2016 Presidential Campaign Hacking Fast Facts CNN Library
Updated 11:55 AM ET, Tue October 31, 2017
(CNN)Here's a look at hacking incidents during the 2016 presidential campaign and Russian meddling in the election. For details about investigations into hacking and efforts to interfere with the election, see 2016 Presidential Election Investigation Fast Facts.
Timeline: September 2015 - The FBI contacts the Democratic National Committee's help desk, cautioning the IT department that at least one computer has been compromised by Russian hackers. A technician scans the system and does not find anything suspicious.
November 2015 - The FBI reaches out to the DNC again, warning them that one of their computers is transmitting information back to Russia. DNC management later says that IT technicians failed to pass along the message that the system had been breached.
March 19, 2016 - Clinton campaign chairman John Podesta receives a phishing email masked as an alert from Google that another user had tried to access his account. It contains a link to a page where Podesta can change his password. He shares the email with a staffer from the campaign's help desk. The staffer replies with a typo - instead of typing "This is an illegitimate email," the staffer types "This is a legitimate email." Podesta follows the instructions and types a new password, allowing hackers to access his emails.
June 12, 2016 - During an interview on British television, WikiLeaks founder Julian Assange says that the website has obtained and will publish a batch of Clinton emails.
June 14, 2016 - The Washington Post reports hackers working for the Russian government accessed the DNC's computer system, stealing oppositional research on Donald Trump and viewing staffers' emails and chat exchanges. The Kremlin, however, denies that the government was linked to the hack, and a US official tells CNN that investigators have not yet concluded that the cyberattack was directed by the Russian government.
June 15, 2016 - A cybersecurity firm, Crowdstrike, was hired by the DNC posts a public notice on its website describing an attack on the political committee's computer network by two groups associated with Russian intelligence. According to the post, two Russian-backed groups called "Cozy Bear" and "Fancy Bear" tunneled into the committee's computer system. In response, a blogger called Guccifer 2.0 claims that he alone conducted the hack, not the Russians. As proof, he posts internal DNC memos and opposition research on Trump. Furthermore, Guccifer 2.0 claims to have passed along thousands of files to WikiLeaks. Trump offers his own theory on the origins of the attack: suggesting in a statement that the DNC hacked itself to distract from Clinton's email scandal.
July 10, 2016 - Seth Rich is murdered.
July 22, 2016 - Days before the Democratic National Convention, WikiLeaks publishes nearly 20,000 emails hacked from the DNC server. The documents include notes in which DNC chair Debbie Wasserman Schultz insults staffers from the Bernie Sanders campaign and messages that suggest the organization was favoring Clinton rather than remaining neutral. Wasserman Schultz resigns in the aftermath of the leak.
July 25, 2016 - The FBI announces it has launched an investigation into the DNC hack. Although the statement doesn't indicate that the agency has a particular suspect or suspects in mind, US officials tell CNN they think the cyberattack is linked to Russia.
July 27, 2016 - During a press conference, Trump talks about Clinton's use of a private email server while she was secretary of state and calls on hackers to find deleted emails. "Russia, if you're listening, I hope you're able to find the 30,000 emails that are missing," says Trump. Newt Gingrich, a Trump surrogate, defends Trump in a Tweet, dismissing the comment as a "joke."
The DNC computers were not hacked to steal Hillary's emails, Seth ...
FBI Director James Comey told the Senate Intelligence Committee that the FBI did, in fact, issue multiple requests at different levels to the DNC to gain direct access to their computer systems and conduct their own forensic analysis.
And the FBI used the word of a computer security firm, CrowdStrike, that the Russians likely hacked the DNC computer(S). Regardless of who is telling the truth about what really happened, perhaps the most astonishing thing about this probe is that a private firm’s investigation and attribution was deemed sufficient by both the DNC and the FBI.
It gets worse. On July 5, 2016: In the early evening, Eastern Daylight Time, someone working in the EDT time zone with a computer directly connected to the DNC server or DNC Local Area Network, copied 1,976 MegaBytes of data in 87 seconds onto an external storage device.
That speed is many times faster than what is physically possible with a hack. It thus appears that the purported “hack” of the DNC by Guccifer 2.0 (the self-proclaimed WikiLeaks source) was not a hack by Russia, but was rather a copy of DNC data onto an external storage device.
Moreover, the forensics performed on the metadata reveal there was a subsequent synthetic insertion – a cut-and-paste job using a Russian template, with the clear aim of attributing the data to a “Russian hack.” This was all performed in the East Coast time zone.
