Cybersecurity Archives - Page 29 of 88

The Latest Chinese Hacking Story: Bots within Bots

December 28, 2016/5 Comments/in Cybersecurity /by emptywheel

Because the press tends to report what the government wants it to on indictments of Chinese hackers, rather than what they’ve really indicted, I wanted to look closely at the case against three Chinese nationals accused — per the news reports — of engaging in insider trading. Here’s how Reuters describes the case against Iat Hong, Bo Zheng, and Chin Hung.

Three Chinese citizens have been criminally charged in the United States with trading on confidential corporate information obtained by hacking into networks and servers of law firms working on mergers, U.S. prosecutors said on Tuesday.

Iat Hong of Macau, Bo Zheng of Changsha, China, and Chin Hung of Macau were charged in an indictment filed in Manhattan federal court with conspiracy, insider trading, wire fraud and computer intrusion.

Prosecutors said the men made more than $4 million by placing trades in at least five company stocks based on inside information from unnamed law firms, including about deals involving Intel Corp and Pitney Bowes Inc.

The indictment does, indeed, accuse the three men of hacking (probably by phishing) into a number of law firms — definitely Cravath Swain & Moore and probably Weil Gotshal to steal information on upcoming mergers and acquisitions. The indictment focuses on the contemplated acquisition of Intermune, by Intel of Altera, and by Pitney Bowes of Borderfree.

Note the indictment never says who was trying to buy Intermune (that is, who the M&A customer of the law firm was). Indeed, in actuality that customer never bought Intermune; Roche did.

That is, for this one transaction, the insider information didn’t necessarily help, because the best information would have involved hacking Roche’s firm.

Other potential buyers of Intermune listed in what may be an article cited in the indictment were Sanofi, Actelion, and GlaxoSmithKline.

That’s not all that big a deal. The indictment at least alleges insider trading accomplished after hacking the lawyers advising on the deals.

Though note that M&A information may not be the only thing to find at the target firms. Christine Varney is the Cravath partner overseeing AT&T’s purchase of Time Warner. That deal was first announced on October 22. This indictment was actually dated October 13 and the first item in the docket dates to June. There would be far more interesting information to some entities, including the Chinese state, about merger involving AT&T that would reside on Cravath’s servers than offering prices, especially given Varney’s close ties to government. That merger necessarily deals with communications policy, up to and including certain surveillance agreements. One would assume the FBI wouldn’t let Cravath to continue to be hacked after the first discovery of this (though John Podesta would argue differently); but if someone like Varney were targeted, there would be far more interesting information than just deal terms.

That said, the detail I found particularly interesting is the way the indictment alleges intellectual property theft. On top of being traders hacking for insider trading information, the indictment claims, the defendants also ran a robotics start-up.

And in addition to stealing information from M&E law firms, the indictment claims the defendants also stole information from a US and a Taiwanese firm involved in robotics.

Indeed, the indictment claims that the defendants were stealing key intellectual property from competitors, from the very beginning of the charged period.

This is interesting to me for several reasons. First, as I have noted, the government likes to claim a Pittsburgh indictment involves IP theft, but in reality, the indictment mostly charges the theft of information pertaining to negotiations, something the US does as well. The sole exception is the theft of nuclear reactor information between companies that already had an information sharing deal.

But also note the timing laid out in the indictment gets awfully vague when it describes the end of the theft of IP. “Late 2015” might or might not be sometime after Obama got Xi Jinpeng to agree to cut down on the hacking of the US in September 2015.

The US has generally played up any possible instance of IP theft involving Chinese nationals. That’s not what happened here. Instead, this is a story about insider trading theft.

Which brings me to one other interesting passage from the indictment, which explains how the defendants tried to hack a bunch of other law firms.

Here, the indictment does list an end date: September 2015, the same month Obama and Xi reached their agreement.

What follows that accusation is a list of five more victim law firms the defendants allegedly tried to hack. All the attempted hacks listed took place on either March 31, or April 3, or April 6, 2015 (so nowhere close to September). Because the information is attempt focused, it might not derive from the targeted law firms (though it could come from a contractor who worked with multiple law firms), but from an attack point.

In any case, thus far this indictment has been spun as another of Preet Bharara’s insider trading indictments. But there may be more here.

Lefties Learn to Love Leaks Again

December 19, 2016/12 Comments/in 2016 Presidential Election, Cybersecurity, Financial Fraud, Russian hacks, WikiLeaks /by emptywheel

Throughout the presidential campaign, observers have noted with irony that many on the right discovered a new-found love for WikiLeaks. Some of the same people who had earlier decried leaks, even called Chelsea Manning a traitor, were lapping up what Julian Assange was dealing on a daily basis.

There was a similar, though less marked, shift on the left. While many on the left had criticized — or at least cautioned about — WikiLeaks from the start, once Assange started targeting their presidential candidate, such leaks became an unprecedented, unparalleled assault on decency, which no one seemed to say when similar leaks targeted Bashar al-Assad.

Which is why I was so amused by the reception of this story yesterday.

After revealing that Donald Trump’s Secretary of State nominee “was the long-time director of a US-Russian oil firm based in the tax haven of the Bahamas, leaked documents show” in the first paragraph, the article admits, in the fourth paragraph that,

Though there is nothing untoward about this directorship, it has not been reported before and is likely to raise fresh questions over Tillerson’s relationship with Russia ahead of a potentially stormy confirmation hearing by the US senate foreign relations committee. Exxon said on Sunday that Tillerson was no longer a director after becoming the company’s CEO in 2006.

The people sharing it on Twitter didn’t seem to notice that (nor did the people RTing my ironic tweet about leaks seem to notice). Effectively, the headline “leaks reveal details I have sensationalized” served its purpose, with few people reading far enough to the caveats that admit this is fairly standard international business practice (indeed, it’s how Trump’s businesses work too). This is a more sober assessment of the import of the document detailing Tillerson’s ties with the Exxon subsidiary doing business in Russia.

This Guardian article worked just like all the articles about DNC and Podesta emails worked, even with — especially with — the people decrying the press for the way it irresponsibly sensationalized those leaks.

The response to this Tillerson document is all the more remarkable given the source of this leak. The Guardian reveals it came from an anonymous source for Süddeutsche Zeitung, which in turn shared the document with the Guardian and the International Consortium of Investigative Journalists.

The leaked 2001 document comes from the corporate registry in the Bahamas. It was one of 1.3m files given to the Germany newspaper Süddeutsche Zeitung by an anonymous source.

[snip]

The documents from the Bahamas corporate registry were shared by Süddeutsche Zeitung with the Guardian and the International Consortium of Investigative Journalists in Washington DC.

That is, this document implicating Vladimir Putin’s buddy Rex Tillerson came via the very same channel that the Panama Papers had, which Putin claimed, back in the time Russia was rifling around the DNC server, was a US intelligence community effort to discredit him and his kleptocratic cronies, largely because that was the initial focus of the US-NGO based consortium that managed the documents adopted, a focus replicated at outlets participating.

See this column for a worthwhile argument that Putin hacked the US as retaliation for the Panama Papers, which makes worthwhile points but would only work chronologically if Putin had advance notice of the Panama Papers (because John Podesta got hacked on March 19, before the first releases from the Panama Papers on April 3).

There really has been a remarkable lack of curiosity about where these files came from. That’s all the more striking in this case, given that the document (barely) implicating Tillerson comes from the Bahamas, where the US at least was collecting every single phone call made.

That’s all the more true given the almost non-existent focus on the Bahamas leaks before — from what I can tell just one story has been done on this stash, though the documents are available in the ICIJ database. Indeed, if the source for the leaks was the same, it would seem to point to an outside hacker rather than an inside leaker. That doesn’t mean the leak was done just to hurt Tillerson. The leak, which became public on September 21, precedes the election of Trump, much less the naming of Tillerson. But it deserves at least some notice.

For what it’s worth, I think it quite possible the US has been involved in such leaks — particularly given how few Americans get named in them. But I don’t think the Panama Papers, which implicated plenty of American friends and even the Saudis, actually did target Putin.

Still, people are going to start believing Putin’s claims that this effort is primarily targeted at him if documents conveniently appear from the leak as if on command.

