The Feedback Loop in Christopher Steele’s Dossier

/22 Comments/in , , /by

Last week, at least three media outlets have provided new details about the relationship between former MI6 officer Christopher Steele — the author of the Trump dossier — and the FBI. First WaPo reported that Steele had reached a verbal agreement that the FBI would pay him to continue his investigation of Russia’s involvement with Trump after still unnamed Democrats stopped paying him after the election. CNN then reported that FBI actually had paid Steele for his expenses. Finally, NBC reported Steele backed out of the deal before it was finalized. Chuck Grassley just sent a letter to Jim Comey asking for more information about the proposed arrangement with Steele.

I’m with Grassley on this. According to WaPo and NBC, FBI would only have paid Steele after the election, presumably regardless of the outcome; by that point Steele’s research couldn’t affect the outcome of the investigation. Nevertheless, the possibility that FBI may have used information from a Democratically paid oppo researcher does raise questions of propriety. Add in the discrepancies in these three reports about whether FBI did pay for Steele’s work, and Grassley is right to raise questions.

I’m also interested in what the relationship says about the way in which political necessities may have impacted the content of Steele’s dossier. All three reports attribute the termination of any FBI-Steele relationship, at least in part, to Steele’s frustration with the FBI. WaPo goes on at some length, explaining that Steele got pissed when Jim Comey reopened the Hillary investigation on October 28, and then grew angrier after the NYT reported the FBI had not confirmed any link to Russia.

Ultimately, the FBI did not pay Steele. Communications between the bureau and the former spy were interrupted as Steele’s now-famous dossier became the subject of news stories, congressional inquiries and presidential denials, according to the people familiar with the arrangement, who spoke on the condition of anonymity because they were not authorized to discuss the matter.

[snip]

In October, anticipating that funding supplied through the original client would dry up, Steele and the FBI reached a spoken understanding: He would continue his work looking at the Kremlin’s ties to Trump and receive compensation for his efforts.

But Steele’s frustration deepened when FBI Director James B. Comey, who had been silent on the Russia inquiry, announced publicly 11 days before the election that the bureau was investigating a newly discovered cache of emails Clinton had exchanged using her private server, according to people familiar with Steele’s thinking.

Those people say Steele’s frustration with the FBI peaked after an Oct. 31 New York Times story that cited law enforcement sources drawing conclusions that he considered premature. The article said that the FBI had not yet found any “conclusive or direct link” between Trump and the Russian government and that the Russian hacking was not intended to help Trump.

WaPo doesn’t lay this out in detail, however. Here’s what happened on those days in October:

October 28: Comey informs eight committee chairs he will reopen the investigation, which promptly (and predictably) leaks.

October 30: Having been officially briefed on the dossier, Harry Reid writes Comey accusing him of a Hatch Act violation for releasing the information on Clinton while withholding what we know to be information in the dossier.

October 31, 6:52PM: David Corn publishes story based on dossier.

October 31, 9:27PM: NYT publishes article describing multiple investigations into Russian interference, stating “no evidence has emerged that would link him or anyone else in his business or political circle directly to Russia’s election operations.”

October 31, 10:52PM: NYT edits article, adding “conclusive or direct” as a caveat in the sentence “Law enforcement officials say that none of the investigations so far have found any conclusive or direct link between Mr. Trump and the Russian government.”

Notably, assuming the times in Newsdiffs (from which I got the NYT timing) are correct, Steele had already gone public before the NYT published its article. That suggests he (like Harry Reid) believed his research should be part of a competing public story. And by going public in what was obviously a Democratically-seeded article, Steele likely made it far more difficult for FBI to continue the relationship.

Already, these new timeline details raise questions about the degree to which Steele’s concerns that the Trump Russian investigation should have more prominence than the email investigation may have influenced his work. Even if Jim Comey did do something colossally stupid by announcing the reopening of the investigation, that shouldn’t affect Steele’s interest in providing the best intelligence to the US, regardless of the public impact, unless he was always motivated primarily by his role as campaign oppo researcher.

The pointless Alfa Bank report that nevertheless seems to reinforce the dodgy Alfa server story

But I also wonder whether it relates to the content. Consider report 112, dated September 14. It pertains to “Kremlin-Alpha Group Cooperation.” It doesn’t have much point in a dossier aiming to hurt Trump. None of his associates nor the Russian DNC hack are mentioned. It does suggest that that Alfa Group had a “bag carrier … to deliver large amounts of illicit cash to” Putin when he was Deputy Mayor of St. Petersburg, though describes the current relationship as “both carrot and stick,” relying in part on kompromat pertaining to Putin’s activities while Deputy Mayor. It makes no allegations of current bribery, though says mutual leverage helps Putin “do his political bidding.”

As I said, there’s no point to have that Alfa Bank passage in a dossier on Trump. But it does serve, in its disclosure, to add a data point (albeit not a very interesting one) to the Alfa Server story that (we now know) FBI was already reviewing but which hadn’t been pitched to the press yet. In Corn’s piece, he mentions the Alfa Bank story but not the report on Putin’s ties to it. It may be in there because someone — perhaps already in possession of the Alfa Bank allegations — asked Steele to lay out more about Alfa’s ties with Putin.

Here’s one reason that’s interesting, though. Even aside from all the other reasons the Alfa story is dodgy, it was deliberately packaged for press consumption. Rather than the at least 19 servers that Trump’s spam email was pinging, it revealed just two: Alfa Bank and Spectrum Health (the latter of which got spun, anachronistically, as a DeVos organization that thus had to be tight with Trump). Which is to say, the Alfa story was dodgy and packaged by yet unknown people.

The discovery of direct collusion during the intelligence review of the Russian hack

More interesting still is what happens in the period that — according to public reporting, anyway — Steele was working for free.

Contrary to what Steele’s anger suggests, there was no real evidence of direct Russian ties to Trump outside of the famous PeeGate incident (and even if that happened, he was not a knowing participant). In the first report, there’s a claim that “the Kremlin has been feeding TRUMP and his team valuable intelligence … including Democratic presidential candidate Hillary Clinton,” but the part of the report that purportedly describes that sharing states that the Kremlin file on Hillary “had not yet been made available abroad, including to TRUMP or his campaign team,” seemingly contradicting the claim. A subsequent report describes a Presidential Administration official discussed the “possible release [of the dossier] to the Republican’s campaign team,” but without any confirmation that occurred (or even that Trump knew about it).

A subsequent report includes a claim of a “well-developed conspiracy of co-operation between [Trump’s team] and the Russian leadership managed through Paul Manafort and Carter Page. It continued to suggest a quid pro quo between the Russian hack and a shift on Ukraine and NATO policies. But in subsequent discussions of Manafort and Page’s corruption, it drops this claim entirely. Even when Michael Cohen enters the narrative, its about managing fallout over Manafort’s Ukrainian corruption.

There are claims that Trump was trying to set up business in Russia, followed by repeated descriptions of Russians not succeeding in getting him to do so.

In other words, in spite of the fact that there were some really damning allegations in the reports, the subsequent reporting didn’t necessarily back the most inflammatory aspects of them.

After the election, there’s just one report, dated December 13. That dates it to after the CIA’s leak fest reporting that Putin hacked the DNC not just to hurt Hillary and the US, but also to elect Trump. It dates to after Obama ordered an IC report on the hack. It dates to after John McCain delivered yet another copy of the dossier to FBI. It slightly precedes a Crowdstrike report (also done for free) bumping its formerly non-public “medium” confidence Russia’s GRU hacked the DNC to “high.”

And after previous reports describing Michael Cohen’s meetings as serving to cover up Manafort’s corruption and Page’s non-consummated Rosneft deal, this one alleges “the operatives involved [in the DNC hack] had been paid by both TRUMP’s team and the Kremlin,” the first such allegation. That is, over a month after the election but less than a month before its leak, the kind of detail backing direct collusion reappeared in this report.

Chuck Grassley’s questions

Which brings me back to Grassley’s letter. In addition to asking about payments, whether the agreement ever went into force, and whether and how Steele’s material served as a basis for FBI reports or even warrants, Grassley asks a question I’ve long wanted to know: Why we got this version of the memo, which is obviously just a partial selection of the complete dossier (rather like the Alfa story).

  1. How did the FBI first obtain Mr. Steele’s Trump investigation memos?  Has the FBI obtained additional memos from this same source that were not published by Buzzfeed?  If so, please provide copies.

We will actually learn a lot about the validity of the dossier if we see what other parts got dealt to the FBI, and if so whether the copy released to the public was cherry picked for the most damning information.

Share this entry

The Conspiratorial Game of Telephone in Bannon’s Rag that Made Left, Right, and POTUS Go Crazy

/73 Comments/in , /by

A story published in Steve Bannon’s rag, Breitbart, got circulated around the White House this morning like some President’s Daily Conspiracy, sending President Trump off on a rant attacking the counterintelligence investigation into his aides’ (and possibly his own) ties with Russia.

Let me unpack it.

The story basically captures a narrative Mark Levin rolled out Thursday night (that is, right after Jeff Sessions recused himself from the Russian hack investigation), which basically lards out the story of counterintelligence intercepts mostly targeting Russians, to suggest Jeff Sessions was brought down in an invented coup.

The Louise Mensch story

The story starts with this Louise Mensch story. For those who don’t know, Mensch is a former Tory Member of Parliament turned American rock promoter wife. Since quitting Parliament to spend more time with her family, she has become a pundit known for taking reasonable observations, injecting just a bit of whack, and turning them into fairly unhinged theories. Perhaps her best known foray into investigative work is when she unknowingly used her own racist search history to impugn a Jeremy Corbyn supporter. In spite of her still apparent tolerance for racism, she offered up her support to Hillary on Valentines Day in 2016. Of late, she has been writing unified theories of Russian spying that start from real nuggets and important observations, then spin loose from the actual supporting evidence.

