captioning funded by cbs and ford. we go further, so you can. >> if your model is built upon the fact that you're not going to pay a dead person's loved ones for a policy that they have completely paid in full, to me that is just a bad policy. >> leslie stahl: he's talking about insurance companies that don't pay out life insurance policies, even when they know their customer has died. and this man's investigation found that it is more widespread than you can imagine. when you found that, what went on inside of you? >> unleash the hounds of hell. let's go after them and expose them for the unconscionable, indefensible behavior. >> bill whitaker: riker's island holds about 10,000 inmates on 400 acres in the shadow of manhattan skyline.

it is known as one of the worst jails in america, with a history of violence. what happened in the case captured on this video is a vivid and horrible example of how bad it can get. >> they watched him languish for seven days as he died. and they did nothing. it was the functional equivalent of torture. they killed him. >> sharyn alfonsi: you've probably been warned to be careful about what you say and do on your phone. do i need to connect this? >> yes. >> alfonsi: okay. but after you see what we found, you won't need to be warned again. >> so, are you connected? >> alfonsi: i am. >> and i have your email. and more importantly i have all the credit cards associated with that account. >> the president of the united states called me on my cell phone. so if the hackers were listening in, they would know that phone conversation. and that is immensely troubling. >> alfonsi: is everything hackable? >> yes. we live in a world where we can't trust the technology that we use.

>> i'm steve kroft. >> i'm lesley stahl. >> i'm bill whitaker. >> i'm sharyn alfonsi. >> i'm scott pelley. those stories tonight on "60 minutes." and i'm still struggling with my diabetes. i do my best to manage. but it's hard to keep up with it. your body and your diabetes change over time. your treatment plan may too. know your options. once-daily toujeo® is a long-acting insulin from the makers of lantus®. it releases slowly to provide consistent insulin levels for a full 24 hours. toujeo® also provides proven full 24-hour blood sugar control and significant a1c reduction. toujeo® is a long-acting, man-made insulin used to control high blood sugar in adults with diabetes. it contains 3 times as much insulin in 1 milliliter as standard insulin. don't use toujeo® to treat diabetic ketoacidosis, during episodes of low blood sugar,

or if you're allergic to insulin. allergic reaction may occur and may be life threatening. don't reuse needles or share insulin pens, even if the needle has been changed. the most common side effect is low blood sugar, which can be serious and life threatening. it may cause shaking, sweating, fast heartbeat, and blurred vision. check your blood sugar levels daily while using toujeo®. injection site reactions may occur. don't change your dose or type of insulin without talking to your doctor. tell your doctor if you take other medicines and about all your medical conditions. insulins, including toujeo®, in combination with tzds (thiazolidinediones) may cause serious side effects like heart failure that can lead to death, even if you've never had heart failure before. don't dilute or mix toujeo® with other insulins or solutions as it may not work as intended and you may lose blood sugar control, which could be serious. ask your doctor about toujeo®. to help protect your dog or cat from fleas and ticks. with the performance you expect from a monthly topical in a non-greasy collar... seresto® kills and repels fleas and ticks for 8 continuous months.

seresto®. from bayer. the #1 selling frequent heartburn brand in america. ♪ "i hope you like it spicy" get complete protection with the purple pill. the leader in frequent heartburn. that's nexium level protection.

>> leslie stahl: when you take out a life insurance policy, you pay premiums in the expectation that when you die your spouse or your children will receive the benefit. but audits of the nation's leading insurance companies have uncovered a systematic, industry-wide practice of not paying significant numbers of beneficiaries. in a little-known series of settlements, 25 of the nation's biggest life insurance companies have agreed to pay more than $7.5 billion in back death benefits. however, about 35 insurance companies have not settled and remain under investigation for not paying when the beneficiary is unaware there was a policy, something that is not at all uncommon. >> kevin mccarty: the

beneficiary never comes forward, because he or she doesn't know the policy exists. >> stahl: but the companies know, says kevin mccarty, the insurance commissioner of florida, who led the national task force investigating the industry. and the companies don't pay, he says, unless a beneficiary makes a claim. >> mccarty: and what we found is that companies have actual knowledge in their files that people have died, yet they have neglected to initiate an investigation and pay the claim. >> stahl: so in other words, life insurance companies are failing to pay out death benefits when they know the person is dead, and they're claiming they don't know. >> mccarty: in many cases, that has been exactly what we have found. >> stahl: when you found that, what went on inside you? >> mccarty: my first instinct was, of course, is unleash the hounds of hell. let's go after them, and expose them for the unconscionable,