I am highly interested in who handed off documents allegedly stolen by Russia’s GRU to Wikileaks. But I’m also interested in who the source enabling asymmetric corruption claims, as if on demand, is.

Obama’s Response to Russia’s Hack: An Emphasis on America’s More Generalized Vulnerability

December 18, 2016/10 Comments/in 2016 Presidential Election, Cybersecurity, Russian hacks /by emptywheel

President Obama’s comments Friday about the Russian hack of the DNC were a rare occasion where I liked one of his speeches far more than more partisan Democrats.

I think Democrats were disappointed because Obama declined to promise escalation. The press set Obama up, twice (first Josh Lederman and then Martha Raddatz), with questions inviting him to attack Putin directly. Similarly, a number of reporters asked questions that betrayed an expectation for a big showy response. Rather than providing that, Obama did several things:

Distinguish the integrity of the process of voting from our larger political discourse
Blame our political discourse (and the press) as much as Putin
Insist on a measured response to Putin

Distinguish the integrity of the process of voting from our larger political discourse

From the very start, Obama distinguished between politics and the integrity of our election system.

I think it is very important for us to distinguish between the politics of the election and the need for us, as a country, both from a national security perspective but also in terms of the integrity of our election system and our democracy, to make sure that we don’t create a political football here.

This gets to a point that most people are very sloppy about when they claim Putin “tampered” with the election. Throughout this election, the press has at times either deliberately or incompetently conflated the theft and release of emails (which the intelligence community unanimously agrees was done by Putin) with the hacking of voting-related servers (reportedly done by “Russians,” but not necessarily the Russian state, which is probably why the October 7 IC statement pointedly declined to attribute those hacks to Russia).

Obama, after having laid out how the IC provided the press and voters with a way to account for the importance of the Russian hack on the election, then returns to what he says was a successful effort to ensure Russia didn’t hack the actual vote counting.

What I was concerned about, in particular, was making sure that that wasn’t compounded by potential hacking that could hamper vote counting, affect the actual election process itself.

And so in early September, when I saw President Putin in China, I felt that the most effective way to ensure that that didn’t happen was to talk to him directly and tell him to cut it out, and there were going to be some serious consequences if he didn’t. And, in fact, we did not see further tampering of the election process.

This is consistent with the anonymous statement the White House released over Thanksgiving weekend, which the press seems unaware of. In it, the White House emphasized that it was aware of no malicious election-related tampering, while admitting they had no idea whether Russia had ever planned any in the first place.

Blame our political discourse (and the press) as much as Putin

By far the most important part of Obama’s comments, I think, were his comments about why he believed this to be the right approach.

Obama described the October 7 DHS/ODNI statement as an effort to inform all voters of the hack and leak (and high level involvement in it), without trying to tip the scale politically.

And at that time, we did not attribute motives or any interpretations of why they had done so. We didn’t discuss what the effects of it might be. We simply let people know — the public know, just as we had let members of Congress know — that this had happened.

And as a consequence, all of you wrote a lot of stories about both what had happened, and then you interpreted why that might have happened and what effect it was going to have on the election outcomes. We did not. And the reason we did not was because in this hyper-partisan atmosphere, at a time when my primary concern was making sure that the integrity of the election process was not in any way damaged, at a time when anything that was said by me or anybody in the White House would immediately be seen through a partisan lens, I wanted to make sure that everybody understood we were playing this thing straight — that we weren’t trying to advantage one side or another, but what we were trying to do was let people know that this had taken place, and so if you started seeing effects on the election, if you were trying to measure why this was happening and how you should consume the information that was being leaked, that you might want to take this into account.

And that’s exactly how we should have handled it.

Again, I get why Democrats are furious about this passage: they wanted and still want the IC to attack Trump for benefitting from the Russian hack. Or at the very least, they want to legitimize their plan to delegitimize Trump by using his Russian ties with Obama endorsement. From a partisan view, I get that. But I also very much agree with Obama’s larger point: if Russia’s simple hack decided the election, it’s as much a statement about how sick our democracy is, across the board, as it is a big win for Putin.

To lead into that point, Obama points out how many of the people in the room — how the press — obsessed about every single new leak, rather than focusing on the issues that mattered to the election.

[W]e allowed you and the American public to make an assessment as to how to weigh that going into the election.

And the truth is, is that there was nobody here who didn’t have some sense of what kind of effect it might have. I’m finding it a little curious that everybody is suddenly acting surprised that this looked like it was disadvantaging Hillary Clinton because you guys wrote about it every day. Every single leak. About every little juicy tidbit of political gossip — including John Podesta’s risotto recipe. This was an obsession that dominated the news coverage.

So I do think it’s worth us reflecting how it is that a presidential election of such importance, of such moment, with so many big issues at stake and such a contrast between the candidates, came to be dominated by a bunch of these leaks. What is it about our political system that made us vulnerable to these kinds of potential manipulations — which, as I’ve said publicly before, were not particularly sophisticated.

This was not some elaborate, complicated espionage scheme. They hacked into some Democratic Party emails that contained pretty routine stuff, some of it embarrassing or uncomfortable, because I suspect that if any of us got our emails hacked into, there might be some things that we wouldn’t want suddenly appearing on the front page of a newspaper or a telecast, even if there wasn’t anything particularly illegal or controversial about it. And then it just took off.

And that concerns me.

He returns to that more generally, with one of the most important lines of the presser. “Our vulnerability to Russia or any other foreign power is directly related to how divided, partisan, dysfunctional our political process is.”

The more [the review of the hack] can be nonpartisan, the better served the American people are going to be, which is why I made the point earlier — and I’m going to keep on repeating this point: Our vulnerability to Russia or any other foreign power is directly related to how divided, partisan, dysfunctional our political process is. That’s the thing that makes us vulnerable.

If fake news that’s being released by some foreign government is almost identical to reports that are being issued through partisan news venues, then it’s not surprising that that foreign propaganda will have a greater effect, because it doesn’t seem that far-fetched compared to some of the other stuff that folks are hearing from domestic propagandists.

To the extent that our political dialogue is such where everything is under suspicion, everybody is corrupt and everybody is doing things for partisan reasons, and all of our institutions are full of malevolent actors — if that’s the storyline that’s being put out there by whatever party is out of power, then when a foreign government introduces that same argument with facts that are made up, voters who have been listening to that stuff for years, who have been getting that stuff every day from talk radio or other venues, they’re going to believe it.

So if we want to really reduce foreign influence on our elections, then we better think about how to make sure that our political process, our political dialogue is stronger than it’s been.

Now, the Democrats who have celebrated hopey changey Obama have, over the years, recognized that his effort to be bipartisan squandered his opportunity, in 2009, to really set up a structure that would make us more resilient. It is, admittedly, infuriating that in his last presser Obama still endorses bipartisanship when the last 8 years (and events rolling out in North Carolina even as he was speaking) prove that the GOP will not play that game unless forced to.

So I get the anger here.

But, it is also true that our democracy was fragile well before Vladimir Putin decided he was going to fuck around. Even if Putin hadn’t hacked John Podesta, the way in which the email investigation rolled out accomplished the same objective. (Indeed, at one point I wondered whether Putin wasn’t jealous of Comey for having a much bigger effect on the election). Even if some Russians didn’t put out fake news, others were still going to do that, playing to the algorithmically enhanced biases of Trump voters. Even without Putin hacking voting machines, we can be certain that in places like Wisconsin and North Carolina the vote had already been hacked by Republicans suppressing Democratic vote.

The effect Putin was seeking was happening, happened, anyway, even without his involvement. That doesn’t excuse his involvement, but it does say that if we nuked Putin off the face of this earth tomorrow, our democracy would remain just as fragile as it was with Putin playing in it during this election.

So Obama is right about our vulnerability, though I think he really hasn’t offered a way to fix it. That’s what we all need to figure out going forward. But I can assure you: focusing exclusively on Russia, as if that is the problem and not the underlying fragility, is not going to fix it.

Insist on a measured response to Putin

Which leads us to his comments on a response. In spite of repeated efforts to get him to say “Vlad Putin is a big fat dick who personally elected Donald Trump,” Obama refused (though that didn’t stop some papers from adopting headings suggesting he had). Rather, Obama used the language used in the October 7 statement, saying the hacks were approved by the highest levels of the Russian government, which necessarily means Putin authorized them.

