133. How Russia Made Trump: Romanian Hackers, WikiLeaks, and Hillary’s Emails (Ep 3)

20:58Gordon:government. Former Secretary of State Colin Powell had also done this. This is not to excuse it. It's just to note that this is not a one-of-one situation. And I think we would both agree, Gordon, that it was a, I think, strikingly bad judgment to do this. And she's going to pay a heavy price for that misjudgment. And she's going to pay a very heavy price for this. Because in the first week of March in 2015, so a year before the GRU's hacks, this becomes a national story. And the New York Times runs a front page article on the subject of Hillary's private server and her emails. And the article says the system may have violated federal requirements and it was, quote, alarming to current and former government archive officials.

21:45Gordon:You never want government archive officials alarmed by what you're doing, Gordon. But they were. Not good. And this had been revealed by a Romanian hacker who went by the moniker. And I always pronounce this Guccifer, Gordon. Guccifer, I'd say. It's Guccifer. I think it's Guccifer. Guccifer is how I'd say it.

22:35Gordon:Republicans had been investigating Clinton, who had been Secretary of State at the time, on suspicion that she had played a role in blocking a viable rescue mission or covering up malfeasance that had led to the deaths.

22:47David:It becomes very political, doesn't it?

22:50Gordon:Intensely political. And Clinton basically says she had set up this private server for convenience, but she'd also written at one point that she didn't want to risk the personal becoming accessible, which I think is a large part of the reason for setting up the server in the first place. And really critically, she had deleted a massive trove of emails that she considered to be personal. So the deletion of emails from this private server starts to feed theories that she had covered up some wrongdoing associated with Benghazi. Hence this kind of spiral of the investigation as trying to get to the bottom of whether she had done something wrong.

23:32Gordon:And then lo and behold, they realized that a bunch of the email traffic that she'd been sending at the time, which she claimed is personal, had been deleted. The State Department investigators, they're going to subsequently determine that classified information may have existed on at least one of her private servers and a thumb drive that weren't in the government's possession. And some of that sensitive information in the emails, it seems, belonged not to the State Department, but to intelligence agencies. So you have the intelligence community's inspector general who actually looks at a sample of the emails and finds that at least four contain classified material.

24:13Gordon:So then that gets relayed to the Justice Department. So you have this - Long running investigation. Long running investigation. It's going to become just a never ending scandal that surrounds her and will surround her for the rest of the year. But Julian Assange and WikiLeaks to bring it back to our definitely not friend of the pod, Julian Assange. They've been all over this. And now we have, Gordon, a very happy alignment in this active measure because the GRU has got a ton of Podesta's emails. They've got information from inside the DNC. They've got information from inside the DCCC. and they've struggled, haven't they, to distribute that information, to get it out there.

25:00Gordon:What does WikiLeaks have though?

25:02David:A platform.

25:03Gordon:They have a platform. By the 14th of June, the GRU sensing that their DCLeaks platform had been a hard sell and wasn't really getting the word out, they start to reach out to WikiLeaks directly. And they don't do this as the GRU, of course. They do this through the DCLeaks Twitter account privately messaging WikiLeaks. You announced your organization was preparing to publish more Hillary's emails. We're ready to support you. We have some sensitive information too, in particular her financial documents. Let's do it together. What do you think about publishing our info at the same moment? And Assange, I like this, he doesn't respond to the first contact attempt because he just, he misses, he misses the message on Twitter.

25:49Gordon:I don't know how you are, Gordon, with your Twitter DMs. dms but you know very erratic i can be spotty right and i guess julian assange is probably getting hit up with this kind of stuff all the time at this point and he just he just misses it what i think is interesting is that you know the gru at this time is monitoring assange's statements so closely and then offering their support because it's very likely and i should say there is still, even after years of investigations, there still is some mystery here, I think, on the kind of the TikTok of - The contacts and the sequence of events, yeah.

26:31Gordon:The contact between the GRU and WikiLeaks. But what seems to be the case is that the reason they're watching Assange and WikiLeaks so closely on Twitter is that they've already passed the archive of John Podesta's inbox to WikiLeaks before the 12th of June, but done so anonymously. And WikiLeaks had not acted on it and had just sat.

