The HACKLA
After applying for Section 8, our private data was in the hands of professional hackers demanding a ransom, making us virtual hostages.
I’m
. I’ve been unsheltered in the City of Los Angeles continuously since 2017. I write about corruption and housing policy from the streets and host live Displacement X Spaces discussions on Sundays at 7pm PST on Twitter, where I’m @rooflesser.Federal Housing Choice Vouchers “HCVs”, also called “Section 8” are our country’s #1 “safety net” against mass homelessness. In the City of Los Angeles, a planned opening of the decade-long waitlist for housing subsidies turned into a trap that left applicants, including my partner and I, in even worse shape than we were in before.
After applying for Section 8, our private data was in the hands of professional hackers demanding a ransom, making us virtual hostages.
2017 Lottery
“We are very pleased to be opening our Section 8 waiting list after 13 years…”
—Douglas Gunthrie 10/2/17
When we applied for Section 8 in October 2022, J and I had been living together in the City of LA’s outdoor public spaces, such as under the highway and underground in storm drains continuously since October 2017, which also happens to be the previous time the City’s Section 8 waiting list opened. Before 2017, the City’s Section 8 waiting list had been closed since October 2004.
The 2017 occasion, celebrated by Mayor Eric Garcetti and HACLA President and Chief Executive Officer “CEO” Doug Gunthrie, seems like it was nearly identical to the 2022 opening.
“The application for the waiting list lottery is scheduled to open starting Monday, October 16, 2017 at 6:00 AM until Sunday, October 29, 2017 at 5:00 PM. Applications are available only online through hacla.hcvlist.org.”
There doesn’t appear to be much public information about the 2004 event. But on August 4th, 2017, LA Sentinel’s Sentinel News Service reported CVP Associates, Inc. (CVP) won a competitive bidding process to handle an estimated 600k incoming applicants and manage the City’s Section 8 waitlist. CVP seems to be Customer Value Partners, Inc. (CVP), a consulting firm that boasts partnerships with Amazon Web Services “AWS” and Google Cloud.
“At the end of the application period, HACLA will use a computer-randomized lottery to select up to 20,000 applicants for placement on the Section 8 Waiting List. As funding is available, HACLA will contact applicants for program eligibility determinations.“
—HACLA.org 10/2/17 announcement
Anirudh Kulkarni is the founder and CEO of CVP and previously worked as a founder at Answerthink HCKT 0.00%↑. CVP acquired Atlas Research (Atlas) in 2021. Atlas, founded in 2008, boasts the U.S. Department of Veteran’s Affairs “VA” as a client, where it won a role in fulfilling a 10-year, $1B Veterans Health Administration’s “VHA” Integrated Healthcare Transformation “IHT” contract.
2019 VASH cut off
“A preference for assistance will be given to applicants who live or work in the City of Los Angeles and to applicants who are veterans or have a household member who is a veteran, released from such military service under conditions other than dishonorable.”
Last year, I wrote about how the U.S. Housing and Urban Development Department Veterans Affairs Supportive Housing “HUD-VASH” vouchers for veteran families evaporated in 2019 in “Somehow at some point”, which was originally published by CityWatchLA.
When Heidi Marston left the Veterans Administration “VA” for LA’s Homeless Services Authority “LAHSA” in February 2019, a program in Echo Park that had helped veterans utilize vouchers shut down and reopened as a LAHSA family shelter. Since that happened, the HACLA has not met HUD’s VASH utilization requirement of 70% or higher, and therefore the City of Los Angeles has been effectively cut off from receiving new HUD-VASH vouchers. The HACLA received only one allotment of 250 vouchers since 2019, or 50 vouchers per year, on average.
The HACLA and LACDA, LA County’s Development Authority, combined, used to get over 800 vouchers per year, on average. Had the HACLA managed to lease-up more veteran households on VASH in 2019, Los Angeles could have received enough vouchers for every homeless veteran in LA to have permanent housing on the private market by now, assuming there was enough physical housing.
“The opening of HACLA’s Section 8 Wait List lottery will help thousands of families who struggle to pay for housing on a fixed-income.”