We have said, and I will confirm, that this happened at the highest levels of the Russian government. And I will let you make that determination as to whether there are high-level Russian officials who go off rogue and decide to tamper with the U.S. election process without Vladimir Putin knowing about it.

Q So I wouldn’t be wrong in saying the President thinks Vladimir Putin authorized the hack?

THE PRESIDENT: Martha, I’ve given you what I’m going to give you.

Similarly, Obama refused to respond to journalists’ invitation to announce some big retaliation.

I know that there have been folks out there who suggest somehow that if we went out there and made big announcements, and thumped our chests about a bunch of stuff, that somehow that would potentially spook the Russians. But keep in mind that we already have enormous numbers of sanctions against the Russians. The relationship between us and Russia has deteriorated, sadly, significantly over the last several years. And so how we approach an appropriate response that increases costs for them for behavior like this in the future, but does not create problems for us, is something that’s worth taking the time to think through and figure out.

I’m going to return to this to discuss a detail no one seems to get about Obama’s choices right now. But for the moment, note his emphasis on a response that increases costs for such hacks that do “not create problems for us.”

Unsurprisingly (and, given America’s own aggressive cyberattacks, possibly unrealistically), Obama says he is most seeking norm-setting.

What we’ve also tried to do is to start creating some international norms about this to prevent some sort of cyber arms race, because we obviously have offensive capabilities as well as defensive capabilities. And my approach is not a situation in which everybody is worse off because folks are constantly attacking each other back and forth, but putting some guardrails around the behavior of nation-states, including our adversaries, just so that they understand that whatever they do to us we can potentially do to them.

Obama’s approach is “not a situation in which everybody is worse off because folks are constantly attacking each other back and forth.” Does that suggest the US has already been hacking Russia? Why do we never consider whether Putin was retaliating against us? Who started this cyberwar, anyway?

Funny how Americans assume the answer must be Putin.

In any case, we do need norms about this stuff, but that likely would require some honestly about what, if anything, is different about cyber election tampering than all the election tampering Russia and the US have engaged in for decades — which is a point Chilean Ariel Dorfman makes after pointing out the irony of CIA “crying foul because its tactics have been imitated by a powerful international rival.”

Even assuming we’ll never learn the full extent of America’s own recent tampering, that’s likely to be something that Obama is thinking about as journalists and Democrats wail that he isn’t taking a more aggressive stance.

The DNC’s Evolving Story about When They Knew They Were Targeted by Russia

December 16, 2016/29 Comments/in 2016 Presidential Election, Cybersecurity, Russian hacks /by emptywheel

This week’s front page story about the Democrats getting hacked by Russia starts with a Keystone Kops anecdote explaining why the DNC didn’t respond more aggressively when FBI first warned them about being targeted in September. The explanation, per the contractor presumably covering his rear-end months later, was that the FBI Special Agent didn’t adequately identify himself.

When Special Agent Adrian Hawkins of the Federal Bureau of Investigation called the Democratic National Committee in September 2015 to pass along some troubling news about its computer network, he was transferred, naturally, to the help desk.

His message was brief, if alarming. At least one computer system belonging to the D.N.C. had been compromised by hackers federal investigators had named “the Dukes,” a cyberespionage team linked to the Russian government.

The F.B.I. knew it well: The bureau had spent the last few years trying to kick the Dukes out of the unclassified email systems of the White House, the State Department and even the Joint Chiefs of Staff, one of the government’s best-protected networks.

Yared Tamene, the tech-support contractor at the D.N.C. who fielded the call, was no expert in cyberattacks. His first moves were to check Google for “the Dukes” and conduct a cursory search of the D.N.C. computer system logs to look for hints of such a cyberintrusion. By his own account, he did not look too hard even after Special Agent Hawkins called back repeatedly over the next several weeks — in part because he wasn’t certain the caller was a real F.B.I. agent and not an impostor.

This has led to (partially justified) complaints from John Podesta about why the FBI didn’t make the effort of driving over to the DNC to warn the higher-ups (who, the article admitted, had decided not to spend much money on cybersecurity).

This NYT version of the FBI Agent story comes from a memo that DNC’s contractor, Yared Tamene, wrote at some point after the fact. The NYT describes the memo repeatedly, though it never describes the recipients of the memo nor reveals precisely when it was written (it is clear it had to have been written after April 2016).

“I had no way of differentiating the call I just received from a prank call,” Mr. Tamene wrote in an internal memo, obtained by The New York Times, that detailed his contact with the F.B.I.

[snip]

“The F.B.I. thinks the D.N.C. has at least one compromised computer on its network and the F.B.I. wanted to know if the D.N.C. is aware, and if so, what the D.N.C. is doing about it,” Mr. Tamene wrote in an internal memo about his contacts with the F.B.I. He added that “the Special Agent told me to look for a specific type of malware dubbed ‘Dukes’ by the U.S. intelligence community and in cybersecurity circles.”

[snip]

In November, Special Agent Hawkins called with more ominous news. A D.N.C. computer was “calling home, where home meant Russia,” Mr. Tamene’s memo says, referring to software sending information to Moscow. “SA Hawkins added that the F.B.I. thinks that this calling home behavior could be the result of a state-sponsored attack.”

[DNC technology director Andrew] Brown knew that Mr. Tamene, who declined to comment, was fielding calls from the F.B.I. But he was tied up on a different problem: evidence suggesting that the campaign of Senator Bernie Sanders of Vermont, Mrs. Clinton’s main Democratic opponent, had improperly gained access to her campaign data.

[snip]

One bit of progress had finally been made by the middle of April: The D.N.C., seven months after it had first been warned, finally installed a “robust set of monitoring tools,” Mr. Tamene’s internal memo says. [my emphasis]

The NYT includes a screen cap of part of that memo (which reveals that the DNC had already been exposed to ransomware attacks by September 2015), but not the other metadata or a link to the full memo.

One reason I raise all this is because the evidence laid out in the story contradicts, in several ways, this August report, relying on three anonymous sources (at least some of whom are probably members of Congress, but then so was the DNC Chair at the time).

The FBI did not tell the Democratic National Committee that U.S officials suspected it was the target of a Russian government-backed cyber attack when agents first contacted the party last fall, three people with knowledge of the discussions told Reuters.

And in months of follow-up conversations about the DNC’s network security, the FBI did not warn party officials that the attack was being investigated as Russian espionage, the sources said.

The lack of full disclosure by the FBI prevented DNC staffers from taking steps that could have reduced the number of confidential emails and documents stolen, one of the sources said. Instead, Russian hackers whom security experts believe are affiliated with the Russian government continued to have access to Democratic Party computers for months during a crucial phase in the U.S. presidential campaign, the source said.

[snip]

In its initial contact with the DNC last fall, the FBI instructed DNC personnel to look for signs of unusual activity on the group’s computer network, one person familiar with the matter said. DNC staff examined their logs and files without finding anything suspicious, that person said.

When DNC staffers requested further information from the FBI to help them track the incursion, they said the agency declined to provide it. In the months that followed, FBI officials spoke with DNC staffers on several other occasions but did not mention the suspicion of Russian involvement in an attack, sources said.

The DNC’s information technology team did not realize the seriousness of the incursion until late March, the sources said. It was unclear what prompted the IT team’s realization.

In August, anonymous sources told Reuters that FBI never told DNC they were being attacked by Russians until … well, Reuters doesn’t actually tell us when the FBI told DNC the Russians were behind the attack, just that Democrats started taking it seriously in March.

But in the pre-Trump Russian hack bonanza, the NYT has now revealed that an internal memo says that the DNC had been informed in November, not March.

And even that part of the explanation doesn’t make sense. As a number of people have noted, Brown is basically saying he didn’t respond to a warning — given in November — that a DNC server was calling home to Russia because he was dealing with a NGP-VAN breach that happened on December 18. He would have had over two weeks to respond to Russia hacking the DNC before the NGP-VAN issue, and that would have been significantly handled by NGP.

Moreover, even the September narrative invites some skepticism. Tamene admits the FBI Special Agent, “told me to look for a specific type of malware dubbed ‘Dukes’ by the U.S. intelligence community and in cybersecurity circles.” And he describes “His first moves were to check Google for “the Dukes” and conduct a cursory search of the D.N.C. computer system logs to look for hints of such a cyberintrusion.” Had Tamene Googled for “dukes malware” any time after September 17, 2015, this is what he would have found.