Back to Mensch’s original article. At a time when Hillary’s team was furious that the FBI had been publicly discussing her emails rather than Trump’s Russian ties, Mensch reported that the FBI got a FISA order in October, after having been denied a more broadly drawn order earlier in the year.

The timing of the October FISA order has been backed in subsequent reporting. It is Mensch’s explanation for the basis of the order that is the problem, as it relied on the dodgy Alfa Bank story.

Contrary to earlier reporting in the New York Times, which cited FBI sources as saying that the agency did not believe that the private server in Donald Trump’s Trump Tower which was connected to a Russian bank had any nefarious purpose, the FBI’s counter-intelligence arm, sources say, re-drew an earlier FISA court request around possible financial and banking offenses related to the server. The first request, which, sources say, named Trump, was denied back in June, but the second was drawn more narrowly and was granted in October after evidence was presented of a server, possibly related to the Trump campaign, and its alleged links to two banks; SVB Bank and Russia’s Alfa Bank. While the Times story speaks of metadata, sources suggest that a FISA warrant was granted to look at the full content of emails and other related documents that may concern US persons.

[snip]

The FISA warrant was granted in connection with the investigation of suspected activity between the server and two banks, SVB Bank and Alfa Bank. However, it is thought in the intelligence community that the warrant covers any ‘US person’ connected to this investigation, and thus covers Donald Trump and at least three further men who have either formed part of his campaign or acted as his media surrogates. The warrant was sought, they say, because actionable intelligence on the matter provided by friendly foreign agencies could not properly be examined without a warrant by US intelligence as it involves ‘US Persons’ who come under the remit of the FBI and not the CIA. Should a counter-intelligence investigation lead to criminal prosecutions, sources say, the Justice Department is concerned that the chain of evidence have a basis in a clear  warrant

I will return to some other aspects of the Alfa Bank story shortly. But for now, consider that the evidence never said a private server “in Donald Trump’s Trump Tower … was connected to a Russian bank.” Rather, it showed that a marketing server in Philadelphia was pinging Alfa Bank and Grand Rapid’s Spectrum Health. As it turns out, it was pinging at least 16 other servers, but that detail was suppressed when the story got packaged up for the press by yet unidentified people. So even if the FBI would have needed a FISA warrant to read traffic involving a Russian (that is, non-US person located overseas) bank — which it wouldn’t — it’s highly unlikely they would have gotten that far, because the story didn’t hold up (and was easily explained by the spam that the servers in question were getting). Moreover, there is no way the FBI would have imagined “financial and banking offenses” from a spam marketing server sending regular pings to a bank. So even if the FBI continued to investigation suspected ties between Alfa Bank and Trump (again, more on that in a follow-up), the specific reference Mensch used to hang the FISA order on should never have involved allegations of a wiretap in Trump Tower.

This is not to say FISC didn’t issue an order pertaining to financial questions involving Russians. Mensch also points to David Corn’s piece on the Trump dossier, which we now know alleges a bunch of other, far more substantive financial issues. Later reporting described a tip from a Baltic country. But all of those pertain to suspected Russian bribes of people close to Trump or Paul Manafort’s corruption, not a spam marketing server sending spam to past clients of Trump hotels.

Which is to say that Mensch took a great tip — that there had been a FISC order — and slapped it onto dodgy allegations floating around in ways that didn’t even make sense for FISA, much less the allegations themselves.

Only Mensch says Trump was personally targeted in the FISA order

All that’s important because this is where the allegation that the order “covers Donald Trump” comes from.

The BBC, the next outlet to report it, claimed “Neither Mr Trump nor his associates are named in the Fisa order, which would only cover foreign citizens or foreign entities – in this case the Russian banks.” That didn’t make sense either, because — again — if the targets were two Russian banks, then FBI wouldn’t need a FISA order. And while it went on to to say three of Trump’s associates were the “subject” of the investigation (but not the target of the FISA order), it did cite someone outside of DOJ claiming that “it’s clear this is about Trump.” That’s still different than wiretapping Trump Tower.

The Guardian, reporting a week later, says that four of Trump’s associates were the targets of the broadly written FISA requested during the summer.

The Guardian has learned that the FBI applied for a warrant from the foreign intelligence surveillance (Fisa) court over the summer in order to monitor four members of the Trump team suspected of irregular contacts with Russian officials. The Fisa court turned down the application asking FBI counter-intelligence investigators to narrow its focus. According to one report, the FBI was finally granted a warrant in October, but that has not been confirmed, and it is not clear whether any warrant led to a full investigation.

But it doesn’t even confirm that the FISC order took place. Here’s a piece I did in January pushing back against claims that anything should be interpreted by the original “rejection” of the FISA order.

Andy McCarthy relies on Mensch to suggest the FISA order is improper

Mensch’s reliance on the Alfa server story also led Andy McCarthy to suggest impropriety in January, which is the next thing cited in Levin/Breitbart. McCarthy ignores the underlying premise — however discredited — of the Alfa story (that it was being used to bribe Trump) and uses Mensch’s inexact language to suggest FBI agents were instead using FISA to investigate bank crimes.

From the three reports, from the Guardian, Heat Street, and the New York Times, it appears the FBI had concerns about a private server in Trump Tower that was connected to one or two Russian banks. Heat Street describes these concerns as centering on “possible financial and banking offenses.” I italicize the word “offenses” because it denotes crimes. Ordinarily, when crimes are suspected, there is a criminal investigation, not a national-security investigation.

According to the New York Times (based on FBI sources), the FBI initially determined that the Trump Tower server did not have “any nefarious purpose.” But then, Heat Street says, “the FBI’s counter-intelligence arm, sources say, re-drew an earlier FISA court request around possible financial and banking offenses related to the server.”

Again, agents do not ordinarily draw FISA requests around possible crimes. Possible crimes prompt applications for regular criminal wiretaps because the objective is to prosecute any such crimes in court. (It is rare and controversial to use FISA wiretaps in criminal prosecutions.) FISA applications, to the contrary, are drawn around people suspected of being operatives of a (usually hostile) foreign power.

Probably the only thing in the larger range of allegations against Trump people that might be treated as a crime rather than a counterintelligence investigation is Paul Manafort’s acceptance of payments from Ukrainian oligarchs he may not have properly disclosed. Yet later reporting actually confirmed that that started as a criminal investigation, for which (as McCarthy points out) is a lot easier to get warrants. The rest involves bribery by a foreign power, so spying. So an appropriate use of FISA.

The expansion of 12333 sharing and the preservation of evidence

Amid a treatment of the Mike Flynn resignation, the release of the dossier (Breitbart sort of tweaks the timeline of these two, though I get that capturing the timeline is tough), and the Sessions’ disclosures, Breitbart discusses the expansion of information sharing and preservation of evidence.

6. January: Obama expands NSA sharing. As Michael Walsh later notes, and as the New York Times reports, the outgoing Obama administration “expanded the power of the National Security Agency to share globally intercepted personal communications with the government’s 16 other intelligence agencies before applying privacy protections.” The new powers, and reduced protections, could make it easier for intelligence on private citizens to be circulated improperly or leaked.

[snip]

10. March: the Washington Post targets Jeff Sessions. The Washington Postreports that Attorney General Jeff Sessions had contact twice with the Russian ambassador during the campaign — once at a Heritage Foundation event and once at a meeting in Sessions’s Senate office. The Post suggests that the two meetings contradict Sessions’s testimony at his confirmation hearings that he had no contacts with the Russians, though in context (not presented by the Post) it was clear he meant in his capacity as a campaign surrogate, and that he was responding to claims in the “dossier” of ongoing contacts. The New York Times, in covering the story, adds that the Obama White House “rushed to preserve” intelligence related to alleged Russian links with the Trump campaign. By “preserve” it really means “disseminate”: officials spread evidence throughout other government agencies “to leave a clear trail of intelligence for government investigators” and perhaps the media as well.

I think I was the one who first identified the irony of expanding 12333 sharing rules — a move that had been in the works since 2004, when CIA started pushing to resume sharing it had had under Stellar Wind — right as CIA and FBI were investigating Trump allies as potential Russian spies.

Understand: On January 3, 2017, amid heated discussions of the Russian hack of the DNC and public reporting that at least four of Trump’s close associates may have had inappropriate conversations with Russia, conversations that may be inaccessible under FISA’s probable cause standard, Loretta Lynch signed an order permitting the bulk sharing of data to (in part) find counterintelligence threats in the US.

This makes at least five years of information collected on Russian targets available, with few limits, to both the CIA and FBI. So long as the CIA or FBI were to tell DIRNSA or NSA’s OGC they were doing so, they could even keep conversations between Americans identified “incidentally” in this data.

I still don’t think giving the CIA and FBI (and 14 other agencies) access to NSA’s bulk SIGINT data with so little oversight is prudent.

But one of the only beneficial aspects of such sharing might be if, before Trump inevitably uses bulk SIGINT data to persecute his political enemies, CIA and FBI use such bulk data to chase down any Russian spies that may have had a role in defeating Hillary Clinton.

And while the expansion had been in the works for years, it is definitely true that both James Clapper and Loretta Lynch signed off on the sharing after the time Obama ordered a more detailed review of Russia’s role in the election. Indeed, Lynch signed off on it the day after FBI found Mike Flynn’s conversations with Sergey Kislyak showing Flynn telling the Ambassador not to worry about Obama’s new Russian sanctions. It is even possible that the sharing made available intercepts involving some of the Trump aides the FISC hadn’t approved for surveillance.

But Breitbart relies on a PJ Media piece instead, which falsely claims Flynn was targeted in the wiretaps of Kislyak and describes it as an expansion of NSA powers rather than an expansion of FBI and CIA access. Breitbart then concludes that “new powers, and reduced protections, could make it easier for intelligence on private citizens to be circulated improperly or leaked.” The guidelines do aspire to prevent that kind of abuse, but the protections against such abuse are far too weak.

