http://nyti.

ms/2hBJis3

POLITICS

ThePerfectWeapon:HowRussian
CyberpowerInvadedtheU.S.
ByERICLIPTON,DAVIDE.SANGERandSCOTTSHANE DEC.13,2016

WASHINGTONWhenSpecialAgentAdrianHawkinsoftheFederalBureauof
InvestigationcalledtheDemocraticNationalCommitteeinSeptember2015topass
alongsometroublingnewsaboutitscomputernetwork,hewastransferred,
naturally,tothehelpdesk.
Hismessagewasbrief,ifalarming.Atleastonecomputersystembelongingto
theD.N.C.hadbeencompromisedbyhackersfederalinvestigatorshadnamedthe
Dukes,acyberespionageteamlinkedtotheRussiangovernment.
TheF.B.I.knewitwell:Thebureauhadspentthelastfewyearstryingtokick
theDukesoutoftheunclassifiedemailsystemsoftheWhiteHouse,theState
DepartmentandeventheJointChiefsofStaff,oneofthegovernmentsbest
protectednetworks.
YaredTamene,thetechsupportcontractorattheD.N.C.whofieldedthecall,
wasnoexpertincyberattacks.HisfirstmovesweretocheckGooglefortheDukes
andconductacursorysearchoftheD.N.C.computersystemlogstolookforhintsof
suchacyberintrusion.Byhisownaccount,hedidnotlooktoohardevenafter
SpecialAgentHawkinscalledbackrepeatedlyoverthenextseveralweeksinpart
becausehewasntcertainthecallerwasarealF.B.I.agentandnotanimpostor.

IhadnowayofdifferentiatingthecallIjustreceivedfromaprankcall,Mr.
Tamenewroteinaninternalmemo,obtainedbyTheNewYorkTimes,thatdetailed
hiscontactwiththeF.B.I.
Itwasthecrypticfirstsignofacyberespionageandinformationwarfare
campaigndevisedtodisruptthe2016presidentialelection,thefirstsuchattemptby
aforeignpowerinAmericanhistory.Whatstartedasaninformationgathering
operation,intelligenceofficialsbelieve,ultimatelymorphedintoanefforttoharm
onecandidate,HillaryClinton,andtiptheelectiontoheropponent,DonaldJ.
Trump.
LikeanotherfamousAmericanelectionscandal,itstartedwithabreakinatthe
D.N.C.Thefirsttime,44yearsagoatthecommitteesoldofficesintheWatergate
complex,theburglarsplantedlisteningdevicesandjimmiedafilingcabinet.This
time,theburglarywasconductedfromafar,directedbytheKremlin,withspear
phishingemailsandzerosandones.
AnexaminationbyTheTimesoftheRussianoperationbasedoninterviews
withdozensofplayerstargetedintheattack,intelligenceofficialswhoinvestigatedit
andObamaadministrationofficialswhodeliberatedoverthebestresponse
revealsaseriesofmissedsignals,slowresponsesandacontinuingunderestimation
oftheseriousnessofthecyberattack.
TheD.N.C.sfumblingencounterwiththeF.B.I.meantthebestchancetohalt
theRussianintrusionwaslost.Thefailuretograspthescopeoftheattacksundercut
effortstominimizetheirimpact.AndtheWhiteHousesreluctancetorespond
forcefullymeanttheRussianshavenotpaidaheavypricefortheiractions,a
decisionthatcouldprovecriticalindeterringfuturecyberattacks.
ThelowkeyapproachoftheF.B.I.meantthatRussianhackerscouldroam
freelythroughthecommitteesnetworkfornearlysevenmonthsbeforetopD.N.C.
officialswerealertedtotheattackandhiredcyberexpertstoprotecttheirsystems.In
themeantime,thehackersmovedontotargetsoutsidetheD.N.C.,includingMrs.
Clintonscampaignchairman,JohnD.Podesta,whoseprivateemailaccountwas
hackedmonthslater.