indefensible behavior that was going on. >> stahl: he says some of the policies are worth more than a million dollars. but most are valued at less than $10,000. >> joseph bigony: morning, joe! >> stahl: as a result of the audits, joseph bigony of west virginia recently got a long- overdue payment of more than $5,000 from his sister's policy. >> bigony: i was the administrator of her estate when she died in june of 1990, and we didn't know anything about this at all. >> jeff atwater: you're talking about millions of policies. >> stahl: millions? >> atwater: hundreds of thousands of policies that we're dealing with just here in florida. >> stahl: jeff atwater is the chief financial officer of florida in charge of regulating the state's insurance industry. >> atwater: you can assume from what we have found that the policies that should have paid out in the '60s, in the '70s, in the '80s, in the '90s were never paid. >> stahl: and you're saying it's part of their plan? >> atwater: after all we've looked at, lesley, it would be hard to imagine. this is not a small dollar amount. these are billions of dollars

that now stay in the investment accounts of these insurance companies rather than return money to those families. >> stahl: tell us some of the big names. >> atwater: it would be all the large brand names that you're familiar with: john hancock, metlife, prudential. many of these companies have sat down with us and made right. >> stahl: no one disputes that the insurers pay out on policies when the beneficiary files a proper claim. but says kevin mccarty of florida, many of the companies routinely and deliberately disregarded evidence in their own files that the policyholders had died. unless someone filed a claim, he says, the companies would cancel the policy and keep the death benefit for themselves. >> mccarty: here's a life insurance policy that's issued in florida in january 2002. the insurer died in april of 2008. we actually have in the insurance company's file, a

copy, a scanned copy, of the death certificate. and the accompanying envelope which displayed the spouse's return address. >> stahl: with the spouse's address on it. >> mccarty: it's right here. >> stahl: let me see. >> mccarty: less than one month after the death the policy was terminated for non-payment. >> stahl: industry lobbyists, like this one at a recent hearing in florida, argue that the burden falls on the beneficiaries. >> lobbyist: we all enter into contracts every day and if you sign that contract, you're obligated to know what's in it. >> stahl: the companies argue that in the policies that these people signed, it says, black and white, that they have to make the claim and show up with a copy or the policy itself. and if they don't do that, we don't have an obligation. >> mccarty: but florida law says something too. and you have to look at it not just in terms of the contract, but to your responsibilities under the florida insurance code. and i'm here to say that you have a responsibility to investigate a claim if you know someone has died.

and if you have a letter that says you're deceased, you have actual knowledge the person has died. >> stahl: insurance companies are regulated separately by each state and he says similar laws are on the books across the country. >> you see right there? >> stahl: state regulators first got wind of the insurance industry practice from jim hartley and jeff drubner who run a technology and auditing company called verus financial. based on an insider tip in 2006, drubner, employing techniques he had used as an f.b.i. agent, combed through insurance company data and discovered that the insurers were routinely using the social security death master file, which is a constantly- updated list of people who have died in the united states. what was the significance to you that they were using the death master file for something? >> jeff drubner: i knew at that point that they knew because if you have--- >> stahl: they knew who was alive and dead, is what you're saying? >> drubner: yeah, because they know who they've insured and if they have a list of everybody

that's passed away, i knew that they knew. >> stahl: what was the next step? >> jim hartley: the next step was to speak to the states. there wasn't one treasurer, one controller or one attorney general who didn't have a reaction that this shouldn't be allowed to happen and we have to fix it. >> stahl: drubner went on to discover that most insurance companies used the death master file only when it was to their advantage: to cut off annuity, or retirement payments once the policyholder died. but they didn't then notify the life insurance side of the company. >> mccarty: we have actual cases, lesley, where a policyholder had both an annuity and a life policy. and they terminated the annuity, and of course they knew the person was dead, so they-- so-- >> stahl: claimed over here that they didn't know he was dead? >> mccarty: lesley, when we went in and looked at the memos, the right side told the left side and the other side said-- >> stahl: and you saw it in the audits? you would just see it-- >> mccarty: we saw it in the audits.

>> stahl: something else they saw in the audits related to "whole life" insurance policies, that in addition to a death benefit build up a cash nest egg, like a 401k. what they found is that when a beneficiary did not come forward, the company continued to pay themselves premiums out of the dead person's nest egg. in this $20,000 policy, for instance, the nest egg was drained down more than $9,000 to zero after the person had died. california controller betty yee says that kind of siphoning off was widespread in cases where beneficiaries did not come forward. >> betty yee: how can you not be outraged by this? >> stahl: she says that in about a third of the cases, there was evidence of death in the file. >> yee: here we have a policyholder. >> stahl: is this the actual file that you saw with the word "deceased" in large, large unmistakable letters? >> yee: yes, yes. "deceased" with the date of death.