26:56David:But this isn't going to remain secret and unspotted in DMs for long, because very soon after that, the whole issue of the hacking of the DNC is going to get very public and very political. Let's look at that after the break. Rated T for Team.

27:42Gordon:Pre-order now. Tax Act is here anytime you want to easily file your taxes. Tax Act is here for the early birds who like to knock them out as soon as the season opens. And for the procrastinators who like to wait until the very last minute. Tax Act is also here for the middlers who file right in the middle of tax season. No one ever talks about the middlers, but Tax Act sees you and Tax Act respects you. TacSac, let's get them over with.

28:39Gordon:Sweetgreen.com, available at participating locations only.

28:49David:So, David, we talked a little bit, haven't we, about how the DNC had been hacked by actually two Russian intelligence groups. And it's worked out it's been hacked. And it's called in a security firm, CrowdStrike, to investigate what had happened to it. And they're going to find evidence of those hacks, which is important at this point.

29:11Gordon:Well, that's right. And once CrowdStrike gets involved, I mean, essentially what happens is that the DNC has to clean up its entire network and run a very tedious cleanup process over a weekend in June. So on Friday, the 10th of June, after realizing that they had been hacked, the DNC takes its machines offline. Everyone has to turn in devices over the weekend. They have to be wiped and cleaned. This whole thing is going to end up costing the DNC over a million dollars. But by the end of the weekend on the 12th of June 2016, the DNC's networks are back online and the Democrats know that they've been hacked.

29:57Gordon:But this is this is what's fascinating is initially it's kind of not that big of a deal. I mean, the Post, the Washington Post is working on a story that's probably leaked to the Post by the DNC itself. And you have CrowdStrike, which has prepared a technical report to kind of coincide with the post. So you know, I guess, an outline of what's happened, that the DNC has been hacked. In the CrowdStrike report, there's been evidence of the tradecraft that the Russians have used in both intrusions. And on the 14th of June, hat tip to our producer, Becky, who notes that this is Trump's birthday, the Washington Post writes a story that reveals that Russian government hackers had penetrated the DNC.

30:47David:Yeah, and I remember this very well, covering the campaign, covering cybersecurity. This was a story, but interestingly enough, it wasn't a massive story at the time, because I think it was seen in the context still of espionage, of this is the kind of thing you'd have expected Russian hackers to have done and the questions about whether their security had been weak. But it did make clear that they potentially got access to the DNC's database of opposition research, which is very interesting information because obviously campaigns do oppo research on their adversaries in which they collect basically the dirt.

31:26David:Well, not dirt, but anything that could be used against them. And, you know, that's going to include Donald Trump. It's going to include others. But the Washington Post definitely framed it as traditional espionage, trying to understand each campaign, what it was doing, what the candidates might be, what positions they would take. So it was not seen as a real emergency, even though actually the reality was something else was already going on involving those GRU hackers.

31:57Gordon:I kind of like this part of the story, Gordon, because there's a pissing match between the hackers and CrowdStrike, isn't there? Because CrowdStrike, in the report that they put out, basically expose a bunch of the shoddy tradecraft that the GRU had used and explain how they did the hack. And that doesn't land so well inside the GRU. The GRU guys are kind of ticked off that CrowdStrike has outed them and how they've done this. So what this means, just kind of set the timeline, is that by mid-June, the GRU has been outed as the perp and the post has run a story, right? So by the middle of June, it is understood that the Russians are behind a hack of the DNC.

32:46Gordon:But the GRU guys are looking to embarrass CrowdStrike and go back at the people who outed them. And the GRU creates an online persona. They whip this together quite quickly. Guccifer 2.0. So remember, we talked about the first Guccifer who had been involved in breaking really the sort of Hillary email story.

33:11David:And who I think had been imprisoned or detained. So no one thought it was him. But Guccifer 2.0, they're trying to make out it's another kind of independent hacker like the Romanian who's trying to have a go at the Americans but is not linked to the state. So it's kind of deliberate front for them.

33:28Gordon:That's right. And on the 15th of June, this Guccifer 2.0 issues a rambling post that dismisses the CrowdStrike conclusions. And they refer to CrowdStrike as a, quote, worldwide known company. There will be a problem with syntax throughout the posts that are issued by the GRU. So instead, Guccifer 2.0 says the DNC has been hacked by a lone hacker and Lukashev and his compadres inside the GRU try to portray themselves as Romanians because the original Guccifer had been Romanian. But this will be a fiction that's exposed when they are posed questions by a Romanian journalist. Yeah. And the responses come back.

