” McCann said. “They did a quick search on passwords and student accounts, and lo and behold, that file is sitting out there.”
A shy, skinny teenager whose hand-me-down clothes didn’t fit him, and who was often ridiculed by schoolmates, Gillespie was already working after school as a computer technician. “He was full of information all the time,” McCann said. “We’d bounce ideas off each other. You could tell his passion for technology, for computers, for figuring out things. That definitely made him stand out.”
Without crediting the students, school administrators closed the breach and changed everyone’s passwords. Gillespie’s anonymous protection of the school’s cyberdefenses was a harbinger of his future. Like a real-life version of Clark Kent or Peter Parker, the self-effacing Gillespie morphs in his spare time into a crime-foiling superhero. A cancer survivor who works at a Nerds on Call computer repair shop and has been overwhelmed by debt — he and his wife had a car repossessed and their home nearly foreclosed on — the 27-year-old Gillespie has become, with little fanfare or reward, one of the world’s leading conquerors of an especially common and virulent cybercrime: ransomware. Asked what motivates him, he replied, “I guess it’s just the affinity for challenge and feeling like I am contributing to beating the bad guys.”
Each year, millions of ransomware attacks paralyze computer systems of individuals, businesses, hospitals and medical offices, government agencies, and even police departments. Often, files cannot be decrypted without paying a ransom, and victims who haven’t saved backup copies and want to retrieve the information have little choice but to pony up. But those who have recovered their data without enriching criminals frequently owe their escapes to Gillespie.
The FBI and local law enforcement agencies have had little success in curbing ransomware. Local departments lack the resources to solve cybercrime, and the ransoms demanded have often been below the threshold that triggers federal investigations. Security researchers like Gillespie have done their best to fill the gap. There are almost 800 known types of ransomware, and Gillespie, mostly by himself but sometimes collaborating with other ransomware hunters, has cracked more than 100 of them. Hundreds of thousands of victims have downloaded his decryption tools for free, potentially saving them from paying hundreds of millions of dollars in ransom.
“He took that deep dive into the technical stuff, and he just thrives on it,” said Lawrence Abrams, founder of a ransomware assistance website called BleepingComputer.com. “Every time a new ransomware comes out, he checks it out. ‘Can it be decrypted? Yes, it can be decrypted. OK, I’ll make the decryptor.’ And it’s just nonstop. He just keeps pumping them out.”
Gillespie downplays his accomplishments. “IT [Internet Technology] moves so fast, there’s always something to learn, and there’s always someone better than you,” he said.
Gillespie’s tools are available on BleepingComputer.com, and they can be accessed through a site he created and operates, called ID Ransomware. There, victims submit about 2,000 ransomware-stricken files every day to find out which strain has hit them and to obtain an antidote, if one exists.
As hackers and their corporate enablers, including cyber insurance providers and data recovery firms whose business models are based on paying ransoms, profit directly or indirectly from cybercrime, one of ransomware’s greatest foes lives paycheck-to-paycheck. Under his internet alias, demonslay335, Gillespie tackles ransomware either in his downtime at Nerds on Call or at night in the two-story bungalow he shares with his wife, Morgan, and their dog, rabbit and eight cats. Surrounded by pets, he lies on his living room couch, decoding ransomware on his laptop and corresponding with victims desperate for his help.
Although the FBI honored him in 2017 with an award for his website, it doesn’t systematically recommend ID Ransomware — meaning that some victims may never learn of a resource that could help them avoid paying a ransom. Many of his friends, relatives and colleagues don’t know the extent of his war on ransomware. “They do not have a clue because of Michael’s modesty,” said his wife’s grandmother, Rita Blanch. “Honestly, I don’t think anyone in the family knows what he does for free. I barely know.” When he got the FBI award, she added, “I sent out a family text, and they’re like: ‘What? What? Our Michael?’”
McCann wasn’t aware of Gillespie’s accomplishments either. “It kind of gives me goosebumps,” the teacher said. “He’s sitting here doing all this for free. That’s incredible.”
On a humid morning in July, Gillespie sat on his covered front porch. His hair was pulled back into a low ponytail, and he sported scraggly facial hair and a V-neck striped shirt. Brown leaves left over from the previous autumn and birdseed from a feeder were scattered on the ground. Gillespie said hello to a cardinal — the Illinois state bird, he pointed out — and a squirrel with a “wonky eye.” He said a family of groundhogs resides under the porch and eats from the front-yard mulberry tree, but they didn’t make an appearance.
