Recall that CrowdStrike Lied About DNC Server “Hack” in 2016
By John Leake | Courageous Discourse™ | July 20, 2024
second I saw the news yesterday that computers all over the world had been taken down—causing widespread disruptions to travel, medical care and an array of businesses—I couldn’t help wondering if it was an implicit reminder of how dependent we are on global computer systems, and therefore how vulnerable we are.
Then I saw the outage was purportedly traced to CrowdStrike—the same Austin-based cybersecurity hired by the DNC in 2016 to investigate the alleged “hack” of its server. The security breach resulted in the leak of incredibly embarrassing e-mails revealing John Podesta, Hillary Clinton, and DNC leadership performing all manner of Machiavellian machinations.
Back then, when I read the Wikileaks e-mails, I immediately wondered, “How are these villains going to change the subject from the content of their e-mails to something else? What misdirection trick are they going to pull?”
Enter CrowdStrike, which the DNC hired to do a forensic cybersecurity analysis of the DNC server. Shortly thereafter, CrowdStrike claimed that Russian agents had hacked it.
It didn’t matter that there was no evidence of this, as CrowdStrike President Shawn Henry admitted under oath in a declassified December 2017 interview before the House Intelligence Committee. The lying mainstream media still ran with the story that became Russian Collusion HOAX—the biggest fraud of the decade.
Even though former NSA Technical Director, William Binney, tried to tell anyone who would listen that the leak must have resulted from a DNC insider who downloaded the e-mails onto a storage device, no major mainstream media outlet would listen to him.
I wondered about Binney’s concept on a DNC insider when I researched the mysterious death of DNC insider Seth Rich (An Extraordinary Unsolved Murder in Washington D.C.) shortly before the accusation of Russian hacking was made.
Did Rich—who was apparently disaffected with the DNC because of its shabby treatment of Bernie Sanders—reveal to someone that he knew that the leak was not the result of an external hack, thereby prompting the perception that he could easily debunk the Russian-Collusion Hoax if he weren’t silenced forever?
Now, less than one week after whoever is running this country allowed a would-be assassin to climb onto a roof and take a shot at Donald Trump on a stage 400 feet away, we are told that CrowdStrike’s defective update to its security software knocked out global IT systems.
It seems to me that CrowdStrike should be viewed with grave suspicion and that businesses should be asking if it is prudent to have CrowdStrike software running on their computer systems.
Ukraine working with FBI to censor social media – official
RT | April 28, 2023
Ukrainian intelligence has partnered with the FBI and other US government agencies to remove ‘Russian’ content on Silicon Valley platforms, a senior official told independent journalist Lee Fang earlier this week at the RSA Convention in San Francisco.
“Once we have a trace or evidence of disinformation campaigns via Facebook or other resources that are from the US, we pass this information to the FBI, along with writing directly to Facebook,” Ilya Vitiuk, head of the Department of Cyber Information Security in the Security Service of Ukraine (SBU), told Fang.
Vitiuk spoke at the cyber security conference, sitting on a panel alongside FBI Cyber Division Assistant Director Bryan Vorndran, Special Agent Alex Kobzanets from the San Francisco field office, and Laura Galante from the Office of the Director of National Intelligence.
Fang noted that the Ukrainian official thanked the many “private sector allies” in the US, including Google, Amazon, Starlink, and CrowdStrike – the DNC contractor that claimed ‘Russian hacking’ in 2016 but later testified it had no evidence for it.
“I don’t know how many times we’ve called the CEOs here in San Francisco to drive to their office on a Sunday afternoon and really engage with our Ukrainian partners,” Kobzanets said during the panel.
According to Vitiuk, the SBU tells the FBI that a certain person or account is “probably Russia’s influence” in order to get them censored. He described the FBI as his agency’s “top partner” and US cyber support as a “psychological game changer” for Ukraine.
“Everything that is against our country, consider it a fake, even if it’s not,” Vitiuk told Fang when asked how the SBU determines what might be disinformation. “Right now, for our victory, it is important to have that kind of understanding, not to be fooled.”
By way of example, Vitiuk cited reports of tensions between President Vladimir Zelensky and Ukraine’s top general, Valery Zaluzhny, saying they were completely fabricated by Russia. In early March, the openly pro-Ukraine German tabloid Bild reported on their disagreements about military tactics.
Fang has previously documented US government plans to work with social media platforms on censoring “disinformation” related to “the nature of US support to Ukraine.” In December, he also revealed that the Pentagon had teamed up with Twitter to “amplify certain messages” for the US military.
Pelosi & husband invest up to $1 million in CrowdStrike, tech firm that launched Russiagate – report
RT | October 10, 2020
Newly-filed financial disclosures show House Speaker Nancy Pelosi and her husband have invested up to $1 million in CrowdStrike, American cybersecurity technology company and the originator of ‘Russian hacking’ claims.
Financial disclosures show Pelosi (D-California) and her husband Paul buying CrowdStrike shares on September 3, according to a RealClearInvestigations report by journalist Aaron Mate. Since then, the stock went from $129.25 a share to $142.97.
Reached for comment, Pelosi’s spokesman Drew Hammill insisted she was “not involved” in her husband’s investments and “not aware of the investment until the required filing was made.” Pelosi invests in publicly traded companies all the time and “fully complies with House Rules and the relevant statutory requirements,” Hammill added.
CrowdStrike seems like a lucrative investment prospect, according to Mate’s report. The company’s valuation went from $1 billion in 2017 to $6.7 billion in 2019, when they went public – and then almost doubled to $11.4 billion. Its revenue rose from $52.75 million in 2017 to $481.41 million in 2020, Mate reports.
The company was hired by the DNC to address the breach of its email system in 2016. It blamed “Russia” for the alleged hack, but never provided the actual servers to the FBI, offering instead images and redacted reports.
CrowdStrike President Shawn Henry testified to the House Intelligence Committee in December 2017 that the company never had “concrete evidence” the data was actually “exfiltrated” from the servers. Instead, he said, they “saw activity that we believed was consistent with activity we’d seen previously and had associated with the Russian Government.”
This testimony was kept classified until May this year, when it was released to the public under pressure from Acting Director of National Intelligence Richard Grenell. In the intervening years, the claim that ‘Russia hacked the DNC’ became an article of faith in Washington, underlying the investigation into President Donald Trump’s “collusion” with the Kremlin led by Robert Mueller.
Prior to joining CrowdStrike, Henry worked under Mueller at the FBI. The company’s co-founder and chief technology officer, Dmitry Alperovitch, used to be a senior fellow at the Atlantic Council, the pro-NATO think tank which thrives on hostility towards Russia.
In addition to feeding the Russiagate frenzy and profiting from it, CrowdStrike also donated to Democrats – about $100,000 to the Democratic Governors Association in 2016 and 2017, according to Mate.
Six big lies you have been told about ‘Russiagate’
By Nebojsa Malic | RT | May 12, 2020
Russian ‘meddling’ in the 2016 US presidential election has become an article of faith, not just among Democrats but many Republicans as well, thanks to the endless repetition of vague talking points, none of which hold water.
It all began with the Democratic National Committee (DNC) claiming in June 2016 that Russia hacked their computers, after documents were published revealing the party’s rigging of the primaries. This was followed by Hillary Clinton accusing her rival for the presidency Donald Trump that he was “colluding” with Russia by asking Moscow for her emails – the ones she deleted from a private server she used to conduct State Department business, that is.