>> stahl: and still they didn't- - they didn't stop paying themselves. >> yee: no, no. and you would've thought with that kind of indication, a next step would be to confirm that by looking at the death master file and beginning the claims process with the family member. >> stahl: and they didn't. >> yee: they didn't. >> stahl: when the cash was all used up, the companies cancelled the policy. under the law, they're allowed to pay themselves premiums using their customer's accumulated cash while they're alive. florida's mccarty says the law was originally intended as a way to protect consumers. >> mccarty: for instance, if you have a life policy and you lose your job and you can't make your premium payment, they will take some of the cash value that's built up in your policy and pay the premium. which is great for consumer protection. >> stahl: but in this situation, after they died... >> mccarty: i think it's tantamount to stealing when you know in your books and records the person is dead and you drain the policy.

now if you think about that, if you would have explained that trying to sell that policy at the beginning-- >> stahl: at the beginning. >> mccarty: you're sitting in your kitchen and saying, you know, you've got all these symbols of security and financial stability and we're going to be there for you with your family in their grief, but they say, "oh, by the way. if you stick that policy in a shoe box and stick it in your closet, not only are we not going to look for you, but we're gonna to take all the cash value in it, and-- >> stahl: give it back to the company. >> mccarty: give it back to the company. and leave your beneficiary with nothing. here, sign here. >> stahl: the 25 insurance companies that have settled with the states admitted no wrongdoing, but agreed to pay out more than $7.5 billion, either directly to the unpaid beneficiaries or to the states, which then try to find the beneficiaries by phone. >> we have received some funds from an insurance company that's in your name.

>> stahl: or online. >> thousands of oklahomans are owed money from life insurance policies. >> stahl: none of the life insurance companies we contacted would give us an interview, but speaking on their behalf, the industry trade association, the american council of life insurers, told us quote: "most life insurers are going well beyond what the law requires to identify policy owners who have died and left unclaimed benefits." ken miller, the treasurer of oklahoma, says there are still about 35 insurance companies that have not settled and some are fighting tooth and nail. at stake, he says, is up to $3 billion more in unclaimed benefits nationwide. who's fighting the hardest? >> ken miller: kemper is the main one. >> stahl: kemper, a chicago- based insurance company, has been pushing for legislation around the country that would bar the states from forcing kemper to go back and search for unpaid beneficiaries.

when we called kemper, they referred us to steve weisbart of the insurance information institute, who says making companies like kemper pay now would be unfair. >> steve weisbart: if we can say, "do something today that you didn't expect to do and didn't plan to do and didn't collect money to do 30 years ago," what else can we say today that they should be doing retroactively. it's potentially an open door. >> stahl: a slippery slope is what you're saying? >> weisbart: a slippery slope. >> stahl: kemper has argued in court filings that it's never used the death master file to identify deceased policyholders and that finding and paying their beneficiaries now would result in "a substantial financial loss" and require the company to "...substanially alter its business practices." >> miller: if your model is built upon the fact that you're not going to pay a dead person's loved ones for a policy that they've completely paid in full,

to me that's just a bad policy. >> stahl: an oklahoma woman, sherry sanders, didn't know about her husband's policy until about a year ago when, because of a settlement, she got a check worth $22,000. we asked oklahoma treasurer miller how much an insurance company can make by holding on to the $22,000. >> miller: well, lesley, now you've hit on something that's the most important issue. and that's the time value of money. because that's what this is all about. this is about money. that $22,000 invested for 50 years at an 8% return becomes $1.2 million. >> stahl: that the company gets because it sat there? >> miller: and that's just one small policy. if you expand that over all the policies that's just due to my state, it's a tremendous amount of money, billions and billions of dollars. >> stahl: the american council of life insurers says that the industry has paid out more than $600 billion in death benefits over the last ten years, so the

companies are doing a good job. >> miller: i don't think we should pat them on the back for doing what they're supposed to do. >> stahl: but the companies say that this is only 1% of the life insurance policies. >> miller: then why fight it? if it's so inconsequential, if it's such a small amount, then why be spending your reputation to not pay dead people's loved ones money that's rightfully due them? >> cbs money watch update sponsored by: >> glor: good evening. the i.r.s. has already processed nearly 105 million tax returns. the deadline to file is the end of monday. a plan to freeze oil production fell apart today after iran skipped a meeting of 18 countries in qatar. and the west coast retailer sports chalet is going out of business after 57 years. i'm jeff glor, cbs news. (gasp) shark diving!

xerox personalized employee portals help companies make benefits simple and accessible... from anywhere. hula dancing? cliff jumping! human resources can work better. with xerox. which allergy? eees. bees? eese. trees? eese. xerox helps hospitals use electronic health records so doctors provide more personalized care. cheese? cheese! patient care can work better. with xerox. that's it.