He opened his Twitter account. “Like right now, I have 58 PMs and 120 notifications,” he said. Most were pleas for help from victims of a ransomware strain, STOP Djvu, which he can sometimes decrypt.
Gillespie’s love of computers and electronics started early. His paternal grandmother, a video gamer, introduced him to online role-playing games such as RuneScape. He played Donkey Kong Country on a used Super Nintendo that his uncle gave him. As emergency services volunteers, his parents communicated with tornado spotters via ham radios. His father, a land surveyor, taught him how to repair electronics by soldering the radios.
Gillespie gleaned from his mother’s father, a police lieutenant in Florida, the importance of protecting the public. Reinforcing the message, his parents went out of their way on family trips to pass through Metropolis, Illinois, which proclaims itself to be Superman’s hometown, and pay their respects at the Man of Steel’s bronze statue. Gillespie was also fascinated by cryptography. He liked the idea of having secret codes that no one else could figure out — and cracking other people’s.
Struggling financially, his family sometimes had to move in with friends or relatives. When he was in high school, his parents filed for bankruptcy in the Central District of Illinois, court documents show.
At Pekin High, he helped protect not only the website but also his classmates’ belongings. One day, noticing that other students were pre-setting codes to the combination locks on their lockers for convenience, he pulled down on every lock in his aisle. About a quarter of the lockers opened. He left a Post-it note in each one, admonishing the user to be more careful.
By then, he and Morgan Blanch were becoming close. They lived down the street from each other but didn’t become friends until their freshman year at Pekin. They began hanging out at each other’s houses and messaging on Myspace. They were both in the school show choir and eventually sang in a national competition on the Grand Ole Opry stage in Nashville, Tennessee.
Both sometimes felt like outcasts. She was overweight. Gillespie, she said, was “that one kid at school that everybody knows who they are because they’re weird or they’re the butt of people’s jokes.”
But they could rely on each other. “We’d get annoyed because our other friends were more flighty,” she said. “They weren’t dependable, whereas if Michael and I made a plan, we stuck to it. And we liked that about each other.” They started dating during Christmas break of their junior year.
When he graduated in 2010, Gillespie was named a Prairie State Scholar and an Illinois State Scholar, based on his standardized test scores and class rank. Instead of going to college, he began working full time at the Nerds on Call store in Normal, Illinois. Even with financial aid, he said, college would have been too expensive, and he already had everything he wanted. “I got a job, got a car, got a girlfriend. Boom. Life together,” he said.
“He just felt that he could learn better on his own than in a classroom setting,” Morgan Gillespie said. “He doesn’t really like to be restrained by protocol or by doing the ‘typical’ route of things. He likes to get in there and figure it out and do whatever it is he feels like he wants to do.”
She enrolled at Millikin University in Decatur, Illinois, but missed Gillespie and dropped out after two months. They moved into a new apartment close to his job and were married in October 2012, with Rita Blanch officiating. For the bachelor party, Gillespie and his Nerds on Call friends went to a nearby farm and shot up old computers with his father’s firearms. “Nobody who was too tipsy got to hold the rifles, but we put a few rounds through some old monitors,” said his best man, former co-worker David Jacobs, who organized the party.
The couple honeymooned in Peoria, Illinois. The next year, with a Federal Housing Administration loan for lower-income borrowers, they purchased their $116,000 bungalow in a working-class neighborhood in Bloomington, Illinois. There they could hear Amtrak’s Lincoln Service roar by on its way to Chicago.
At Nerds on Call, Gillespie was known as the Swiss Army Knife for his versatility. So when a client was hit by TeslaCrypt ransomware in 2015, Gillespie was assigned to recover the files.
He embraced the task. Not only was it an opportunity to expand his skills, but he also objected to the very idea of paying a ransom. “I say hell no,” he said. “There’s all the stuff about how it’s funding terrorism, funding bad stuff. But more so, it’s just encouraging [criminals] to keep going.”
Gillespie “lives so heavily in the tech world, I think having bad actors involved just bothers him,” Jacobs said. “Sometimes it’s also a little bit of competition. ‘It’s me versus the bad guys and I want to win. I want to be able to outdo their schemes.’”
Gillespie immediately consulted BleepingComputer.com. Established in 2004 by Abrams to provide free advice for any computer problem through tutorials and forums, it had become the go-to site for ransomware assistance.