EvenMr.Podesta,asavvyWashingtoninsiderwhohadwrittena2014reporton
cyberprivacyforPresidentObama,didnottrulyunderstandthegravityofthe
hacking.
Bylastsummer,Democratswatchedinhelplessfuryastheirprivateemailsand
confidentialdocumentsappearedonlinedayafterdayprocuredbyRussian
intelligenceagents,postedonWikiLeaksandotherwebsites,theneagerlyreported
onbytheAmericanmedia,includingTheTimes.Mr.Trumpgleefullycitedmanyof
thepurloinedemailsonthecampaigntrail.
ThefalloutincludedtheresignationsofRepresentativeDebbieWasserman
SchultzofFlorida,thechairwomanoftheD.N.C.,andmostofhertoppartyaides.
LeadingDemocratsweresidelinedattheheightofthecampaign,silencedby
revelationsofembarrassingemailsorconsumedbythescrambletodealwiththe
hacking.Thoughlittlenoticedbythepublic,confidentialdocumentstakenbythe
RussianhackersfromtheD.N.C.ssisterorganization,theDemocraticCongressional
CampaignCommittee,turnedupincongressionalracesinadozenstates,tainting
someofthemwithaccusationsofscandal.
Inrecentdays,askepticalpresidentelect,thenationsintelligenceagenciesand
thetwomajorpartieshavebecomeembroiledinanextraordinarypublicdispute
overwhatevidenceexiststhatPresidentVladimirV.PutinofRussiamovedbeyond
mereespionagetodeliberatelytrytosubvertAmericandemocracyandpickthe
winnerofthepresidentialelection.
ManyofMrs.ClintonsclosestaidesbelievethattheRussianassaulthada
profoundimpactontheelection,whileconcedingthatotherfactorsfromMrs.
Clintonsweaknessesasacandidate,toherprivateemailserver,tothepublic
statementsoftheF.B.I.director,JamesB.Comey,aboutherhandlingofclassified
informationwerealsoimportant.
Whiletheresnowaytobecertainoftheultimateimpactofthehack,thismuch
isclear:Alowcost,highimpactweaponthatRussiahadtestfiredinelectionsfrom
UkrainetoEuropewastrainedontheUnitedStates,withdevastatingeffectiveness.
ForRussia,withanenfeebledeconomyandanucleararsenalitcannotuseshortof

alloutwar,cyberpowerprovedtheperfectweapon:cheap,hardtoseecoming,hard
totrace.
Thereshouldntbeanydoubtinanybodysmind,Adm.MichaelS.Rogers,the
directoroftheNationalSecurityAgencyandcommanderofUnitedStatesCyber
Commandsaidatapostelectionconference.Thiswasnotsomethingthatwasdone
casually,thiswasnotsomethingthatwasdonebychance,thiswasnotatargetthat
wasselectedpurelyarbitrarily,hesaid.Thiswasaconsciouseffortbyanation
statetoattempttoachieveaspecificeffect.
Forthepeoplewhoseemailswerestolen,thisnewformofpoliticalsabotagehas
leftatrailofshockandprofessionaldamage.NeeraTanden,presidentoftheCenter
forAmericanProgressandakeyClintonsupporter,recallswalkingintothebusy
Clintontransitionoffices,humiliatedtoseeherfaceontelevisionscreensaspundits
discussedaleakedemailinwhichshehadcalledMrs.Clintonsinstincts
suboptimal.
Itwasjustasuckerpunchtotheguteveryday,Ms.Tandensaid.Itwasthe
worstprofessionalexperienceofmylife.
TheUnitedStates,too,hascarriedoutcyberattacks,andindecadespastthe
C.I.A.triedtosubvertforeignelections.ButtheRussianattackisincreasingly
understoodacrossthepoliticalspectrumasanominoushistoriclandmarkwith
onenotableexception:Mr.Trumphasrejectedthefindingsoftheintelligence
agencieshewillsoonoverseeasridiculous,insistingthatthehackermaybe
American,orChinese,butthattheyhavenoidea.
Mr.Trumpcitedthereporteddisagreementsbetweentheagenciesabout
whetherMr.Putinintendedtohelpelecthim.OnTuesday,aRussiangovernment
spokesmanechoedMr.Trumpsscorn.
ThistaleofhacksresemblesabanalbrawlbetweenAmericansecurityofficials
overspheresofinfluence,MariaZakharova,thespokeswomanfortheRussian
ForeignMinistry,wroteonFacebook.

