US releases detailed look at Russia's election hacking
WASHINGTON: The US on Thursday released its most detailed report yet on Russia's efforts to interfere in the US presidential election by hacking American political sites and email accounts.
The 13-page joint analysis by the Homeland Security Department and the Federal Bureau of Investigation was first such report ever to attribute malicious cyber activity to a particular country or actors.
It was also the first time the US has officially and specifically tied intrusions into the Democratic National Committee to hackers with the Russian civilian and military intelligence services, the FSB and GRU, expanding on an Oct. 7 accusation by the Obama administration.
The report said the intelligence services were involved in "an ongoing campaign of cyber-enabled operations directed at the US government and its citizens." It added, "In some cases, (the Russian intelligence services') actors masqueraded as third parties, hiding behind false online personas designed to cause the victim to misattribute the source of the attack."
Over the summer stolen emails from Democrats were posted by an online persona known as Guccifer 2.0, believed by US officials to be linked to Russia. Outrage over documents that appeared to show favoritism for Hillary Clinton forced the DNC's chair, Debbie Wasserman Schultz, to resign.
The US released the report as President Barack Obama sanctioned the GRU and the FSB, the GRU's leadership and companies which the US said support the GRU.
Thursday's sanctions were the administration's first use of a 2015 executive order for combatting cyberattacks against critical infrastructure and commercial espionage. Because election systems aren't considered critical infrastructure, Obama amended the order Thursday to allow for sanctions on entities "interfering with or undermining election processes or institutions."
The retaliation against Russia, just weeks before President-elect Donald Trump takes office, culminated months of political handwringing about how and whether to respond to Moscow's meddling. US intelligence agencies concluded that Russia's goal was to help Trump win — an assessment Trump has dismissed as ridiculous. Trump said Thursday he would meet with the intelligence community's leaders next week for an update on the situation.
The report did not go far beyond confirming details already disclosed by cybersecurity firm CrowdStrike, which was hired to investigate the DNC hacks.
It described the intelligence services' use of "spearphishing" — fake emails intended to trick victims into typing in their user names and passwords. At least one person opened attachments with malicious software. The report noted that actors "likely associated" with Russian intelligence services are continuing to engage in spearphishing campaigns, including one launched just days after the US election.
The DNC was infiltrated by the FSB in summer 2015 and again by the GRU in spring 2016 using spearphishing emails that often appeared to come from legitimate or official organizations, the report said.
Russian officials have denied any involvement in hacking US political sites and emails.
The report provides clues for cybersecurity workers in the private sector to identify compromised systems and prevent more intrusions. The Homeland Security Department said it has already included this information within its own cyber threat information-sharing program, which automatically flags threats in real time for participating companies and agencies.
US officials also provided antivirus vendors with two malicious software samples used by Russian intelligence services.
US punishes Russia for hacking presidential campaign
HONOLULU: The United States struck back Thursday at Russia for hacking the US presidential campaign with a sweeping set of punishments targeting Russia's spy agencies and diplomats. The US said Russia must bear costs for its actions, but Moscow called the Obama administration "losers" and threatened retaliation.
A month after an election the US says Russia tried to sway for Donald Trump, President Barack Obama sanctioned the GRU and FSB, leading Russian intelligence agencies the US said were involved. Those sanctions could easily be pulled back by Trump, who has insisted that Obama and Democrats are merely attempting to delegitimize his election.
In an elaborately coordinated response by at least five federal agencies, the Obama administration also sought to expose Russia's cyber tactics with a detailed technical report and hinted it might still launch a covert counterattack.
"All Americans should be alarmed by Russia's actions," Obama said, adding, "Such activities have consequences."
He said the response wasn't over and the US could take further, covert action — a thinly veiled reference to a counterstrike in cyberspace the US has been considering.
Trump issued a statement saying it was "time for our country to move on to bigger and better things." Yet in the face of newly public evidence, he suggested he was keeping an open mind.
"In the interest of our country and its great people, I will meet with leaders of the intelligence community next week in order to be updated on the facts of this situation," Trump said.
As part of the punishment, the US also kicked out 35 Russian diplomats who the US said were actually intelligence operatives, and shut down a pair of Russian compounds, in New York and Maryland. The US said those actions were in response to Russia's harassment of US diplomats, calling it part of a pattern of aggression that included the cyberattacks on the Democratic National Committee and Hillary Clinton's campaign chairman.
It was the strongest action the Obama administration has taken to date to retaliate for a cyberattack, and more comprehensive than last year's sanctions on North Korea after it hacked Sony Pictures Entertainment. The new penalties add to existing US sanctions over Russia's actions in Ukraine, which have impaired Russia's economy but had limited impact on President Vladimir Putin's behavior.
Russia, which denied the hacking allegations, called the penalties a clumsy yet aggressive attempt to "harm Russian-American ties." Putin spokesman Dmitry Peskov said Russia would take into account the fact that Trump will soon replace Obama as it drafts retaliatory measures.
The day marked a low point for US relations with Russia, which have suffered during Obama's years as he and Putin tussled over Ukraine, Edward Snowden and Russia's support for Syrian President Bashar Assad. Maria Zakharova, a Russian foreign ministry spokeswoman, took to Facebook to call the Obama administration "a group of foreign policy losers, angry and ignorant."
It was unlikely the new sanctions, while symbolically significant, would have a major impact on Russian spy operations. The sanctions freeze any US assets and block Americans from doing business with them. But Russian law bars the spy agencies from having assets in the US, and any activities they undertake would likely be covert and hard to identify.
"On its face, this is more than a slap on the wrists, but hardly an appropriate response to an unprecedented attack on our electoral system," said Stewart Baker, a cybersecurity lawyer and former National Security Agency and Homeland Security Department official.
Indeed, senior Obama administration officials said that even with the penalties, the US had reason to believe Russia would keep hacking other nations' elections and might well try to hack American elections again in 2018 or 2020. The officials briefed reporters on a conference call on condition of anonymity.
Though the FBI and Homeland Security Department issued a joint report on "Russian malicious cyber activity" — replete with examples of malware code used by the Russians — it still has not released a broader report Obama has promised detailing Russia's efforts to interfere with US elections.
The report has been eagerly anticipated by those hoping to make it politically untenable for Trump to continue questioning whether Russia was really involved. But US officials said those seeking more detail about who the US has determined did the hacking need look only to the list of sanctions targets, which includes the GRU head, his three deputies, and two Russian nationals wanted by the FBI for cybercrimes.
The move puts Trump in the position of having to decide whether to roll back the measures once in office, and US officials acknowledged that Trump could use his executive authorities to do so. Still, they suggested that building the case against Russia now would make it harder for Trump to justify easing up.
US allegations of hacking have ignited a heated debate over Trump's approach to Russia and his refusal to accept the assessment of US intelligence agencies that Russia's government was responsible and wanted to help him win. Though US lawmakers have long called for Obama to be tougher on Russia, some Republicans have found that position less tenable now that Trump is floating the possibility of closer ties to Moscow.
"While today's action by the administration is overdue, it is an appropriate way to end eight years of failed policy with Russia," said House Speaker Paul Ryan, R-Wis.
US intelligence agencies concluded that Russia was trying to help Trump win when hackers connected to the government breached Democratic Party computers and stole tens of thousands of emails that were then posted on WikiLeaks, some containing embarrassing information for Democrats. Clinton aide John Podesta's emails were also stolen and released publicly in the final weeks of the campaign.