With a little help of the mainstream media, which overwhelmingly endorsed Clinton and predicted her victory, her efforts to cover up her email scandal turned into Russia “hacking our democracy,” eventually spawning the ‘Russiagate’ investigation led by Special Counsel Robert Mueller and a series of failed attempts to derail Trump’s election and oust him from the White House.
Lie #1: Russia hacked the DNC
The infamous US intelligence community assessment (ICA) of January 2017, and the Senate Intelligence Committee report based on it – as well as ‘analysis’ by actual election meddlers, among others – all claimed that the Russian government and President Vladimir Putin personally were behind the “hack” and publication of DNC documents. These have always been assertions, and no evidence was ever provided.
Last week’s declassification of 50+ interviews in the probe conducted by the House Intelligence Committee revealed that the cybersecurity firm CrowdStrike, brought in by the DNC lawyers to fix the “hack,” did not have evidence either.
CrowdStrike’s president, ex-FBI official Shawn Henry, testified that they “saw activity that we believed was consistent with activity we’d seen previously and had associated with the Russian Government.” [emphasis added]
In the same testimony, Henry also testified that CrowdStrike never had any evidence the data was actually “exfiltrated,” i.e. stolen from the DNC servers.
CrowdStrike’s feelings about the hack remain the only “evidence” so far, since the FBI never asked them or the DNC for the actual server, as Henry also confirmed. Meanwhile, former NSA official and whistleblower William Binney argued back in November 2017 that actual evidence showed a leak from the inside, not a hack.
Lie #2: Russia hacked Podesta’s emails and published them in collusion with WikiLeaks
There is likewise zero proof that the Russian government had anything to do with the private email account of John Podesta, Clinton’s campaign chair, which a staffer admitted had been compromised when someone fell for a phishing scam.
Instead, the key argument that WikiLeaks was somehow ‘colluding’ with Russia over the publication of the emails rests on a conspiracy theory promoted by the Clinton campaign staff, after RT reported on a fresh batch of emails before WikiLeaks got around to tweeting about them – but after they were published on the website and available to anyone willing to do actual journalism.
In fact, the existence of RT has been a major “argument” of Russiagaters; a third of the ICA intended to show ‘Russian meddling’ consisted of a four-year-old appendix about RT that was in no way relevant to the 2016 situation but lamented its coverage of fracking and ‘Occupy Wall Street’ protests, for example.
Lie #3: The Steele ‘pee tape’ dossier was irrelevant
As it later emerged, Clinton’s claims about ‘Russian collusion’ were based on a dodgy dossier her campaign commissioned through the DNC and a firm called Fusion GPS from a British spy named Christopher Steele. It said that the Kremlin was blackmailing Trump with a tape of depraved sex acts in a Moscow hotel, with prostitutes supposedly paid to urinate on a bed President Barack Obama had slept on.
It was clearly ridiculous and entirely evidence-free. Democrats claimed it played no role in Russia investigations. Yet the FBI paid Steele for information from the dossier, and used it to justify a FISA warrant for the surveillance of Trump campaign aide Carter Page – and with him the campaign itself – starting right before the election, and renewed three times.
By January 2020, the DOJ had formally disavowed the dossier and all four FISA warrants, along with any information obtained from them, saying “there was insufficient predication to establish probable cause.”
Lie #4: General Michael Flynn treasonously colluded with Russia and lied about it to the FBI
Trump’s first national security adviser was hounded out of the White House after less than two weeks on the job, after media leaks insinuated he had improperly discussed sanctions with Russian ambassador Sergey Kislyak, violating the Logan Act, and then lied to the FBI about it.
After FBI Director James Comey was fired by Trump in May 2017, he told the media the president had urged him to drop the investigation of Flynn, which was quickly construed as “obstruction” and used as one of the pretexts to appoint Robert Mueller as special counsel into ‘Russiagate.’
When actual evidence was finally coaxed out of prosecutors, however, it showed that the FBI sought to frame Flynn in a perjury trap, and that the people involved were Comey himself, his deputy Andrew McCabe, disgraced lovers Peter Strzok and Lisa Page, and others. All charges against Flynn were dropped.
Flynn didn’t even lie to Strzok and the other agent interviewing him – and the memo of that conversation had been first heavily edited, then destroyed. Basically, everything about the Flynn case has been as false as ABC’s December 2017 bombshell report about his “collusion” with Russia that got Brian Ross fired.
Lie #5: Mueller found collusion, or at least Russian meddling
When Mueller’s final report came out, in the spring of 2019, it found zero evidence of “collusion” but insisted there had been Russian “meddling” in the election. The only trouble was that he had no proof of meddling, basing it entirely on the above-mentioned intelligence “assessments” and his own indictments.
A Russian company named in one of the indictments actually contested it in US court and won. First, a federal judge slapped down Mueller’s prosecutors for violating rules by presenting allegations as “established” and “confirmed” facts and ruling that no link was actually established behind a catering company accused of “sowing discord” on social media – a far cry from hacking the DNC! – and the Russian government.
The DOJ quietly dropped that particular case in March, just as coronavirus shutdowns were starting across the US, using “recent events” and a change in classification of some of its evidence as a face-saving excuse.
Lie #6: Paul Manafort was Trump’s conduit to Russia
Paul Manafort, who ran Trump’s campaign between March and August 2016, was convicted of multiple counts of conspiracy against the US and sentenced to a lengthy prison term. However, despite repeated attempts by the media to present him as some kind of liaison between Trump and Russia, the entirety of things that got him in trouble with the law had to do with tax evasion on money he made lobbying for and in… Ukraine.
During the two trials against Manafort, it emerged that he and his business partner Rick Gates had worked with Podesta’s brother Tony to fleece Ukrainian oligarchs for years, and stash the profits in tax havens.
The Ukrainian officials who leaked the so-called “black ledger” implicating Manafort to the US media were even convicted of election meddling by a court in Kiev, and the whole thing may have been solicited by a Ukrainian-American DNC contractor… The US media have been curiously uninterested in that particular “collusion,” needless to say.
Peel back all these layers of misinformation, like an onion, and what’s left is an empty talking point, endlessly repeated by Democrats like Adam Schiff (D-California), that “Russia hacked our democracy.”
The charge is vague enough that it can mean anything, and deliberately so. No evidence is ever offered, because there isn’t any – as the years of investigations and boxes full of documents have clearly shown.
Crowdstrike admits ‘no evidence’ Russia stole emails from DNC server
Pushback with Aaron Maté | May 11, 2020
Crowdstrike, the firm that accused Russia of stealing DNC emails in 2016, has made a bombshell admission. In newly released Congressional testimony, Crowdstrike president Shawn Henry said that “we did not have concrete evidence” that alleged Russian hackers actually took the emails from DNC servers. “There’s circumstantial evidence, but no evidence that they were actually exfiltrated,” Henry said.
Aaron Maté breaks down Henry’s testimony and why it adds new doubt about the core allegation at the heart of Russiagate.
WHY IS CROWDSTRIKE CONFUSED ON ELEVEN KEY DETAILS ABOUT THE DNC HACK?
