CNN
—
Two of the most senior figures in the US government — Secretary of State Marco Rubio and the White House chief of staff — have been impersonated in recent weeks using artificial intelligence — a tactic that harnesses a rapidly developing technology that cybersecurity experts say is becoming the “new normal” in terms of cheap and easy scams targeting senior US officials.
“It’s now easy and quick to clone someone’s voice using AI tools, which now require less than 15 seconds of someone’s voice to create a believable voice clone,” said Rachel Tobac, chief executive of SocialProof Security, a firm that trains people to defend against such attacks.
“Just six months ago, I needed a clear one-to-two-minute sample of someone’s voice without background noise or music to create a believable voice clone — not so anymore.”
“Voice-cloning is the new normal (in terms of) impersonation social-engineering attempts,” she said.
Rubio told CNN on Thursday that he expects more AI-based efforts to impersonate him.
“It won’t be the last time you see me or others, for that matter. Maybe some of you will be impersonated,” Rubio said on a trip to Malaysia.
“Within days of becoming Secretary of State, I had foreign ministers calling the State Department asking if I had just texted them,” said Rubio, who is also the national security adviser. “This is just the reality of the 21st Century, AI and fake stuff that’s going on.”
In Rubio’s case, an imposter called at least five people, including three foreign ministers, a governor and a senator. The unknown attacker set up an account on the Signal messaging platform in mid-June using the display name “marco.rubio@state.gov,” according to a State Department cable last week on the incident viewed by CNN.
“The actor left voicemails on Signal for at least two targeted individuals, and in one instance, sent a text message inviting the individual to communicate on Signal,” the cable said.
An AI-based robocall last year that mimicked the voice of then-President Joe Biden and tried to dissuade voters from voting in a primary was a wake-up call for senior US officials over the risks that AI could pose to the electoral process.
For public figures whose voices are everywhere online, the cloning process is even simpler, said Steve Grobman, chief technology officer at cybersecurity firm McAfee.
“What’s most concerning is that with AI-powered clones, seeing – or hearing – is no longer believing, and even trained professionals can be fooled, especially when a familiar voice makes an urgent request,” Grobman told CNN. “It’s also why we need smarter tools to help people tell what’s real and what’s not. We can’t rely on our own instincts anymore.”
However, Rubio and others who heard audio of the call imitating him said it didn’t quite sound like him, meaning whoever was behind it didn’t go to great lengths to match his voice.
The audacity of the ruse is what has some US officials alarmed. A month before the fake Rubio calls began, the FBI warned in May that unidentified “malicious actors” were impersonating senior US officials to target their contacts in government. The aim was to build a rapport with the target to then access their online accounts. The ultimate goal of the scheme — whether to steal information or money — was unclear.
White House Chief of Staff Susie Wiles, a trusted confidant of President Donald Trump, was one of the government officials being impersonated, CNN and other news outlets reported.
Early into the FBI investigation of the Wiles impersonation, officials suspected the impersonator was a criminal rather than state actor, multiple sources familiar with the matter said. But investigators also examined if there was any connection to Iran — given that Tehran-linked hackers were believed to have previously hacked Wiles’ phone.
CNN has requested comment from the FBI on the status of the investigation. Rubio said he referred the matter to the FBI and the State Department’s diplomatic security when he found out about it last week.
Even before news of the Rubio and Wiles imposters broke, employees across the federal bureaucracy were trying to tighten up their phone communications in response to an entirely different and more sophisticated threat. Chinese government-backed hackers broke into America’s biggest telecom providers as part of an effort to spy on senior US officials, Washington alleges, in activity that was revealed last year.
In the wake of that hack, the FBI and Department of Homeland Security urged government employees to use encrypted messaging platforms so the hackers could not snoop on their texts.
There is no way to prevent people from setting up fake accounts and using any of a dozen free pieces of software online to clone someone’s voice. So the FBI and the State Department have been publicly and privately warning US officials to take extra care in their communications, and to tell their circle of contacts about the impersonation schemes.
Government agencies “must now focus on defense and catching attackers using deepfakes in action,” Tobac, the cybersecurity executive, told CNN. “One way to do that is to use another method of communication to verify identity before taking action on a sensitive request.”
CNN’s Kylie Atwood and Jennifer Hansler contributed to this report.
