FBI Got Everything It Asked for in DNC Investigation, Refuting ‘Missing Server’ Myth – Defense One

New transcripts released by the House intelligence committee shed light on Russias interference in 2016 election.

I would like you to do us a favor, though, President Donald Trump told his Ukranian counterpart in the infamous July 2019 phone conversation that led to his impeachment. Because our country has been through a lot and Ukraine knows a lot about it. I would like you to find out what happened with this whole situation with Ukraine, they say CrowdStrike The server, they say Ukraine hasit.

Trump was only the latest to perpetuate a myth surrounding Russian hackers 2016 theft of emails from the Democratic National Committee: that the theft was an inside job, that a server mysteriously disappeared in a purported coverup. In fact, all available evidence says the theft was carried out by two groups allegedly connected to Moscows intelligence agencies: APT-28 and APT-29, aka Fancy Bear and CozyBear.

The pile of evidence grew deeper on Thursday evening, when the House Permanent Select Committee on Intelligence released more than 50 transcripts of FBI interviews conducted in 2017 and 208 under Robert Muellers investigation into Russias meddling in the 2016 election. One in particular stands out.

The interview with Yared Tamene Wolde Yohannes, who ran the DNCs IT in 2015 and 2016, reveals a few important facts. It confirms that the FBI knew that at least one Russian actor, Cozy Bear, had penetrated the DNC network by the fall of 2015 and, Yohannes suggests, possibly as far back as July. It also reveals that the FBI wasnt direct or forthcoming with DNC about what they were seeing. They asked for information without telling the DNC who really was afterthem.

Subscribe

Receive daily email updates:

Subscribe to the Defense One daily.

Be the first to receive updates.

I would say that the information that the FBI was providing, honestly, was frustrating in how redacted it was, Yohannes complains. He said the FBI agent who told him about the intrusion didnt say Russian state-sponsored actor. He said Russians in general. The FBI didnt even hand over data that could have helped Yohannes secure his network like timestamped screenshots of documents or emails or network logs until February2016.

The DNC only learned that the Russian government was targeting them in the spring of 2016, from Crowdstrike, a cybersecuritycompany.

The transcript also reveals that the DNC gave the FBI everything it asked for: roughly 15 gigabytes of server logs and related metadata showing intrusionactivity.

We eventually delivered those logs. I think the actual date that we were able to get it to the FBI was 10 days later. So like April 29, I think, was the date that we actually sent them the logs. And the FBI agent confirmed receipt by sending me a text message saying: You know, thank you for sending that. Thats great, very helpful. Ill let you know what we find, Yohannes says in thetranscript

Yohannes concludes the interview with a wish that the FBI would have shared more about what it knew was happening to theDNC.

What I would like to seeis better sharing of information at the declassified level, I mean, they do that already. They have websites, they have maybe even seminars, that kind of stuff. But these are not readily available, easily digestible, well-marketed. I would love to see, you know, a small organization like the DNC, which has a really big profile but its a really small nonprofit organization, can use that kind of assistance from the U.S. intelligence community and others, potentially, right? Yeah, so I would love to see that kind ofthing.

The transcript confirms what others have reported via anonymous sources: that the U.S. intelligence community was well aware that Russians had penetrated DNC networks longbefore the group knew it had beencompromised.

The emails were dumped to Wikileaks in the summer and fall of 2016. The IC might have announced then that the thieves were Russian, and that the theft was part of a coordinated effort to sway the upcoming election. Instead, the IC made its first formal statement on the matter on Oct. 7. That delay allowed someone to sow doubt in the publics mind about what really happened, doubt that persiststoday.

In some ways, the intelligence community appears to have learned from this failure. In July 2018, the NSA formed a group to disrupt Russian active measures aimed at the UnitedStates.

But other signs show that the Intelligence community is still not forthcoming about the attacks that the country faces. Earlier this week, The U.S. Cybersecurity and Infrastructure Security Agency and UKs National Cyber Security Centre released a joint statement saying that powerful cybercriminals were targeting healthcare organizations amid the pandemic. But officials with both organizations rebuffed repeated requests to identify who those attackers were, showing that old habits, even unhelpful ones, are hard topurge.

Read more:
FBI Got Everything It Asked for in DNC Investigation, Refuting 'Missing Server' Myth - Defense One