Today we release a new whitepaper on an APT group commonly referred to as “the Dukes”. We believe that the Dukes are a well-resourced, highly dedicated, and organized cyber-espionage group that has been working for the Russian government since at least 2008 to collect intelligence in support of foreign and security policy decision-making. [my emphasis]

So had this initial report taken place after September 17, Tamene would have learned, thanks to the second sentence of a top Google return, that he was facing a “highly dedicated, and organized cyber-espionage group that has been working for the Russian government. ” Had he done the Google search he said he did, that is, he would almost certainly have learned he was facing down Russian hackers.

Had he clicked through to the report — which is where he would have gone to find the malware signatures to look for — he would have seen a big pink graphic tying the Dukes to Russia.

It’s certainly possible the alert came before the white paper was released (though if it came after, it explains why the FBI would have thought simply mentioning the Dukes would be sufficient). But that would suggest Tamene remembered the call and his Google search for the Dukes in detail sometime in April but not in September when this report got a fair amount of attention.

None of this is to excuse the FBI (I’ve already started a post on that part of this). But it’s clear that Democrats have been — at a minimum — inconsistent in their story to the press about why they didn’t respond to warnings sooner. And given the multiple problems with their explanation about what happened last fall, it’s likely they did get some warning, but just didn’t heed it.

Update: When I wrote this this morning, I had read this tweet stream and this story but not the underlying Shadow Brokers related post, by someone writing under the pseudonym Boceffus Cleetus it relates to, which is basically a Medium post introducing the latest sale of Shadow Broker tools. It wasn’t until I read this post — and then the second Boceffus Cleetus post that I realized Boceffus Cleetus posted (his) original post — along with a reference to the name magnified back when this hack started — the day after the NYT wrote a story of the hack from DNC’s perspective.

As the tweet stream lays out, Boceffus Cleetus is a play on ventriloquism, (duh, speaking for others) and the Dukes of Hazard. Both analyses of this argue that the reference to “Dukes of Hazard” is, in turn, a reference to the name given to the FSB hacking efforts (the other I’ve used is “Cozy Bear”) in the report I linked above — that is, to the name F-Secure had given the FSB hackers, most notably in the report I linked above. I didn’t make too much of it until I read this second Boceffus Cleetus post, which in seemingly one sentence lays out Bill Binney’s theory of the DNC hack (that is, that NSA handed it on) with a country drawl and a lot of conspiracy theory added.

After my shadow brokers tweet I was contacted by an anonymous source claiming to be FBI. Yep I know prove it? I wasn’t able to get’em to verify their identity. But y’all don’t be runnin away yet, suspend yer disbelief and check out their claims. What if the Russian’s ain’t hacking nothin? What if the shadow brokers ain’t Russian? Whatcha got as the next best theory? What if its a deep state civil war tween CIA and ole NSA? A deep state civil war to see who really runs things. NSA is Department of Defense, military. The majority of the military are high school grads, coming from rural “Red States”, conservatives. The NSA has the global surveillance capabilities to intercept all the DNC and Podesta emails. CIA is college grads only and has the traditions of the urban yankee northeastern and east coast ivy leaguers, “Blue State”, liberals.

It’s all mostly gratuitous — an attempt to feed (as explicitly named “fake news”) some of the alternate explanations out there right now.

But I find the portrayal of an NSA-CIA feud notable, in part, because the mostly likely reason FBI (which is where Boceffus Cleetus’ fictional source came from) didn’t tell the DNC who was hacking them back in September 2015 is because the actual tip — that Russia was hacking the DNC — came from the NSA. But FBI had to hide that. So instead, they used the name for FSB that was current at the time.

I’ll add, too, that this plays on Craig Murray’s claim that a national security person leaked him the Podesta documents.

So what’s the point? Dunno. I defer to theGrugq’s third post, in which he argues this post is signaling to show NSA the Russian hackers must have access to NSA’s classified networks, because they’ve accessed a map of everything.

This dump has a bit of everything. In fact, it has too much of everything. The first drop was a firewall ops kit. It had everything that was supposed to be used against firewalls. This dump, on the other hand, has too much diversity and each tool is comprehensive.

The depth and breadth of the tooling they reveal can only possibly be explained by:

an improbable sequence of hack backs which got, in sequence, massive depth of codenamed implants, exploits, manuals,

access to high side data

[snip]

It is obvious that this data would never leave NSA classified networks except by some serious operator error (as I believe was the case with the first ShadowBrokers leak.) For this dump though, it is simply not plausible. There is no way that such diverse and comprehensive ops tooling was accidentally exposed. It beggars belief to think that any operator could be so careless that they’d expose this much tooling, on multiple diverse operations.

There are, based on my count, twenty one (21) scripts/manuals for operations contained in this dump. They cover too many operations for a mistake, and they are too comprehensive for a mistake.

Remember, Obama has been stating assuredly that the US has far more defensive and offensive capability than Russia. The latter might well be true. But the latter is nuts, if for no other reason than we have so much more to secure. The former might be true. But not if hackers can log into NSA’s fridge and steal their beer.

I’m not entirely sure what to make of this. But against the background of increasing dick-wagging, it’ll be interesting to see how it plays out.

Unpacking the New CIA Leak: Don’t Ignore the Aluminum Tube Footnote

December 9, 2016/57 Comments/in 2016 Presidential Election, Cybersecurity, Russian hacks /by emptywheel

This post will unpack the leak from the CIA published in the WaPo tonight.

Before I start with the substance of the story, consider this background. First, if Trump comes into office on the current trajectory, the US will let Russia help Bashar al-Assad stay in power, thwarting a 4-year effort on the part of the Saudis to remove him from power. It will also restructure the hierarchy of horrible human rights abusing allies the US has, with the Saudis losing out to other human rights abusers, potentially up to and including that other petrostate, Russia. It will also install a ton of people with ties to the US oil industry in the cabinet, meaning the US will effectively subsidize oil production in this country, which will have the perhaps inadvertent result of ensuring the US remains oil-independent even though the market can’t justify fracking right now.

The CIA is institutionally quite close with the Saudis right now, and has been in charge of their covert war against Assad.

This story came 24 days after the White House released an anonymous statement asserting, among other things, “the Federal government did not observe any increased level of malicious cyber activity aimed at disrupting our electoral process on election day,” suggesting that the Russians may have been deterred.

This story was leaked within hours of the time the White House announced it was calling for an all-intelligence community review of the Russia intelligence, offered without much detail. Indeed, this story was leaked and published as an update to that story.

Which is to say, the CIA and/or people in Congress (this story seems primarily to come from Democratic Senators) leaked this, apparently in response to President Obama’s not terribly urgent call to have all intelligence agencies weigh in on the subject of Russian influence, after weeks of Democrats pressuring him to release more information. It was designed to both make the White House-ordered review more urgent and influence the outcome.

So here’s what that story says.

In September, the spooks briefed “congressional leaders” (which for a variety of reasons I wildarseguess is either a Gang of Four briefing including Paul Ryan, Nancy Pelosi, Mitch McConnell, and Harry Reid or a briefing to SSCI plus McConnell, Reid, Jack Reed, and John McCain). Apparently, the substance of the briefing was that Russia’s intent in hacking Democratic entities was not to increase distrust of institutions, but instead to elect Trump.

The CIA has concluded in a secret assessment that Russia intervened in the 2016 election to help Donald Trump win the presidency, rather than just to undermine confidence in the U.S. electoral system, according to officials briefed on the matter.

The difference between this story and other public assessments is that it seems to identify the people — who sound like people with ties to the Russian government but not necessarily part of it — who funneled documents from Russia’s GRU to Wikileaks.

Intelligence agencies have identified individuals with connections to the Russian government who provided WikiLeaks with thousands of hacked emails from the Democratic National Committee and others, including Hillary Clinton’s campaign chairman, according to U.S. officials. Those officials described the individuals as actors known to the intelligence community and part of a wider Russian operation to boost Trump and hurt Clinton’s chances.

[snip]

[I]ntelligence agencies do not have specific intelligence showing officials in the Kremlin “directing” the identified individuals to pass the Democratic emails to WikiLeaks, a second senior U.S. official said. Those actors, according to the official, were “one step” removed from the Russian government, rather than government employees.

