Democratic National Committee cyber attacks

The Democratic National Committee cyber attacks took place in 2015 and 2016, in which Russian computer hackers infiltrated the Democratic National Committee (DNC) computer network, leading to a data breach. Some cybersecurity experts, as well as the U.S. government, stated that the cyberespionage was the work of Russian intelligence agencies.

Forensic evidence analyzed by several cybersecurity firms, CrowdStrike, Fidelis, and Mandiant (or FireEye), strongly indicates that two Russian intelligence agencies infiltrated the DNC computer systems. The American cybersecurity firm CrowdStrike, which removed the hacking programs, revealed a history of encounters with both groups and had already named them, calling one of them Cozy Bear and the other Fancy Bear, names which are used in the media.[1][2][3][4][5]

On December 9, 2016, the CIA told U.S. legislators the U.S. Intelligence Community concluded Russia conducted the cyberattacks and other operations during the 2016 U.S. election to assist Donald Trump in winning the presidency.[6] Multiple U.S. intelligence agencies concluded that specific individuals tied to the Russian government provided WikiLeaks with the stolen emails from the DNC, as well as stolen emails from Hillary Clinton's campaign chairman, who was also the target of a cyberattack.[6] These intelligence organizations additionally concluded Russia hacked the Republican National Committee (R.N.C.) as well as the D.N.C., but chose not to leak information obtained from the R.N.C.[7]

Cyber attacks and responsibility

Cyber attacks that successfully penetrated the DNC computing system began in 2015. Attacks by "Cozy Bear" began in the summer of 2015. Attacks by "Fancy Bear" began in April 2016. It was after the "Fancy Bear" group began their activities that the compromised system became apparent. The groups were presumed to have been spying on communications, stealing opposition research on Donald Trump, as well as reading all email and chats. Both were finally identified by CrowdStrike in May 2016. Both groups of intruders were successfully expelled from the DNC systems within hours after detection. These attacks are considered to be part of a group of recent attacks targeting U.S. government departments and several political organizations, including 2016 campaign organizations.[1][2][3][4][5]

On July 22, 2016, a person or entity going by the moniker "Guccifer 2.0" claimed on a WordPress-hosted blog to have been acting alone in hacking the DNC.[8][9] He also claimed to send significant amounts of stolen electronic DNC documents to WikiLeaks. WikiLeaks has not revealed the source for their leaked emails.[10] However, cybersecurity experts and firms, including CrowdStrike, Fidelis Cybersecurity, Mandiant, SecureWorks, ThreatConnect, and the editor for Ars Technica, have rejected the claims of "Guccifer 2.0" and have determined, on the basis of substantial evidence, that the cyberattacks were committed by two Russian state-sponsored groups (Cozy Bear and Fancy Bear).[11]

According to separate reports in the New York Times and the Washington Post, U.S. intelligence agencies have concluded with "high confidence"[12] that the Russian government was behind the theft of emails and documents from the DNC.[12][13] While the U.S. intelligence community has concluded that Russia was behind the cyberattack, intelligence officials told the Washington Post that they had "not reached a conclusion about who passed the emails to WikiLeaks" and so did not know "whether Russian officials directed the leak."[13] A number of experts and cybersecurity analysts believe that "Guccifer 2.0" is probably a Russian government disinformation cover story to distract attention away from the DNC breach by the two Russian intelligence agencies.[1][2][3][4][14]

President Obama and Russian President Vladimir Putin had a discussion about computer security issues, which took place as a side segment during the then-ongoing G20 summit in China in September 2016. Obama said Russian hacking stopped after his warning to Putin.[15]

In a joint statement on October 7, 2016, the United States Department of Homeland Security and the Office of the Director of National Intelligence stated that the US intelligence community is confident that the Russian government directed the breaches and the release of the obtained or allegedly obtained material in an attempt to "… interfere with the US election process."[16][17][18]

Background

As is common among Russian intelligence services, both groups used similar hacking tools and strategies. It is believed that neither group was aware of the other. Although this is antithetical to American computer intelligence methods, for fear of undermining or defeating intelligence operations of the other, this has been common practice in the Russian intelligence community since 2004.[2][4][19]

This intrusion was part of several attacks attempting to access information from American political organizations, including the 2016 U.S. presidential campaigns.[20] Both "Cozy Bear" and "Fancy Bear" are known adversaries, who have extensively engaged in political and economic espionage that benefits the Russian Federation government. Both are believed connected to the Russian intelligence services. Also, both access resources and demonstrate levels of proficiency matching nation-state capabilities.