34:13Gordon:It looks like it's been through Google Translate. Yeah. That's right. Right. So as proof, though, Guccifer 2.0 puts out on a blog 11 documents that he claims had come from the DNC. And this includes an oppo research file on Trump and a list of major Democratic donors. By this time, though, the GRU is tampered with some of the files. Five of the leaked documents, their Microsoft Word files, they're named like 1.doc, 2.doc and on and on. All of them had been modified on the 15th of June, just before being published. The GRU had used kind of an old active measures trick and had decided, well, we better make these documents look more interesting.

34:57Gordon:And so they had upgraded four out of the five they had written confidential across the top. And another one of them, they wrote secret, right? Just to make them look - They know journalists. That's what people want. Make them look more interesting. Since you see that. Yeah, exactly. But in the haste of kind of this whole story breaking, the GRU officer who had edited the documents did not clean up the metadata and left his machine's username visible in the original Cyrillic. The name was Felix Edmundovich. Now, Felix Edmundovich is not a Pop-Tart eating GRU hacker. this is the first name and the patronymic of felix zerszynski the founder of the founder of

35:44David:the cheque the hero of many right of every every soviet and russian spy so it's a little bit of a giveaway isn't it which gets spotted i think including by a few people online who start to go uh this looks like the russians that's right that's right so there's basically a group of

36:03Gordon:kind of online volunteer detectives who quickly spot these metadata errors.

36:13David:A bit sloppy, which is classic GRU, and which basically allows everyone to go, this does not look like a lone hacker. You know, this looks like Russian intelligence, and that Guccifer 2 is just a front for the GRU.

36:31Gordon:I guess the hackers are consumed in the month of June with establishing their DC Leaks portal and fighting with CrowdStrike online. But on July 14th, Guccifer 2.0 sends an email to WikiLeaks that includes an attachment with detailed instructions. Now, I wondered if Gordon was going to prevent me from reading the attachments file, but I'm just going to do it anyway. WKDNCLink1.txt.gpg. This is the attachment. which I can't believe anyone would click on something that has that for an attachment file name. But a few days later, WikiLeaks privately acknowledges the receipt of the archive, which is about a gigabyte of information.

37:18Gordon:And they tell the GRU officers that the public release would be ready that week. So, on Friday, the 22nd of July, three days ahead of, this timing is really important, three days ahead of the Democratic Convention, WikiLeaks will dump online 19 ,252 emails with more than 8 ,000 attachments, all stolen from the DNC's computers and made searchable by keyword. And Julian Assange himself announces the release that morning. He says, are you ready for Hillary? He's writing on Twitter. We begin our series today with 20 ,000 emails from the top of the DNC. And then a while later, WikiLeaks own account sends out links to that trove.

38:07Gordon:And it's got hashtags, which is hashtag Hillary 2016 and hashtag feel the burn, B-E-R-N, because her primary opponent at that point is Bernie Sanders.

38:18David:And it's at this point, I remember it well, the story explodes. Really interesting. But they've been trying for so long to get traction from the stolen emails. And now suddenly it takes off. It's something about WikiLeaks. It's something about the timing ahead of the convention. And crucially, that there is actually really interesting information in there. because what it shows is that the DNC, which is the Democratic Party, which is supposed to be neutral between the different candidates trying to become the nominee for the Democratic Party, it seems to show that the senior officials have been taking sides and supporting Hillary Clinton against Bernie Sanders.

38:59David:And this, I think, is really important because there is a genuine story in there, if you like, which is the DNC has taken sides. And it's going to have an impact on the anger in the Democratic Party. You obviously have Bernie Sanders, which is the insurgent wing of the Democratic Party. And suddenly his supporters are going to feel very pissed off with both the Democratic Party and with Hillary Clinton for apparently secretly behind, you know, when they shouldn't have been conspiring against him. I mean, it's going to lead to the chair of the DNC, Debbie Wasserman Schultz, resigning. I mean, she's going to resign over what's in those emails.

39:39David:So it is damaging in that sense, isn't it?