Comment: Someone gained access to the computer data that Cloudstrike looked at making it look like the Russian hacked the DNC computer. Now if the change was made to the DNC data after the emails pointing to the DNC favoring Hillary, it is likely our CIA made these changes. CIA now has the capability to make it look like the Russians, Chinese/PRC, North Korea, or an extremist Muslim nation did the hacking (aka Obfuscation). https://stonecoldtrut...;
The investigation methods used to come to the conclusion that the Russian Government led the hacks of the DNC, Clinton Campaign Chair John Podesta, and the DCCC were further called into question by a recent BuzzFeed report by Jason Leopold, who has developed a notable reputation from leading several non-partisan Freedom of Information Act lawsuits for investigative journalism purposes.
On March 15 that the Department of Homeland Security released just two heavily redacted pages of unclassified information in response to an FOIA request for definitive evidence of Russian election interference allegations.
Leopold wrote, “what the agency turned over to us and Ryan Shapiro, a PhD candidate at MIT and a research affiliate at Harvard University, is truly bizarre: a two-page intelligence assessment of the incident, dated Aug. 22, 2016, that contains information DHS culled from the internet.
It’s all unclassified — yet DHS covered nearly everything in wide swaths of black ink. Why? Not because it would threaten national security, but because it would reveal the methods DHS uses to gather intelligence, methods that may am
In lieu of substantive evidence provided to the public that the alleged hacks which led to Wikileaks releases of DNC and Clinton Campaign Manager John Podesta’s emails were orchestrated by the Russian Government, CrowdStrike’s bias has been cited as undependable in its own assessment, in addition to its skeptical methods and conclusions.
The firm’s CTO and co-founder, Dmitri Alperovitch, is a senior fellow at the Atlantic Council, a think tank with openly anti-Russian sentiments that is funded by Ukrainian billionaire Victor Pinchuk, who also happened to donate at least $10 million to the Clinton Foundation.
In 2013, the Atlantic Council awarded Hillary Clinton it’s Distinguished International Leadership Award.
In 2014, the Atlantic Council hosted one of several events with former Ukrainian Prime Minister Arseniy Yatsenyuk, who took over after pro-Russian President Viktor Yanukovych was ousted in early 2014, who now lives in exile in Russia.
Recall that the FBI was denied access to the DNC servers by the DNC itself, and simply agreed to rely on the results provided by CrowdStrike, which as you can see has ties to all sorts of anti-Russia organizations and individuals.
I find it absolutely remarkable that James Comey head of the FBI outsourced his job to CrowdStrike.
There remains zero evidence that Russia hacked the DNC. I repeat, there remains zero evidence that Russia hacked the DNC.
As cybersecurity expert Jeffrey Carr noted:
Jeffrey Carr called the FBI/Department of Homeland Security Report, the only alleged evidence released by intelligence officials, released in late December 2016 a “fatally flawed effort” that provided no evidence to substantiate the claims that the Russian government conducted the hacks, though that’s what it was purported to do.
Absolutely remarkable, but there’s more. As TechCrunch reported back in 2015:
If you need proof that security is a red-hot market these days, how about this morning’s announcement that cybersecurity company CrowdStrike landed a $100 million Series C investment round?
The round was led by Google Capital with Rackspace, which happens to be one of the company’s customers also investing. Existing investors Accel and Warburg Pincus also participated. Today’s investment brings the total to-date to $156 million.
Why do I find it interesting that Google was a major investor in CrowdStrike?
Well for one, we know that Chairman of Alphabet, Inc. (Google’s parent company), Eric Schmidt, was actively working to help the Hillary campaign. As I highlighted in the 2015 post, Meet “Groundwork” – Google Chairman Eric Schmidt’s Stealth Startup Working to Make Hillary Clinton President:
An under-the-radar startup funded by billionaire Eric Schmidt has become a major technology vendor for Hillary Clinton’s presidential campaign, underscoring the bonds between Silicon Valley and Democratic politics.
The Groundwork, according to Democratic campaign operatives and technologists, is part of efforts by Schmidt—the executive chairman of Google parent-company Alphabet—to ensure that Clinton has the engineering talent needed to win the election.
And it is one of a series of quiet investments by Schmidt that recognize how modern political campaigns are run, with data analytics and digital outreach as vital ingredients that allow candidates to find, court, and turn out critical voter blocs.
There is also another gap in play: The shrinking distance between Google and the Democratic Party.
Former Google executive Stephanie Hannon is the Clinton campaign’s chief technology officer, and a host of ex-Googlers are currently employed as high-ranking technical staff at the Obama White House. Schmidt, for his part, is one of the most powerful donors in the Democratic Party—and his influence does not stem only from his wealth, estimated by Forbes at more than $10 billion.