"Cozy Bear" has in the past year infiltrated unclassified computer systems of the White House, the U.S. State Department, and the U.S. Joint Chiefs of Staff. According to CrowdStrike, other targeted sectors include: Defense, Energy, Mining, Financial, Insurance, Legal, Manufacturing, Media, Think tanks, Pharmaceutical, Research and Technology industries as well as universities. "Cozy Bear" observed attacks have occurred in Western Europe, Brazil, China, Japan, Mexico, New Zealand, South Korea, Turkey and Central Asia.[2][4]

"Fancy Bear" has been operating since the mid-2000s. CrowdStrike reported targeting has included Aerospace, Defense, Energy, Government and the Media industries. "Fancy Bear" intrusions have occurred in United States, Western Europe, Brazil, Canada, China, Republic of Georgia, Iran, Japan, Malaysia and South Korea. Targeted defense ministries and military organizations parallel Russian Federation government interests. This may indicate affiliation with the Main Intelligence Directorate (GRU, a Russian military intelligence service). Specifically, "Fancy Bear" has been linked to intrusions into the German Bundestag and France’s TV5 Monde (television station) in April 2015.[2][4] SecureWorks, a cybersecurity firm headquartered in the United States, concluded that from March 2015 to May 2016, the "Fancy Bear" target list included not merely the DNC, but tens of thousands of foes of Putin and the Kremlin in the United States, Ukraine, Russia, Georgia, and Syria. Only a handful of Republicans were targeted, however.[21]

Hacking the DNC

On January 25, 2018 Dutch newspaper de Volkskrant and TV program Nieuwsuur reported that in 2014 the Dutch Intelligence agency General Intelligence and Security Service (AIVD) successfully infiltrated the computers of Cozy Bear and observed the hacking of the head office of the DNC and subsequently The White House and were the first to alert the National Security Agency about the cyber-intrusion.[22]

In early 2015, the NSA apprised the FBI and other agencies of the DNC intrusions which the Dutch had secretly detected and on August 15, 2015, the Washington field office first alerted DNC technical staff of the compromise of their systems.[23] Much later, the lack of higher level communications between the political party and the government was seen by the former as an "unfathomable lapse" and it wasn't until April 2016 when legal authorizations to share sensitive technical data with the government finally apprised DNC leaders that their systems had been penetrated.[24]

Cozy Bear" had access to DNC systems since the summer of 2015; and "Fancy Bear", since April 2016. There was no evidence of collaboration or knowledge of the other's presence within the system. Rather, the "two Russian espionage groups compromised the same systems and engaged separately in the theft of identical credentials".[4][19][25] "Cozy Bear" employed the "Sea Daddy" implant and an obfuscated PowerShell script as a backdoor, launching malicious code at various times and in various DNC systems. "Fancy Bear" employed X Agent malware, which enabled distant command execution, transmissions of files and keylogging, as well as the "X-Tunnel" malware.

DNC leaders became aware of the compromise in April 2016. These attacks broadly reflect Russian government interest in the U.S. political system, as well as political leaders' policies, tendencies and proclivities while assessing possible beneficial outcomes. The attacks also broadly reflect Russian government interest in the strategies, policies, and practices of the U.S. Government. This also globally reflects foreign governments' interest in ascertaining information on Donald Trump as a new entry into U.S. political leadership roles, in contrast to information likely to have been garnered over the decades pertaining to the Clintons.[2][4]

The DNC commissioned the cybersecurity company CrowdStrike to defeat the intrusions. Its chief technology officer, Dmitri Alperovitch, who is also a cybersecurity expert, stated:

CrowdStrike stands fully by its analysis and findings identifying two separate Russian intelligence-affiliated adversaries present in the DNC network in May 2016[...] We've had lots of experience with both of these actors attempting to target our customers in the past and know them well. In fact, our team considers them some of the best adversaries out of all the numerous nation-state, criminal and hacktivist/terrorist groups we encounter on a daily basis. Their tradecraft is superb, operational security second to none and the extensive usage of 'living-off-the-land' techniques enables them to easily bypass many security solutions they encounter.[4]

Other cybersecurity firms, Fidelis Cybersecurity and FireEye, independently reviewed the malware and came to the same conclusion as CrowdStrike—that expert Russian hacking groups were responsible for the breach.[26] In November 2017, US authorities identified 6 Russian individuals who conducted the hack.[27] Beginning in December 2016 the Russian government arrested Sergei Mikhailov, a high ranking government cyber-spy, Ruslan Stoyanov, a private sector cyber-security expert, Georgy Fomchenkov, a former government cyber-spy, and Dmitry Dokuchaev, a Mikhailov associate and charged them with aiding U.S. intelligence agencies which the New York Times associated with the DNC hacking.[28][29]