By Larry C Johnson | Sic Semper Tyrannis | March 17, 2020
Here is the bottom-line—despite being hired in late April (or early May) of 2016 to stop an unauthorized intrusion into the DNC, CrowdStrike, the cyber firm hired by the DNC’s law firm to solve the problem, failed abysmally. More than 30,000 emails were taken from the DNC server between 22 and 25 May 2016 and given to Wikileaks. Crowdstrike blamed Russia for the intrusion but claimed that only two files were taken. And CrowdStrike inexplicably waited until 10 June 2016 to reboot the DNC network.
CrowdStrike, a cyber-security company hired by a Perkins Coie lawyer retained by the DNC, provided the narrative to the American public of the alledged hack of the DNC, But the Crowdstrike explanation is inconsistent, contradictory and implausible. Despite glaring oddities in the CrowdStrike account of that event, CrowdStrike subsequently traded on its fame in the investigation of the so-called Russian hack of the DNC and became a publicly traded company. Was CrowdStrike’s fame for “discovering” the alleged Russian hack of the DNC a critical factor in its subsequent launch as a publicly traded company?
The Crowdstrike account of the hack is very flawed. There are 11 contradictions, inconsistencies or oddities in the public narrative about CrowdStrike’s role in uncovering and allegedly mitigating a Russian intrusion (note–the underlying facts for these conclusions are found in Ellen Nakashima’s Washington Post story, Vicki Ward’s Esquire story, the Mueller Report and the blog of Crowdstrike founder Dmitri Alperovitch):
- Two different dates—30 April or 6 May—are reported by Nakashima and Ward respectively as the date CrowdStrike was hired to investigate an intrusion into the DNC computer network.
- There are on the record contradictions about who hired Crowdstrike. Nakashima reports that the DNC called Michael Sussman of the law firm, Perkins Coie, who in turn contacted Crowdtrike’s CEO Shawn Henry. Crowdstrike founder Dmitri Alperovitch tells Nakashima a different story, stating our “Incident Response group, was called by the Democratic National Committee (DNC).
- CrowdStrike claims it discovered within 24 hours the “Russians” were responsible for the “intrusion” into the DNC network.
- CrowdStrike’s installation of Falcon (its proprietary software to stop breaches) on the DNC on the 1st of May or the 6th of May would have alerted to intruders that they had been detected.
- CrowdStrike officials told the Washington Post’s Ellen Nakashima that they were, “not sure how the hackers got in” and didn’t “have hard evidence.”
- In a blog posting by CrowdStrike’s founder, Dmitri Alperovitch, on the same day that Nakashima’s article was published in the Washington Post, wrote that the intrusion into the DNC was done by two separate Russian intelligence organizations using malware identified as Fancy Bear (APT28) and Cozy Bear (APT29).
- But, Alperovitch admits his team found no evidence the two Russian organizations were coordinating their “attack” or even knew of each other’s presence on the DNC network.
- There is great confusion over what the “hackers” obtained. DNC sources claim the hackers gained access to the entire database of opposition research on GOP presidential candidate Donald Trump. DNC sources and CrowdStrike claimed the intruders, “read all email and chat traffic.” Yet, DNC officials insisted, “that no financial, donor or personal information appears to have been accessed or taken.” However, CrowdStrike states, “The hackers stole two files.”
- Crowdstrike’s Alperovitch, in his blog posting, does not specify whether it was Cozy Bear or Fancy Bear that took the files.
- Wikileaks published DNC emails in July 2016 that show the last message taken from the DNC was dated 25 May 2016. This was much more than “two files.”
- CrowdStrike, in complete disregard to basic security practice when confronted with an intrusion, waited five weeks to disconnect the DNC computers from the network and sanitize them.
Let us start with the very contradictory public accounts attributed to Crowdstrke’s founder, Dmitri Alperovitch. The 14 June 2016 story by Ellen Nakashima of the Washington Post and the October 2016 piece by Vicki Ward in Esquire magazine offer two different dates for the start of the investigation:
When did the DNC learn of the “intrusion”?
Ellen Nakashima claims it was the end of April:
DNC leaders were tipped to the hack in late April. Chief executive Amy Dacey got a call from her operations chief saying that their information technology team had noticed some unusual network activity. . . . That evening, she spoke with Michael Sussmann, a DNC lawyer who is a partner with Perkins Coie in Washington. Soon after, Sussmann, a former federal prosecutor who handled computer crime cases, called Henry, whom he has known for many years. Within 24 hours, CrowdStrike had installed software on the DNC’s computers so that it could analyze data that could indicate who had gained access, when and how.
Ward’s timeline, citing Alperovitch, reports the alert came later, on 6 May 2016:
At six o’clock on the morning of May 6, Dmitri Alperovitch woke up in a Los Angeles hotel to an alarming email. . . . late the previous night, his company had been asked by the Democratic National Committee to investigate a possible breach of its network. A CrowdStrike security expert had sent the DNC a proprietary software package, called Falcon, that monitors the networks of its clients in real time. Falcon “lit up,” the email said, within ten seconds of being installed at the DNC: Russia was in the network.
This is a significant and troubling discrepancy because it marks the point in time when CrowdStrike installed its Falcon software on the DNC server. It is one thing to confuse the 30th of April with the 1st of May. But Alperovitch gave two different reporters two different dates.
What did the “hackers” take from the DNC?
Ellen Nakashima’s reporting is contradictory and wrong. Initially, she is told that the hackers got access to the entire Donald Trump database and that all emails and chats could be read. But then she is assured that only two files were taken. This was based on Crowdstrike’s CEO’s assurance, which was proven subsequently to be spectacularly wrong when Wikileaks published 35,813 DNC emails. How did Crowdstrike miss that critical detail? Here is Nakashima’s reporting:
Russian government hackers penetrated the computer network of the Democratic National Committee and gained access to the entire database of opposition research on GOP presidential candidate Donald Trump, according to committee officials and security experts who responded to the breach.
The intruders so thoroughly compromised the DNC’s system that they also were able to read all email and chat traffic, said DNC officials and the security experts. . . .
The DNC said that no financial, donor or personal information appears to have been accessed or taken, suggesting that the breach was traditional espionage, not the work of criminal hackers.
One group, which CrowdStrike had dubbed Cozy Bear, had gained access last summer (2015) and was monitoring the DNC’s email and chat communications, Alperovitch said.
The other, which the firm had named Fancy Bear, broke into the network in late April and targeted the opposition research files. It was this breach that set off the alarm. The hackers stole two files, Henry said. And they had access to the computers of the entire research staff — an average of about several dozen on any given day. . . .
CrowdStrike is continuing the forensic investigation, said Sussmann, the DNC lawyer. “But at this time, it appears that no financial information or sensitive employee, donor or voter information was accessed by the Russian attackers,” he said.
The DNC emails that are posted on the Wikileaks website and the metadata shows that these emails were removed from the DNC server starting the late on the 22nd of May and continuing thru the 23rd of May. The last tranche occurred late in the morning (Washington, DC time) of the 25th of May 2016. Crowdstrike’s CEO, Shawn Henry, insisted on the 14th of June 2016 that “ONLY TWO FILES” had been taken. This is demonstrably not true. Besides the failure of Crowdstrike to detect the removal of more than 35,000 emails, there is another important and unanswered question—why did Crowdstrike wait until the 10th of June 2016 to start disconnecting the DNC server when they allegedly knew on the 6th of May that the Russians had entered the DNC network?