>> bill whitaker: there has been a lot of talk about criminal justice reform in america, and it would be hard to find a place more in need of reform than rikers island, the most important jail in new york city. located in the middle of the east river, rikers holds about 10,000 inmates. it's a volatile mix. some have been convicted of minor crimes; but as many as 80% are awaiting trial. many are there because they can't make bail. and, in a trend that reflects a growing national problem, rikers holds a rising number of mentally ill inmates. the mentally ill now make up more than 40% of the population. correction officers are not adequately trained to deal with this population.

the result is a disturbing pattern of neglect and excessive force that is the focus of our story tonight. it has led the u.s. attorney preet bharara to intervene. >> preet bharara: what you really had, we found was-- was a culture of violence on top of a code of silence, and that is a deadly combination. and i mean that literally, as we found in a number of cases that we have brought in connection with riker's island. >> whitaker: concerned by those deaths and a stream of alarming reports about rikers island, preet bharara-- who is the u.s. attorney for the southern district of new york-- launched a two-year investigation into the jail complex. >> bharara: we found in an alarming number of cases there was no discipline with respect to officers at all. you had an officer who had dozens of complaints against him and was never disciplined once, or maybe just one time, and that's something that has to change. people have to understand that there are consequences for their actions, not just the inmates,

but the-- the officers as well. >> whitaker: how long has this been going on? >> bharara: years and years. too long. >> whitaker: rikers is a 400- acre island just off the tarmac of laguardia airport in the shadows of manhattan skyscrapers. one bridge leads in and out. it's surrounded by its own moat. the inmate population has come down dramatically from a high of 20,000 to 10,000. but despite the decrease, city data shows violence has gone up over the last decade. because of the us attorney's findings, an unusual collaboration was formed. bharara, the prosecutor, teamed up with plaintiffs' lawyers, the legal aid society and private attorney jonathan abady in a class action lawsuit on behalf of a dozen rikers inmates. >> jonathan abady: the number of facial fractures, of traumatic brain injury, of broken bones, of serious physical injury, is just out of control. >> whitaker: compounding the problems at rikers is that

increase in the number of mentally ill inmates. >> bharara: and that just complicates issues relating to violence and issues relating to care, and issues relating to discipline. so it's a problem. >> whitaker: what was captured on this video, obtained by "60 minutes," helps illustrate what u.s. attorney bharara is talking about. it has not been seen in public before. bradley ballard, who was schizophrenic and diabetic, was brought to rikers in 2013 on charges of violating parole for an assault conviction. in the video, he was "observed twisting his shirt into a phallic symbol and making lewd gestures," and then was taken back to his cell, according to an investigation by the new york state commission of correction. >> abady: he was placed in the functional equivalent of solitary confinement. they put him in a cell. they locked the cell. and they basically threw away the key. >> whitaker: abady represents ballard's family in a pending wrongful death suit against the city. the commission's report found

that ballard was locked in his cell for six days prior to his death and was denied access to his life supporting prescription medications and that day after day, officers, supervisors and clinicians walked by, observed his deteriorating state but failed to help him. after repeated floodings of ballard's toilet, a maintenance worker turned off the water running in to ballard's cell. the report found that ballard was lying in his own waste. he's spraying-- deodorizer? >> abady: yes. the reports are that corrections officers were bringing aerosol cans from home because the stench was so bad coming from that cell. >> whitaker: here, an inmate who delivered a food tray pulled his shirt up over his nose. the report found the videotape indicated ballard's cell was "grossly unsanitary." finally, on the sixth day, medical workers were called. according to the report, an

officer asked ballard if he could get up on his own. "i need help" ballard said. inmate workers carried him out of his cell and put him on a gurney. records showed ballard went into cardiac arrest soon after. he died hours later. >> abady: they watched him languish for seven days as he died. and they did nothing. it was the functional equivalent of torture. they killed him. >> whitaker: the city's medical examiner declared ballard's death a homicide, according to the commission report. it called ballard's medical and custodial treatment from the time he entered rikers "so incompetent and inadequate as to shock the conscience." the department of correction issued a statement that it "adjusted its practices to ensure that a similar tragedy doesn't happen again." but to this day, no criminal charges have been filed against any of the officers, supervisors or health workers involved. it's impossible to know if

anyone stepped forward. but if they did, it wasn't enough to help bradley ballard >> norman seabrook: that's inhumane in my opinion. that should never have happened. >> whitaker: norman seabrook is president of the union that represents the correction officers, but not the higher ranking supervisors. we showed him the ballard video. who's responsible? >> seabrook: the supervisor. >> whitaker: what about your officers? >> seabrook: the officers follow the instructions of the supervisor. >> whitaker: in another incident captured on surveillance video, inmate jose bautista tried to hang himself. he had been arrested on domestic charges and was awaiting trial. he couldn't post the $250 bail. when he jumped up suddenly, officers beat him so severely he suffered a perforated bowel and needed emergency surgery, according to case records. bautista's case was one of 129 "serious injuries" over an 11 month period documented in a revealing report by the new york

city department of health and mental hygiene that was intended for internal use only, but "60 minutes" managed to get a copy. the report found 77% of the injuries involved mentally ill inmates and their injuries were severe enough "to require care beyond the capacity of jail medical doctors." >> dr. daniel selling: you could take a third of the 77% and say that, okay, it was the inmate who was just being violent and needed to be subdued. but 77% is-- i think tells the story. it's a problem. >> whitaker: dr. daniel selling, who is now in private practice, was the executive director of mental health at rikers for five years until he left in 2014. is it fair to say that rikers is a mental institution? >> selling: sure. it's probably one of the largest mental institutions in the nation, if not the largest. >> whitaker: can you tell me about the case of bradley ballard? what does that say about how