Donor information

Although the DNC claimed that no personal, financial, or donor information was accessed, "Guccifer 2.0" leaked what he or they claimed were donor lists detailing DNC campaign contributions to Gawker and The Smoking Gun.[30][31] However, this information has not been authenticated, and doubts remain about Guccifer 2.0's backstory.[32]

Guccifer 2.0
Main article: Guccifer 2.0
Main article: 2016 Democratic National Committee email leak

In June 2016, a person or person(s) claimed to be the hacker who had hacked the DNC servers and then published the stolen documents online.[33] "Guccifer 2.0" later also claimed to have leaked 20.000 emails to WikiLeaks.[34][35]

U.S. intelligence conclusions
ODNI declassified assessment of "Russian activities and intentions in recent U.S. elections"

The U.S. Intelligence Community tasked resources debating why Putin chose summer 2016 to escalate active measures influencing U.S. politics.[36] Director of National Intelligence James R. Clapper said after the 2011–13 Russian protests that Putin's confidence in his viability as a politician was damaged, and Putin responded with the propaganda operation.[36] Former CIA officer Patrick Skinner explained the goal was to spread uncertainty.[37] U.S. Congressman Adam Schiff, Ranking Member of the House Permanent Select Committee on Intelligence, commented on Putin's aims, and said U.S. intelligence agencies were concerned with Russian propaganda.[36] Speaking about disinformation that appeared in Hungary, Slovakia, the Czech Republic, and Poland, Schiff said there was an increase of the same behavior in the U.S.[36] Schiff concluded Russian propaganda operations would continue against the U.S. after the election.[36]

On December 9, 2016, the CIA told U.S. legislators the U.S. Intelligence Community concluded Russia conducted operations during the 2016 U.S. election to assist Donald Trump in winning the presidency.[6][38][39] Multiple U.S intelligence agencies concluded people with specific individuals tied to the Russian government gave WikiLeaks hacked emails from the Democratic National Committee (D.N.C.) and additional sources such as John Podesta, campaign chairman for Hillary Clinton.[6] These intelligence organizations additionally concluded Russia hacked the Republican National Committee (R.N.C.) as well as the D.N.C.—and chose not to leak information obtained from the R.N.C.[7] The CIA said the foreign intelligence agents were Russian operatives previously known to the U.S.[6] CIA officials told U.S. Senators it was "quite clear" Russia's intentions were to help Trump.[38] Trump released a statement December 9, and disregarded the CIA conclusions.[6]

U.S. legislative response

Members of the U.S. Senate Intelligence Committee traveled to Ukraine and Poland in 2016 and learned about Russian operations to influence their affairs.[40] U.S. Senator Angus King told the Portland Press Herald that tactics used by Russia during the 2016 U.S. election were analogous to those used against other countries.[40] On 30 November 2016, King joined a letter in which seven members of the U.S. Senate Intelligence Committee asked President Obama to publicize more information from the intelligence community on Russia's role in the U.S. election.[40][41] In an interview with CNN, Senator King warned against ignoring the problem, saying it was a bipartisan issue.[42]

Representatives in the U.S. Congress took action to monitor the National security of the United States by advancing legislation to monitor propaganda.[43][44] On 30 November 2016, legislators approved a measure within the National Defense Authorization Act to ask the U.S. State Department to act against propaganda with an inter-agency panel.[43][44] The legislation authorized funding of $160 million over a two-year-period.[43] The initiative was developed through a bipartisan bill, the Countering Foreign Propaganda and Disinformation Act, written by U.S. Senators Republican Rob Portman and Democrat Chris Murphy.[43] Portman urged more U.S. government action to counter propaganda.[43] Murphy said after the election it was apparent the U.S. needed additional tactics to fight Russian propaganda.[43] U.S. Senate Intelligence Committee member Ron Wyden said frustration over covert Russian propaganda was bipartisan.[43]

Republican U.S. Senators stated they planned to hold hearings and investigate Russian influence on the 2016 U.S. elections.[45] By doing so they went against the preference of incoming Republican President-elect Donald Trump, who downplayed any potential Russian meddling in the election.[45] U.S. Senate Armed Services Committee Chairman John McCain and U.S. Senate Intelligence Committee Chairman Richard Burr discussed plans for collaboration on investigations of Russian cyberwarfare during the election.[45] U.S. Senate Foreign Relations Committee Chairman Bob Corker planned a 2017 investigation.[45] Senator Lindsey Graham indicated he would conduct a sweeping investigation in the 115th Congress.[45]