For what it’s worth, I think that 12333 sharing is part of what the NYT reported on, the distribution of information around government. Whereas on January 2, only NSA might have had raw intercepts targeting Russians that might involve Trump aides, on January 3, CIA and FBI (and Treasury, which is also part of this inquiry) might have gotten their own copies, with FBI’s likely stored in an ad hoc database connected with the investigation (and therefore harder to find outside of the CI team investigating it). Nevertheless, the NYT story certainly suggests that Obama’s Administration worked to ensure that Trump couldn’t easily dismantle the investigation into his associates, while hiding the names of Russian spies and other informants. The question is whether it is appropriate to protect an ongoing investigation like that.

Breitbart gets an important detail wrong, however.

It treats the preservation of evidence — something more closely tied to the 12333 sharing and the investigation into people like Manafort and Carter Page — as part of the Jeff Sessions story. It is true that NYT ultimately added the Sessions story to its evidence preservation story, but that was added almost two hours after the story was first posted, to match the WaPo story.

Nevertheless, Breitbart, in a piece written by Trump’s campaign biographer in the rag until recent run by Trump’s consigliere Steve Bannon, links the two, tying this preservation of the ongoing investigation to the events that led to Sessions’ recusal.

Trump goes batshit in response Sessions’ recusal and then reads a misleading story placed in Bannon’s rag

All this is noteworthy because Trump was apparently already lashing out because Sessions recused himself.

Mr. Trump’s mood was said to be explosive before he departed for his weekend in Florida, with an episode in which he vented at his staff. The president’s ire was trained in particular on Donald F. McGahn, his White House counsel, according to two people briefed on the matter.

Mr. Trump was said to be frustrated about the decision by Jeff Sessions, his attorney general, to recuse himself from participating in any investigations of connections between the Trump campaign and Russia. Mr. Trump has said there were no such connections.

It’s particularly interesting that Trump attacked McGahn, because after what may have been a significant delay this week, he told White House staffers to retain records that may be relevant to the investigation. In addition, Sessions had informed McGahn he was recusing even as Trump was publicly claiming there was no reason to do so.

That’s the backdrop for the moment when Trump read the Breitbart article (I wonder who put it in his hands? Robert Costa reported that Bannon “is working closely with Trump on combating what he calls the ‘deep state’ in intel comm, per multiple people at WH”) and went on a Twitter rant complaining. The rant starts with the same projection he engaged in last night, suggesting Democratic meetings with Sergey Kislyak (about which no one lied about under oath) were just as damning as Sessions’ failure to disclose his own meetings with the Russian Ambassador.

He then immediately transitioned back and forth between the confused allegations from the original Mensch piece to Sessions again.

Which Trump then expands to suggest something even Breitbart did not — that Obama himself ordered the wiretap on Trump.

Trump’s accusations have led a range of sources to deny that Obama ordered the wiretap in both the NYT,

One former senior law enforcement official who worked under Mr. Obama said that it was “100 percent untrue” that the government had wiretapped Mr. Trump, and that the current president should be pressed to offer any evidence for his assertion.

Ben Rhodes, a former top national security aide to Mr. Obama, said in a Twitter message directed at Mr. Trump on Saturday that “no president can order a wiretap” and added, “Those restrictions were put in place to protect citizens from people like you.”

And in WaPo,

Kevin Lewis, a spokesman for Obama, said in a statement early Saturday afternoon: “A cardinal rule of the Obama Administration was that no White House official ever interfered with any independent investigation led by the Department of Justice. As part of that practice, neither President Obama nor any White House official ever ordered surveillance on any U.S. citizen. Any suggestion otherwise is simply false.”

Why do people believe Trump on Twitter?

In spite of the fact that Trump’s information can be pretty clearly attributed to the Breitbart piece, and the allegations about Trump Tower in it can be pretty clearly shown to be unsubstantiated, both the right and the left took Trump’s tirade to be some kind of confirmation, as if he just got briefed by the spooks that they’ve been listening in on this calls.

Trump hasn’t been bugged. It’s quite likely a number of Trump’s close associates are, after incriminating information showed up about or involving them on other wiretaps. There’s zero reason to believe Obama ordered them, not least because everyone involved believed Obama was responding too nonchalantly to the Russian accusations.

Trump’s associates are bugged, to the extent one or more of them are directly targeted rather than being collected incidentally, because they’re suspected of being Russian assets. That’s one of the key points of FISA, to use it to investigate possible spies working for foreign governments.

But because of the frenzy caused by Trump’s response to the Breitbart story, people are taking as true Trump’s claim he has been bugged, with Democrats claiming this is proof that Trump himself is in the crosshairs and normally surveillance loving Republicans suggesting using FISA to do what FISA is supposed to do is an abuse.

Remember, at least according to Sessions, he had decided to recuse before the WaPo disclosures on his ties with Kislyak. Whether or not that’s true, Trump is furious that Sessions recused even after a clear conflict became known.

And in response he tried — with a great deal of success — to discredit the very notion of this investigation.

Update: NYT updated their piece to reveal that WHCO Don McGahn is chasing down the purported FISA order covering Trump and his associates.

But a senior White House official said that Donald F. McGahn II, the president’s chief counsel, was working on Saturday to secure access to what the official described as a document issued by the Foreign Intelligence Surveillance Court authorizing surveillance of Mr. Trump and his associates. The official offered no evidence to support the notion that such a document exists; any such move by a White House counsel would be viewed at the Justice Department as a stunning case of interference.

Based on the assumption there is a FISA order covering at least some of his close associates, but probably not one covering him, understand what has happened here:

  1. Trump’s Attorney General, who claims he had already decided to recuse, recused after his nomination lies were exposed, meaning he no longer controls the investigation into his boss
  2. A misleading article written in response to that recusal led Trump to claim he was being targeted
  3. Based on the claim, Trump sent out his WHCO to find a FISA order probably not targeting him but probably targeting his aides
  4. Having just been deprived of visibility and control over the investigation, Trump is forcibly obtaining another way to control it
Share this entry

Reuters Confirms Krebs’ Supposition on Russian Treason Charges

/5 Comments/in , /by

Earlier this month, I noted Brian Krebs’ supposition on the source of the Russian treason charges against some FSB officers. He suggested the charges arose from an old grudge that spam businessman Pavel Vrublevsky had against two of the guys who got charged. Vrublevsky has long wanted to prove that they leaked information on his operations.

[T]he accusations got me looking more deeply through my huge cache of leaked ChronoPay emails for any mention of Mikhaylov or Stoyanov — the cybercrime investigators arrested in Russia last week and charged with treason. I also looked because in phone interviews in 2011 Vrublevsky told me he suspected both men were responsible for leaking his company’s emails to me, to the FBI, and to Kimberly Zenz, a senior threat analyst who works for the security firm iDefense (now owned by Verisign).

In that conversation, Vrublevsky said he was convinced that Mikhaylov was taking information gathered by Russian government cybercrime investigators and feeding it to U.S. law enforcement and intelligence agencies and to Zenz. Vrublevsky told me then that if ever he could prove for certain Mikhaylov was involved in leaking incriminating data on ChronoPay, he would have someone “tear him a new asshole.”

As it happens, an email that Vrublevsky wrote to a ChronoPay employee in 2010 eerily presages the arrests of Mikhaylov and Stoyanov, voicing Vrublevsky’s suspicion that the two men were closely involved in leaking ChronoPay emails and documents that were seized by Mikhaylov’s own division — the Information Security Center (CDC) of the Russian Federal Security Service (FSB).

Today, Reuters confirms Vrublevsky’s role in the arrest (as well as identifies the fourth person, Georgy Fomchenkov, arrested in the case).

The source connected to the investigation said the arrests were a result of accusations first made in 2010 by Pavel Vrublevsky, a Russian businessman and founder of ChronoPay, an online payments company. Vrublevsky told Reuters he had also learned that the arrests were a response to his allegations: that Stoyanov and Mikhailov had passed secrets on to American firms.

This makes a lot of sense. Notably, it explains why Kaspersky attributes Ruslan Stoyanov’s charges to actions that precede his time at the firm.

Reuters does not, however, pursue the other connection Krebs made — the long-term association between the operator of King Servers, Vladimir Fomenko, who has been named in association with the hack — and Vrublevsky.

My suspicion is that the King Servers connection identified other associations that were far more sensitive for Russia than just an old spam business grudge. And that’s why Vrublevsky is finally getting his revenge.

Update: Just to add two bits to this, because people are reading the Reuters story to suggest there’s no tie to the DNC hack. Not even Reuters states that. On the contrary, a source “connected to the investigation” states sometimes Russia uses old charges to go after people on new ones (actually we do this too, especially where the old charges can be prosecuted without exposing classified information).

Neither Vrublevsky nor the source connected with the investigation offered an explanation as to why they believe the Russian authorities would resurrect such an old case seven years after the allegations were first made.

However, the source said he believed the case may not be the sole reason why Russian authorities had decided to arrest the men now: in his experience, he said, Russian authorities at times use old cases as a way of charging people suspected of later crimes.

And Krebs made the connection to Vrublevsky because his company translated the denial for King Servers.

Fomenko issued a statement in response to being implicated in the ThreatConnect and FBI reports. Fomenko’s statement — written in Russian — said he did not know the identity of the hackers who used his network to attack U.S. election-related targets, but that those same hackers still owed his company USD $290 in unpaid server bills.

A English-language translation of that statement was simultaneously published on ChronoPay.com, Vrublevsky’s payment processing company.

“The analysis of the internal data allows King Servers to confidently refute any conclusions about the involvement of the Russian special services in this attack,” Fomenko said in his statement, which credits ChronoPay for the translation. “The company also reported that the attackers still owe the company $US290 for rental services and King Servers send an invoice for the payment to Donald Trump & Vladimir Putin, as well as the company reserves the right to send it to any other person who will be accused by mass media of this attack.” [italics mine]

Krebs suggested the complaint about unpaid bills sounded like Vrublevsky humor.