—Doug Gunthrie, The HACLA’s then-president and CEO
Too often, government departments like the VA and our PHA seem to work with each other to deprive beneficiaries of entitlements. For example, until recently, veterans’ benefits counted as “income”. This caused veteran families to be ineligible for subsidized housing, and may have contributed to the low HUD-VASH utilization rate.
Since the government is responsible for paying many “fixed incomes” like VA benefits, Social Security, disability and welfare, public housing authorities “PHAs”should be the voice of their tenants and applicants. PHAs could lobby for higher payments that allow recipients of benefits to afford rent without having to rely on multiple bureaucracies.
2021 3,365 EHVs
“Rental subsidy programs reduce poverty, housing instability and homelessness...”
Until 2021, Section 8 had never specifically sought to relieve recipients of homelessness by bringing people from the street indoors. Then 2021’s American Rescue Plan “ARP” funded 70k HUD Emergency Housing Vouchers “EHVs” targeting unsheltered households. Los Angeles received more than 5,000 with 3,365 coming to the HACLA on July 1st, 2021, and they had to be assigned to a household for leasing by September 30th, 2023. EHV applications were not accepted by HACLA directly and had to come from LAHSA, subjecting them to gatekeeping of nonprofit service providers, whose workers claim they are housing insecure themselves.
Ultimately, the vouchers got leased up, but not quickly enough, causing Los Angeles to forfeit its chance at getting another allotment. EHVs are supposed to expire on September 30th, 2030.
Last month, the U.S. Housing and Urban Development Department “HUD” sent a letter to public housing authorities around the country explaining that final payments would be made this month and they will likely last through the end of 2025. It explains that the funds don’t technically expire until September 30th, 2035, but that no more money will come in after this last payment, so landlords are going to stop getting paid, possibly in 2026, and people are going to be evicted.
✉️ Read the letter from HUD.
2022 LAUSD ransom
On March 10th, 2022, LA Unified School District “LAUSD” released a memo about multi-factor authentication “MFA”, but failed to implement it for six months. On Labor Day, September 5th, 2022, LAUSD was subject of a ransomware attack. Later that week, it decided to finally implement MFA. Ransom negotiations went on for about a month, with LAUSD flatly refusing to pay and the hackers eventually publishing a limited amount of data, giving the appearance that they were exaggerating the amount of information they possessed. It could be said that this attack led to positive changes within the department, and the solution was a practical one which isn’t likely to open a new “back door” for hackers.
2022 Lottery
“It’s been five years since we last opened our Section 8 waiting list and the need for rental assistance has grown…Our goal, with the reopening of HACLA’s Section 8 Waiting List Lottery is to help thousands of families who are struggling financially to find stable housing.”
In October 2022, my partner J and I applied online for the City’s Section 8 “lottery” on my iPhone, which we charged off a 12v car battery. I heard about the lottery on Twitter (now X).
“…We’ve ensured that the online application is convenient to access and easy to apply. There are step-by-step videos to assist applicants on how to apply and frequently asked questions that applicants may have about the program and their eligibility.”
—Doug Gunthrie
The Housing Authority of the City of Los Angeles “The HACLA”, under then-President and Chief Executive Officer “CEO” Doug Gunthrie, had decided to again open its federal housing choice voucher “HCV” waiting list, closed since 2017.
“No applications will be handed out or accepted in-person, by mail, email, or fax at any HACLA office. Applicants will be required to have a valid, working email address.”
—HACLA.org 10/11/22 press release
For two weeks, from 6 a.m. on Monday, October 17th through 5 p.m. on Sunday, October 30th, to much of former Mayor Eric Garcetti’s excited style of fanfare and media buzz, the possibility of a future in stable, subsidized housing was just one online form away at HACLA.HCVList.org.
We lost.
In December, we were notified via email that we were among over half-a-million “losers” who had not been lucky enough to secure one of 20,000 or 30,000 “slots” (the number was inconsistently reported) for subsidized housing that were expected sometime in the next decade. That means The HACLA, which manages roughly 50,000 vouchers, plans on processing 5.5 vouchers per day for the next 10 years.
From July 1st, 2021 through September 30, 2023, The HACLA also had 3,365 Emergency Housing Vouchers “EHVs” available from the American Rescue Plan. That’s 4.3 EHVs per day, in addition to 5.5 Housing Choice Vouchers “HCVs”, for a total of 9.8 vouchers for the HACLA to process per day. The EHVs are no longer available, but why can’t HACLA keep up that same pace?