Crowdstrike accused Russia of the DNC breach but lacked concrete proof.
Ellen Nakashima’s report reveals that Crowdstrike relied exclusively on circumstantial evidence for its claim that the Russian Government hacked the DNC server. According to Nakashima:
CrowdStrike is not sure how the hackers got in. The firm suspects they may have targeted DNC employees with “spearphishing” emails. These are communications that appear legitimate — often made to look like they came from a colleague or someone trusted — but that contain links or attachments that when clicked on deploy malicious software that enables a hacker to gain access to a computer. “But we don’t have hard evidence,” Alperovitch said.
There is a word in English for the phrases, “Not sure” and “No hard evidence”–that word is, “assumption.” Assuming that the Russians did it is not the same as proving, based on evidence, that the Russians were culpable. But that is exactly what CrowdStrike did.
The so-called “proof” of the Russian intrusions is the presence of Fancy Bear and Cozy Bear?
At first glance, Dmitri Alperovitch’s blog posting describing the Fancy Bear and Cozy Bear “intrusions” appears quite substantive. But cyber security professionals quickly identified a variety of shortcomings with the Alperovitch account. For example, this malware is not unique nor proprietary to Russia. Other countries and hackers have access to APT28 and have used it.
Skip Folden offers one of the best comprehensive analyses of the problems with the Alperovitch explanation:
No basis whatsoever:
APT28, aka Fancy Bear, Sofacy, Strontium, Pawn Storm, Sednit, etc., and APT29, aka Cozy Bear, Cozy Duke, Monkeys, CozyCar,The Dukes, etc., are used as ‘proof’ of Russia ‘hacking’ by Russian Intelligence agencies GRU and FSB respectively.
There is no basis whatsoever to attribute the use of known intrusion elements to Russia, not even if they were once reverse routed to Russia, which claim has never been made by NSA or any other of our IC.
On June 15, 2016 Dmitri Alperovitch himself, in an Atlantic Council article, gave only “medium-level of confidence that Fancy Bear is GRU” and “low-level of confidence that Cozy Bear is FSB.” These assessments, from the main source himself, that either APT is Russian intelligence, averages 37%-38% [(50 + 25) / 2].
Exclusivity:
None of the technical indicators, e.g., intrusion tools (such as X-Agent, X-Tunnel), facilities, tactics, techniques, or procedures, etc., of the 28 and 29 APTs can be uniquely attributed to Russia, even if one or more had ever been trace routed to Russia. Once an element of a set of intrusion tools is used in the public domain it can be reverse-engineered and used by other groups which precludes the assumption of exclusivity in future use. The proof that any of these tools have never been reverse engineered and used by others is left to the student – or prosecutor.
Using targets:
Also, targets have been used as basis for attributing intrusions to Russia, and that is pure nonsense. Both many state and non-state players have deep interests in the same targets and have the technical expertise to launch intrusions. In Grizzly Steppe, page 2, second paragraph, beginning with, “Both groups have historically targeted …,” is there anything in that paragraph which can be claimed as unique to Russia or which excludes all other major state players in the world or any of the non-state organizations? No.
Key Logger Consideration:
On the subject of naming specific GRU officers initiating specific actions on GRU Russian facilities on certain dates / times, other than via implanted ID chips under the finger tips of these named GRU officers, the logical assumption would be by installed key logger capabilities, physical or malware, on one or more GRU Russian computers.
The GRU is a highly advanced Russian intelligence unit. It would be very surprising were the GRU open to any method used to install key logger capabilities. It would be even more surprising, if not beyond comprehension that the GRU did not scan all systems upon start-up and in real time, including key logger protection and anomalies of performance degradation and data transmissions.
Foreign intelligence source:
Other option would be via a foreign intelligence unit source with local GRU access. Any such would be quite anti-Russian and be another nail in the coffin of any chain of evidence / custody validity at Russian site.
Stated simply, Dmitri Alperovitch’s conclusion that “the Russians did it” are not supported by the forensic evidence. Instead, he relies on the assumption that the presence of APT28 and APT29 prove Moscow’s covert hand. What is even more striking is that the FBI accepted this explanation without demanding forensic evidence.
Former FBI Director James Comey and former NSA Director Mike Rogers testified under oath before Congress that neither agency ever received access to the DNC server. All information the FBI used in its investigation was supplied by CrowdStrike. The Hill reported:
The FBI requested direct access to the Democratic National Committee’s (DNC) hacked computer servers but was denied, Director James Comey told lawmakers on Tuesday.
The bureau made “multiple requests at different levels,” according to Comey, but ultimately struck an agreement with the DNC that a “highly respected private company” would get access and share what it found with investigators.
The foregoing facts raise major questions about the validity of the Crowdstrike methodology and conclusions with respect to what happened on the DNC network. This is not a conspiracy theory. It is a set of facts that, as of today, have no satisfactory explanation. The American public deserve answers.
Did John Brennan’s CIA Create Guccifer 2.0 and DCLeaks?
By Larry C Johnson | Sic Semper Tyrannis | December 20, 2019
Special Counsel Robert Mueller’s report insists that Guccifer 2.0 and DCLeaks were created by Russia’s military intelligence organization, the GRU, as part of a Russian plot to meddle in the U.S. 2016 Presidential Election. But this is a lie. Guccifer 2.0 and DCLeaks were created by Brennan’s CIA and this action by the CIA should be a target of U.S. Attorney John Durham’s investigation. Let me explain why.
Let us start with the January 2017 Intelligence Community Assessment aka ICA. Only three agencies of the 17 in the U.S. intelligence community contributed to and coordinated on the ICA–the FBI, the CIA and NSA. In the preamble to the ICA, you can read the following explanation about methodology:
When Intelligence Community analysts use words such as “we assess” or “we judge,” they are conveying an analytic assessment or judgment
To be clear, the phrase,“We assess”, is intel community jargon for “opinion”. If there was actual evidence or source material for a judgment the writer of the assessment would state, “According to a reliable source” or “knowledgeable source” or “documentary evidence.”
Pay close attention to what the analysts writing the ICA stated about the GRU and Guccifer 2.0 and DCLeaks:
We assess with high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release US victim data obtained in cyber operations publicly and in exclusives to media outlets.
- Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory statements and false claims about his likely Russian identity throughout the election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists.
- Content that we assess was taken from e-mail accounts targeted by the GRU in March 2016 appeared on DCLeaks.com starting in June.
We assess with high confidence that the GRU relayed material it acquired from the DNC and senior Democratic officials to WikiLeaks. Moscow most likely chose WikiLeaks because of its self-proclaimed reputation for authenticity. Disclosures through WikiLeaks did not contain any evident forgeries.
Not one piece of corroborating intelligence. It is all based on opinion and strong belief. There was no human source report or electronic intercept pointing to a relationship between the GRU and the two alleged creations of the GRU–Guccifer 2.0 persona and DCLeaks.com.