Share this entry

Four Details about Surveillance and the Flynn Ouster

/60 Comments/in , /by

It turns out Trump is on pace to fire a person every week, just like in his reality show. As you surely know, Mike Flynn has been ousted as National Security Advisor, along with his Deputy, KT McFarland.

There has been some confusion about what intelligence the spooks who just caused Flynn to be fired relied on. So let’s start with this detail from last night’s WaPo story:

After the sanctions were rolled out, the Obama administration braced itself for the Russian retaliation. To the surprise of many U.S. officials, Russian President Vladimir Putin announced on Dec. 30 that there would be no response. Trump praised the decision on Twitter.

Intelligence analysts began to search for clues that could help explain Putin’s move. The search turned up Kislyak’s communications, which the FBI routinely monitors, and the phone call in question with Flynn, a retired Army lieutenant general with years of intelligence experience.

From that call and subsequent intercepts, FBI agents wrote a secret report summarizing ­Flynn’s discussions with Kislyak.

That is, in response to questions elicited by Putin’s response, analysts actually read the intercepts of the Flynn-Kislyak call, which led to further monitoring of the conversations. And contrary to what HPSCI Chair Devin Nunes is whining, FBI would have access to Flynn’s side of the call right away, because they would own the tap (and in any case, they’d get unminimized copies of anything from NSA).

Some have pointed to this passage to suggest that the FBI was always listening in.

U.S. intelligence reports during the 2016 presidential campaign showed that Kislyak was in touch with Flynn, officials said. Communications between the two continued after Trump’s victory on Nov. 8, according to officials with access to intelligence reports on the matter.

It’s quite likely that’s not the case. After all, even Michael McFaul (who served as Ambassador to Russia at the beginning of the Obama Administration) said it was normal to have such calls before inauguration. Moreover, the FBI wouldn’t need to access the content of communications to learn that they were taking place. The metadata would be enough. And the actual content of the contacts would remain in some server in Utah.

Also, some have suggested that Flynn must be the Trump associate against whom a single FISA order was obtained in October. That’s unlikely, first of all, because if there were a FISA order on Flynn, then the FBI wouldn’t have needed the weird Putin response to lead them to read the actual content of calls (not to mention, the WaPo is clear that the contacts were collected as a result of normal monitoring of a foreign diplomat). Furthermore, most reports of that FISA order suggest the FBI first asked for four orders (in June and July) but only got one, in October. So it’s likely that FISA order covers another of Trump’s Russian buddies.

Finally, remember that for a great deal of SIGINT, FBI wouldn’t need a warrant. That’s because Obama changed the EO 12333 sharing rules just 4 days after the IC started getting really suspicious about Flynn’s contacts with Russia. That would make five years of intercepts available to FBI without a warrant in any counterintelligence cases, as this one is.

Update: Corrected KT McFarland instead of KC. Also, I’ve been informed she’ll stick around until Trump names a new NSA.

Share this entry

How Hal Martin Stole 75% of NSA’s Hacking Tools: NSA Failed to Implement Required Security Fixes for Three Years after Snowden

/4 Comments/in , , /by

The other day, Ellen Nakashima reported that Hal Martin, the Booz Allen contractor who has been in custody for months based on allegations he stole terabytes of NSA’s hacking tools, may be indicted this week. The story raises some interesting questions — such as how, absent some proof that Martin leaked this information to a third party, prosecutors intend to distinguish Martin’s hoarding from David Petraeus’ sharing of code word information with his girlfriend Paula Broadwell. One detail Nakashima included — that Martin had stolen “operational plans against ‘a known enemy’ of the United States” — may suggest prosecutors plan to insinuate Martin stole the information to alert that known enemy (especially if the known enemy is Russia).

All that said, the detail in Nakashima’s story that has attracted the most notice is the claim that Martin stole 75% of NSA’s hacking tools.

Some U.S. officials said that Martin allegedly made off with more than 75 percent of TAO’s library of hacking tools — an allegation which, if true, would be a stunning breach of security.

Frankly, this factoid feels a lot like the claim that Edward Snowden stole 1.5 million documents from NSA, a claim invented at least in part because Congress wanted an inflammatory detail they could leak and expand budgets with. That’s especially true given that the 75% number comes from “US officials,” which sometimes include members of Congress or their staffers.

Still, the stat is pretty impressive: even in the wake of the Snowden leak, a contractor was able to walk out the door, over time, with most of NSA’s most dangerous hacking tools.

Except it should in no way be a surprise. Consider what the House Intelligence Report on Snowden revealed, which I mentioned here. Buried way back at the end of the report, it describes how in the wake of Snowden’s leaks, NSA compiled a list of security improvements that would have stopped Snowden, which it dubbed, “Secure the Net.” This initiative included the following, among other things:

  • Imposing two person control for transferring data by removable media (making it harder for one individual to put terabytes of data on a thumb drive and walk out the door with it)
  • Reducing the number of privileged and authorized data transfer agents (making it easier to track those who could move terabytes of data around)
  • Moving towards continuous evaluation model for background investigations (which might reveal that someone had debt problems, as Martin did)

By July 2014, the report reveals, even some of the most simple changes included in the initiative had not been implemented. On August 22, 2016 — nine days after an entity calling itself Shadow Brokers first offered to auction off what have since been verified as NSA tools — NSA reported that four of the initiatives associated with the Secure the Net remained unfulfilled.

All the while, according to the prosecutors’ allegations, Martin continued to walk out of NSA with TAO’s hacking tools.

Parallel to NSA’s own Secure the Net initiative, in the intelligence authorization for 2016 the House directed the DOD Inspector General to assess NSA’s information security. I find it interesting that HPSCI had to order this review and that they asked DOD’s IG, not NSA’s IG, to do it.

DOD IG issued its report on August 29, 2016, two days after a search of Martin’s home had revealed he had taken terabytes of data and the very day he was arrested. The report revealed that NSA needed to do more than its proposed fixes under the Secure the Net initiative. Among the things it discovered, for example, is that NSA did not consistently secure server racks and other sensitive equipment in data centers, and did not extend two-stage authentication controls to all high risk users.

So more than three years after Snowden walked out of the NSA with thousands of documents on a thumb drive, DOD Inspector General discovered that NSA wasn’t even securing all its server racks.

“Recent security breaches at NSA underscore the necessity for the agency to improve its security posture,” The HPSCI report stated dryly, referring obliquely to Martin and (presumably) another case Nakashima has reported on.

Then the report went on to reveal that CIA didn’t even require a physical token for general or privileged users of its enterprise or mission systems.

So yes, it is shocking that a contractor managed to walk out the door with 75% of NSA’s hacking tools, whatever that means. But it is also shocking that even the Edward Snowden breach didn’t lead NSA to implement some really basic security procedures.

Share this entry

BuzzFeed Now Looking to Institutional Dems to Police a Phantom Surge of Lefty Fake News

/8 Comments/in , /by

One of my many concerns about the fake fake news scare is that it provides a way to discredit alternative voices, as the PropOrNot effort tried to discredit a number of superb outlets that don’t happen to share PropOrNot’s Neocon approach to Syria. BuzzFeed, in its seemingly unquenchable desire to generate buzz by inflating the threat of fake news, takes that a step further by turning to institutional Democratic outlets — outlets whose credibility got damaged by Hillary’s catastrophic loss — to police an alleged surge of fake news on the left.

First, consider its evidence for a surge in Democrats embracing fake news.

There are new cases daily. Suspicions about his 2020 reelection filing. Theories about the “regime’s” plan for a “coup d’état against the United States” (complete with Day After Tomorrow imagery of New York City buried in snow). Stories based on an unverified Twitter account offering supposed “secrets” from “rogue” White House staffers (followed by more than 650,000 people). Even theories about the Twitter account (“Russian disinformation”).

Since the election, the debunking website Snopes has monitored a growing list of fake news articles aimed at liberals, shooting down stories about a new law to charge protesters with terrorism, a plan to turn the USS Enterprise into a floating casino, and a claim that Vice President Mike Pence put himself through gay conversion therapy.

[snip]

Panicky liberal memes have cascaded across the internet in recent weeks, like an Instagram post regarding Steve Bannon’s powers on the National Security Council shared by a celebrity stylist and actress. Some trolls have even found success making fake news specifically aimed at tricking conservatives.

Let’s take the purported “fake news” story BuzzFeed bases its argument on, one by one:

  • A debunking of a Twitter thread (not a finished news piece) of the conclusions about a discovery that Trump, very unusually for a President, filed for reelection immediately after inauguration. There’s no debunking that Trump filed his candidacy, nor that it is unusual, nor, even, that Trump is fundraising off it. That’s not fake news. It’s an attempt to figure out why Trump is doing something unusual, with a fact-checking process happening in the Twitter discussion.
  • An admittedly overblown Medium post about some of the shady things Trump has done, as well as the much rumored claim that the reported sale of 19% of Rosneft confirms the Trump dossier claim that Carter Page would get part of Rosneft if he could arrange the lifting of US sanctions on Russia. The story’s treatment — and especially it’s use of the word “coup” — is silly, but the underlying question of whether Trump will instruct agencies to ignore the law, as already happened in limited form at Dulles over the first weekend of the Muslim ban, as well as the question of how Trump intends to target people of color, is a real one.
  • A story basically talking about the formation of the RoguePotusStaff Twitter account that notes prominently that “there’s no way to verify the authenticity of the newly minted Twitter channel.” BuzzFeed provided no evidence this was being preferentially shared by people on the left.
  • A Twitter thread speculating, based off linguistic analysis, that the RoguePotusStaff account might be Russian disinformation. Again, BuzzFeed made no claims about who was responding to this thread.
  • A debunking of a claim posted in November on a conservative fake news site claiming that protestors would get charged with terrorism.
  • A “debunking” of a satirical story from November posted in the Duffel Blog claiming Trump was going to repurpose an aircraft carrier.
  • A debunking of a fake news story from November claim that Mike Pence had put himself through gay conversion therapy that notes Pence did, indeed, push gay conversation therapy.
  • A liberal trolling effort aimed at conservatives, which started in December, claimed that Trump had removed symbols of Islam from the White House.
  • An instagram post that (BuzzFeed snottily notes) got shared by an actress and a stylist reporting the true fact that Bannon had been added to the National Security Council and noting the arguably true fact that the NSC reviews the kill list including the possibility of targeting Americans (technically, the targeted killing review team installed by Obama is not coincident with the NSC, but it does overlap significantly, and Anwar al-Awlaki was targeted by that process).