According to campaign finance disclosures, Clinton’s campaign is the Groundwork’s only political client. Its employees are mostly back-end software developers with experience at blue-chip tech firms like Netflix, Dreamhost, and Google.
Cyber Firm Rewrites Part of Disputed Russian Hacking Report
WASHINGTON — U.S. cybersecurity firm CrowdStrike has revised and retracted statements it used to buttress claims of Russian hacking during last year's American presidential election campaign.
The shift followed a VOA report that the company misrepresented data published by an influential British think tank.
In December, CrowdStrike said it found evidence that Russians hacked into a Ukrainian artillery app, contributing to heavy losses of howitzers in Ukraine's war with pro-Russian separatists.
VOA reported Tuesday that the International Institute for Strategic Studies (IISS), which publishes an annual reference estimating the strength of world armed forces, disavowed the CrowdStrike report and said it had never been contacted by the company.
Ukraine's Ministry of Defense also has stated that the combat losses and hacking never happened.
Some see overblown allegations
CrowdStrike was first to link hacks of Democratic Party computers to Russian actors last year, but some cybersecurity experts have questioned its evidence.
The company has come under fire from some Republicans who say charges of Kremlin meddling in the election are overblown.
Evelyn Farkas is also a member of the Atlantic Council.
Evelyn was one of Hillary Clinton's campaign advisers and she worked as deputy assistant secretary of defense for Russia/Ukraine/Eurasia under Obama. Such cozy incestuous connections happening last year during the campaign! Even though Evelyn was done in 2015 under President Obama, she was obviously still getting security updates (most likely through Hillary Clinton) and during the transition period from November to January, Evelyn has admitted that there was a second surveillance going on against Trump and his transition team, because she told Mika on Morning Joe that she was worried that all the information that had been gathered by Obama's people would be lost forever and then she pointed out that that's why there were leaks to the media in January!
Why Crowdstrike’s Russian Hacking Story Fell Apart- Say Hello to Fancy Bear
In the wake of the JAR-16-20296 dated December 29, 2016 about hacking and influencing the 2016 election, the need for real evidence is clear. The joint report adds nothing substantial to the October 7th report. It relies on proofs provided by the cyber security firm Crowdstrike that is clearly not on par with intelligence findings or evidence. At the top of the report is an “as is” statement showing this.
The difference between Dmitri Alperovitch’s claims which are reflected in JAR-1620296 and this article is that enough evidence is provided to warrant an investigation of specific parties for the DNC hacks. The real story involves specific anti-American actors that need to be investigated for real crimes.
For instance, the malware used was an out-dated version just waiting to be found. The one other interesting point is that the Russian malware called Grizzly Steppe is from Ukraine. How did Crowdstrike miss this when it is their business to know?
Later in this article you’ll meet and know a little more about the real “Fancy Bear and Cozy Bear.” The bar for identification set by Crowdstrike has never been able to get beyond words like probably, maybe, could be, or should be, in their attribution.
The article is lengthy because the facts need to be in one place. The bar Dimitri Alperovitch set for identifying the hackers involved is that low. Other than asking America to trust them, how many solid facts has Alperovitch provided to back his claim of Russian involvement?
The December 29th JAR adds a flowchart that shows how a basic phishing hack is performed. It doesn’t add anything significant beyond that. Noticeably, they use both their designation APT 28 and APT 29 as well as the Crowdstrike labels of Fancy Bear and Cozy Bear separately.
This is important because information from outside intelligence agencies has the value of rumor or unsubstantiated information at best according to policy. Usable intelligence needs to be free from partisan politics and verifiable. Intel agencies noted back in the early 90’s that every private actor in the information game was radically political.
The Hill.com article about Russia hacking the electric grid is a perfect example of why this intelligence is political and not taken seriously. If any proof of Russian involvement existed, the US would be at war. Under current laws of war, there would be no difference between an attack on the power grid or a missile strike.
According to the Hill “Private security firms provided more detailed forensic analysis, which the FBI and DHS said Thursday correlated with the IC’s findings.
“The Joint Analysis Report recognizes the excellent work undertaken by security companies and private sector network owners and operators, and provides new indicators of compromise and malicious infrastructure identified during the course of investigations and incident response,” read a statement identifies two Russian intelligence groups already named by CrowdStrike and other private security firms.”