Overtheweekend,fourprominentsenators,twoRepublicansandtwo
Democrats,joinedforcestopledgeaninvestigationwhilepointedlyignoringMr.
Trumpsskepticalclaims.
DemocratsandRepublicansmustworktogether,andacrossthejurisdictional
linesoftheCongress,toexaminetheserecentincidentsthoroughlyanddevise
comprehensivesolutionstodeteranddefendagainstfurthercyberattacks,said
SenatorsJohnMcCain,LindseyGraham,ChuckSchumerandJackReed.
Thiscannotbecomeapartisanissue,theysaid.Thestakesaretoohighfor
ourcountry.

ATargetforBreakIns
SittinginthebasementoftheDemocraticNationalCommitteeheadquarters,below
awallsize2012portraitofasmilingBarackObama,isa1960serafilingcabinet
missingthehandleonthebottomdrawer.Onlyaframednewspaperstoryhanging
onthewallhintsattheimportanceofthisagedpieceofofficefurniture.
GOPSecurityAideAmong5ArrestedinBuggingAffair,readstheheadline
fromthefrontpageofTheWashingtonPostonJune19,1972,withthebylinesof
BobWoodwardandCarlBernstein.
AndrewBrown,37,thetechnologydirectorattheD.N.C.,wasbornafterthat
famousbreakin.Butashebegantoplanforthisyearselectioncycle,hewaswell
awarethattheD.N.C.couldbecomeabreakintargetagain.
TherewereaspirationstoensurethattheD.N.C.waswellprotectedagainst
cyberintrudersandthentherewasthereality,Mr.Brownandhisbossesatthe
organizationacknowledged:TheD.N.C.wasanonprofitgroup,dependenton
donations,withafractionofthesecuritybudgetthatacorporationitssizewould
have.
Therewasneverenoughmoneytodoeverythingweneededtodo,Mr.Brown
said.

TheD.N.C.hadastandardemailspamfilteringservice,intendedtoblock
phishingattacksandmalwarecreatedtoresemblelegitimateemail.Butwhen
RussianhackersstartedinontheD.N.C.,thecommitteedidnothavethemost
advancedsystemsinplacetotracksuspicioustraffic,internalD.N.C.memosshow.
Mr.Tamene,whoreportstoMr.BrownandfieldedthecallfromtheF.B.I.
agent,wasnotafulltimeD.N.C.employeeheworksforaChicagobased
contractingfirmcalledTheMISDepartment.Hewaslefttofigureout,largelyonhis
own,howtorespondandevenwhetherthemanwhohadcalledintotheD.N.C.
switchboardwasreallyanF.B.I.agent.
TheF.B.I.thinkstheD.N.C.hasatleastonecompromisedcomputeronits
networkandtheF.B.I.wantedtoknowiftheD.N.C.isaware,andifso,whatthe
D.N.C.isdoingaboutit,Mr.Tamenewroteinaninternalmemoabouthiscontacts
withtheF.B.I.HeaddedthattheSpecialAgenttoldmetolookforaspecifictypeof
malwaredubbedDukesbytheU.S.intelligencecommunityandincybersecurity
circles.
PartoftheproblemwasthatSpecialAgentHawkinsdidnotshowupinperson
attheD.N.C.Norcouldheemailanyonethere,asthatriskedalertingthehackers
thattheF.B.I.knewtheywereinthesystem.
Mr.TamenesinitialscanoftheD.N.C.systemusinghislessthanoptimal
toolsandincompletetargetinginformationfromtheF.B.I.foundnothing.So
whenSpecialAgentHawkinscalledrepeatedlyinOctober,leavingvoicemail
messagesforMr.Tamene,urginghimtocallback,Ididnotreturnhiscalls,asIhad
nothingtoreport,Mr.Tameneexplainedinhismemo.
InNovember,SpecialAgentHawkinscalledwithmoreominousnews.AD.N.C.
computerwascallinghome,wherehomemeantRussia,Mr.Tamenesmemosays,
referringtosoftwaresendinginformationtoMoscow.SAHawkinsaddedthatthe
F.B.I.thinksthatthiscallinghomebehaviorcouldbetheresultofastatesponsored
attack.
Mr.BrownknewthatMr.Tamene,whodeclinedtocomment,wasfieldingcalls
fromtheF.B.I.Buthewastieduponadifferentproblem:evidencesuggestingthat