things work on rikers? >> selling: that's probably the worst case that i've experienced, been a part of. that was a case in which all systems failed. >> whitaker: selling said the staff of the private medical contractor failed to do the required daily rounds and never informed him about ballard's deteriorating condition. the city's contract with the private medical firm was not renewed. bradley ballard is not the only mentally ill inmate to have died in custody in recent years. in 2014, u.s. attorney preet bharara filed the first criminal civil rights case in a decade against a rikers officer or supervisor in connection with the poisoning of mentally ill inmate jason echevarria, who died after ingesting toxic soap while in solitary confinement. as seen in this video that was entered into evidence, echevarria, a robbery suspect

who was also awaiting trial, was escorted to a cell where he swallowed the toxic soap that was given to him for cleaning his cell. his father ramon told us he believes he ate the soap in a desperate effort to get out of solitary confinement. >> ramon echevaria: and my son was screaming, because he was burning up inside. >> whitaker: he's dying? >> echevarria: he's dying. >> whitaker: a few hours later, according to court documents, correction officer raymond castro alerted unit supervisor captain terrence pendergrass that echevarria needed medical attention. according to castro's testimony, captain pendergrass said, "don't call me if you have live breathing bodies. only call me if you need a cell extraction or if you have a dead body." another correction officer, angel lazarte, testified as to what happened next: a pharmacy technician on her rounds said echevarria could die. he then approached pendergrass, and pendergrass told him to write an injury report. you can see on the tape,

pendergrass then went to look into echevarria's cell himself. he returned and interrupted the writing of the report. pendergrass led lazarte away from the desk. after they talked, lazarte pocketed the report. according to court records, the report was never filed. echevarria was discovered dead the next morning. the medical examiner ruled his death a homicide, due to "neglect and denial of medical care." >> echevarria: he saw him. he was-- he was in pain and everything. why couldn't you just call an ambulance for him? okay, he's a prisoner, he's an inmate. he's a human being. he's a human being. >> bharara: it both breaks your heart and it makes your blood boil, because you're thinking to yourself, here's somebody who had responsibility for making sure that peace was enforced, but also responsible for the safety and protection of those under his charge. >> whitaker: and that report was never filed. >> bharara: one of the conclusions we found in our

investigation was that in case, after case, after case, sometimes you would have individuals who would witness things and they would get together and they would coach each other into what the response should be, which makes it very difficult to hold anyone accountable. >> whitaker: that culture you're describing seemed so entrenched that the officers felt almost comfortable behaving like that even with the cameras running i'm just what-- what does that say to you about that culture? >> bharar: yeah. it says that the culture is broken. it says that the institution is broken. >> whitaker: captain pendergrass was convicted in december 2014. a jury found that pendergrass violated "jason echevarria's constitutional rights by deliberately ignoring his pleas for help and depriving him of urgent medical care, leaving echevarria to die alone in his cell." pendergrass was sentenced to five years in prison. officers castro and lazarte have since been fired. union president norman seabrook

said his officers don't have the training to deal with mentally ill inmates like jason echevarria and bradley ballard. your men are not trained-- >> seabrook: and women. no, they're not trained. >> whitaker: your men and women are not trained to deal with mental illness? >> seabrook: not at all. >> whitaker: we asked norman seabrook about the internal report showing the vast majority of excessive force cases involving mentally ill inmates. >> seabrook: at the end of the day shouldn't the question be, "why didn't these individuals receive their medication, so they wouldn't attack a correction officer?" if you're talking about an inmate that has a mental health problem, then certainly something set this person off. >> whitaker: seabrook says it's not just an issue of the mentally ill. rikers is a dangerous place, and many of his officers are assaulted every year. seabrook wanted to show us the conditions his officers have to contend with. but when he took us out to rikers, department of correction staffers stopped us from going inside with our cameras to see the problems seabrook is talking about. this is as far as we got,

walking around the perimeter of one of the buildings with him. we wanted to talk to the commissioner of the correction department about the problems at rikers, but our three scheduled interviews all were postponed. the city recently initiated a number of policy changes, like installing more cameras and reducing the use of solitary confinement. a federal monitor was appointed to insure the reforms are implemented. u.s. attorney bharara is going to hold the city to it. is there a decrease in violence? >> bharara: you know, it-- it remains to be seen how much that decrease will be over time. i think the training will take some time and is happening as we speak. >> whitaker: it's taken some time to build up this culture of violence. >> bharara: yes, it has. >> whitaker: how long do you think it will take to unravel it? >> bharara: i-- i'm not gonna put a clock on it, but i will say that we're-- we're impatient people, and we like to see results, that's why we got involved in the first place.