In an interview with Washingtonsblog, William Binney, the creator of the NSA global surveillance system said “I expected to see the IP’s or other signatures of APT’s 28/29 [the entities which the U.S. claims hacked the Democratic emails] and where they were located and how/when the data got transferred to them from DNC/HRC [i.e. Hillary Rodham Clinton]/etc. They seem to have been following APT 28/29 since at least 2015, so, where are they?”
According to the latest Washington Post story, Crowdstrike’s CEO tied a group his company dubbed “Fancy Bear” to targeting Ukrainian artillery positions in Debaltsevo as well as across the Ukrainian civil war front for the past 2 years.
Alperovitch states in many articles the Ukrainians were using an Android app to target the self-proclaimed Republics positions and that hacking this app was what gave targeting data to the armies in Donbass instead.
Alperovitch first gained notice when he was the VP in charge of threat research with McAfee.
Asked to comment on Alperovitch’s discovery of Russian hacks on Larry King, John McAfee had this to say.
“Based on all of his experience, McAfee does not believe that Russians were behind the hacks on the Democratic National Committee (DNC), John Podesta’s emails, and the Hillary Clinton presidential campaign. As he told RT, “if it looks like the Russians did it, then I can guarantee you it was not the Russians.”
How does Crowdstrike’s story part with reality? First is the admission that it is probably, maybe, could be Russia hacking the DNC. “Intelligence agencies do not have specific intelligence showing officials in the Kremlin ‘directing’ the identified individuals to pass the Democratic emails to Wiki Leaks.”
The public evidence never goes beyond the word possibility. While never going beyond that or using facts, Crowdstrike insists that it’s Russia behind both Clinton’s and the Ukrainian losses. NBC carried the story because one of the partners in Crowdstrike is also a consultant for NBC.
According to NBC the story reads like this.”The company, Crowdstrike, was hired by the DNC to investigate the hack and issued a report publicly attributing it to Russian intelligence. One of Crowdstrike’s senior executives is Shawn Henry, a former senior FBI official who consults for NBC News.
“But the Russians used the app to turn the tables on their foes, Crowdstrike says. Once a Ukrainian soldier downloaded it on his Android phone, the Russians were able to eavesdrop on his communications and determine his position through geo-location.
In June, Crowdstrike went public with its findings that two separate Russian intelligence agencies had hacked the DNC. One, which Crowdstrike and other researchers call Cozy Bear, is believed to be linked to Russia’s CIA, known as the FSB. The other, known as Fancy Bear, is believed to be tied to the military intelligence agency, called the GRU.”
The information is so certain the level of proof never rises above “believed to be.” According to the December 12th Intercept article “Most importantly, the Post adds that “intelligence agencies do not have specific intelligence showing officials in the Kremlin ‘directing’ the identified individuals to pass the Democratic emails to WikiLeaks.”
Because Ukrainian soldiers are using a smartphone app they activate their geolocation to use it. Targeting is from location to location. The app would need the current user location to make it work.
In 2015 I wrote an article that showed many of the available open source tools that geolocate, and track people. They even show street view. This means that using simple means, someone with freeware or an online website, and not a military budget can look at what you are seeing at any given moment.
Where Crowdstrike fails is insisting people believe that the code they see is (a) an advanced way to geolocate and (b) it was how a state with large resources would do it. Would you leave a calling card where you would get caught and fined through sanctions or worse? If you use an anonymous online resource at least Crowdstrike won’t believe you are Russian and possibly up to something.
” Using open source tools this has been going on for years in the private sector.
For geolocation purposes, your smartphone is one of the greatest tools to use. Finding and following you has never been easier. Let’s face it if you are going to stalk someone, “street view” on a map is the next best thing to being there. In the following video, the software hacks your modem. It’s only one step from your phone or computer.”
Lots more with links. By pawning it off on Russia, they made a worldwide embarrassment of an outgoing President of the United States and made the President Elect the suspect of rumor.
Quite possibly now the former UK Ambassador Craig Murry’s admission of being the involved party to “leaks” should be looked at. “Now both Julian Assange and I have stated definitively the leak does not come from Russia. Do we credibly have access? Yes, very obviously. Very, very few people can be said to definitely have access to the source of the leak.
The people saying it is not Russia are those who do have access. After access, you consider truthfulness.
Do Julian Assange and I have a reputation for truthfulness?
Well in 10 years not one of the tens of thousands of documents WikiLeaks has released has had its authenticity successfully challenged. As for me, I have a reputation for inconvenient truth telling.”
Register for free to join our community of investors and share your ideas. You will also get access to streaming quotes, interactive charts, trades, portfolio, live options flow and more tools.