Sure enough, a BleepingComputer member known as BloodDolly had figured out how to crack TeslaCrypt. But Gillespie still had to create a key for the client, which required running complex software for hours or days at a time. “I wanted to post a success story for one of my customer’s systems that was hit this week,” he proudly announced on the forum in August 2015. “I’ve just successfully decoded a few sample files at home. … My customer is going to be thrilled we can get her photos back.”
Gillespie realized that Abrams, BloodDolly and other ransomware researchers were overwhelmed with requests for help. He soaked up everything they could teach him. Soon he was running software from both his home computer and computers under his desk at work, generating customized keys for scores of TeslaCrypt victims who had posted on BleepingComputer or on social media.
“It was huge, it was insane,” Abrams recalled. “We were cracking keys left and right. And Michael got the bug from that. He came to the site, started cracking keys, starting helping.”
Gillespie also began exchanging private messages on BleepingComputer with U.K.-based ransomware expert Fabian Wosar. Wosar, now the chief technology officer of antivirus provider Emsisoft, was working to break other strains of ransomware, and he referred TeslaCrypt victims to Gillespie. Wosar, too, shared his knowledge with Gillespie.
“Sometimes, when people seem genuinely interested, I just ask them if they want to come along,” Wosar said. “I just open a screen share, and they can watch what I’m doing. And I explain to them what I am doing and why, and what all this different stuff means.”
Wosar, Gillespie, Abrams and a handful of other volunteers worldwide began communicating over the messaging platform Slack, forming a group they dubbed the Ransomware Hunting Team. Abrams would hear about a new type of ransomware through users’ posts on his website and send a sample to his teammates. If they could solve it, they would.
Gillespie creates 90% of the decryptors available on BleepingComputer, Abrams said. Since May, when Abrams began tracking statistics, decryptors on the site have been downloaded more than 320,000 times.
While BleepingComputer makes money from advertisers, members of the hunting team from time to time have discussed charging for their services. Each time, “it left a sour taste,” Abrams said. He recalled a mother who contacted him to say she’d lost photos of her son, a fallen Army veteran, to ransomware. Abrams helped to decrypt her files. “I couldn’t charge for that,” he said.
Wosar and Gillespie have each created more free, public decryptors than anybody else in the world. The two have much in common: neither went to college and both consider themselves autodidacts, learning mostly from internet research. Both found a home and friendships on BleepingComputer. And both, Wosar said, suffer from imposter syndrome — feelings of inadequacy that persist despite their success.
“I think we’re all kind of misfits,” Wosar said, referring to members of the team. “We all have weird quirks that isolate us from the normal world but come in handy when it comes to tracking ransomware and helping people. That’s why and how we work so well together. You don’t need credentials, as long as you have the passion and the drive to teach yourself the skills required. And Michael clearly has it, right?”
As ransomware became increasingly prevalent, the Ransomware Hunting Team had trouble staying abreast of new variants. “It just got to the point where we just couldn’t keep track any more,” Abrams said.
Gillespie quietly began working on a solution. “I’m a programmer,” he said. “What do I do? I automate.”
At night, on his couch, Gillespie developed a site where victims could upload a ransomware-encrypted file and automatically learn what type it was, whether a decryptor existed and, if so, how to get it. In March 2016, he launched ID Ransomware with an announcement on Twitter and on BleepingComputer. “All too often after a ransomware attack, the first question is, ‘what encrypted my files?’, followed by ‘can I decrypt my data?’” he wrote. “This web service aims to help answer those questions, and guide a victim to the correct information relating to their infection.”
The site took off immediately. Victims, ransomware recovery firms and other researchers sent encrypted files for analysis. When they submitted files infected by an unidentified type of ransomware, Gillespie added it to his database. As before, he and other members of the team worked to create decryptors for newly discovered strains. ID Ransomware currently can detect more than 780 strains, of which almost 40% have free decryptors, most of them developed by Gillespie or Wosar, and others by cybersecurity firms such as Kaspersky, Avast and Bitdefender.
He’s developed other free applications for victims, which are available on BleepingComputer. RansomNoteCleaner removes ransom notes left behind after an infection — eliminating the time-consuming task of removing them manually — and CryptoSearch locates encrypted files and makes it easier to back them up, in the hope that a solution may someday be discovered. ID Ransomware also cross-references the submitter’s IP address with Shodan, a site that can show a computer’s vulnerabilities. If it detects an open port, which could have allowed the hackers in, ID Ransomware flags the vulnerability — and, like the notes Gillespie stuck in the high school lockers, suggests fixing it.