Public data from the HUD’s HCV dashboard show The HACLA utilizing 82% of its HCVs, with 44,169 out of 52,645 in use as of December 31st, 2023. 85% or 44,772 out of 52,471 HCVs are in use as of December 31st, 2024, a slight improvement in utilization but only because there are 174 fewer vouchers than the year prior. How are we losing vouchers?
HUD considers public housing authorities “PHAs” with utilization rates under 95% “failing”. HUD wants to see utilization rates of 98%. The anticipated average output of 5.5 vouchers/day is disappointing, especially from a department that has a budget of >$1.9B annually, mostly coming from federal sources, supplemented by rents paid by low-income tenants.
Our housing authority needs to be performing more lease-ups daily just to outpace deaths from poverty.
#7adayinLA 🕯️
Seven people are dying on the streets of Los Angeles daily, according to information available from the LA County Medical Examiner. Los Angeles is utilizing death as its main permanent housing outcome and primary escape from poverty.
“Rental assistance programs like these fight against poverty and help reduce homelessness.“
—HACLA.org 10/11/22 press release
I spoke to one family of Section 8 lottery “winners”, who were very grateful and extremely deserving after dealing with a flooded apartment for several years. They were slightly disappointed to learn they’d be waiting by the phone for up to ten years for their permanent subsidies to be ready. The overall effect this lottery had on the public was not a massive sigh of relief, as it should have been for the massive and growing housing insecure population of LA.
When the lottery was over, no one was kissing the ground because it didn’t greatly improve the lives of any of the many needy participants. There was no token winner jumping up and down, being handed a giant coupon redeemable for the lions’ share of their rent on a safe LA home, surrounded by balloons and camera flashes.
Unbelievably, the City’s Section 8 lottery made many of our lives a little bit harder.
2023 “NOTICE OF DATA BREACH”
Less than six months after applying for Section 8, in March 2023, J and I received identical letters to our shared P.O. Box informing us that our data had been breached by HACLA, which had collected our private info in October for the Section 8 lottery.
✉️ Read the entire letter.
The three-page letters offered us one year of free credit monitoring as a consolation for having our data exposed publicly. Examining the letter, it seemed to have been sent from outside of Los Angeles, which was suspicious. It was from a P.O. Box in Pennsylvania. We both decided not to enroll in the free credit monitoring. The offer to call a number and give them the information we were trying to guard felt like a trap.
▶️ Listen to my audio diary from March 2023:
“How are we supposed to know that this isn’t the scam?” 🙃
I asked J, who replied,
“…does it ever end?” 🥴
In the months following, we were called by bill collectors who knew our names. We didn’t engage, but imagined it was probably related to the breach, but we couldn’t definitively prove it. We screened our calls and became wary of answering unfamiliar numbers.
The overall impression I got at the time was that we were somehow being blamed for personal negligence in sharing our private personal information with The HACLA in the Section 8 lottery, while the undetected hackers apparently had access to their system. If we can’t trust our housing authority, one of the oldest in the country, operating since 1938, with our information, how are we supposed to be able to trust them with our housing, if we’re ever lucky enough to become tenants who rely on them to cover a portion of our rent each month?
“What happened?”
—The HACLA, 3/10/23
Contemplating the timeline of events raises more questions. It seems convenient for the waiting list to open like a fire hose of data as hackers were present in the HACLA’s system. Was the entire lottery engineered to extract more personal information from the system for the hackers? Was HACLA.HCVList.org (which no longer exists) compromised? Why didn’t CVP, Inc. become aware of the infiltration sooner? Why did hackers think recovery of our data was worth anything to The HACLA, when they had already decided who was and wasn’t getting assisted from the next voucher allotment? If the whole lottery was engineered to be a scam using the bait of affordable housing, I guess we were suckers.