This is the part that has always been missing in the past: how the documents got from GRU, which hacked the DNC and John Podesta, to Wikileaks, which released them. It appears that CIA now thinks they know the answer: some people one step removed from the Russian government, funneling the documents from GRU hackers (presumably) to Wikileaks to be leaked, with the intent of electing Trump.

Not everyone buys this story. Mitch McConnell doesn’t buy the intelligence.

In September, during a secret briefing for congressional leaders, Senate Republican Leader Mitch McConnell (Ky.) voiced doubts about the veracity of the intelligence, according to officials present.

That’s one doubt raised about CIA’s claim — though like you all, I assume Mitch McConnell shouldn’t be trusted on this front.

But McConnell wasn’t the only one. One source for this story — which sounds like someone like Harry Reid or Dianne Feinstein — claimed that this CIA judgment is the “consensus” view of all the intelligence agencies, a term of art.

“It is the assessment of the intelligence community that Russia’s goal here was to favor one candidate over the other, to help Trump get elected,” said a senior U.S. official briefed on an intelligence presentation made to U.S. senators. “That’s the consensus view.”

Except that in a briefing this week (which may have been what impressed John McCain and Lindsey Graham to do their own investigation), that’s not what this represented.

The CIA shared its latest assessment with key senators in a closed-door briefing on Capitol Hill last week, in which agency officials cited a growing body of intelligence from multiple sources. Agency briefers told the senators it was now “quite clear” that electing Trump was Russia’s goal, according to the officials, who spoke on the condition of anonymity to discuss intelligence matters.

The CIA presentation to senators about Russia’s intentions fell short of a formal U.S. assessment produced by all 17 intelligence agencies. A senior U.S. official said there were minor disagreements among intelligence officials about the agency’s assessment, in part because some questions remain unanswered. [my emphasis]

That’s a conflict. Some senior US official (often code for senior member of Congress) says this is the consensus view. Another senior US official (or maybe the very same one) says there are “minor disagreements.”

Remember: we went to war against Iraq, which turned out to have no WMD, in part because no one read the “minor disagreements” from a few agencies about some aluminum tubes. A number of Senators who didn’t read that footnote closely (and at least one that did) are involved in this story. What we’re being told is there are some aluminum tube type disagreements.

Let’s hear about those disagreements this time, shall we?

Here’s the big takeaway. The language “a formal US assessment produced by all 17 intelligence agencies” is, like “a consensus view,” a term of art. It’s an opportunity for agencies which may have differing theories of what happened here to submit their footnotes.

That may be what Obama called for today: the formal assessment from all agencies (though admittedly, the White House purposely left the scope and intent of it vague).

Whatever that review is intended to be, what happened as soon as Obama announced it is that the CIA and/or Democratic Senators started leaking their conclusion. That’s what this story is.

Update: One other really critical detail. When the White House announced the Obama review today, Wikileaks made what was a bizarre statement. Linking to a CNN story on the Obama ordered review that erred on the side of blaming Russia for everything, it said, “CNN: Obama orders report into WikiLeaks timed for release just prior to Trump presidency.” Even though none of the statements on the review focused on what this story does — that is, on the way that the DNC and Podesta emails got to Wikileaks — Wikileaks nevertheless interpreted it as an inquiry targeted at it.

Update: And now David Sanger (whose story on the Obama-ordered review was particularly bad) and Scott Shane reveal the RNC also got hacked, and it is the differential leaking that leads the spooks to believe the Russians wanted Trump to win.

They based that conclusion, in part, on another finding — which they say was also reached with high confidence — that the Russians hacked the Republican National Committee’s computer systems in addition to their attacks on Democratic organizations, but did not release whatever information they gleaned from the Republican networks.

In the months before the election, it was largely documents from Democratic Party systems that were leaked to the public.

This may be a fair assessment. But you would have to account for two things before making it. First, you’d need to know the timing and hacker behind the RNC hack. That’s because two entities are believed to have hacked the DNC: an FSB appearing hacking group, and a GRU one. The FSB is not believed to have leaked. GRU is believed to have. So if the FSB hacked the RNC but didn’t leak it, it would be completely consistent with what FSB did with DNC.

NYT now says the RNC hack was by GRU in the spring, so it is a fair question why the DNC things got leaked but RNC did not.

Also, Sanger and Shane say “largely documents” from Dems were leaked. That’s false. There were two streams of non-Wikileaks releases, Guccifer, which did leak all-Dem stuff, and DC Leaks, which leaked stuff that might be better qualified as Ukrainian related. The most publicized of documents from the latter were from Colin Powell, which didn’t help Trump at all.

Update: It’s clear that Harry Reid (who of course is retiring and so can leak speech and debate protected classified information without worrying he’ll be shut off in the future) is one key driver of this story. Last night he was saying, “”I was right. Comey was wrong. I hope he can look in the mirror and see what he did to this country.” This morning he is on the TV saying he believes Comey had information on this before the election.

Update, 12/10: This follow-up from WaPo is instructive, as it compares what CIA briefed the Senate Intelligence Committee about the current state of evidence with what FBI briefed the House Intelligence Committee about the current state of evidence. While the focus is on different Republican and Democratic understandings of both, the story also makes it clear that FBI definitely doesn’t back what WaPo’s sources from yesterday said was a consensus view.

The Game of Telephone about the Election Hacking Review

December 9, 2016/6 Comments/in 2016 Presidential Election, Cybersecurity, Russian hacks /by emptywheel

This morning, the White House announced that Obama has ordered a review of election-related hacking, to be completed before Donald Trump takes over. I want to capture the varying descriptions of what the review will entail.

Politico: The review will look at the hacks blamed on the Russians this year and malicious cyber activity (publicly understood to be China in 2008 and someone else in 2012) going back to 2008

The review will put the spate of hacks — which officials have blamed on Russia — “in a greater context” by framing them against the “malicious cyber activity” that may have occurred around the edges of the 2008 and 2012 president elections, said White House principal deputy press secretary Eric Schultz at a briefing.

“This will be a review that is broad and deep at the same time,” he added.

[snip]

In 2008, the campaigns for both Sen. John McCain (R-Ariz.) and Obama were bombarded by suspected Chinese hackers, according to U.S. intelligence officials. The digital intruders were reportedly after internal policy papers and the emails of top advisers.

And in 2012, Gawker reported that hackers had broken into Republican presidential candidate Mitt Romney’s personal Hotmail account after correctly answering his backup security question: “What is your favorite pet?”

“We will be looking at all foreign actors and any attempt to interfere with the elections,” Schultz said.

WaPo: The review will be a “full review” of Russian hacking during the November election

President Obama has ordered a “full review” of Russian hacking during the November election, as pressure from Congress has grown for greater public understanding of exactly what Moscow did to interfere in the electoral process.

[snip]

U.S. intelligence and law enforcement agencies had already been probing what they see as a broad covert Russian operation to sow distrust in the presidential election process. It was their briefings of senior lawmakers that led a number of them to press for more information to be made public.

[snip]

Though Russia has long conducted cyberspying on U.S. agencies, companies and organizations, this presidential campaign marks the first time Russia has attempted through cyber means to interfere in, if not actively influence, the outcome of an election, the officials said.

CNN: The review will look at “hacking by the Russians aimed at influencing US elections going back to 2008” (CNN notes that the IC “never said there was strong evidence that [hacks of voter registration systems were] tied to the Russian government”)

President Barack Obama has ordered a full review into hacking by the Russians aimed at influencing US elections going back to 2008, the White House said Friday.

“The President has directed the Intelligence Community to conduct a full review of what happened during the 2016 election process. It is to capture lessons learned from that and to report to a range of stakeholders,” White House Homeland Security and Counterterrorism Adviser Lisa Monaco said at a Christian Science Monitor breakfast with reporters Friday. “This is consistent with the work that we did over the summer to engage Congress on the threats that we were seeing.”
White House spokesman Eric Schultz added later that the review would encompass malicious cyber activity related to US elections going back to 2008. [my emphasis]

Wikileaks (relying on the CNN story): The review will look at Wikileaks

CNN: Obama orders report into WikiLeaks timed for release just prior to Trump presidency

NYT: The review will look at all Russian efforts to influence the 2016 election, including publishing email contents and probing the “vote-counting system” (presumably a reference to voter lists that have nothing to do with vote counting)

President Obama has ordered American intelligence agencies to produce a full report on Russian efforts to influence the 2016 presidential election, his homeland security adviser said on Friday. He also directed them to develop a list of “lessons learned” from the broad campaign the United States has accused Russia of carrying out to steal emails, publish their contents and probe the vote-counting system.