thecampaignofSenatorBernieSandersofVermont,Mrs.Clintonsmain
Democraticopponent,hadimproperlygainedaccesstohercampaigndata.
Ms.WassermanSchultz,thentheD.N.C.schairwoman,andAmyDacey,then
itschiefexecutive,saidininterviewsthatneitherofthemwasnotifiedaboutthe
earlyreportsthatthecommitteessystemhadlikelybeencompromised.
ShawnHenry,whoonceledtheF.B.I.scyberdivisionandisnowpresidentof
CrowdStrikeServices,thecybersecurityfirmretainedbytheD.N.C.inApril,saidhe
wasbaffledthattheF.B.I.didnotcallamoreseniorofficialattheD.N.C.orsendan
agentinpersontothepartyheadquarterstotrytoforceamorevigorousresponse.
Wearenottalkingaboutanofficethatisinthemiddleofthewoodsof
Montana,Mr.Henrysaid.Wearetalkingaboutanofficethatishalfamilefrom
theF.B.I.officethatisgettingthenotification.
Thisisnotamomandpopdelicatessenoralocallibrary.Thisacriticalpiece
oftheU.S.infrastructurebecauseitrelatestoourelectoralprocess,ourelected
officials,ourlegislativeprocess,ourexecutiveprocess,headded.Tomeitisa
highlevel,seriousissue,andifafteracoupleofmonthsyoudontseeanyresults,
somebodyoughttoraisethattoahigherlevel.
TheF.B.I.declinedtocommentontheagencyshandlingofthehack.TheF.B.I.
takesveryseriouslyanycompromiseofpublicandprivatesectorsystems,itsaidin
astatement,addingthatagentswillcontinuetoshareinformationtohelptargets
safeguardtheirsystemsagainsttheactionsofpersistentcybercriminals.
ByMarch,Mr.Tameneandhisteamhadmetatleasttwiceinpersonwiththe
F.B.I.andconcludedthatAgentHawkinswasreallyafederalemployee.Butthenthe
situationtookadireturn.
AsecondteamofRussianaffiliatedhackersbegantotargettheD.N.C.and
otherplayersinthepoliticalworld,particularlyDemocrats.BillyRinehart,aformer
D.N.C.regionalfielddirectorwhowasthenworkingforMrs.Clintonscampaign,got
anoddemailwarningfromGoogle.

SomeonejustusedyourpasswordtotrytosignintoyourGoogleaccount,the
March22emailsaid,addingthatthesigninattempthadoccurredinUkraine.
Googlestoppedthissigninattempt.Youshouldchangeyourpassword
immediately.
Mr.RinehartwasinHawaiiatthetime.Herememberscheckinghisemailat4
a.m.formessagesfromEastCoastassociates.Withoutthinkingmuchaboutthe
notification,heclickedonthechangepasswordbuttonandhalfasleep,asbesthe
canremember,hetypedinanewpassword.
WhathedidnotknowuntilmonthslateristhathehadjustgiventheRussian
hackersaccesstohisemailaccount.
HundredsofsimilarphishingemailswerebeingsenttoAmericanpolitical
targets,includinganidenticalemailsentonMarch19toMr.Podesta,chairmanof
theClintoncampaign.GivenhowmanyemailsMr.Podestareceivedthroughthis
personalemailaccount,severalaidesalsohadaccesstoit,andoneofthemnoticed
thewarningemail,sendingittoacomputertechniciantomakesureitwas
legitimatebeforeanyoneclickedonthechangepasswordbutton.
Thisisalegitimateemail,CharlesDelavan,aClintoncampaignaide,replied
toanotherofMr.Podestasaides,whohadnoticedthealert.Johnneedstochange
hispasswordimmediately.
Withanotherclick,adecadeofemailsthatMr.PodestamaintainedinhisGmail
accountatotalofabout60,000wereunlockedfortheRussianhackers.Mr.
Delavan,inaninterview,saidthathisbadadvicewasaresultofatypo:Heknewthis
wasaphishingattack,asthecampaignwasgettingdozensofthem.Hesaidhehad
meanttotypethatitwasanillegitimateemail,anerrorthathesaidhasplagued
himeversince.
Duringthissecondwave,thehackersalsogainedaccesstotheDemocratic
CongressionalCampaignCommittee,andthen,throughavirtualprivatenetwork
connection,tothemaincomputernetworkoftheD.N.C.