Now consider the spin that Robert Mueller put on this opinion in his report on possible collusion between the Trump campaign and the Russians. Mueller bluffs the unsuspecting reader into believing that it is a proven fact that Guccifer 2.0 and DCLeaks were Russian assets. But he is relying on a mere opinion from a handpicked group of intel analysts working under the direction of then CIA Director John Brennan.Here’s Mueller’s take (I apologize for the lengthy quote but it is important that you read how the Mueller team presents this):
DCLeaks
“The GRU began planning the releases at least as early as April 19, 2016, when Unit 26165 registered the domain dcleaks.com through a service that anonymized the registrant.137 Unit 26165 paid for the registration using a pool of bitcoin that it had mined.138 The dcleaks.com landing page pointed to different tranches of stolen documents, arranged by victim or subject matter. Other dcleaks.com pages contained indexes of the stolen emails that were being released (bearing the sender, recipient, and date of the email). To control access and the timing of releases, pages were sometimes password-protected for a period of time and later made unrestricted to the public.
Starting in June 2016, the GRU posted stolen documents onto the website dcleaks.com, including documents stolen from a number of individuals associated with the Clinton Campaign. These documents appeared to have originated from personal email accounts (in particular, Google and Microsoft accounts), rather than the DNC and DCCC computer networks. DCLeaks victims included an advisor to the Clinton Campaign, a former DNC employee and Clinton Campaign employee, and four other campaign volunteers.139 The GRU released through dcleaks.com thousands of documents, including personal identifying and financial information, internal correspondence related to the“Clinton Campaign and prior political jobs, and fundraising files and information.140
GRU officers operated a Facebook page under the DCLeaks moniker, which they primarily used to promote releases of materials.141 The Facebook page was administered through a small number of preexisting GRU-controlled Facebook accounts.142
GRU officers also used the DCLeaks Facebook account, the Twitter account @dcleaks__, and the email account dcleaksproject@gmail.com to communicate privately with reporters and other U.S. persons. GRU officers using the DCLeaks persona gave certain reporters early access to archives of leaked files by sending them links and passwords to pages on the dcleaks.com website that had not yet become public. For example, on July 14, 2016, GRU officers operating under the DCLeaks persona sent a link and password for a non-public DCLeaks webpage to a U.S. reporter via the Facebook account.143 Similarly, on September 14, 2016, GRU officers sent reporters Twitter direct messages from @dcleaks_, with a password to another non-public part of the dcleaks.com website.144
The dcleaks.com website remained operational and public until March 2017.”
Guccifer 2.0
On June 14, 2016, the DNC and its cyber-response team announced the breach of the DNC network and suspected theft of DNC documents. In the statements, the cyber-response team alleged that Russian state-sponsored actors (which they referred to as “Fancy Bear”) were responsible for the breach.145 Apparently in response to that announcement, on June 15, 2016, GRU officers using the persona Guccifer 2.0 created a WordPress blog. In the hours leading up to the launch of that WordPress blog, GRU officers logged into a Moscow-based server used and managed by Unit 74455 and searched for a number of specific words and phrases in English, including “some hundred sheets,” “illuminati,” and “worldwide known.” Approximately two hours after the last of those searches, Guccifer 2.0 published its first post, attributing the DNC server hack to a lone Romanian hacker and using several of the unique English words and phrases that the GRU officers had searched for that day.146
That same day, June 15, 2016, the GRU also used the Guccifer 2.0 WordPress blog to begin releasing to the public documents stolen from the DNC and DCCC computer networks.
The Guccifer 2.0 persona ultimately released thousands of documents stolen from the DNC and DCCC in a series of blog posts between June 15, 2016 and October 18, 2016.147 Released documents included opposition research performed by the DNC (including a memorandum analyzing potential criticisms of candidate Trump), internal policy documents (such as recommendations on how to address politically sensitive issues), analyses of specific congressional races, and fundraising documents. Releases were organized around thematic issues, such as specific states (e.g., Florida and Pennsylvania) that were perceived as competitive in the 2016 U.S. presidential election.
Beginning in late June 2016, the GRU also used the Guccifer 2.0 persona to release documents directly to reporters and other interested individuals. Specifically, on June 27, 2016, Guccifer 2.0 sent an email to the news outlet The Smoking Gun offering to provide “exclusive access to some leaked emails linked [to] Hillary Clinton’s staff.”148 The GRU later sent the reporter a password and link to a locked portion of the dcleaks.com website that contained an archive of emails stolen by Unit 26165 from a Clinton Campaign volunteer in March 2016.149 “That the Guccifer 2.0 persona provided reporters access to a restricted portion of the DCLeaks website tends to indicate that both personas were operated by the same or a closely-related group of people.150
The GRU continued its release efforts through Guccifer 2.0 into August 2016. For example, on August 15, 2016, the Guccifer 2.0 persona sent a candidate for the U.S. Congress documents related to the candidate’s opponent.151 On August 22, 2016, the Guccifer 2.0 persona transferred approximately 2.5 gigabytes of Florida-related data stolen from the DCCC to a U.S. blogger covering Florida politics.152 On August 22, 2016, the Guccifer 2.0 persona sent a U.S. reporter documents stolen from the DCCC pertaining to the Black Lives Matter movement.153”
Wow. Sounds pretty convincing. The documents referencing communications by DCLeaks or Guccifer 2.0 with Wikileaks are real. What is not true is that these entities were GRU assets.
In October 2015 John Brennan reorganized the CIA. As part of that reorganization he created a new directorate–DIRECTORATE OF DIGITAL INNOVATION. Its mission was to “manipulate digital footprints.” In other words, this was the Directorate that did the work of creating Guccifer 2.0 and DCLeaks. One of their specialties, creating Digital Dust.
We also know, thanks to Wikileaks, that the CIA was using software specifically designed to mask CIA activity and make it appear like it was done by a foreign entity. Wikipedia describes the Vault 7 documents:
Vault 7 is a series of documents that WikiLeaks began to publish on 7 March 2017, that detail activities and capabilities of the United States’ Central Intelligence Agency to perform electronic surveillance and cyber warfare. The files, dated from 2013–2016, include details on the agency’s software capabilities, such as the ability to compromise cars, smart TVs,[1] web browsers (including Google Chrome, Microsoft Edge, Mozilla Firefox, and Opera Software ASA),[2][3][4] and the operating systems of most smartphones (including Apple’s iOS and Google’s Android), as well as other operating systems such as Microsoft Windows, macOS, and Linux[5][6
One of the tools in Vault 7 carries the innocuous name, MARBLE. Hackernews explains the purpose and function of MARBLE:
Dubbed “Marble,” the part 3 of CIA files contains 676 source code files of a secret anti-forensic Marble Framework, which is basically an obfuscator or a packer used to hide the true source of CIA malware.
The CIA’s Marble Framework tool includes a variety of different algorithm with foreign language text intentionally inserted into the malware source code to fool security analysts and falsely attribute attacks to the wrong nation.Marble is used to hamper[ing] forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA,” says the whistleblowing site.
“… for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion,” WikiLeaks explains.
So guess what gullible techies “discovered” in mid-June 2016? The meta data in the Guccifer 2.0 communications had “Russian fingerprints.”
We still don’t know who he is or whether he works for the Russian government, but one thing is for sure: Guccifer 2.0—the nom de guerre of the person claiming he hacked the Democratic National Committee and published hundreds of pages that appeared to prove it—left behind fingerprints implicating a Russian-speaking person with a nostalgia for the country’s lost Soviet era.