Gillespie worked nonstop. “I felt like I never saw him,” his wife said. “We would be hanging out in the evening, and he would be like, ‘Oh my gosh, I have to go do this.’ And he would just disappear for hours.”
Volunteers around the world have translated ID Ransomware into two dozen languages, from Swedish to Nepali. Only 26% of submissions to the site have come from the U.S. “He collects amazing data because so many people use it,” Abrams said. “He has tons of information. You can see statistics, trends, what kinds of attacks are happening and when. Everyone uses it.”
Those users include law enforcement, on both sides of the Atlantic. Europol and Netherlands police flattered ID Ransomware by imitation, launching a similar but less comprehensive site. An FBI agent from the Springfield, Illinois, field office asked to meet Gillespie, and they got together with another agent at a local Panera restaurant.
“The first meeting was nerve-wracking for me because, you know, why does the FBI want to talk to me?” Gillespie recalled. “I was so awkward at that meeting. I wasn’t thinking, ‘Am I gonna get arrested.’ But I did have in the back of my mind, ‘Am I gonna say something stupid?’”
The FBI needed help. Victims often don’t report attacks to the bureau because they don’t want investors or the public to learn of their security lapses. In 2018, the FBI received only 1,493 reports of ransomware — compared with the 2,000 queries daily to Gillespie’s site from about 750 different IP addresses worldwide.
At first, the agents sought information about the origins of a specific ransomware attack, something Gillespie does not investigate. Then they began requesting lists of IP addresses that had uploaded files to ID Ransomware, which could help identify victims, as well as ransom notes and other material. Gillespie, who discloses on the ID Ransomware homepage that email or bitcoin addresses uploaded to the site may be shared with “trusted third parties or law enforcement,” complied.
His assistance appears to have paid off. Gillespie said agents indicated to him that his information may have been instrumental in last year’s indictment of two Iranian hackers wanted in connection with SamSam ransomware, which paralyzed computer networks across North America and the U.K. between 2015 and 2018. Although the suspects have not been arrested, it was the U.S. government’s first indictment of cyberattackers for deploying a ransomware scheme.
Gillespie continues to meet regularly with FBI agents. He tips them off, for instance, when a ransom note or extension on a file uploaded to the site identifies the targeted business. Cooperation from such victims could help law enforcement learn more about the source of the ransomware, he said.
Some other ransomware hunters are warier of the FBI. Abrams expressed concern that, despite the ID Ransomware acknowledgment, there could be “repercussions” from victims who might be upset that Gillespie identified them to the bureau. Gillespie “is a little too trusting” of law enforcement, Abrams said. “I do think that he’s not very worldly and that he sees things a little more black and white than with a lot of shades of gray. And I think in that case he could be easily manipulated and taken advantage of.”
In 2017, the FBI awarded Gillespie a Community Leadership Award for his “public service, devotion and assistance to victims of ransomware in the United States and Internationally.” Gillespie prominently displays the award in his home. In April 2018, he and his wife flew to Washington for the award ceremony, accompanied by his boss at Nerds on Call. The joke around the office was that the boss “went with him to try to nerf anybody trying to recruit him,” said Gillespie’s former co-worker, Jacobs. “He would be very difficult to replace.”
Philosophically opposed to charging victims, Gillespie keeps ID Ransomware free. He put up a link for donations to help cover the costs of running the site, but he didn’t bother to register it as a nonprofit, which would have enabled donors to deduct gifts from their taxes. Contributions were scarce. One $3,000 donation through PayPal proved to be a scam — Gillespie speculated that it may have been revenge by hackers whose ransomware he disabled — and PayPal demanded the money back. He couldn’t repay it and switched to another service.
Gillespie “doesn’t chase money,” Jacobs said. “If he were chasing money, he would have been living on the East or West Coast by now and doing something for some company that we’d all heard of instead of a little service provider in the Midwest. But he’s one of those guys, he operates very heavily on principle.”