Most of these things are not news! Most are not pretending to be news! The only single thing included among BuzzFeed’s “proof” that lefties are resorting to fake news that would support that claim is the Mike Pence story. And to get there, BuzzFeed has to pretend that the Duffel Blog is not explicitly satire, that multiple cases of conservative fake news are lefty fake news, that well-considered discussions on Twitter are fake news, and that we all have to stop following RoguePotusStaff because we don’t know whether its writers are really Rogue POTUS staffers or not.

It’s a shoddy series of claims that BuzzFeed should be embarrassed about making. Effectively, it is calling discussion and satire — including correction — fake news.

To BuzzFeed’s credit, after months of mis-stating what a poll it did revealed — BuzzFeed had been claiming that 75% of people believe fake news, but in reality the poll showed that 75% of those who recall fake news believe it — BuzzFeed finally got that, at least, correct. Bravo BuzzFeed!

But other than that, they’ve got almost nothing here.

Believe it or not, that’s not the most offensive part of this story. Having invented a lefty fake news problem out of satire and Twitter discussions, BuzzFeed then decided it’s important what official Democratic sources thing about it. While one Bernie source said it was best to ignore these things (another said it was a real problem), BuzzFeed framed other responses in terms of left protests of elected officials.

Democratic operatives and staffers at left-leaning media outlets predict that viral anti-Trump conspiracy theories will ultimately distract from real reporting about the administration, undermining legitimate causes for outrage on the left over what the administration is actually doing.

Still, for now, it’s a conversation that exists almost entirely outside the political class itself. Elected officials are not hawking phony stories as true, like Trump’s calls to investigate widespread voter fraud during the election. But that remove poses its own problems for leaders with no obvious way to dismantle widely shared false stories.

“It exists on the left and that’s a problem because it misinforms people,” said Judd Legum, editor in chief of progressive news site ThinkProgress. “That’s harmful in other ways because the time you’re spending talking about that, you could spend talking about other stuff.”

“It contributes to a broader environment of distrust, and it sort of accelerates the post-factual nature of our times,” said Teddy Goff, co-founder of Precision Strategies and a former senior aide to Barack Obama and Hillary Clinton. “Fake news is pretty damaging no matter who it benefits politically. No one on the left should think we ought to be replicating the fake news tactics on the right.”

[snip]

The online energy also raises questions about the party’s relationship with its base. In recent weeks, progressives have pressured lawmakers to adopt a tougher stance toward Trump and join ranks with the millions of protesters who marched over inauguration weekend.

The two top-ranking Democrats in Washington, Chuck Schumer in the Senate and Nancy Pelosi in the House, have both signaled an openness to working on legislation with Trump. Last week, protests formed outside Schumer’s home in Brooklyn. And among progressive activists online, Pelosi was met with vehement push-back after saying the party has a “responsibility to the American people to find our common ground.”

“Elected Democrats are stuck struggling to keep ahead of the anger that the base is feeling right now,” said [Jim] Manley, the former Reid adviser. “It’s very palpable.”

First, BuzzFeed is wrong in saying elected officials are not hawking phony stories as true. One reason the claim that Wikileaks doctored Democratic emails got so much traction is because Dems repeatedly made that claim (and as I’ve noted, Hillary quickly escalated the Alfa News story that most media outlets rejected as problematic).

Worse, BuzzFeed deems Democratic operatives and staffers as somehow chosen to decide what are “legitimate causes for outrage on the left over what the administration is actually doing.” It further suggests there’s a connection between people protesting elected leaders and fake news.

Finally, BuzzFeed shows absolutely no self-awareness about the people it seeks about and the stories they’ve pitched. Consider: Manley is in the very immediate vicinity of the people who got the WaPo to push the claim that CIA had decided Russia hacked the DNC in order to get Trump elected, a conclusion that — we’ve subsequently learned — is the single one any agency in the IC (in this case, the NSA) expressed less confidence in. Moreover, we know that Harry Reid spent months trying to get the FBI to reveal details included in the Trump dossier that no one has been able to confirm. And when the dossier was released, Judd Legum magnified it himself, in much the same way the Medium post did the Rosneft claim.

Oh, and as a reminder: BuzzFeed was the entity that decided it was a good idea to publish an unverified intelligence dossier in the first place!

I mean, if the institutional Dems that BuzzFeed has deemed the arbiters of what is “legitimate” to talk about think the unproven Russian dossier counts, then BuzzFeed has even less in its claim about fake news.

Nevertheless, it thought it was a good idea to assign two journalists to make thinly substantiated claims about a lefty news problem that it then used to police whether lefty protestors are doing the right thing.

Share this entry

John Yoo Wishes Trump Abused Executive Authority More Effectively

/9 Comments/in , /by

At the end of a John Yoo critique of Donald Trump’s abuses that a lot of people are mis-reading, he says this:

A successful president need not have a degree in constitutional law. But he should understand the Constitution’s grant of executive power. He should share Hamilton’s vision of an energetic president leading the executive branch in a unified direction, rather than viewing the government as the enemy. He should realize that the Constitution channels the president toward protecting the nation from foreign threats, while cooperating with Congress on matters at home.

Otherwise, our new president will spend his days overreacting to the latest events, dissipating his political capital and haphazardly wasting the executive’s powers.

John Yoo is not stating that, across the board, Trump has overstepped his authority. Indeed, the areas where Yoo suggests Trump has or will overstep his authority — exiting NAFTA and building a wall — are things Trump has not yet put into place. His concern is prospective. The only thing Trump has already done that Yoo believes abused power was firing Sally Yates, and that because of his explanation for firing her.

Even though the constitutional text is silent on the issue, long historical practice and Supreme Court precedent have recognized a presidential power of removal. Mr. Trump was thus on solid footing, because attorneys general have a duty to defend laws and executive orders, so long as they have a plausible legal grounding. But the White House undermined its valid use of the removal power by accusing Ms. Yates of being “weak on borders and very weak on illegal immigration.” Such irrelevant ad hominem accusations suggest a misconception of the president’s authority of removal.

Yoo doesn’t, for example, complain about Trump’s Executive Order on Dodd-Frank, which may have little effect.

But what Yoo is worried about is not abuse, per se, but that Trump will “waste the executive’s powers.”

That’s important given Yoo’s critique of Trump’s Muslim ban.

Immigration has driven Mr. Trump even deeper into the constitutional thickets. Even though his executive order halting immigration from seven Muslim nations makes for bad policy, I believe it falls within the law. But after the order was issued, his adviser Rudolph Giuliani disclosed that Mr. Trump had initially asked for “a Muslim ban,” which would most likely violate the Constitution’s protection for freedom of religion or its prohibition on the state establishment of religion, or both — no mean feat. Had Mr. Trump taken advantage of the resources of the executive branch as a whole, not just a few White House advisers, he would not have rushed out an ill-conceived policy made vulnerable to judicial challenge.

Yoo is saying that Trump could have implemented this policy if only he had gotten better advice about how to hide the fact that it was a Muslim ban, in the same way firing Yates would have been fine had Trump offered another explanation for it.

There’s a big rush among those who’ve abused executive authority in the past to rehabilitate themselves by seeming to criticize Trump. Many of them — including Yoo — are mostly complaining that Trump’s bad execution of abuse of executive power might give it a bad name.

 

Share this entry

The Problems with Pompeo: A Willingness to Use Information on Americans Russia Hacked and Shared with Trump

/20 Comments/in , , , /by

On Friday, the Senate confirmed the first two of President Trump’s nominees: Generals Mattis and Kelly to run DOD and DHS, respectfully. But it did not confirm the third nominee slotted for that day, Mike Pompeo. In part because the nomination was not dealt with in regular fashion in the Senate Intelligence Committee (which did not vote out his nomination), Ron Wyden managed to force Mitch McConnell to hold 6 hours of debate tomorrow on his nomination.

Wyden has suggested we need to have more debate because Pompeo hasn’t answered all the questions posed to him. And it is true that Wyden has concerns about the following issues. But perhaps most of all, Wyden’s questions suggest he is concerned that the Trump administration will use information the Russians hacked against Americans.

In follow-up questions posed to Pompeo, Wyden expressed concern about Pompeo’s:

  • Enthusiasm for using bulk collections of “lifestyle” information on Americans
  • Willingness to have the CIA engage in activities the Ambassador or other Chief of Mission disagrees with
  • Squirminess about when the CIA can kill a US person
  • Dodginess on classifying torture information that reveals illegal, embarrassing, competitive, or otherwise unclassified information

But as I said, Wyden’s chief concern appears that Pompeo will use information the Russians have or will give the Trump administration against Americans.

Enthusiasm for using bulk collections of “lifestyle” information on Americans

A big point of concern for Wyden and Martin Heinrich throughout Pompeo’s confirmation process is this op-ed he wrote at the beginning of last year. Based in part on the fact that the intelligence community didn’t find the Tashfeen Malik’s anti-American statements on non-public social media, and in part on the demonstrably false claim that the IC didn’t find the Garland attackers beforehand (in reality, the FBI was cheering them on), Pompeo argued we need to collect still more data. “Congress should pass a law re-establishing collection of all metadata, and combining it with publicly available financial and lifestyle information into a comprehensive, searchable database,” he wrote.