TheF.B.I.observedthissurgeofactivityaswell,againreachingouttoMr.
Tamenetowarnhim.YetMr.Tamenestillsawnoreasontobealarmed:Hefound
copiesofthephishingemailsintheD.N.C.sspamfilter.Buthehadnoreason,he
said,tobelievethatthecomputersystemshadbeeninfiltrated.
OnebitofprogresshadfinallybeenmadebythemiddleofApril:TheD.N.C.,
sevenmonthsafterithadfirstbeenwarned,finallyinstalledarobustsetof
monitoringtools,Mr.Tamenesinternalmemosays.

HoningStealthyTactics
TheUnitedStateshadtwodecadesofwarningthatRussiasintelligenceagencies
weretryingtobreakintoAmericasmostsensitivecomputernetworks.Butthe
Russianshavealwaysmanagedtostayastepahead.
TheirfirstmajorattackwasdetectedonOct.7,1996,whenacomputeroperator
attheColoradoSchoolofMinesdiscoveredsomenighttimecomputeractivityhe
couldnotexplain.TheschoolhadamajorcontractwiththeNavy,andtheoperator
warnedhiscontactsthere.ButashappenedtwodecadeslaterattheD.N.C.,atfirst
everyonewasunabletoconnectthedots,saidThomasRid,ascholaratKings
CollegeinLondonwhohasstudiedtheattack.
InvestigatorsgaveitanameMoonlightMazeandspenttwoyears,often
workingdayandnight,tracinghowithoppedfromtheNavytotheDepartmentof
EnergytotheAirForceandNASA.Intheend,theyconcludedthatthetotalnumber
offilesstolen,ifprintedandstacked,wouldbetallerthantheWashington
Monument.
Wholeweaponsdesignswereflowingoutthedoor,anditwasafirsttasteof
whatwastocome:anescalatingcampaignofcyberattacksaroundtheworld.
Butforyears,theRussiansstayedlargelyoutoftheheadlines,thankstothe
Chinesewhotookbiggerrisks,andoftengotcaught.Theystolethedesignsforthe
F35fighterjet,corporatesecretsforrollingsteel,eventheblueprintsforgas
pipelinesthatsupplymuchoftheUnitedStates.Andduringthe2008presidential
electioncycle,ChineseintelligencehackedintothecampaignsofMr.ObamaandMr.