2023 SBSD Ransom
The following month, the San Bernardino Sheriffs Department “SBSD” paid out over half a million dollars as a ransom payment in response to a cyber attack. On April 8th, 2023, SBSD said their insurance covered half of the $1.1M ransom. Whenever ransoms get satisfied, it increases the value of this disruptive style of hacking. It’s interesting that the police coughed up the cash in order to protect themselves, but school districts and housing departments, who typically have smaller budgets, couldn’t afford to. Do they have a higher deductible on their insurance?
2024 Cyberattack
On Halloween, a tweet on X announced a second incident targeting The HACLA’s system. Lars Daniel wrote for Forbes that 900GB of sensitive data was “exfiltrated” by a named “ransomware gang”, a different named entity than the initial incident, including:
Personal identification information
Database backups
Financial documents
Executive and employee records
Customer information
Internal corporate communications
On May 18, 2023, Attorney Ryan Clarkson of Malibu’s Clarkson Law Firm filed a class-action lawsuit against the City of Los Angeles. Like my partner and I, plaintiff and class representative Michael Azar applied for a subsidy through the HACLA’s open lottery.
Who houses the hackers?
In 2022, LAUSD Superintendent Alberto Carvallo told LAist the hackers were located in Russia, but gave no further proof or explanation. I’m choosing not to speculate on the origin or name either group of hackers. I don’t want to amplify them unless and until I understand their intentions. If these hackers end up exposing illegal tenant removals, denial of housing on any scale and/or shedding light on the inner-workings of the often-opaque, State-mandated City Housing Authority, I’ll appreciate their work. For example, what do the “internal corporate communications” say?
While renewal of federal housing assistance, administered by local public housing authorities “PHAs” like The HACLA, is uncertain, as it currently is, and it appears our City is actually losing coveted subsidies on its own, without outside interference, relief feels farther away than ever. I would like to be wrong, but these data breaches feel like part of a larger assault on tenants and those qualified to reside in subsidy-stabilized housing in general, not rebellion or liberation.
How many identities must be stolen until none of our personal information has any value? Would that be bad, or possibly a good thing?
TL;DR
Types of U.S. Housing and Urban Development Department “HUD” (federal) vouchers:
HCV • Housing Choice Vouchers “Section 8” come directly from a public housing authority “PHA” waitlist.
LACDA • LA County Development Authority
HACLA • Housing Authority of the City of LA
VASH • Veterans Administration Supportive Housing referrals come from nonprofits working for the Veterans Administration “VA” at the Soldier’s Home
VASH PBVs are for permanent supportive housing “PSH” units located at the Soldier’s Home
EHV • Emergency Housing Vouchers funded by American Rescue Plan “ARP” targeted at unhoused households; applications must come to PHA from LAHSA
PBV • Project-Based Vouchers are for PSH; they are non-portable; tenants may move out on HCV after one year; referrals come to PHA from LAHSA, DMH, DHS through the co-ordinated entry system “CES”
HACLA Timeline:
2004 • October • 20k HCVs
2005-07 • HACLA waitlist closed
2008–16 • 4,275 VASH including PBVs
2017 • 10/16–29 • 20k HCVs; 340 VASH
2019 • 0 VASH
2020 • COVID-19; 0 VASH
2021 • 3,365 EHVs; 0 VASH; CVP acquires Atlas (VA contract)
A timeline of the attack was published last year in Forbes. It appears below, with additional events added by me,
, with a *:2022 • 250 VASH*
1/15 • [Hacker] gained initial access to HACLA’s systems.
3/10 • LAUSD Multi-Factor Authentication “MFA” document*
10/17–30 • 20k HCVs*
12/31 • HACLA’s IT team discovered their systems had been encrypted, prompting an immediate server shutdown.
2023 • *0 VASH
1/27 • [Hacker] published the stolen data after ransom negotiations failed.
2/13 • An investigation revealed the true scope of the breach.
Additionally:
3/10 • “Notice of Data Breach”
4/7 • SBSD attack • 4/8 • $1.1M ransom paid
5/18 • Class-action lawsuit
9/30 • EHVs sunset; Exp. 9/30/30.
2024 • 10/31 • 2nd HACLA cyber attack
2025 • 3/6 • HUD EHV letter
2026-35 • EHVs expiring
Also please check out The Homeless Hacker by
, who is homeless with his fiancé.Illustrations created from prompts with Wombo’s free dream.ai app for iOS