Pompeo has dodged questions about precisely what “lifestyle” information he wants to collect — though it surely includes Twitter’s firehose of data from Dataminr. Sadly, he repeatedly pointed to executive orders in his answers, and the new EO 12333 sharing rules permit the access of “public” information, which can include information from data brokers (though Pompeo claims ignorance of what he might want to use). So while Wyden is concerned that Pompeo will start dragnetting Americans, sadly he has been enabled to do so by one of the last things Obama did.

Willingness to have the CIA engage in activities the Ambassador or other Chief of Mission disagrees with

Another concern Wyden raised pertains to disagreements between the Chief of Mission (the top diplomat in a country) and the CIA Station Chief. This has been an issue in the past at least as it pertains to drone strikes in Pakistan and the torture program, where the Ambassador was either not informed or not properly consulted on CIA activities within a country.

When asked a yes or no question whether he would permit CIA to conduct activities even while an outstanding disagreement remained, Pompeo refused to answer, stating instead that he would seek an expeditious decision from the President. Effectively, he suggested if he were losing a disagreement with State, he’d get Trump to override State.

Squirminess about when the CIA can kill a US person

Wyden, who has long sought guidelines on when the US can kill an American citizen, returned to pre-hearing questions on this topic. After citing the Drone Rule Book requirement that DOJ be involved before taking action against a US person, he asked whether Pompeo agreed with the requirement. Pompeo basically said the US “must consider an American citizen’s constitutional rights prior to targeting him” and “CIA attorneys frequently consult with” DOJ (though left open the possibility of relying on less formal analysis). Ultimately, Pompeo dodged laying out any additional checks he’d following before killing an American.

Dodginess on classifying torture information that reveals illegal, embarrassing, competitive, or otherwise unclassified information

Wyden asked Pompeo if he disagreed with the prohibitions on classifying information to “(1) conceal violations of law, inefficiency, or administrative error; (2) prevent embarrassment to a person, organization, or agency; (3) restrain  competition; or ( 4) prevent or delay the release of information that does not require protection in the interest of national security,” prohibitions that existed in Clinton’s, George W. Bush’s, and Obama’s EOs on classified information. Pompeo said he did not. However, immediately in that context, Wyden asked about the Torture Report, and Pompeo dodged all questions about declassifying the torture report.

Willingness to use information obtained by Russians hacking Americans

But as I said, Wyden’s persistent concerns in his post-hearing questions pertained to whether and how Pompeo would be willing to cooperate with the Russians. Raising a Pompeo hearing comment that if a foreign partner gave the CIA information on US persons “independently,” “it may be appropriate of CIA to collect [that] information in bulk,” Wyden raised Trump’s encouragement of Russian hacking and asked what circumstances would make foreign collection so improper that CIA should not receive such information. Pompeo responded, “information obtained through such egregious conduct may be appropriate for the CIA to use or disseminate.”

Wyden then listed out a bunch of conditions, such as information coming from an adversary, to disrupt US democracy, information implicating First Amendment protected political activity, or information affecting thousands or millions of Americans. “The listed conditions could all be relevant,” Pompeo responded, remaining non-committal.

Wyden raised a Pompeo comment suggesting rules for accessing US person communications under EO 12333 and asked if that was true of information known to include significant US person information. Pompeo said he would consult experts and AGG guidelines (which, arguably, are this flexible).

Wyden raised Pompeo’s promise to expand intelligence cooperation with state and non-state partners, and asked specifically whether this included Russia, and if so how Pompeo planned on dealing with the counterintelligence risks of doing so. Pompeo said he as not referring to “any specific partners,” said, “CIA already has a strong counterintelligence program,” and said anything he did would comply with law and standard practices and be noticed to Congress.

Wyden then asked if “it is legal or appropriate for the White House to obtain from a foreign partner…information that includes the communications of U.S. persons” and if he learned that they were doing so, whether he would inform Congress of it. Pompeo responded “I am not aware of a DCIA role in supervising White House activities or providing legal counsel to the White House on its activities,” apparently committing only to informing Congress of CIA’s own activities.

In short, there are a lot of reasons to be worried about Pompeo as Director of CIA. But Wyden seems most worried that CIA (and the White House) will use information Russia gives them against American citizens.

Share this entry

The Democrats Newfound Love for Russian Intelligence Product

/38 Comments/in , /by

As you know, Buzzfeed published a dossier laying out Donald Trump’s ties to Russia last night. The dossier is described as oppo research done by a former MI6 agent first for a GOP rival (which doesn’t make a ton of sense as the dossier starts in June 2016) and then picked up by Hillary. There are competing reports on whether this dossier was included in the briefing on the Russian hack intelligence provided to Trump the other day (and I and others falsely claimed that this dossier is what some Senate Dems have pointed to as evidence they’ve been briefed about Trump’s ties to Russia).

I wanted to make a few points about the dossier.

First, note that this is not the complete dossier. There are references to reports that are not included with this dump. That means, even assuming the provenance on all else is solid, this is a cherry picked version of what the former MI6 consultant reported to Hillary.

Second, ask yourself why Hillary didn’t leak this dossier during the election (besides sharing the contents of it with David Corn). I don’t know the answer to that, but I’d sure like to know it (and I’ve got some theories that don’t raise my confidence about the dossier generally).

Third, as a number of people have noted, there are errors in this report, down to the spelling of Alfa Bank. That’s not itself discrediting, but it should caution people not to take this as finished intelligence.

For what it’s worth, I find some of it very credible. Some of it accords with stuff I know. Others of it conflicts in material ways with well-sourced information I know. I find other claims transparently silly (such as the report that anyone believed Trump didn’t have serious business ties to Russia). That may simply speak to the credibility of the individual underlying sources, or it may speak to the dossier generally. I don’t yet have an opinion on that.

Which brings me to the sources. Trump’s team has claimed that these reports come from Russian intelligence, which ought to raise the very good question of why we’d take as Gospel something Russian intelligence said now when we’re supposed to disdain known accurate information (Hillary emails) leaked on behalf of Russian intelligence. Trump’s claim is — as regards the most sensational of the claims in the report, that Trump had prostitutes urinate on a bed that Barack and Michelle Obama had used while in Moscow, as well as a few more of the claims — true. It is not true for others of the claims.

Which is to say, I’m not entirely sure what to make of this dossier yet. It is more interesting to me as an artifact — as something that Hillary had but chose not to leak but that got leaked yesterday of all days — than as a source of information, but I do think some of the information in the dossier might, with far more vetting, turn out to be somewhat accurate. There are reports FBI is investigating this document that I’m not 100% sure I believe.

I’ll come back to this analysis when I can print out the document, but here’s a list of all of the sources used in the report. Remember, before you get to these embedded sources (most are described as a “compatriot” of the actual source), you’ve got to remember the former MI6 agent paid to do opposition research (and perhaps directing his agents to look for opposition research). So everything here is Hillary’s surrogates to former MI6 agent to (usually) a “compatriot” to the underlying source. Also, some of these sources are obviously repetitive (such as the source close to Ivanov), so the entire dossier likely relies on closer to 10 underlying sources than the 31 listed here.

  1. Source A: Senior Russian Foreign Ministry figure with knowledge of intelligence the Kremlin was feeding Trump [via trusted compatriot]
  2. Source B: Former top level Russian intelligence officer still active insider the Kremlin, who says the Russians have enough material to blackmail Trump [via trusted compatriot]
  3. Source C: Senior Russian financial official
  4. Source D: A close associate of Trump who knows that the Ritz Carlton is under control by FSB
  5. Source E: redacted, possibly a staffer at the Ritz Carlton, which is reportedly controlled by FSB
  6. Source F: A female staffer at the Ritz, which is reportedly controlled by FSB
  7. Source G: A senior Kremlin official
  8. Unlabeled senior government official claiming the Russians had had only limited success penetrating foreign governments we know they’ve penetrated (like the US) but explaining RU had had increasing problems with its own hackers
  9. A Russian IT specialist with direct knowledge of FSB’s coercion and blackmail used to recruit hackers
  10. An IT operator inside a leading Russian State Owned Entity familiar with FSB penetration of a foreign director
  11. An FSB cyber operative
  12. Source E2: An ethnic Russian close associate of Trump who claims Trump has a minimal investment profile in Russia
  13. A Russian source close to Rosneft President Igor Sechin
  14. A compatriot of an official close to Presidential Admin Head Sergei Ivanov
  15. A trusted associate of a Russian émigré figure
  16. A Kremlin source close to Sergei Ivanov
  17. A Kremlin source close to Dmitri   Medvedev
  18. A close colleague of Sergei Ivanov
  19. A Kremlin official involved in US relations
  20. An ethnic Russian associate of Trump, who had spoken to Carter Page
  21. A compatriot of a Kremlin insider discussing Duma Head of Foreign Relations Committee Konstantin Kosachev
  22. A well-placed Russian figure
  23. An American political figure associated with Trump
  24. A trusted compatriot of a senior member of Presidential Administration and of a senior Minister of Foreign Affairs official
  25. A former top level Russian intelligence officer
  26. A trusted compatriot of a top level Russian government official
  27. A trusted compatriot of a St. Petersburg member of the political/business elite and another involved in the services/tourist industry
  28. A trusted compatriot of a senior Russian leadership figure and a foreign ministry official
  29. A trusted compatriot of a close associate of Rosneft President Igor Sechin, a senior member of Sechin’s staff, and a Kremlin insider with direct access to the leadership
  30. A longstanding compatriot friend of a Kremlin insider
  31. [Redacted]

 

Share this entry
[Photo: National Security Agency, Ft. Meade, MD via Wikimedia]

The Shadow Brokers: “A Nice Little NSA You’ve Got Here; It’d Be a Shame If…”

/9 Comments/in , /by

When President Obama discussed how to retaliate against Russia for hacking the DNC last Friday, he described the trick of finding “an appropriate response that increases costs for them for behavior like this in the future, but does not create problems for us.” Aside from questions of efficacy, Obama raised something that a number of people looking for a big explosive response seem to have forgotten: that any response may create problems for us.