To make ends meet, Gillespie supplemented his Nerds on Call salary with a 2 a.m. paper route, delivering the local newspaper on his bike. While he had enjoyed having a paper route in junior high, the job now depressed him. But the family bills were mounting, especially for health care. Morgan Gillespie struggled with diabetes and other medical issues. Over the years, Michael Gillespie noticed blood in his urine, and in the fall of 2017, his wife finally made him see a doctor. The physician removed a tumor and diagnosed bladder cancer, which rarely affects young adults. Gillespie took one day off for surgery and one to recover before returning to work. He underwent immunotherapy treatment weekly for two months, and the cancer has been in remission since. Although he was insured through Nerds on Call, the costs for his care still added up.
The couple reached a financial breaking point. They racked up credit card debt and fell behind on payments on Morgan Gillespie’s Nissan. They rotated which utility bills they would pay; one month their electricity would be turned off, and the next month it would be gas. They surrendered the car to the bank, which sold it at a loss at auction and forced them to make up the difference. Last year, around the time his wife lost her job as a nanny, they missed four mortgage payments on their house and began to receive foreclosure notices, Michael Gillespie said.
Gillespie said he’s considering charging other security researchers for the statistics he gathers on the site, but he will always keep the tools free for victims. Friends and family members nagged Gillespie to collect fees from ID Ransomware users. Even his wife’s grandmother, whom Gillespie calls “grammy,” brought it up. “I try to not interfere in that area,” Rita Blanch said. “Unless, being silly at times, when I would say to him, ‘Babe, you need to charge, you could, like, be rich.’”
Other relatives “have been like: ‘Why isn’t he charging? Why isn’t he making money off of this?’” said his wife, who recently found a part-time job as a babysitter. “They think it’s almost dumb, the fact that he does what he does. But that was just never what the deal was for us. He just doesn’t want to take advantage of people who are already being taken advantage of.”
Instead, his fellow ransomware hunters stepped in. Abrams covered the $400 cost of obtaining a certificate that lets users know they’re downloading from a trustworthy site. Wosar began donating to ID Ransomware, and his employer, Emsisoft, hired Gillespie part-time this year to create Emsisoft-branded decryptors. The money enabled the Gillespies to catch up on mortgage payments.
“He’s doing so much, how do you not support him if you can?” Abrams said.
After dinner one summer evening, Gillespie took a visitor to the Normal office of Nerds on Call, one of the company’s three locations in central Illinois, nestled in a strip mall between a check-cashing store and a Great Clips hair salon. Gillespie, who has worked for Nerds on Call for 11 years, has keys, so he was able to open the office and disable the alarm system. In the back, behind the retail area, is his desk, adorned with framed photos of his cats.
As his wife’s relatives often remind him, he could earn three times as much somewhere else. But he’s happy at Nerds on Call, which gives him the freedom to work on ransomware in his downtime. This year, he figured out fixes for the STOP Djvu ransomware, which was infecting files through pirated software. Victims — who were unlikely to seek law enforcement assistance since they were committing a crime themselves — continue to press Michael for help unceasingly. “It’s borderline harassment,” he said.
His frustration with the deluge of entreaties occasionally boiled over in his tweets. “Everything you could possibly need to know is IN THE FUCKING FAQ, and its in BIG BOLD RED LETTERS,” he once responded. “I’m losing sleep, losing time at my job, losing fucking sanity at this point.”
Some STOP Djvu victims thanked Gillespie. Adam Hegedus of Szolnok, Hungary, was surfing the internet on his girlfriend's laptop in August when he disabled the anti-virus and firewall protections. Ransomware crippled the computer, and a text file demanded $1,000 to restore access. Hegedus' girlfriend is a teacher, and her lesson plans, thesis and other important documents were encrypted. Hegedus felt so guilty that he couldn't sleep, and he sought assistance from several forums, including BleepingComputer.com. This month, Gillespie replied with some good news; he had a decryption key. Hegedus called his girlfriend, who rushed home and was delighted to be able to use her files again.
"You cannot imagine how grateful I am," Hegedus wrote to Gillespie. "Everything has been decrypted and this is only because of your hard work." Hegedus offered a donation, but Gillespie declined.
Gillespie hopes that someday his services will no longer be needed, because businesses and people will have learned proper cybersecurity. “If the world had backups, then we wouldn’t have ransomware,” he said.
In the meantime, he said, he plans to keep plugging away, even as hackers and their enablers pile up profits. “There’s a time in every IT person’s career where they think, ‘I’m on the wrong side,’” he said. “You start seeing the dollar amounts that are involved. But nah, I can’t say that I ever have. I just don’t care to go that way.”
ProPublica research reporter Doris Burke contributed to this article.