McCain,makingoffwithinternalpositionpapersandcommunications.Butthey
didntpublishanyofit.
TheRussianshadnotgoneaway,ofcourse.Theywerejustalotmorestealthy,
saidKevinMandia,aformerAirForceintelligenceofficerwhospentmostofhisdays
fightingoffRussiancyberattacksbeforefoundingMandiant,acybersecurityfirm
thatisnowadivisionofFireEyeandthecompanytheClintoncampaignbrought
intosecureitsownsystems.
TheRussianswerealsoquickertoturntheirattackstopoliticalpurposes.A
2007cyberattackonEstonia,aformerSovietrepublicthathadjoinedNATO,senta
messagethatRussiacouldparalyzethecountrywithoutinvadingit.Thenextyear
cyberwasusedduringRussiaswarwithGeorgia.
ButAmericanofficialsdidnotimaginethattheRussianswoulddaretrythose
techniquesinsidetheUnitedStates.Theywerelargelyfocusedonpreventingwhat
formerDefenseSecretaryLeonE.PanettawarnedwasanapproachingcyberPearl
Harborashutdownofthepowergridorcellphonenetworks.
Butin2014and2015,aRussianhackinggroupbegansystematicallytargeting
theStateDepartment,theWhiteHouseandtheJointChiefsofStaff.Eachtime,
theyeventuallymetwithsomeformofsuccess,MichaelSulmeyer,aformer
cyberexpertforthesecretaryofdefense,andBenBuchanan,nowbothofthe
HarvardCyberSecurityProject,wroterecentlyinasoontobepublishedpaperfor
theCarnegieEndowment.
TheRussiansgrewstealthierandstealthier,trickinggovernmentcomputers
intosendingoutdatawhiledisguisingtheelectroniccommandandcontrol
messagesthatsetoffalarmsforanyonelookingformaliciousactions.TheState
Departmentwassocrippledthatitrepeatedlycloseditssystemstothrowoutthe
intruders.Atonepoint,officialstravelingtoViennawithSecretaryofStateJohn
KerryfortheIrannuclearnegotiationshadtosetupcommercialGmailaccountsjust
tocommunicatewithoneanotherandwithreporterstravelingwiththem.
Mr.Obamawasbriefedregularlyonallthis,buthemadeadecisionthatmany
intheWhiteHousenowregret:HedidnotnameRussianspublicly,orissue

sanctions.Therewasalwaysareason:fearofescalatingacyberwar,andconcernthat
theUnitedStatesneededRussiascooperationinnegotiationsoverSyria.
Wedhaveallthesecircularmeetings,oneseniorStateDepartmentofficial
said,inwhicheveryoneagreedyouhadtopushbackattheRussiansandpushback
hard.Butitdidnthappen.
SotheRussiansescalatedagainbreakingintosystemsnotjustforespionage,
buttopublishorbroadcastwhattheyfound,knownasdoxinginthecyberworld.
Itwasabrazenchangeintactics,movingtheRussiansfromespionageto
influenceoperations.InFebruary2014,theybroadcastaninterceptedphonecall
betweenVictoriaNuland,theassistantsecretaryofstatewhohandlesRussianaffairs
andhasacontentiousrelationshipwithMr.Putin,andGeoffreyPyatt,theUnited
StatesambassadortoUkraine.Ms.Nulandwashearddescribingalittleknown
AmericanefforttobrokeradealinUkraine,theninpoliticalturmoil.
TheywerenottheonlyonesonwhomtheRussiansusedthestealandleak
strategy.TheOpenSocietyFoundation,runbyGeorgeSoros,wasamajortarget,
andwhenitsdocumentswerereleased,someturnedouttohavebeenalteredto
makeitappearasifthefoundationwasfinancingRussianoppositionmembers.
Lastyear,theattacksbecamemoreaggressive.RussiahackedamajorFrench
televisionstation,fryingcriticalhardware.AroundChristmas,itattackedpartofthe
powergridinUkraine,droppingaportionofthecountryintodarkness,killing
backupgeneratorsandtakingcontrolofgenerators.Inretrospect,itwasawarning
shot.
Theattackswerenotfullyintegratedmilitaryoperations,Mr.Sulmeyersaid.
Buttheyshowedanincreasingboldness.

CozyBearandFancyBear
ThedaybeforetheWhiteHouseCorrespondentsAssociationdinnerinApril,Ms.
Dacey,theD.N.C.schiefexecutive,waspreparingforanightofpartieswhenshegot
anurgentphonecall.