te is brought to you by ford. at the rbc heritage in hilton head island, south carolina, south african brandon grace shot a final round 66 to win the tournament by two over luke donald and russell knox. nba playoff action, lebron james and kyrie irving score more than 20 as the cavs won game one against the pistons. for more sports news and information, go to cbssports.com. jim nantz reporting from south carolina. the place ord dealer is to get into a new ford explorer. explorer's terrain management system easily handles changing road conditions. and, explorer gives you push-button convenience with the powerfold third row seat. you'll find a full lineup of ford suvs designed to help you be unstoppable. right now you can drive a new explorer and get 0% financing for 60 months. hurry, this offer is for a limited time only. see your ford dealer today.

the possibility of a flare was almost always on my mind. thinking about what to avoid, where to go... and how to deal with my uc. to me, that was normal. until i talked to my doctor. she told me that humira helps people like me get uc under control and keep it under control when certain medications haven't worked well enough. humira can lower your ability to fight infections, including tuberculosis. serious, sometimes fatal infections and cancers, including lymphoma, have happened; as have blood, liver, and nervous system problems, serious allergic reactions, and new or worsening heart failure. before treatment, get tested for tb. tell your doctor if you've been to areas where certain fungal infections are common, and if you've had tb, hepatitis b, are prone to infections, or have flu-like symptoms or sores. don't start humira if you have an infection. raise your expectations. ask your gastroenterologist about humira. with humira, control is possible.

my wife and i are now participating in your mutual fund. we invested in your fund to help us pay for a college education for our son. we've enclosed a picture of our son so that you can get a sense there are real people out here trusting you with their hard-earned money. ♪ at fidelity, we don't just manage money, we manage people's money. ♪

>> sharyn alfonsi: a lot of modern life is interconnected through the internet of things,

a global empire of billions of devices and machines. automobile navigation systems. smart t.v.'s. thermostats. telephone networks. home security systems. online banking. almost everything you can imagine is linked to the world- wide web. and the emperor of it all is the smartphone. you've probably been warned to be careful about what you say and do on your phone, but after you see what we found, you won't need to be warned again. we heard we could find some of the world's best hackers in germany. so we headed for berlin. just off a trendy street and through this alley, we rang the bell at the door of a former factory. >> karsten nohl: hi! i'm karsten. >> alfonsi: that's where we met karsten nohl. >> come on in. >> alfonsi: a german hacker with a doctorate in computer engineering from the university

of virginia. you can lead the way. we were invited for a rare look at the inner workings of security research labs. during the day, the lab advises fortune 500 companies on computer security. but at night, this international team of hackers looks for flaws in the devices we use everyday: smartphones, usb sticks and sim cards. they are trying to find vulnerabilities before the bad guys do, so they can warn the public about risks. at computer terminals and work benches equipped with micro lasers, they physically and digitally break into systems and devices. >> nohl: hang up. >> alfonsi: now, nohl's team is probing the security of mobile phone networks. is one phone more secure than another? is an iphone more secure than an android?

>> nohl: all phones are the same. >> alfonsi: if you just have somebody's phone number, what could you do? >> nohl: track their whereabouts, know where-- where they go for work, which other people they meet when-- you can spy on whom they call and what they say over the phone. and you can read their texts. >> alfonsi: we wanted to see whether nohl's group could actually do what they claimed. so we sent an off-the-shelf iphone from "60 minutes" in new york to representative ted lieu, a congressman from california. he has a computer science degree from stanford and is a member of the house committee that oversees information technology. he agreed to use our phone to talk to his staff knowing they woulbe hacked. and they were. all we gave nohl was the number of the "60 minutes'" iphone that we lent the congressman. >> alfonsi: hello congressman? it's sharyn alfonsi from "60 minutes." as soon as i called congressman lieu on his phone-- good. how are you doing? nohl and his team were listening

and recording both ends of our conversation. i'm calling from berlin. i wonder if i might talk to you about this hacking story we're working on. >> nohl: what hacking story? >> alfonsi: they were able to do it by exploiting a security flaw they discovered in signaling system seven, or ss7. it is a little-known, but vital global network that connects phone carriers. congressman, thank you so much for helping us. every person with a cell phone needs ss7 to call or text each other. though most of us have never heard of it. nohl says attacks on cell phones are growing as the number of mobile devices explodes. but ss7 is not the way most hackers break into your phone. those hacks are on display in las vegas. >> john hering: three days of non-stop hacking. >> alfonsi: that's where john hering guided us through the unconventional convention where 20,000 hackers get together