Governor’s request to Becerra comes after report on cost to drivers
Gov. Gavin Newsom on Monday asked the state attorney general to investigate whether California’s leading oil and gas suppliers are involved in price-fixing or other unfair practices related to high pump prices.
The request, which Attorney General Xavier Becerra’s office said it would accept, comes amid growing frustration with high prices charged in communities across the state. The investigation has the potential to trigger the most consequential review of California’s gas prices in years.
“Simply stated, name-brand gas retail outlets in California are charging more for a gallon of gas compared to their unbranded, hypermart competitors,” Newsom wrote in the letter. “There is no identifiable evidence to justify these premium prices.”
Newsom’s request came on the heels of a report released by the California Energy Commission on the cost of retail gasoline in California. The document, prepared after the governor asked the agency in April to examine the issue, concluded that the state’s drivers spent $1.5 billion more than those in other states for gasoline in 2018 — even though there was no determinable difference in the gasoline being sold by different retailers.
“The name-brand stations, therefore, are charging higher prices for what appears to be the same product,” wrote commission officials. “The CEC received no response from the name-brand retailers in response to a request for information to support their product claims.”
In May, state officials concluded that “market manipulation” may explain the mystery surcharge imposed on California drivers. They promised additional details this month, though Monday’s report leaves a number of questions unanswered. Those unknowns included why so many residents choose higher-priced fuel instead of cheaper alternatives available in some locations.
“Consumers may be purchasing higher-priced gasoline brands for convenience, credit card acceptance or other reasons,” researchers wrote. “However, if competitors decide collectively to fix prices, this may be unlawful.”
Severin Borenstein, a professor at UC Berkeley’s Haas School of Business who has been studying what he calls the “mystery surcharge” on gas sold in California, applauded Newsom’s decision. “It’s really time to find out the reason,” he said Monday. “Consumers have spent many billions of dollars over the years.”
Borenstein’s research found that even after accounting for the state’s high gasoline taxes and unique environmental rules that impose stricter refining standards, Californians still paid roughly 40 cents per gallon more by the end of 2018 than did drivers in other states — double what it had been in most years since 2015.
The state’s average price for a gallon of regular gasoline on Monday was $4.14 and San Diego County’s average price was $4.12, according to AAA. The national average was $2.65 per gallon.
State energy commission officials said in their report that refinery challenges, refining standards and occasional shutdowns or incidents at individual locations do not explain the cost differential. And the report concluded the most noticeable uptick had been in prices paid at retail gas stations since 2012 operated by companies that include Chevron and Shell.
“These price increases occurred without significant changes in the overall market share of these brands at the retail level,” the report said.
Researchers found Chevron’s retail gasoline sales in California resulted in almost $1.6 billion in revenue in 2018, more than double what those sales generated earned in 2010. Shell’s total retail sales hit $818 million in 2018, up from $421 million in 2010.
A Chevron spokesman referred questions to an oil industry group. A request for comment from Shell wasn’t immediately returned.
While energy commission officials wrote they “found no evidence of unlawful activities” by major oil companies, they also acknowledged they lacked the expertise to conduct a more thorough investigation — a shortcoming apparently resolved by Newsom’s request for Becerra to get involved.
“The mystery surcharge adds up, especially for cost-conscious, working families,” the governor wrote in his letter to Becerra. “If oil companies are engaging in false advertising or price fixing, then legal action should be taken to protect the public.”
Catherine Reheis-Boyd, president of the Western States Petroleum Association, said the industry trade group is reviewing the CEC report. But she said it was important to note California’s fuel taxes and standards, which are more strict than other states, account for the first $1.07 per gallon at the pump.
“Everyone has to have a seat at the table to ensure policies provide adequate, affordable, reliable energy to the communities we serve,” she said.
While California is known for its environmentally conscious fuel standards, the state was the seventh-largest producer of crude oil in the country in March. The oil industry is a powerful force in California politics, working to halt legislation in the Assembly earlier this year that would have limited new oil and gas production around homes and schools.
But Newsom has expressed a desire to take on the oil industry during his first year in office. In July, he fired the state’s top oil and gas regulator for doubling the state’s fracking permits this year.
“This is the first time a governor has requested an investigation and prosecution by the attorney general in modern history into the oil industry,” said Jamie Court, president of Consumer Watchdog, which has criticized the oil industry. “I think it’s a pretty big step.”
Myers writes for the Los Angeles Times. The Associated Press contributed to this report.