Which is why I find it curious that — aside from this one piece by Krypt3ia — no one factored in another cyber-attack on the US in discussions about retaliation, one that is, at least in execution, on-going: the release of NSA tools by a group calling itself the Shadow Brokers.

I’ve put a rough timeline (!) below. But as it shows, several weeks after the initial release of the DNC emails led to Debbie Wasserman Schultz’s resignation, the Shadow Brokers posted the first of what have thus far been 6 messages. Especially recently, the timing of the Shadow Brokers releases correlates in interesting ways with developments in the DNC hack. At the very least, the coincidence suggests the threat of further exposure of NSA’s hacking may be a factor in discussions about a response.

Release One: Burning US firewall providers

The first Shadow Brokers post announced an auction of Equation Group (that is, NSA offensive hacking) files. It released enough files to make it clear that a number of firewall companies, including several American companies, had been targeted by the NSA. Accompanying the release was a rant that indirectly pointed to the Clintons — discussing blowjobs and running for President — but at that point, there was not much focus about whether these files were related to the Russian hacking and, more importantly, not a ton of focus on the files in discussions of the Russian hacking. That is, while many people assumed Russia might be the culprit, that it might fell out of the discussion.

Two weeks later, the FBI arrested Hal Martin, a(nother) Booz Allen contractor that — the NYT story that revealed his arrested — served as a ready scapegoat for the files.

The very next day, Shadow Brokers posted its second message, the first of several proving that it was not, personally, Hal Martin. It was basically a play on Team America’s Kim Jong Il character, asking why everyone was so stupid.

A few days later, on September 5, President Obama gave Vladimir Putin the first of several warnings about the hacking — understood to be the DNC hacking (reportedly, no one knew about the Podesta hack yet, even though the emails had been stolen in March).

Almost a month passed before Shadow Brokers posted again, on October 1, basically whining about no one playing in the auction. The following two weeks are critical in the DNC hack rollout.

On October 7, two leaks distract from the IC attribution announcement

On October 7, three things happen (well, more, but I’ll come back to that): First, ODNI and DHS released their statement blaming Russia for the hack. The WaPo published the Access Hollywood “Grab them by the pussy” video. And WikiLeaks started releasing the Podesta emails.

Side note: This weekend, Podesta complained about the latter two events, describing how they came out just an hour apart. People even disputed the claim. But in neither Podesta’s comment nor the fact-check are people mentioning that it’s not so much the Podesta emails distracted from the Trump video (which I don’t think to be the case anyway, because the GrabThemByThePussy really did distract us for a while), but both — and especially the video — distracting from the Russia implication.

A week later, the same NBC team that has been the recipient of other DNC hack related leaks published a dick-wagging story promising that the CIA was about to cyber-retaliate for the hacks.

The next day, Shadow Brokers released message number 4 calling off the auction. The Shadow Brokers post also crassly spoofs airplane Loretta Lynch’s meeting with Bill Clinton (there a cultural reference here I don’t get), bringing the message content of the SB series still closer to the context of the Hillary emails.

Release Two: ID alleged NSA targets and threaten the election

Thus far, mind you, Shadow Brokers had just released enough to seriously compromise America’s firewall companies and their relationship with the NSA — but had mostly just been making noise since the first release. That changed on October 30, less than two weeks before the election.

Most of the focus on this release has been on the data released: a set of IP addresses seemingly showing the addresses NSA had hacked or used as a proxy. The IP addresses were dated, so the release wasn’t exposing ongoing operations, probably. But it did reveal a significant number of academic targets. It also showed that, several years before we drummed up the Iraq War, we were targeting the Organization for the Prohibition of Chemical Weapons. Unlike the first release, then, this one didn’t so much help anyone hack. Instead, it identified who had been hacked, and the degree to which these were not obvious targets.

But the message from that release is, in retrospect, just as important. It includes a reference to the NBC dick-wagging story about CIA hacking Russia. It questions why the focus has been on the DNC hack and not the Shadow Brokers release, “hacking DNC is way way most important than EquationGroup losing capabilities. Amerikanskis is not knowing USSA cyber capabilities is being screwed.” It invited people to hack the election.

On November 8th, instead of not voting, maybe be stopping the vote all together? Maybe being grinch who stopped election from coming? Maybe hacking election is being the best idea? #hackelection2016.

And then it demanded payment or the bleeding would continue. “How bad do you want it to get? When you are ready to make the bleeding stop, payus,”

The next day, according to NBC, for the first time in his Administration, President Obama used the “Red Phone” communication system with Russia and discussed war, albeit in muddled terms.

Now, even aside from this timing, it makes more sense that Obama was reacting to the Shadow Brokers release than the DNC ones. Though Dems have suggested Russia kept hacking after the spring, that appears to have been more phishing attempts, not known theft of documents. As for the DNC and Podesta files, as Obama said on Friday, those files had already been stolen. Short of stopping WikiLeaks (and Ecuador had cut off Julian Assange’s wifi access by then, presumably in response to US pressure, though it had little impact on the release of the Podesta files), there was nothing that a call could do about the ongoing leaks pertaining to Hillary. There were, admittedly, the probes of state voter registration sites, but the IC has consistently stopped short of attributing those to Russia.

But a response to a threat to hack Russia?

Which would seem to suggest the IC believes that these Shadow Brokers files are coming from Russia.

Release Three: A broad array of alleged tools, including those that hacked Belgacom

Then things went quiet again for a while, until the leakapalooza starting on December 9, which was basically an effort by the Dems and some spooks to pressure Trump and/or delegitimize his election. Significantly, however, the December 9 WaPo story also reported, for the first time, that CIA knew who the cut-outs between Russia’s hackers and Wikileaks were, something James Clapper said the IC didn’t have as late as November 17. In addition, the NYT published its long piece describing the hack, told in a way to put the Dems in the best possible light (which is a polite way of saying it is not hard-hitting news).

So on December 14, a Motherboard post from a persona named Bocefus Cleetus points to a ZeroNet site with a set of files listed for individual sale (and aggregating all the past messages).

With regards to the files, here is HackerHouse’s analysis, here is the Grugq’s post on the technical aspect of the files, and a few of Shadow Brokers’ most recent tweets allegedly describe what some of the files are. The short version though is, like the original release, these are dated files, some of them triggering known interests of commentary on NSA’s hacking. There’s a good deal of variety in tools, some of which sound cool. One of them, at least according to Hacker House, is likely one of the tools used to hack Belgacom.

Interestingly, HackerHouse and the Grugq disagree as to what this array suggests about the source of the files. The Grugq argues that these files must come from inside the NSA, because there’d be no other explanation for all of them to be in the same place.

Why High Side?

The easiest way to tell this is high side [inside NSA’s classified networks] gear, not a back hack from an ops box is that there is simply too much here. Its hard for me to explain because it requires a level of information security knowledge combined with understanding how cyber operations are conducted (which is different from pen tests or red teaming.)

The TAO of Cyber

Cyber operations are basically designed with operational security in mind. The operators create a minimal package of tooling needed for conducting exactly, only and specifically the operation they are doing. This means, for example, if they are hitting a telco Call Data Records (CDR) box, they will plan for what they are going to do on that specific computer and prepare the tools for only that plan and that computer. If those tools are captured, or there is a back hack up to their staging point, the loss is compartmented.

But HackerHouse argues they must be from a staging site (that is, external to the NSA) because they are binary files.

The bulk of these projects are not provided in source code form and instead appear to be binary files, which further strengthens the hypothesis that these files were compromised from an operational staging post or actively obtained from a field operation. If they had been in source code format then this would suggest an insider leak is more likely, binary files are often used in operations over their source code counterpart.

For what it’s worth, in the first post, Shadow Brokers claims it tracked EG’s traffic. “We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group.” But it is worth noting that, 4 months after the first leak, tech folks are still disputing whether these must have come from inside our outside the NSA.

Assuming no one buys these files, then, the release has done several things. First, it provided Belgacom and other potential targets of US hacking more evidence they might use to identify an NSA hack. As such, it seems consistent with the earlier releases: not so damaging for current operations as it is for the exposure of who and how the US targets civilian targets.

But it also tells the NSA more about what Shadow Brokers has — at least some of the tools it has (in the first post, SB claimed NSA didn’t know what it had), but also where they were obtained.

Cleetus’ close commentary on recent events

Which brings me to the message (post one, post two) of presumed Shadow Brokers persona, Bocefus Cleetus (as others have argued, a possible allusion to “ventriloquist dummy of FSB”), which the Grugq wrote about here. I suspect (this is a wildarseguess) Cleetus may serve as a temporally contingent way to alert the public to files that may have been out there for a while.

As the Grugq notes, the first message is interesting for its invocation of Rage against the Machine’s “People of the Sun” juxtaposed against a background and fake discourse targeting caricatured Neo-Nazi Trump voters. He reads the former as a warning about invading brown people, but I think — given the stylistic fluidity across the six Shadow Brokers’ messages — it might better be understood as mixed metaphors. RATM where one has been led to expect Hank Williams Jr.

There’s also a reference to fake news. As with the October 30 release (assuming Cleetus is a persona of Shadow Brokers), this is also a piece responding to very current events.

But Cleetus’ second message that is a far more interesting comment on immediate events. For example, from the first, it invokes NYT’s blockbuster (which is remarkably favorable to the DNC) story on the hack, which has now been translated into Russia. Here’s Cleetus’ first line:

After my shadow brokers tweet I was contacted by an anonymous source claiming to be FBI. Yep I know prove it? I wasn’t able to get’em to verify their identity.

Here’s an early line from the NYT story:

“I had no way of differentiating the call I just received from a prank call,” Mr. Tamene wrote in an internal memo, obtained by The New York Times, that detailed his contact with the F.B.I.