every year to share secrets and test their skills. >> hering: it's proving what's possible. any system can be broken. it's just about knowing how to break it. >> alfonsi: hering is a hacker himself. he's the thirty-something whiz who co-founded the mobile security company "lookout" when he was 23. lookout has developed a free app that scans your mobile phone for malware and alerts the user to an attack. how likely is it that somebody's phone has been hacked? >> hering: in today's world, there's really only two types of companies or two types of people which are those who have been hacked and realize it and those who have been hacked and haven't. >> alfonsi: how much do you think people have been kind of ignoring the security of their cell phones, thinking, "i've got a passcode, i must be fine?" >> hering: i think that most people have not really thought about their phones as computers. and that that's really starting to shift. >> alfonsi: and that's what you think? it's like having a laptop now? >> hering: oh absolutely. i mean, your mobile phone is effectively a supercomputer in your pocket. there's more technology in your

mobile phone than was in, you know, the space craft that took man to the moon. i mean, it's-- it's really unbelievable. >> alfonsi: is everything hackable? >> hering: yes. >> alfonsi: everything? >> hering: yes. >> alfonsi: if somebody tells you, "you can't do it." >> hering: i don't believe it. >> alfonsi: john hering offered to prove it. so he gathered a group of ace hackers at our las vegas hotel. each of them a specialist in cracking mobile devices and figuring out how to protect them. >> adam laurie: would you put your money in a bank that didn't test their locks on their safes? we need to try and break it to make sure that the bad guys can't. >> alfonsi: how easy is it to break the phone right now? >> john oberheide: very easy. >> laurie: as you've seen, pretty trivial. >> alfonsi: do i need to connect to it? okay. it started when we logged onto the hotel wi-fi. at least it looked like the hotel wi-fi. hering had created a ghost version. it's called spoofing. i mean, this looks legitimate. >> hering: it looks very legitimate. so you're connected? >> alfonsi: i am. >> hering: and i have your email. ( laughs )

>> alfonsi: you have access to my email right now-- >> hering: yeah. it's coming through right now. i actually can s-- i know have a ride-sharing application up here, all the information that's being transmitted, including your account i.d., your mobile phone, which i just got the mobile number. then more importantly, i have all the credit cards associated with that account. >> alfonsi: jon oberheide pointed out the greatest weakness in mobile security is human nature. >> jon oberheide: with social engineering, you can't really fix the human element. humans are gullible. they install malicious applications. they give up their passwords every day. and it's really hard to fix that human element. >> alfonsi: john hering warned us he could spy on anyone through their own phone as long as the phone's camera had a clear view. we propped up the a phone on my desk and set up cameras to record a demonstration. first he sent a text message with an attachment to download. >> hering: we're in business. >> alfonsi: then hering called from san francisco.

( desk phone rings ) and proved the hack worked. >> hering: i installed some malware in your device that's broadcasting video of your phone. >> alfonsi: my phone's not even lit up. >> hering: i understand, yeah. >> alfonsi: that's so creepy. >> katie: it's pitch black for us. >> alfonsi: in this case, when i downloaded the attachment, hering was able to take control of my phone. but congressman lieu didn't have to do anything to get attacked. all karsten nohl's team in berlin needed to get into the congressman's phone was the number. remember ss7, that little-known global phone network we told you about earlier? >> nohl: i've been tracking the congreeman. >> alfonsi: there's a flaw in it that allowed nohl to intercept and record the congressman's calls and track his movements in washington and back home. >> nohl: the congressman has been in california,, more specifically the l.a. area. zoom in here a little bit, torrance. >> alfonsi: the ss7 network is the heart of the worldwide mobile phone system.

phone companies use ss7 to exchange billing information. billions of calls and text messages travel through its it is also the network that allows phones to roam. are you able to track his movements even if he moves the location services and turns that off? >> nohl: yes. the mobile network independent from the little g.p.s. chip in your phone knows where you are. so any choices that a congressman could've made, choosing a phone, choosing a pin number, installing or not installing certain apps, have no influence over what we are showing because this is targeting the mobile network. that of course, is not controlled by any one customer. >> alfonsi: despite him making good choices. you're still able to get to his phone. >> nohl: exactly. >> alfonsi: karsten nohl and his team were legally granted access to ss7 by several international cell phone carriers. in exchange, the carriers wanted nohl to test the network's

vulnerability to attack. that's because criminals have proven they can get into ss7. >> nohl: mobile networks are the only place in which this problem can be solved. there is no global policing of ss7. each mobile network has to move to protect their customers on their networks. and that is hard. >> alfonsi: nohl and others told us some u.s. carriers are easier to access through ss7 than others. "60 minutes" contacted the cellular phone trade association to ask about attacks on the ss7 network. they acknowledged there have been reports of security breaches abroad, but assured us that all u.s. cell phone networks were secure. congressman lieu was on a u.s. network using the phone we lent him when he was part of our hacking demonstration from berlin. i just want to play for you something we were able to capture off of your phone. >> hi ted it's marc, how are you? >> representative lieu: i'm good.