President Obama order

On December 9, 2016, President Obama ordered the entire United States Intelligence Community to conduct an investigation into Russia's attempts to influence the 2016 U.S. election — and provide a report before he left office on January 20, 2017.[46][47][48] Lisa Monaco, U.S. Homeland Security Advisor and chief counterterrorism advisor to the president, announced the study, and said the intrusion of a foreign nation into a U.S. national election was an unprecedented event that would necessitate further investigation by subsequent administrations in the executive branch.[46] The intelligence analysis will take into account data from the last three presidential elections in the U.S.[47] Evidence showed malicious cyberwarfare during the 2008 and 2016 U.S. elections.[47]

gollark: Like all correct people, I have a 1080p monitor, which has at least 4 times the size.
gollark: It's not just edit. You also have the tiny 51x19 screen.
gollark: It's *not very useful*.
gollark: GTech™ had drone delivery in *2017* on some random modded server.
gollark: PixelTech's drone delivery program is not actually going to work or bring any revenues in.

See also

References
  1. Rid, Thomas (July 25, 2016). "All Signs Point to Russia Being Behind the DNC Hack". Motherboard. Vice Media. Retrieved 27 July 2016.
  2. Nakashima, Ellen (14 June 2016). "Russian government hackers penetrated DNC, stole opposition research on Trump". The Washington Post. Washington D C. Retrieved 1 February 2017.
  3. Sanger, David E.; Rick Corasaniti (14 June 2016). "D.N.C. Says Russian Hackers Penetrated Its Files, Including Dossier on Donald Trump". The New York Times. New York City. Retrieved 24 July 2016.
  4. Alperovitch, Dmitri (15 June 2016). "Bears in the Midst: Intrusion into the Democratic National Committee". From The Front Lines. CrowdStrike, Inc. Retrieved 22 July 2016. Note: Dmitri Alperovitch is a CrowdStrike co-founder, CTO, and cybersecurity expert.
  5. Sanger, David E.; Schmitt, Eric (July 26, 2016). "Spy Agency Consensus Grows That Russia Hacked D.N.C." New York Times. Retrieved July 27, 2016.
  6. Adam Entous; Ellen Nakashima; Greg Miller (9 December 2016), "Secret CIA assessment says Russia was trying to help Trump win White House", The Washington Post, retrieved 10 December 2016
  7. David E. Sanger; Scott Shane (9 December 2016), "Russia hacked Republican committee but kept data, U.S. concludes", Houston Chronicle, The New York Times, retrieved 10 December 2016
  8. Uchill, Joe (2016-07-26). "Evidence mounts linking DNC email hacker to Russia". The Hill. The Hill. Retrieved July 31, 2016.
  9. Uchill, Joe (2016-07-22). "WikiLeaks posts 20,000 DNC emails". The Hill. Retrieved 2016-08-07.
  10. "WikiLeaks' DNC Email Leak Reveals Off The Record Media Correspondence". CBS News. SanFrancisco.cbslocal.com. July 22, 2016. Retrieved 2016-08-03.
  12. "Spy Agency Consensus Grows That Russia Hacked D.N.C." New York Times. Retrieved July 26, 2016.
  13. Ellen Nakashima, Is there a Russian master plan to install Trump in the White House? Some intelligence officials are skeptical, New York Times (July 27, 2016).
  14. Knight, Nika (14 June 2016). "'Cozy Bear' & 'Fancy Bear' Attack: Russian Hackers Infiltrate DNC Computers". Common Dreams. Portland, ME. Retrieved 22 July 2016. Note: This news article is licensed under a Creative Commons Attribution-Share Alike 3.0 License
  15. "Obama says he told Putin to 'cut it out' on Russia hacking". Politico. December 16, 2016.
  16. Nakashima, Ellen. "US government officially accuses Russia of hacking campaign to interfere with elections". The Washington Post. Retrieved October 7, 2016.
  17. Ackerman, Spencer; Thielman, Sam. "US officially accuses Russia of hacking DNC and interfering with election". The Guardian. Retrieved October 7, 2016.
  18. Evan Perez and Theodore Schleifer. "US accuses Russia of trying to interfere with 2016 election". CNN. Retrieved 2016-10-07.
  19. Staff (11 May 2016). "Summary of Putin's hydra: Inside Russia's intelligence services". European Council on Foreign Affairs. Retrieved 22 July 2016.