Exhibit A in the case is this document created and later edited in the ubiquitous Microsoft Word format. Metadata left inside the file shows it was last edited by someone using the computer name “Феликс Эдмундович.” That means the computer was configured to use the Russian language and that it was connected to a Russian-language keyboard. More intriguing still, “Феликс Эдмундович” is the colloquial name that translates to Felix Dzerzhinsky, the 20th Century Russian statesman who is best known for founding the Soviet secret police. (The metadata also shows that the purported DNC strategy memo was originally created by someone named Warren Flood, which happens to be the name of a LinkedIn user claiming to provide strategy and data analytics services to Democratic candidates.)
Just use your common sense. If the Russians were really trying to carry out a covert cyberattack, do you really think they are so sloppy and incompetent to insert the name of the creator of the Soviet secret police in the metadata? No. The Russians are not clowns. This was a clumsy attempt to frame the Russians.
Why would the CIA do this? The CIA knew that Podesta’s emails had been hacked and were circulating on the internet. But they had no evidence about the identity of the culprit. If they had such evidence, they would have cited it in the 2017 ICA.
The U.S. intelligence community became aware around May 26, 2016 that someone with access to the DNC network was offering those emails to Julian Assange and Wikileaks. Julian Assange and people who spoke to him indicate that the person was Seth Rich. Whether or not it was Seth, the Trump Task Force at CIA was aware that the emails, which would be embarrassing to the Clinton campaign, would be released at some time in the future. Hence the motive to create Guccifer 2.0 and pin the blame on Russia.
It is essential to recall the timeline of the alleged Russian intrusion into the DNC network. The only source for the claim that Russia hacked the DNC is a private cyber security firm, CrowdStrike. Here is the timeline for the DNC “hack.”
Here are the facts on the public record. They are at odds with the claims of the Intelligence Community:
- It was 29 April 2016, when the DNC claims it became aware its servers had been penetrated. No claim yet about who was responsible. And no claim that there had been a prior warning by the FBI of a penetration of the DNC by Russian military intelligence.
- According to CrowdStrike founder, Dimitri Alperovitch, his company first supposedly detected the Russians mucking around inside the DNC server on 6 May 2016. A CrowdStrike intelligence analyst reportedly told Alperovitch that:
- Falcon had identified not one but two Russian intruders: Cozy Bear, a group CrowdStrike’s experts believed was affiliated with the FSB, Russia’s answer to the CIA; and Fancy Bear, which they had linked to the GRU, Russian military intelligence.
- The Wikileaks data shows that the last message copied from the DNC network is dated Wed, 25 May 2016 08:48:35.
- 10 June 2016–CrowdStrike waited until 10 June 2016 to take concrete steps to clean up the DNC network. Alperovitch told Esquire’s Vicky Ward that: ‘Ultimately, the teams decided it was necessary to replace the software on every computer at the DNC. Until the network was clean, secrecy was vital. On the afternoon of Friday, June 10, all DNC employees were instructed to leave their laptops in the office.”
- On June 14, 2016, Ellen Nakamura, a Washington Post reporter who had been briefed by computer security company hired by the DNC—Crowdstrike–, wrote:
- Russian government hackers penetrated the computer network of the Democratic National Committee and gained access to the entire database of opposition research on GOP presidential candidate Donald Trump, according to committee officials and security experts who responded to the breach.
- The intruders so thoroughly compromised the DNC’s system that they also were able to read all email and chat traffic, said DNC officials and the security experts.
- The intrusion into the DNC was one of several targeting American political organizations. The networks of presidential candidates Hillary Clinton and Donald Trump were also targeted by Russian spies, as were the computers of some Republican political action committees, U.S. officials said. But details on those cases were not available.
- 15 June, 2016, an internet “personality” self-described as Guccifer 2.0 surfaces and claims to be responsible for the hacks but denies being Russian. The people/entity behind Guccifer 2.0:
- Used a Russian VPN service provider to conceal their identity.
- Created an email account with AOL.fr (a service that exposes the sender’s IP address) and contacted the press (exposing his VPN IP address in the process).
- Contacted various media outlets through this set up and claimed credit for hacking the DNC, sharing copies of files purportedly from the hack (one of which had Russian error messages embedded in them) with reporters from Gawker, The Smoking Gun and other outlets.
- Carried out searches for terms that were mostly in English, several of which would appear in Guccifer 2.0’s first blog post. They chose to do this via a server based in Moscow. (this is from the indictment,
“On or about June 15, 2016, the Conspirators logged into a Moscow-based server used and managed by Unit 74455”) - Created a blog and made an initial blog post claiming to have hacked the DNC, providing links to various documents as proof.
- Carelessly dropped a “Russian Smiley” into his first blog post.
- Managed to add the name “Феликс Эдмундович” (which translates to Felix Dzerzhinsky, also known as “Iron Felix”) to the metadata of several documents. (Several sources went beyond what the evidence shows and made claims about Guccifer 2.0 using a Russian keyboard, however, these claims are just assumptions made in response to the presence of cyrillic characters.)
The only thing that the Guccifer 2.0 character did not do to declare its Russian heritage was to take out full page ads in the New York Times and Washington Post. But the “forensic” fingerprints that Guccifer 2.0 was leaving behind is not the only inexplicable event.
Time for the common sense standard again. Crowdstrike detected the Russians on the 6th of May, according to CEO Dimitri Alperovitch, but took no steps to shutdown the network, eliminate the malware and clean the computers until 34 days later, i.e., the 10th of June. That is 34 days of inexcusable inaction.
It is only AFTER Julian Assange announces on 12 June 2016 that WikiLeaks has emails relating to Hillary Clinton that DCLeaks or Guccifer 2.0 try to contact Assange.
The actions attributed to DCLeaks and Guccifer 2.0 should be priority investigative targets for U.S. Attorney John Durham’s team of investigators. This potential use of a known CIA tool, developed under Brennan with the sole purpose to obfuscate the source of intrusions, pointing to another nation, as a false flag operation, is one of the actions and issues that U.S. Attorney John Durham should be looking into as a potential act of “Seditious conspiracy. It needs to be done. To quote the CIA, I strongly assess that the only intelligence agency that evidence indicates was meddling via cyber attacks in the 2016 Presidential election was the CIA, not the GRU.
Cyber sleuths responsible for Russiagate now warn of ‘Iranian hackers’
RT | June 21, 2019
Iranian hackers are threatening US computer systems, cybersecurity firms FireEye and CrowdStrike claimed just as tensions between Washington and Tehran pulled back from the brink of war.
“Really, we’re seeing increased cyber activity that seems to be focused on the West,” Adam Meyers, vice president of Intelligence at CrowdStrike, told Politico. “In early June, mid-June is when it really started to kick off.”
Ben Read, senior cyber-espionage analyst at FireEye, confirmed the timeline and told the paper that the latest campaign is led by a government-connected Iranian hacker group known as APT33 or “Refined Kitten.”
Wired magazine carried a story on Thursday also alleging Iranian attacks, based on information from CrowdStrike and another firm, Dragos – this time targeting the US Department of Energy with phishing emails pretending to come from the White House Council of Economic Advisers.