>> i sent you some revisions on the letter to the n.s.a., regarding the-- the data collection. >> representative lieu: wow. >> alfonsi: what is your reaction to knowing that they were listening to all of your calls? >> representative lieu: i have two. first, it's really creepy. and second, it makes me angry. >> alfonsi: makes you angry, why? >> representative lieu: they could hear any call of pretty much anyone who has a smartphone. it could be stock trades you want someone to execute. it could be calls with a bank. >> alfonsi: karsten nohl's team automatically logged the numbers of every phone that called congressman lieu. which means, there's a lot more damage that could be done than just intercepting that one phone call. a malicous hacker would be able to target and attack every one of the other phones too. so give us an idea, without being too specific, of the types of people that would be in a congressman's phone. >> representative lieu: there are other members of congress, other elected officials.

last year, the president of the united states called me on my cell phone. and we discussed some issues. so if the hackers were listening in, they would know that phone conversation. and that's immensely troubling. >> alfonsi: nohl told us the ss7 flaw is a significant risk, mostly to political leaders and business executives whose private communications could be of high value to hackers. the ability to intercept cell phone calls through the ss7 network is an open secret among the world's intelligence agencies, including ours, and they don't necessarily want that hole plugged. if you end up hearing from the intelligence agencies that this flaw is extremely valuable to them and to the information that they're able to get from it, what would you say to that? >> representative lieu: that the people who knew about this flaw and saying that should be fired. >> alfonsi: should be fired? >> representative lieu: absolutely. >> alfonsi: why? >> representative lieu: you cannot have 300-some million americans and really, right, the global citizenry be at risk of

having their phone conversations intercepted with a known flaw, simply because some intelligence agencies might get some data. that is not acceptable. >> hering: i'd say, that the average person is not going to be exposed to the type of attacks we showed you today. our goal was to show what's possible. so people can really understand if we don't address security issues, what the state of the world will be? >> alfonsi: which will be what? >> hering: we live in a world where we can't trust the technology that we use. >> how your phone could be hacked when a stranger bumps into you. go to 60minutesovertime.com, sponsored by lyrica. before fibromyalgia, i was active. i was energetic. then the chronic, widespread pain drained my energy. my doctor said moving more helps ease fibromyalgia pain. he also prescribed lyrica. fibromyalgia is thought to be the result of overactive nerves.

lyrica is believed to calm these nerves. for some, lyrica can significantly relieve fibromyalgia pain and improve function, so i feel better. lyrica may cause serious allergic reactions or suicidal thoughts or actions. tell your doctor right away if you have these, new or worsening depression, or unusual changes in mood or behavior. or swelling, trouble breathing, rash, hives, blisters, muscle pain with fever, tired feeling, or blurry vision. common side effects are dizziness, sleepiness, weight gain and swelling of hands, legs and feet. don't drink alcohol while taking lyrica. don't drive or use machinery until you know how lyrica affects you. those who have had a drug or alcohol problem may be more likely to misuse lyrica. with less pain, i can be more active. ask your doctor about lyrica. to you, they're more than just a pet. so protect them with k9 advantix ii. it kills fleas, ticks and mosquitoes. k9 advantix ii. for the love of dog.

i'm bushed! i've been on my feel alyea me too. excuse me...coming through! ride the gel wave of comfort with dr. scholls massaging gel insoles. they're proven to give you comfort. which helps you feel more energized ...all day long. i want what he has.

>> stahl: in the mail this week, viewers dove in with comments about our story on schuyler bailar, the transgender swimmer on the harvard men's team. other viewers criticized us for reporting the story at all.

and there was this: i'm lesley stahl. we'll be back next week with another edition of "60 minutes." ♪ the sun'll come out tomorrow... ♪ for people with heart failure, tomorrow is not a given. but entresto is a medicine

that helps make more tomorrows possible. ♪ tomorrow, tomorrow... ♪ i love ya, tomorrow in the largest heart failure study ever. entresto helped more people stay alive and out of the hospital than a leading heart failure medicine. women who are pregnant must not take entresto. it can cause harm or death to an unborn baby. don't take entresto with an ace inhibitor or aliskiren. if you've had angioedema while taking an ace or arb medicine, don't take entresto. the most serious side effects are angioedema, low blood pressure... ...kidney problems, or high potassium in your blood. ♪ tomorrow, tomorrow i love ya, tomorrow.♪ ask your heart doctor about entresto. and help make tomorrow possible. ♪ you're only a day away ♪

previously on madam secretary... henry: i'm offering you a chance to save your sister's life. oh, my god. you, you are asking me to be a spy. you know what they do to spies in russia? please, get me out! henry: i'm taking care of it. now, hang up the damn phone. there he is. abort! abort! abort! what? no. what...? henry: stop the van. stop the van! did you just give him up? who's part of the negotiation? tell me where my brother is. how do you sleep at night? henry: everything in my power. how do you sleep...? (tires squealing) (laughter in distance) (indistinct chatter and laughter) elizabeth: hey, good morning, sleepyhead. good morning, family. morning, dad. i guess my alarm didn't go off. stevie: yeah. my alarm sometimes does that, too. when i forget to set it. uh, well, i guess that's possible. i was up kind of late.