CYBERCOM versus NSA: On Fighting Isis or Spying on Them

December 1, 2016/6 Comments/in Cybersecurity /by emptywheel

I keep thinking back to this story, in which people in the immediate vicinity of Ash Carter and James Clapper told Ellen Nakashima that they had wanted to fire Admiral Mike Rogers, the dual hatted head of CyberCommand and NSA, in October. The sexy reason given for firing Rogers — one apparently driven by Clapper — is that NSA continued to leak critical documents after Rogers was brought in in the wake of the Snowden leaks.

But further down in the story, a description of why Carter wanted him fired appears. Carter’s angry because Rogers’ offensive hackers had not, up until around the period he recommended to Obama Rogers be fired, succeeded in sabotaging ISIS’ networks.

Rogers has not impressed Carter with his handling of U.S. Cyber Command’s cyberoffensive against the Islamic State. Over the past year or so, the command’s operations against the terrorist group’s networks in Syria and Iraq have not borne much fruit, officials said. In the past month, military hackers have been successful at disrupting some Islamic State networks, but it was the first time they had done that, the officials said.

Nakashima presents this in the context of the decision to split CYBERCOM from NSA and — click through to read that part further down in the piece — with Rogers’ decision to merge NSA’s Information Assurance Directorate (its defensive wing) with the offensive spying unit.

The expectation had been that Rogers would be replaced before the Nov. 8 election, but as part of an announcement about the change in leadership structure at the NSA and Cyber Command, a second administration official said.

“It was going to be part of a full package,” the official said. “The idea was not for any kind of public firing.” In any case, Rogers’s term at the NSA and Cyber Command is due to end in the spring, officials said.

The president would then appoint an acting NSA director, enabling his successor to nominate their own person. But a key lawmaker, Sen. John McCain (R-Ariz.), the chairman of the Senate Armed Services Committee, threatened to block any such nominee if the White House proceeded with the plan to split the leadership at the NSA and Cyber Command.

I was always in favor of splitting these entities — CYBERCOM, NSA, and IAD — into three, because I believed that was one of the only ways we’d get a robust defense. Until then, everything will be subordinated to offensive interests. But Nakashima’s article focuses on the other split, CYBERCOM and NSA, describing them as fundamentally different missions.

The rationale for splitting what is called the “dual-hat” arrangement is that the agencies’ missions are fundamentally different, that the nation’s cyberspies and military hackers should not be competing to use the same networks, and that the job of leading both organizations is too big for one person.

They are separate missions: CYBERCOM’s job is to sabotage things, NSA’s job is to collect information. That is made clear by the example that apparently irks Carter: CYBERCOM wasn’t sabotaging ISIS like he wanted.

It is not explicit here, but the suggestion is that CYBERCOM was not sabotaging ISIS because someone decided it was more important to collect information on it. That sounds like an innocent enough trade-off until you consider CIA’s prioritization for overthrowing Assad over eliminating ISIS, and its long willingness to overlook that its trained fighters were fighting with al Qaeda and sometimes even ISIS. Add in DOD’s abject failure at training their own rebels, such that the job reverted to CIA along with all the questionably loyalties in that agency.

There was a similar debate way back in 2010, when NSA and CIA and GCHQ were fighting about what to do with Inspire magazine: sabotage it (DOD’s preference, based on the understanding it might get people killed), tamper with it (GCHQ’s cupcake recipe), or use it to information gather (almost certainly with the help of NSA, tracking the metadata associated with the magazine). At the time, that was a relatively minor turf battle (though perhaps hinting at a bigger betrayed by DOD’s inability to kill Anwar al-Alwaki and CIA’s subsequent success as soon as it had built its own drone targeting base in Saudi Arabia).

This one, however, is bigger. Syria is a clusterfuck, and different people in different corners of the government have different priorities about whether Assad needs to go before we can get rid of ISIS. McCain is clearly on the side of ousting Assad, which may be another reason — beyond just turf battles — why he opposed the CYBERCOM/NSA split.

Add in the quickness with which Devin Nunes, Donald Trump transition team member, accused Nakashima’s sources of leaking classified information. The stuff about Rogers probably wasn’t classified (in any case, Carter and Clapper would have been the original classification authorities on that information). But the fact that we only just moved from collecting intelligence on ISIS to sabotaging them likely is.

CYBERCOM and NSA do have potentially conflicting missions. And it sounds like that was made abundantly clear as Rogers chose to prioritize intelligence gathering on ISIS over doing things that might help to kill them.

The White House Attempts to Unring the Election Integrity Fearmongering

November 28, 2016/3 Comments/in 2016 Presidential Election, Cybersecurity /by emptywheel

Over the weekend, the White House gave the NYT a statement on the integrity of our elections that deserves more attention. Here it is, in full:

The Kremlin probably expected that publicity surrounding the disclosures that followed the Russian Government-directed compromises of e-mails from U.S. persons and institutions, including from U.S. political organizations, would raise questions about the integrity of the election process that could have undermined the legitimacy of the President-elect. Nevertheless, we stand behind our election results, which accurately reflect the will of the American people.

The Federal government did not observe any increased level of malicious cyber activity aimed at disrupting our electoral process on election day. As we have noted before, we remained confident in the overall integrity of electoral infrastructure, a confidence that was borne out on election day. As a result, we believe our elections were free and fair from a cybersecurity perspective.

That said, since we do not know if the Russians had planned any malicious cyber activity for election day, we don’t know if they were deterred from further activity by the various warnings the U.S. government conveyed.

As the NYT noted in its introduction to this statement, the person who released this statement (my guess is Ned Price, but that’s just a wildarseguess) would not let him or herself be identified. While this is a long-time habit of the Obama Administration (one that merely exacerbated a Bush habit), consider what it means that a statement intended to increase confidence about our electoral process was issued anonymously.

You’re doing it wrong.

The statement itself highlights the perverse effect of all the fearmongering about Russia hacking our elections.

Let’s start with the last paragraph. “We do not know if the Russians had planned any malicious cyber activity for election day [… or] if they were deterred.” This suggests that at no time before the election did anyone in the White House know of plans to disrupt the election. That’s an important detail, because many sloppy journalists have consistently misread reports of the hacking of voter registration lists from a Russian hosting service but that may not have even been Russians must less the Russian state to mean that the Russian state was trying to hack the election itself. While there was one late report that suggests FBI may have gotten more reason to believe these polling list probes were Russian state entities, this statement seems to refute that.

Indeed, the second paragraph seems to back that. “The Federal government did not observe any increased level of malicious cyber activity aimed at disrupting our electoral process on election day.” The White House, now explicitly speaking for the entire Federal government, says that there was no increased malicious cyber activity aimed at disrupting election day, regardless of the actor. While it’s certainly possible known probes of registration lists continued, according to this statement they didn’t accelerate as the election drew near. This makes it more likely these probes were identity theft related, not Russian state tampering.

If there was no there there to all the claims of Russian hacking our election infrastructure (which is distinct from claims that Russia hacked the DNC and other political organizations, which is something our spooks do as well), then why didn’t the White House stop all the fearmongering about the election infrastructure beyond the joint ODNI/DHS statement that admitted there was no conclusive evidence that was happening?

That’s where this statement starts.

The Kremlin probably expected that publicity surrounding the disclosures that followed the Russian Government-directed compromises of e-mails from U.S. persons and institutions … would raise questions about the integrity of the election process that could have undermined the legitimacy of the President-elect.

They’re not even saying “rais[ing] questions about the integrity of the election” is what “the Kremlin” (“the Kremlin” has served as a very sloppy metonymy throughout this discussion) had in mind. They’re just guessing that the intent existed.