This line from Cleetus:

The NSA has the global surveillance capabilities to intercept all the DNC and Podesta emails.

Seems to reflect Bill Binney’s theory, which is that the NSA would know if there were really a hack because it would have seen the traffic.

In other words, any data that is passed from the servers of the Democratic National Committee (DNC) or of Hillary Rodham Clinton (HRC) – or any other server in the U.S. – is collected by the NSA.  These data transfers carry destination addresses in what are called packets, which enable the transfer to be traced and followed through the network.

[snip]

The bottom line is that the NSA would know where and how any “hacked” emails from the DNC, HRC or any other servers were routed through the network. This process can sometimes require a closer look into the routing to sort out intermediate clients, but in the end sender and recipient can be traced across the network.

There’s the reference to the now-forgotten stink when Trump interviewed Mike Rogers.

Clapper and Carter tried to get Rogers fired. They also called for the breakup of NSA.

That was first reported by the same folks who set off this leakapalooza.

The heads of the Pentagon and the nation’s intelligence community have recommended to President Obama that the director of the National Security Agency, Adm. Michael S. Rogers, be removed.

The recommendation, delivered to the White House last month, was made by Defense Secretary Ashton B. Carter and Director of National Intelligence James R. Clapper Jr., according to several U.S. officials familiar with the matter.

Action has been delayed, some administration officials said, because relieving Rogers of his duties is tied to another controversial recommendation: to create separate chains of command at the NSA and the military’s cyberwarfare unit, a recommendation by Clapper and Carter that has been stalled because of other issues.

What ever happened to Trump’s imminent plan to replace James Clapper with Mike Rogers amidst a big rearrangement of the spook desk chairs, I wonder? Has he completely forgotten Clapper is out of here on January 20, at noon sharp, Clapper said?

In any case, those bits directly echo very current news. But the rest of the post posits a fight between DOD and CIA, some of it rooted in equally real, if more dated, pissing contests.

Look it up for yerself! DOD and CIA have had a turf war going back to the Afghanistan and Iraq Wars bout whose job it was to run paramilitary operations. A turf war over the next “domain of battle” with all the government cheese.

One reason Shadow Brokers’ positing of a NSA-CIA spat — which the Grugq argues could not be real — is so interesting is because most of the recent reporting has forgotten NSA’s centrality in all this and instead focused on an FBI-CIA split, which was artificially resolved by pre-empting the President’s press conference on Friday.

I don’t think there’s really an NSA-CIA pissing contest, though there may be an interesting detail here or there I’ll return to.

But it brings us full circle. President Obama, in urging calm, invoked the kind of retaliation that might, “create problems for us.” Those comments took place as if only the DNC and Podesta hacks were at issue (indeed, he made Martha Raddatz qualify what leaks the IC had blamed on Russia, and that’s what she said). But it appears likely that the IC connects Shadow Broker to the other two. And the whole time we’ve been talking about retaliating, the Shadow Brokers has not so much been undercutting the NSA’s bread and butter, but letting our allies and other neutral parties see precisely whom we conduct this dragnet on.

That sounds like something that might “create problems for us.”

On October 30, Shadow Brokers taunted, “When you are ready to make the bleeding stop, payus, so we can move onto the next game.” I think we’re still in that first game.

Shadow Brokers Timeline

August 13: Message 1 Equation Group Warez Auction Invitation

The name, in general, is a play on the villain from Mass Effect.

GitHub, Reddit, Tumblr (see note), with takedowns as stolen property

Message on Pastebin

Claims files obtained by following EG traffic, claims EG doesn’t know what it lost

We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group.

[snip]

Equation Group not know what lost. We want Equation Group to bid so we keep secret. You bid against Equation Group, win and find out or bid pump price up, piss them off, everyone wins.

Rant about wealthy elites who don’t get blowjobs who run for President

We have final message for “Wealthy Elites”. We know what is wealthy but what is Elites? Elites is making laws protect self and friends, lie and fuck other peoples. Elites is breaking laws, regular peoples go to jail, life ruin, family ruin, but not Elites. Elites is breaking laws, many peoples know Elites guilty, Elites call top friends at law enforcement and government agencies, offer bribes, make promise future handjobs, (but no blowjobs). Elites top friends announce, no law broken, no crime commit. Reporters (not call journalist) make living say write only nice things about Elites, convince dumb cattle, is just politics, everything is awesome, check out our ads and our prostitutes. Then Elites runs for president. Why run for president when already control country like dictatorship? What this have do with fun Cyber Weapons Auction? We want make sure Wealthy Elite recognizes the danger cyber weapons, this message, our auction, poses to their wealth and control. Let us spell out for Elites. Your wealth and control depends on electronic data. You see what “Equation Group” can do. You see what cryptolockers and stuxnet can do. You see free files we give for free. You see attacks on banks and SWIFT in news. Maybe there is Equation Group version of cryptolocker+stuxnet for banks and financial systems? If Equation Group lose control of cyber weapons, who else lose or find cyber weapons? If electronic data go bye bye where leave Wealthy Elites? Maybe with dumb cattle? “Do you feel in charge?” Wealthy Elites, you send bitcoins, you bid in auction, maybe big advantage for you?

August 27: Hal Martin arrested

August 28: Message 2 “Why is everyone so fucking stupid”

A play on Team America’s “I’m so ronery“

Additional details on auction, Pastebin

September 1: Message 6 files signed

September 5: Obama and Putin discuss DNC hacks at G-20

September 25: Sam Adams Award presentation; Craig Murray meets intermediary tied to Podeseta leak

October 1: Message 3 “Why you no like?”

More details on the auction. Medium

Q: Why saying “don’t trust us”?

A: TheShadowBrokers is making comment on trust-less exchanges. TheShadowBrokers is thinking is no thing now as trust-less. “Don’t Trust” is not equal to “Is Scam”. TheShadowBrokers is thinking no way to exchange secrets (auction files) without one party trusting other. If seller trust buyer and buyer no pay, then no more secrets. If buyer trust seller and seller no deliver, the no more sales. TheShadowBrokers is having more things to sell. Reputation is being another benefit of public auction.

October 7: IC Attribution of DNC hack to Russia, Podesta email release starts, Access Hollywood video

October 14: NBC story, CIA Prepping for Possible Cyber Strike Against Russia

Vice President Joe Biden told “Meet the Press” moderator Chuck Todd on Friday that “we’re sending a message” to Putin and that “it will be at the time of our choosing, and under the circumstances that will have the greatest impact.”

October 15: Message 4 “Yo Swag Me Out”

Calls off auction and provides spoof (I’m missing what this is a reference to) of Loretta Lynch/Bill Clinton plane conversation

October 17: Ecuador cuts off Assange’s Internet access

October 30: Message 5 Trick or Treat for Amerikanskis

Medium announcement

A reference to October 14 NBC story and Biden’s threat to Putin, mocking relative focus on DNC hacks over Equation Group hacks

Why is DirtyGrandpa threating CIA cyberwar with Russia? Why not threating with NSA or CyberCommand? CIA is cyber B-Team, yes? Where is cyber A-Team? Maybe threating is not being for external propaganda? Maybe is being for internal propaganda? Oldest control trick in book, yes? Waving flag, blaming problems on external sources, not taking responsibility for failures.

A challenge about whether the DNC hack is more important that the EG hack

But neverminding, hacking DNC is way way most important than EquationGroup losing capabilities. Amerikanskis is not knowing USSA cyber capabilities is being screwed?

[snip]

Maybe political hacks is being more important?

A call for people to hack the elections

TheShadowBrokers is having suggestion. On November 8th, instead of not voting, maybe be stopping the vote all together? Maybe being grinch who stopped election from coming? Maybe hacking election is being the best idea? #hackelection2016. If peoples is not being hackers, then #disruptelection2016, #disruptcorruption2016. Maybe peoples not be going to work, be finding local polling places and protesting, blocking , disrupting , smashing equipment, tearing up ballots? The wealthy elites is being weakest during elections and transition of power.

A threat that it will get worse

How bad do you want it to get? When you are ready to make the bleeding stop, payus, so we can move onto the next game. The game where you try to catch us cashing out!

October 31: Obama contacts Putin on Red Phone for first time in presidency, reportedly warns he’ll treat an attack on the election as an act of war.

November 26: Anonymous White House statement on election integrity

December 9: Obama calls for a review of hacking; WaPo releases releases story claiming CIA believes Russia did the hack to elect Trump

December 13: NYT story on DNC hack that leads with detail that FBI called DNC but staffer didn’t believe he was FBI.

December 14 (?): Message 6 “Black Friday/Cyber Monday Sale” (file signed September 1; Mustafa al-Bassam seemed to know they were coming if not already out there)

December 14: Message 6B Bocefus Cleetus 1 “Are the Shadow Brokers selling NSA tools on ZeroNet?”

Reference to Rage Against the Machine People of the Sun

Possible reference to Hank Williams Jr, Dukes of Hazard (perhaps ventriloquist doll for FSB)

Reference to fake news

December 15: Shadow Brokers interview with Motherboard

December 16, 5:21 AM(?): Message 6A Bocefus Cleetus 2, ““New Theory: Shadow Brokers Incident is a Deep State Civil War between CIA vs NSA”

Reference to NYT story on how DNC got hacked

Reference to Bill Binney theory on hack

Seeming rewriting of perceived FBI-CIA feud

Reference to (now forgotten) Trump interview with Mike Rogers

Reference to larger discussions of bureaucratic organization

DOD and CIA have had a turf war going back to the Afghanistan and Iraq Wars bout whose job it was to run paramilitary operations. A turf war over the next “domain of battle” with all the government cheese.

December 16, 2:40PM: Obama press conference

January 1, 2017 [Update} Shadow Brokers complains it did not get included in Obama’s sanctions list

Share this entry