39:41Gordon:What is it? I mean, in a few emails, Debbie Wasserman Schultz had called Bernie Sanders, campaign manager, an ass and a liar. And there was one particularly embarrassing chain that had the DNC's chief financial officer proposing to other DNC officials. I mean, just a straight up attack on Bernie Sanders on the grounds of Bernie Sanders' religious beliefs, right? Or kind of his lack thereof. It said basically, can we get someone to ask his belief? Does he believe in a god? He had skated on saying he has a Jewish heritage. I think I read he's an atheist. My Southern Baptist peeps would draw a big difference between a Jew and an atheist, right?

40:18Gordon:It doesn't look so good. You're supposed to be the impartial CFO of the DNC. There isn't evidence that the DNC really ever acted on these ideas, but it kind of doesn't matter because, and especially it doesn't matter from, you know, again, to bring this back to a Russian intelligence operation, the Russian standpoint, if you are attempting to weaken Hillary Clinton, this is a good way to do that. Because what it does is it exposes the fact that your entire party has, well, you could spin it this way, I guess, has essentially rigged the outcome of the primary in your favor.

40:57David:Yeah. And I think, you know, we'll come back later, I think, to the question of how much difference did the Russian active measure make on the election. But I think it's worth just briefly saying, I think this is one point where I think you can make the case that it does make a difference, not just to this moment and being a news story, but to the eventual outcome of what we know later will be a close election. Because if some of those Bernie Sanders supporters are sufficiently pissed off that the DNC has been conspiring against them and Hillary Clinton's been conspiring against them. They are not going to throw their support behind her, are they?

41:32David:When she comes out of the convention as the nominee, they're going to be kind of annoyed. So your ability to unify support across the Democratic Party and bring in the left wing Bernie Sanders supporters is going to be undermined by this. And in a close election, I think you can make the case that that actually has a material impact in terms of the energy and the breadth of support that gets behind Hillary Clinton once she comes out of the convention.

41:59Gordon:Well, and someone else, Gordon, is going to seize on the spill of these emails. And there's going to be a tweet from Donald Trump that says, leaked emails of DNC show plans to destroy Bernie Sanders, mock his heritage and much more online from WikiLeaks. Really vicious. Rigged. And I think that that'll say it all about how this active measure is going to start to just seep into the bloodstream of this election and how it's going to just ricochet around and be used and really promulgated by media, the candidates themselves. It's really a startling story. It's going to show how this thing is going to turn into absolute wildfire as the summer turns into the fall.

42:46David:So perhaps there with Donald Trump entering the fray of the election campaign and this issue of the leaked emails, let's stop for this time. But of course, a reminder, if you want to hear the rest of this series, do join the Declassified Club at therestisclassified.com, where you'll also get access to the bonus series we're doing for members, which is going to look very specifically at that issue of the Trump campaign and Russia and that relationship, which sits alongside this series, looking at, if you like, the Russian active measures. So lots there for members to enjoy. But otherwise, we'll see you next time.

43:22Gordon:See you next time.

43:28David:Do you want to know what really happens inside MI5? Or what we chat about when the cameras aren't rolling? If you love the show and you want to come behind the scenes with us, who better to join than our producer, Becky? From now on, And she'll be writing a free newsletter every week, taking you behind the mic at The Rest Is Classified.

43:48Gordon:Make sure to subscribe via the link in the episode description to be the first to read The Latest Classified Insider or head to therestisclassified.com to find out more.

43:59David:To some, he is the revolutionary hero who restored China to its rightful place on the global stage. To others, he's a brutal despot, accused of presiding over more civilian deaths than either Stalin or Hitler. Mao Zedong has one of the most recognisable faces in the world, yet he started life in a muddy provincial village. A rebel son who hated his father survived a 6 ,000 mile walk across China and rose to become a figure of titanic proportions. From Empire, the goalhanger world history show, I'm Anita Arnon. And I'm William Durrenpul. In this six-part series, we're joined by world-renowned expert Rana Mitter to explore the life of the father of communist China, Mao Zedong.

44:44David:We'll track his rise from a bookstore owner to a guerrilla commander, and we'll witness his ruthless elimination to secure total power, and we'll descend into the dark experiment of the Cultural Revolution, a time when ancient temples were burnt, children denounced their parents, and a nation worshipped a mango as a sacred relic. Subscribe to Empire wherever you get your podcasts to listen now.