Throughout the discussion of Russian hacking, the entire point of it has been one of the weakest points of the allegations: no one ever provided a credible explanation for how releasing validated copies of real emails could undermine the election. The strongest case I saw made is that the emails provided something that Trump himself, his true-believers, Macedonian teenagers, and Russian propagandists could hang false stories onto; but that’s no different from what happened to official Hillary emails released under FOIA (to say nothing of FBI leaks about same) or actual events like Hillary’s pneumonia. Those people can make lies up about anything and they don’t need Podesta emails to do so. Trump, as Republicans have for decades, turned out to be perfectly capable of raising baseless concerns about election integrity (as he did again last night).

So here, when asked why, after dick-waving about an imminent Russian hack of the election, the White House wasn’t backing a review of the vote, this White House official who wouldn’t go on the record instead effectively said, “Who knows? ‘The Kremlin’ probably figured the damage was done.”

Which brings me to my complaint about the way the Russian hacking has been dealt with — largely fed by a deliberate Hillary effort to emphasize Trump’s Russian ties rather than all his shady dealings generally.

Who is responsible for doubts about the integrity of our election? The hack-and-leakers? Trump? Or the national security officials (who, in this case, won’t even go on the record) making uncertain claims that the Russians intend to undermine confidence in elections? At some point, those pounding the war drums are the ones who are undermining confidence, not the Russian hackers themselves.

And none of those actions take place in a vacuum. Even as both the Russians (allegedly) were undermining faith in our elections and national security types were hyping up concerns that people might lose faith in our elections which likely helped undermine faith in our elections, there were real reasons why Americans shouldn’t have faith in their elections. Consider this line: “As a result, we believe our elections were free and fair from a cybersecurity perspective.” This anonymous person at the White House is asserting there were no hacks of the election. But he or she is not asserting the election was free and fair.

Of course not. That’s because in a number of states — notably, in swing states NC and WI — the Republicans undertook known, documented efforts to ensure the elections weren’t free and fair by making it harder for likely Democratic voters to vote than Republican voters.

Voters — especially students and voters of color normally targeted in suppression efforts — shouldn’t be complacent about the integrity of our elections. Numerous circuit courts have found evidence showing they’re not free and fair. Our elections were not going to be free and fair well before Russian hackers targeted the DNC.

But rather than focusing on the things closer to home that we need to improve, we’re all worried the Russians are coming … to do what decades of Republican efforts have already done.

The Self Serving Jill Stein Recount Scam

November 26, 2016/54 Comments/in 2016 Election, 2016 Presidential Election, Culture, Cybersecurity, Democrats, Law /by bmaz

Jill Stein, admittedly, always struck me as a bit of a naive and somewhat unhinged candidate. But, Stein was the “Green Party” candidate and, once Bernie Sanders lost, became the go to darling for ill advised voters and activists that were far too willing to wreck the world with Donald Trump than consider the circumstances and vote for an eminently qualified, albeit terribly flawed, candidate in the form of Hillary Clinton. It is hard to argue with anarchist, blow it all up, demagogues when trying to protect a lame, and status quo, candidate. Even when the ultimate opponent is a raging racist, bigoted, misogynistic, female choice hating and torture loving shill like Donald Trump.

So many otherwise Democratic voters went off and voted for Stein and/or Gary Johnson. Did it make the “final difference”? I have no idea, but there is certainly an argument that could be made.

Was it the Jim Comey FBI factor from the stunningly inappropriate rogue actions by the FBI Director putting his self righteous thumb on the electoral scale in both the start of the critical summer elections season and, then, yet again in the last two weeks before the election? It is easy to make that argument, irrespective of any other factor.

Was it that Hillary did not expend personal and campaign time and dime in Wisconsin and other Rust Belt states when she did a lost, but very much growing, cause venue such as Arizona? Easy case for that argument as well.

The actual data and competent reportage seems to indicate that all of the above were significant factors. It strikes me that is right.

All of the above factors fed into the defeat of Clinton and the election loss by her, if only by the electoral college, at the tiny hands of Trump. So be it. That is what happened under the electoral laws and process (yes, let us not forget the pernicious meddling of Russia and/or Wikileaks, whether they are coupled or not) pertinent to the 2016 US Presidential election. But, like the result or not, that was all pursuant to the Constitution and election laws as are currently extant in the United States. There is not one competent piece of evidence that the actual vote itself was “hacked” or “rigged”. Just none.

Which brings us to the much ballyhooed action of Jill Stein to crowd fund and conduct audits and or recounts in the key states of Wisconsin, Michigan and Pennsylvania. The second she started her effort, I opined it was an attention grabbing craven play by Stein, and not a legitimate effort with any eye to any substantive results. On a more private forum I intoned:

But that is the thing: It IS bomb throwing, and stupidly so. There is NO evidentiary basis for fraud or mistake that I have seen. The guy who started it, [J. Alex] Halderman himself, admits as much legally when he says he thinks it is most likely poll inaccuracy, not anything nefarious.

I know all the beaten down, especially Clinton diehards, that cannot fathom how she blew this election, want to grasp for something. But it just isn’t there.

I stand by that completely. What Jill Stein is doing is blatant self promotion, list building, reputational repair where it is undeserved, and slush funding for an incoherent Green Party. It is detestable to the extreme. Stein has glommed onto this recount scam as a way to serve herself, she certainly is not serving anything else.

To quote a significant Democratic election law attorney, and longtime friend of this blog, Adam Bonin:

“If there were something to do here, there are a lot of us who would be jumping on it”

Early on the hashtag #AuditTheVote was attached to this chicanery. Here is the problem with that – two out of three of Stein’s target states already “audit the vote” as a regular matter of law without the need for Stein’s self serving injection into the matter. In fact, Stein’s primary target, Wisconsin, has a reasonably robust random audit provision in Wisconsin Revised Statute 7.08(6), which has been generally deigned to require:

The voting system audit procedures consist of two independent processes: an audit conducted by municipalities of reporting units randomly selected by the State Elections Board and an audit of reporting units conducted by the State Elections Board. Number of Reporting Units to Audit: Per the requirements of section 7.08(6), Wis. Stats., each type of electronic voting system in Wisconsin must be audited after the general election to ensure that each system does not exceed the error rate prescribed in the federal voting system guidelines. The State Elections Board will randomly select fifty (50) reporting units across Wisconsin which will be subject to municipal audit, including a minimum of five (5) reporting units for each voting system used in Wisconsin. If fewer than five (5) reporting units for any voting system are selected through the random selection process, then additional reporting units will be randomly selected by voting system until five reporting units per voting system have been selected. If there are fewer than 5 reporting units using a voting system the State Elections Board staff will audit those reporting units if the reporting units are not selected as part of the random draw. until five reporting units per voting system have been selected. If there are fewer than 5 reporting units using a voting system the State Elections Board staff will audit those reporting units if the reporting units are not selected as part of the random draw.

Well, that is actually pretty robust. And all of which would have been, and will be, performed without the preening self interjection of Jill Stein in her first state of concern, Wisconsin.

Just Wisconsin? Nope. Pennsylvania also has an inherent audit provision, though not quite as robust as Wisconsin. The bottom line is, though, there are already “audit the vote” provisions in two out of three of Jill Stein’s targets, even though she declined to say so in her propaganda seeking funding to stay in the spotlight and reconstruct her reputation. In fairness, Michigan has no such automatic audit provision, so there is that.

Next, you need to consider that there is a substantive difference between “audits” of the vote and flat out recounts. Stein has always been about recounts, despite the bogusly applied #AuditTheVote nomenclature applied by Stein and her glommers on. Recounts are expensive, labor intensive, and time consuming. And they are asinine where there is not a single shred of competent evidence to support fraud or mistake that could, even in the remotest possibility, change the outcome in a given state or states.

And, let us be crystal clear here, there is still NO competent evidence whatsoever of fraud, mistake or other irregularity that could change the result. None. And that is the thing, unless there is fraud, mistake or systematic error, recounts can do nothing to legally support a challenge to the election results. A challenge has to stand up in court. It cannot be thin and based upon rote supposition and suspicion. Even if Stein’s folly turns up a minor discrepancy here and there, that will not suffice.