“The Department of Energy is aware of the reports of APT33 activity and for security reasons we do not comment on current cyber activity directed at the Department’s networks,” the agency said in a statement.
CrowdStrike is the contractor that accused Russia of hacking the Democratic National Committee in 2016. Federal investigators just took their word for it, never actually examining the DNC computers.
FireEye also accused Russia of trying to hack Democrats, this time during the 2018 midterms. The firm also picked Hillary Clinton – of the private email server in attic fame – as the keynote speaker at their upcoming cybersecurity conference in October.
Allegations of Iranian cyber-warfare came as almost everyone in Washington expected some form of US military action against Tehran following the shooting down of a US spy drone over the Strait of Hormuz on Thursday.
A shooting war seemed to have been avoided in the nick of time, however, with President Trump saying on Friday that he changed his mind about a “disproportionate” response just minutes before the operation was underway.
The Mad Chase for Russia-gate Prey
By Daniel Lazare | Consortium News | June 30, 2017
June is turning out to be the cruelest month for the Russia-gate industry. The pain began on June 8 when ex-FBI Director James Comey testified that a sensational New York Times article declaring that “members of Donald J. Trump’s 2016 presidential campaign and other Trump associates had repeated contacts with senior Russian intelligence officials” was “in the main … not true.”
Then came Republican Karen Handel’s June 20 victory in a special election in Georgia’s sixth congressional district, sparking bitter recriminations among Democrats who had hoped to ride to victory on a Russia-gate-propelled wave of resistance to Trump.
More evidence that the strategy was not working came a day later when the Harris Poll and Harvard’s Center for American Political Studies produced a devastating survey showing that 62 percent of voters see no evidence that the Trump campaign colluded with Russia, while 54 percent believe the “Deep State” is trying to unseat the President by leaking classified information. The poll even showed a small bounce in Trump’s popularity, with 45 percent viewing him favorably as opposed to only 39 percent for his defeated Democratic rival Hillary Clinton.
The mainstream news media also came in for some lumps. On June 23, CNN retracted a story that had claimed that Congress was looking into reports that the Trump transition team met secretly with a Russian investment fund under sanction from the U.S. government. Three days later, CNN announced that three staffers responsible for the blooper – reporter and Pulitzer Prize-nominee Thomas Frank; Pulitzer-winner Eric Lichtblau, late of the New York Times ; and Lex Haris, executive editor in charge of investigations – had resigned.
Adding to CNN’s embarrassment, Project Veritas, the brainchild of rightwing provocateur James O’Keefe, released an undercover video in which a CNN producer named John Bonifield explained that the network can’t stop talking about Russia because it boosts ratings and then went on to say about Russia-gate:
“Could be bullshit, I mean it’s mostly bullshit right now. Like, we don’t have any big giant proof. But … the leaks keep leaking, and there are so many great leaks, and it’s amazing, and I just refuse to believe that if they had something really good like that, that wouldn’t leak because we’ve been getting all these other leaks. So I just feel like they don’t really have it but they want to keep digging. And so I think the president is probably right to say, like, look, you’re witch-hunting me, like, you have no smoking gun, you have no real proof.”
Project Veritas also released an undercover video interview with CNN contributor Van Jones calling the long-running probe into possible collusion between Trump’s 2016 campaign and Russia a “nothing-burger,” a position similar to the skepticism that Jones has displayed in his on-air comments.
True, the Bonifield video was only a medical reporter sounding off about a story that he’s not even covering and doing so to a dirty-trickster who has received financing from Trump and who, after another undercover film stunt, was ordered in 2013 to apologize and pay $100,000 to an anti-poverty worker whose privacy he had invaded.
Good for Ratings
But, still, Bonifield’s “president-is-probably-right” comment is hard to shake. Ditto Van Jones’ “nothing-burger.” Unless both quotes are completely doctored, it appears that the scuttlebutt among CNNers is that Russia-gate is a lot of hot air but no one cares because it’s sending viewership through the roof.
And if that’s what CNN thinks, then it may be what MSNBC’s Rachel Maddow thinks as she also plays the Russia card for all it’s worth. It may also be what The Washington Post has in the back of its mind even while hyperventilating about Russian President Vladimir Putin’s “crime of the century, an unprecedented and largely successful destabilizing attack on American democracy.”
The New York Times also got caught up in its enthusiasm to hype the Russia-gate case on June 25 when it ran a story slamming Trump for “refus[ing] to acknowledge a basic fact agreed upon by 17 American intelligence agencies that he now oversees: Russia orchestrated the attacks [on Democratic emails], and did it to help get him elected.”
The “17-intelligence-agency” canard has been a favorite go-to assertion for both Democrats and the mainstream news media, although it was repudiated in May by President Obama’s Director of National Intelligence James Clapper and CIA Director John Brennan.
So, on June 29, the Times apparently found itself with no choice but to issue a correction stating: “The [Russia-hacking] assessment was made by four intelligence agencies — the Office of the Director of National Intelligence, the Central Intelligence Agency, the Federal Bureau of Investigation and the National Security Agency. The assessment was not approved by all 17 organizations in the American intelligence community.”
This point is important because, as Consortiumnews.com and other non-mainstream news outlets have argued for more than a month, it is much easier to manipulate a finding by hand-picking analysts from a small number of intelligence agencies than by seeking the judgments and dissents from all 17.
Despite the correction, the Times soon returned to its pattern of shading the truth regarding the U.S. intelligence assessment. On June 30, a Times article reported: “Mr. Trump has repeatedly cast doubt on the unanimous conclusion of United States intelligence agencies that Russia sought to interfere in the 2016 race.”
The Times’ phrase “unanimous conclusion” conveys the false impression that all 17 agencies were onboard without specifically saying so, although we now know that the Times’ editors are aware that only selected analysts from three agencies plus the DNI’s office were involved.
In other words, the Times cited a “unanimous conclusion of United States intelligence agencies” to mislead its readers without specifically repeating the “all-17-agencies” falsehood. This behavior suggests that the Times is so blinded by its anti-Trump animus that it wants to conceal from its readers how shaky the whole tale is.
Holes from the Start
But the problems with Russia-gate date back to the beginning. Where Watergate was about a real burglary, this one began with a cyber break-in that may or may not have occurred. In his June 8 testimony before the Senate Intelligence Committee, Comey conceded that the FBI never checked the DNC’s servers to confirm that they had truly been hacked.
COMMITTEE CHAIRMAN RICHARD BURR: Did you ever have access to the actual hardware that was hacked? Or did you have to rely on a third party to provide you the data that they had collected?
COMEY: In the case of the DNC, and, I believe, the DCCC [i.e. the Democratic Congressional Campaign Committee], but I’m sure the DNC, we did not have access to the devices themselves. We got relevant forensic information from a private party, a high-class entity, that had done the work. But we didn’t get direct access.
BURR: But no content?
COMEY: Correct.
BURR: Isn’t content an important part of the forensics from a counterintelligence standpoint?
COMEY: It is, although what was briefed to me by my folks — the people who were my folks at the time – is that they had gotten the information from the private party that they needed to understand the intrusion by the spring of 2016.
The FBI apparently was confident that it could rely on such “a high-class entity” as CrowdStrike to tell it what it needed to know. Yet neither the Democratic National Committee nor CrowdStrike, the Irvine, California, cyber-security firm the DNC hired, was remotely objective.