  20. Nakashima, Ellen (18 May 2016). "National intelligence director: Hackers have targeted 2016 presidential campaigns". The Washington Post. Retrieved 22 July 2016.
  21. "Russian hackers pursued Putin foes, not just U.S. Democrats". Star-Advertiser. Associated Press. November 1, 2017. Retrieved November 2, 2017.
  22. Dutch intelligence first to alert U.S. about Russian hack of Democratic Party
  23. Miller, Greg (2018). The Apprentice: Trump, Russia and the Subversion of American Democracy. New York: Custom House. p.20. ISBN 978-0-06-280370-2.
  24. Miller, 2018, p. 24.
  25. Naylor, Brian (14 June 2016). "Russian Hackers Penetrate Democratic National Committee..." WBUR. National Public Radio. Retrieved 22 July 2016.
  26. Michael Kan, Russian hackers were behind DNC breach, says Fidelis Cybersecurity, IDG News Service/ComputerWorld (June 20, 2016).
  27. "U.S. authorities identify six Russian officials in DNC hack: WSJ". Reuters. 2 Nov 2017. Retrieved 2017-11-02.
  28. Shane, Scott; Sanger, David E.; and Kramer, Andrew E. (27 January 2017). "Russians Charged With Treason Worked in Office Linked to Election Hacking". New York Times website Retrieved 31 December 2017.
  29. Levintova, Hannah. (21 December 2017). "Is Putin Trying to Pin the DNC Hacks on America’s Own Spies?" Mother Jones website Retrieved 31 December 2017.
  30. Biddle, Sam. "Contrary to DNC Claim, Hacked Data Contains a Ton of Personal Donor Information". Archived from the original on 13 August 2016. Retrieved 1 August 2016.
  31. "DNC Hacker Releases Trump Oppo Report". 15 June 2016. Retrieved 1 August 2016.
  32. Uchill, Joe (13 July 2015). "Guccifer 2.0 releases new DNC docs". The Hill. Capitol Hill Publishing Corp. Retrieved 27 July 2016.
  33. Tal Kopan,Kopan, Tal (June 21, 2016). "DNC hack: What you need to know". CNN.
  34. Uchill, Joe (2016-07-22). "WikiLeaks posts 20,000 DNC emails". The Hill. Retrieved 2016-07-24.
  35. Biddle, Sam. "New Leak: Top DNC Official Wanted to Use Bernie Sanders's Religious Beliefs Against Him". The Intercept. en-US. Retrieved 2016-07-24.
  36. "Vladimir Putin Wins the Election No Matter Who The Next President Is", The Daily Beast, 4 November 2016, retrieved 2 December 2016
  37. Schatz, Bryan, "The Kremlin Would Be Proud of Trump's Propaganda Playbook", Mother Jones, retrieved 2 December 2016
  38. Chris Sanchez; Bryan Logan (9 December 2016), "The CIA says it has evidence that Russia tried to help Trump win the US election", Business Insider, retrieved 10 December 2016
  39. Sommerfeldt, Chris (9 December 2016), "Russia intervened in the 2016 election to help Donald Trump win the White House: report", New York Daily News, retrieved 10 December 2016
  40. Miller, Kevin (1 December 2016), "Angus King: Russian involvement in U.S. election 'an arrow aimed at the heart of democracy'", Portland Press Herald, retrieved 2 December 2016
  41. Staff report (30 November 2016), "Angus King among senators asking president to declassify information about Russia and election", Portland Press Herald, retrieved 2 December 2016
  42. Jim Sciutto; Manu Raju (3 December 2016), Democrats want Russian hacking intelligence declassified, CNN, retrieved 3 December 2016
  43. Timberg, Craig (30 November 2016), "Effort to combat foreign propaganda advances in Congress", The Washington Post, retrieved 1 December 2016
  44. Porter, Tom (1 December 2016), "US House of representatives backs proposal to counter global Russian subversion", International Business Times UK edition, retrieved 1 December 2016
  45. Demirjian, Karoun (8 December 2016), "Republicans ready to launch wide-ranging probe of Russia, despite Trump's stance", Chicago Tribune, The Washington Post, retrieved 10 December 2016
  46. Sanger, David E. (9 December 2016), "Obama Orders Intelligence Report on Russian Election Hacking", The New York Times, retrieved 10 December 2016
  47. Elizabeth Weise; Gregory Korte (9 December 2016), "Obama orders review of foreign attempts to hack U.S. election", USA Today, retrieved 10 December 2016
  48. Josh Gerstein; Jennifer Scholtes; Eric Geller; Martin Matishak (9 December 2016), "Obama orders 'deep dive' of election-related hacking", Politico, retrieved 10 December 2016
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.