The vote differential, again in Wisconsin for instance, between Clinton and Trump currently stands at 27,259 votes. Yes, that is less than the total of Stein, so despite the wild claim she threw the election that some Clinton supporters have thrown, I will not. Some Stein voters were never going to vote for Clinton; so while Stein’s vanity run deserves ridicule, it does not, in and of itself, “prove” Clinton would have won but for Stein. Close enough for ridicule given that Trump is the result? Sure. But, again that, too, holds for ridicule of Clinton’s own arrogant and detached campaign and the fatally pernicious effects of the completely rogue arbiter of his own justice, James Comey.

So, where does that leave us? With a Norma Desmond like self promoting grifter, dying to redeem her name and stay in some/any spotlight, in the form of Jill Stein. She was a cancer on the election (hey, her dinner with Putin and Mike Flynn was cool though!) that, at a minimum, helped elect Trump, and she is sticking around to create more hell now that said deed is done.

This is absurd. Jill Stein is a grifter and a fraud. And she is playing this opportunity to, first off, list build for herself and the Greens, secondly, resuscitate her and their name, thirdly, stay in the press, and lastly, create an amorphous slush fund to continue those things. Stein is succeeding beyond wildest expectations if your idea of the normal course of business is Donald Trumpian level grifting.

For a woman who raised only $3.5 million during her entire vanity run for President, Stein has now raised nearly $6 million dollars in far less than a week on this scam. That is NOT because Stein has dedicated Green Party followers wanting to bleed yet more money into their candidate after the election; no, it is because desperate Clintonians are seeking some way, any way, to stop Trump. And playing on that desperation is exactly the fraud of Jill Stein.

A common refrain I see is that, “golly, there is no harm, and much good, that can come from confirming the vote”. But that is just more self serving balderdash from the desperate and/or Stein acolytes. In fact, there is great harm that can come from Stein’s shenanigans. Here is Rick Hasen from the Election Law Blog, quoting the Wisconsin Journal Sentinel:

Wisconsin could be at risk of missing a Dec. 13 deadline to certify its 10 electoral votes if clerks can’t complete an expected recount by then.

Hitting the deadline could be particularly tricky if Green Party presidential nominee Jill Stein is able to force the recount to be conducted by hand, Wisconsin’s top election official said.

Stein — who received just 1% of the vote in Wisconsin — has promised to file for a recount by Friday’s 5 p.m. deadline in Wisconsin. She is also planning to ask for recounts in Michigan and Pennsylvania, which have deadlines next week.

A federal “safe harbor” law requires states to complete presidential recounts within 35 days of the election to ensure their electoral votes are counted. This year, that’s Dec. 13.

What is the upshot of this? Easy, Stein’s effort could easily place Wisconsin, in light of the December 13 deadline, of missing the deadline and disenfranchising all voters in Wisconsin. Yes, there are potential repercussions from actions like Stein is taking, especially when there is no known basis or grounds whatsoever evidentiary wise to support them. And that is just Wisconsin. Michigan and Pennsylvania are in even bigger jeopardy thanks to the self serving hubris of Jill Stein, should she actually continue on to file in those states as promised, without any rational basis for challenging the vote therein.

Lastly, while I have been writing the instant post, the attorney for the DNC and Clinton Campaign, Marc E. Elias, has weighed in on Medium with an official take for both himself and, by all appearances, the aforementioned campaign entities. The Reader’s Digest version, by my eyes, is that, while the DNC and Clinton camps are going to join into the Stein effort, they have never seen any basis for it, and are being dragged into a position of noticing their appearance and joinder simply in order to preserve their rights to be involved should Stein’s group go so far off the rails or, in the remotest of all potentialities, find anything. That is not joinder with enthusiasm, it is joinder to protect your legal voice. Trump is now doing the same for similar reasons. I do not blame either Clinton or Trump for doing so, in fact, Stein’s idiocy put both of said parties in that regrettable posture. Don’t cast your eye askew for one second at Elias and the Dems, nor even Trump and the Repubs, ….Stein and her idiotic self serving publicity play made them do it.

In short, this effort by Jill Stein is nothing more than a self promoting vanity play. If you want to donate to that grift, by all means, go ahead. But don’t blather about how it is going to help democracy or promote fair elections. That is absurd. In fact, just exactly as absurd as Jill Stein’s cynical grift on her current donors who are far different than her few and far between Green donors.

Stein is scamming the dispossessed. That is a Trumpian level fraud.

About that Russian Hacker Story

November 13, 2016/9 Comments/in 2016 Presidential Election, Cybersecurity, emptywheel /by emptywheel

This story is going viral on social media. The CNN article, dated October 12, describes a compromise of a FL contractor they don’t situate in time.

Federal investigators believe Russian hackers were behind cyberattacks on a contractor for Florida’s election system that may have exposed the personal data of Florida voters, according to US officials briefed on the probe.

The hack of the Florida contractor comes on the heels of hacks in Illinois, in which personal data of tens of thousands of voters may have been stolen, and one in Arizona, in which investigators now believe the data of voters was likely exposed.

Later in the article, CNN makes it clear this is the same hack as described in this earlier ABC reporting, which expands on a story from several days earlier. ABC’s reporting doesn’t date the compromise either. Rather, it explains that FL was one of four states in which hackers had succeeded in compromising data, whereas hackers had scanned voting related systems — tried to hack systems — in half the states.

As ABC News first reported Thursday, hackers have recently tried to infiltrate voter registration systems in nearly half of the states across the country –- a significantly larger cyber-assault than U.S. officials have been willing to concede.

And while officials have publicly admitted Illinois and Arizona had their systems compromised, officials have yet to acknowledge that information related to at least two other states’ voters has also been exposed.

Hackers working on behalf of the Russian government are suspected in the onslaught against election-related systems, according to sources with knowledge of the matter.

And ABC’s source at least claimed that all hackers did was copy voter data.

The voter information was exposed after cyber-operatives gained entry to at least one computer associated with a private company hired to administer voter information, the sources said.

A simple “phishing” scheme –- with a malicious link or attachment sent in an email –- is likely how it all started, one source said.

“The attack was successful only in the sense that they gained access to the database, but they didn’t manipulate any of the voter [information] in the database,” the source said.

So, in spite of what people might think given the fact that the CNN is going viral right now, it doesn’t refer to a hack in conjunction with the election. It refers to a hack that happened well over a month ago. It refers to a hack that — at least according to people who have an incentive to say so — resulted only in the theft of data, not its alteration.

Both CNN and ABC use language that suggests the Russian government was behind this hack. Here’s CNN:

FBI investigators believe the the hacks and attempted intrusions of state election sites were carried out by hackers working for Russian intelligence.

And here’s ABC:

Hackers working on behalf of the Russian government are suspected in the onslaught against election-related systems, according to sources with knowledge of the matter.

But (as CNN points out) the October 7 joint DNI/DHS statement on Russian hacking doesn’t attribute the voting rolls part to the Russian state.

Some states have also recently seen scanning and probing of their election-related systems, which in most cases originated from servers operated by a Russian company. However, we are not now in a position to attribute this activity to the Russian Government.

An earlier DHS one explicitly attributes them to cybercriminals.

(U//FOUO) DHS has no indication that adversaries or criminals are planning cyber operations against US election infrastructure that would change the outcome of the coming US election. Multiple checks and redundancies in US election infrastructure—including diversity of systems, non-Internet connected voting machines, pre-election testing, and processes for media, campaign, and election officials to check, audit, and validate results—make it likely that cyber manipulation of US election systems intended to change the outcome of a national election would be detected.

(U//FOUO) We judge cybercriminals and criminal hackers are likely to continue to target personally identifiable information (PII), such as that available in voter registration databases. We have no indication, however, that criminals are planning theft of voter information to disrupt or alter US computer-enabled election infrastructure.

There were known instances of identity thieves hacking voting rolls going back some time, so it is possible that’s all this was about.

We learned recently that FBI Director Comey pointedly did not want to be included on the joint DNI/DHS statement, because it was too close to the election. So it’s possible there was disagreement about that part of it (which might explain the FBI-sourced leak to CNN).

Also note, I believe the known hackers used different methods, including both SQL injection and phishing. If in response to the earlier ones, DHS did a review of voting systems and found a number of phishes using the same methods as GRU, that may explain why FBI would say it was Russian.

In any case, we don’t know what happened, and at least public claims say the hackers didn’t alter any data.

But the CNN story, at least, is not about something that just happened.

Update: Fixed some typos and clarity problems.