Hillary Clinton was on record calling Putin a “bully” whose goal was “to stymie, to confront, to undermine American power” while Dmitri Aperovitch, CrowdStrike’s chief technical officer, is a Russian émigré who is both anti-Putin personally and an associate of the Atlantic Council, a pro-Clinton/anti-Russian think tank that is funded by the Saudis, the United Arab Emirates and the Ukrainian World Congress. The Atlantic Council is one of the most anti-Russian voices in Washington.
So, an anti-Putin DNC hired an anti-Putin security specialist, who, to absolutely no one’s surprise, “immediately” determined that the break-in was the work of hackers “closely linked to the Russian government’s powerful and highly capable intelligence services.”
Comey’s trust in CrowdStrike was akin to cops trusting a private eye not only to investigate a murder, but to determine if it even occurred. Yet the mainstream media’s pack journalists saw no reason to question the FBI because doing so would not accord with an anti-Trump bias so pronounced that even journalism profs have begun to notice.
Doubts about CrowdStrike
Since CrowdStrike issued its findings, it has come under wide-ranging criticism. Cyber experts have called its analysis inconsistent because while praising the alleged hackers to the skies (“our team considers them some of the best adversaries out of all the numerous nation-state, criminal and hacktivist/terrorist groups we encounter on a daily basis”), CrowdStrike says it was able to uncover their identity because they made kindergarten-level mistakes, most notably uploading documents in a Russian-language format under the name “Felix Edmundovich,” a reference to Felix E. Dzerzhinsky, founder of the Soviet secret police.
“Raise your hand if you think that a GRU or FSB officer would add Iron Felix’s name to the metadata of a stolen document before he released it to the world while pretending to be a Romanian hacker,” wisecracked cyber-skeptic Jeffrey Carr.
Others noted how easy it is for even novice hackers to leave a false trail. In Seattle, cyber-sleuths Mark Maunder and Rob McMahon of Wordfence, makers of a popular computer-security program, discovered that “malware” found in the DNC was an early version of a publicly available program developed in the Ukraine – which was strange, they said, because one would expect Russian intelligence to develop its own tools or use ones that were more up to date.
But even if the malware was Russian, experts pointed out that its use in this instance no more implicates Russian intelligence than the use of an Uzi in a bank robbery implicates Mossad.
Other loose threads appeared. In January, Carr poured cold water on a subsequent CrowdStrike report charging that pro-Russian separatists had used similar malware to zero in on pro-government artillery units in the eastern Ukraine.
The Ukrainian ministry of defense and the London think tank from which CrowdStrike obtained much of its data agreed that the company didn’t know what it was talking about. But if CrowdStrike was wrong about the Ukraine case, how could everyone be sure it was right about the DNC?
In March, Wikileaks went public with its “Vault 7” findings showing, among other things, that the CIA has developed sophisticated software in order to scatter false clues – which inevitably led to dark mutterings that maybe the agency had hacked the DNC itself in order to blame it on the Russians.
Finally, although Wikileaks policy is never to comment on its sources, Julian Assange, the group’s founder, decided to make an exception.
“The Clinton camp has been able to project a neo-McCarthyist hysteria that Russia is responsible for everything,” he told journalist John Pilger in November. “Hillary Clinton has stated multiple times, falsely, that 17 U.S. intelligence agencies had assessed that Russia was the source of our publications. That’s false – we can say that the Russian government is not the source.”
Craig Murray, an ex-British diplomat who is a Wikileaks adviser, disclosed that he personally flew to Washington to meet with a person who was either the original source or an associate of the source. Murray said the motive for the leak was “disgust at the corruption of the Clinton Foundation and the tilting of the primary election playing field against Bernie Sanders.”
Conceivably, such contacts could have been cutouts to conceal from WikiLeaks the actual sources. Still, Wikileaks’ record of veracity should be enough to give anyone pause. Yet the press either ignored the WikiLeaks comments or, in the case of The Washington Post, struggled to prove that WikiLeaks was lying.
Unstable Foundation
The stories that have been built upon this unstable foundation have proved shaky, too. In March, the Times published a front-page exposé asserting that Trump campaign manager Paul Manafort “had regular communications with his longtime associate – a former Russian military translator in Kiev who has been investigated in Ukraine on suspicion of being a Russian intelligence agent.” But if the man was merely a suspected spy as opposed to a convicted one, then what’s the problem?
The article also noted that Jason Greenblatt, a former Trump lawyer who is now a special White House representative for international negotiations, met last summer with Rabbi Berel Lazar, “the chief rabbi of Russia and an ally of Russia’s president, Vladimir V. Putin.” But an Orthodox Jew paying a call on Russia’s chief rabbi is hardly extraordinary. Neither is the fact that the rabbi is a Putin ally since Putin enjoys broad support in the Russian Jewish community.
In April, the Times published another innuendo-laden front-page story about businessman Carter Page whose July 2016 trip to Moscow proved to be “a catalyst for the F.B.I. investigation into connections between Russia and President Trump’s campaign.”
Page’s sins chiefly consist of lecturing at a Moscow academic institute about U.S.-Russian relations in terms that The New York Times believed “echoed the position of President Vladimir V. Putin of Russia” and, on another occasion, meeting with a suspected Russian intelligence agent in New York.
“There is no evidence that Mr. Page knew the man was an intelligence officer,” the article added. So is it now a crime to talk with a Russian or some other foreign national who, unbeknownst to you, may turn out to be an intelligence agent?
Then there is poor Mike Flynn, driven out as national security adviser after just 24 days in office for allegedly misrepresenting conversations with Russian Ambassador Sergey Kislyak – exchanges during the Trump transition that supposedly exposed him to the possibility of Russian blackmail although U.S. intelligence was monitoring the talks and therefore knew their exact contents. And, since the Russians no doubt assumed as much, it’s hard to see what they could have blackmailed him with. [See Consortiumnews.com’s “Turning Gen. Flynn into Road Kill.”]
Yet the mainstream media eagerly gobbled up this blackmail possibility while presenting with a straight face the claim by Obama holdovers at the Justice Department that the Flynn-Kislyak conversations might have violated the 1799 Logan Act, an ancient relic that has never been used to prosecute anyone in its entire two-century history.
So, if the scandal is looking increasingly threadbare now, could the reason be that there was little or nothing to it when it was first announced during the final weeks of the 2016 campaign?
Although it’s impossible to say what evidence might eventually emerge, Russia-gate is looking more and more like a Democratic version of Benghazi, a pseudo-scandal that no one could ever figure out but which wound up making Hillary Clinton look like a persecuted hero and the Republicans seem like obsessed idiots.
As much as that epic inquiry turned out to be mostly a witch-hunt, Americans are beginning to sense the same about Washington’s latest game of “gotcha.”
The United States is still a democracy in some vague sense of the word, and “We the People” are losing patience with subterranean maneuvers on the part of the Democrats, the neoconservatives, and the intelligence agencies seeking to reverse a presidential election.
Like Benghazi or possibly even the Birthergate scam about President Obama’s Kenyan birthplace, the whole convoluted Russia-gate tale grows stranger by the day.
Daniel Lazare is the author of several books including The Frozen Republic: How the Constitution Is Paralyzing Democracy (Harcourt Brace).

