Link to CNN article
DNC rebuffed request to examine computer servers
“The FBI repeatedly stressed to DNC officials the necessity of obtaining direct access to servers and data, only to be rebuffed until well after the initial compromise had been mitigated,” a senior law enforcement official told CNN. “This left the FBI no choice but to rely upon a third party for information. These actions caused significant delays and inhibited the FBI from addressing the intrusion earlier.”
This statement is in response to reports that the FBI never asked the DNC for access to the hacked systems.
So, the evidence that Russia hacked the DNC comes from a private cyber-security firm’s assessment rather than from an FBI investigation, and the DNC refused to allow the FBI to analyze the server.
This seems very strange to me.
[
us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf]Grizzly Steppe—Russian Malicious Cyber Activity](
https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY STEPPE-2016-1229.pdf]Grizzly Steppe—Russian Malicious Cyber Activity)
JOINT ANALYSIS REPORT
DISCLAIMER: This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service referenced in this advisory or otherwise. This document is distributed as TLP:WHITE: Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol, see
us-cert.gov/tlp.
JOINT ANALYSIS REPORT
This Joint Analysis Report (JAR) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This document provides technical details regarding the tools and infrastructure used by the Russian civilian and military intelligence Services (RIS) to compromise and exploit networks and endpoints associated with the U.S. election, as well as a range of U.S. Government, political, and private sector entities. The U.S. Government is referring to this malicious cyber activity by RIS as GRIZZLY STEPPE.
Previous JARs have not attributed malicious cyber activity to specific countries or threat actors. However, public attribution of these activities to RIS is supported by technical indicators from the U.S. Intelligence Community, DHS, FBI, the private sector, and other entities. This determination expands upon the Joint Statement released October 7, 2016, from the Department of Homeland Security and the Director of National Intelligence on Election Security.
So as far as I can tell, the entire hypothesis that Russia haccked the DNC comes from Crowdstrike’s investigation, which this report “does not endorse,” and not from a law enforcement or intelligence analysis at all.
Report
After CrowdStrike released its Ukraine report, company co-founder Dmitri Alperovitch claimed it provided added evidence of Russian election interference. In both hacks, he said, the company found malware used by “Fancy Bear,” a group with ties to Russian intelligence agencies.
I assume by Russian election interference they are referring to the US election, which the same company is also investigating.
Dmitrova noted that the FBI and the U.S. intelligence community have also concluded that Russia was behind the hacks of the Democratic National Committee, Democratic Congressional Campaign Committee and the email account of John Podesta, Hillary Clinton’s campaign manager.
Note the circular logic: the accuracy of the Crowdstrike report is validated by the agreement of other organizations. But these organizations are relying on Crowdstrike’s assessment for their conclusions.
Well, I guess I can finally vote, for option #4.