Withthenewmonitoringsysteminplace,Mr.Tamenehadexamined
administrativelogsoftheD.N.C.scomputersystemandfoundsomethingvery
suspicious:Anunauthorizedperson,withadministratorlevelsecuritystatus,had
gainedaccesstotheD.N.C.scomputers.
NotsureitisrelatedtowhattheF.B.I.hasbeennoticing,saidoneinternal
D.N.C.emailsentonApril29.TheD.N.C.mayhavebeenhackedinaseriousway
thisweek,withpasswordtheft,etc.
Nooneknewjusthowbadthebreachwasbutitwasclearthatalotmorethan
asinglefilingcabinetworthofmaterialsmighthavebeentaken.Asecretcommittee
wasimmediatelycreated,includingMs.Dacey,Ms.WassermanSchultz,Mr.Brown
andMichaelSussmann,aformercybercrimesprosecutorattheDepartmentof
JusticewhonowworksatPerkinsCoie,theWashingtonlawfirmthathandles
D.N.C.politicalmatters.
Threemostimportantquestions,Mr.Sussmannwrotetohisclientsthenight
thebreakinwasconfirmed.1)Whatdatawasaccessed?2)Howwasitdone?3)
Howdowestopit?
Mr.SussmanninstructedhisclientsnottouseD.N.C.emailbecausetheyhad
justoneopportunitytolockthehackersoutaneffortthatcouldbefoiledifthe
hackersknewthattheD.N.C.wasontothem.
Youonlygetonechancetoraisethedrawbridge,Mr.Sussmannsaid.Ifthe
adversariesknowyouareawareoftheirpresence,theywilltakestepstoburrowin,
orerasethelogsthatshowtheywerepresent.
TheD.N.C.immediatelyhiredCrowdStrike,acybersecurityfirm,toscanits
computers,identifytheintrudersandbuildanewcomputerandtelephonesystem
fromscratch.Withinaday,CrowdStrikeconfirmedthattheintrusionhadoriginated
inRussia,Mr.Sussmannsaid.
Theworkthatsuchcompaniesdoisacomputerversionofoldfashionedcrime
sceneinvestigation,withfingerprints,bulletcasingsandDNAswabsreplacedbyan
electronictrailthatcanbejustasincriminating.Andjustaspolicedetectiveslearn

toidentifythetelltalemethodsofaveteranburglar,soCrowdStrikeinvestigators
recognizedthedistinctivehandiworkofCozyBearandFancyBear.
ThoseareCrowdStrikesnicknamesforthetwoRussianhackinggroupsthatthe
firmfoundatworkinsidetheD.N.C.network.CozyBearthegroupalsoknownas
theDukesorA.P.T.29,foradvancedpersistentthreatmayormaynotbe
associatedwiththeF.S.B.,themainsuccessortotheSovieteraK.G.B.,butitis
widelybelievedtobeaRussiangovernmentoperation.Itmadeitsfirstappearance
in2014,saidDmitriAlperovitch,CrowdStrikescofounderandchieftechnology
officer.
ItwasCozyBear,CrowdStrikeconcluded,thatfirstpenetratedtheD.N.C.inthe
summerof2015,bysendingspearphishingemailstoalonglistofAmerican
governmentagencies,Washingtonnonprofitsandgovernmentcontractors.
Wheneversomeoneclickedonaphishingmessage,theRussianswouldenterthe
network,exfiltratedocumentsofinterestandstockpilethemforintelligence
purposes.
OncetheygotintotheD.N.C.,theyfoundthedatavaluableanddecidedto
continuetheoperation,saidMr.Alperovitch,whowasborninRussiaandmovedto
theUnitedStatesasateenager.
OnlyinMarch2016didFancyBearshowupfirstpenetratingthecomputers
oftheDemocraticCongressionalCampaignCommittee,andthenjumpingtothe
D.N.C.,investigatorsbelieve.FancyBear,sometimescalledA.P.T.28andbelievedto
bedirectedbytheG.R.U.,Russiasmilitaryintelligenceagency,isanolderoutfit,
trackedbyWesterninvestigatorsfornearlyadecade.ItwasFancyBearthatgothold
ofMr.Podestasemail.
Attribution,astheskillofidentifyingacyberattackerisknown,ismoreartthan
science.Itisoftenimpossibletonameanattackerwithabsolutecertainty.Butover
time,byaccumulatingareferencelibraryofhackingtechniquesandtargets,itis
possibletospotrepeatoffenders.FancyBear,forinstance,hasgoneaftermilitary
andpoliticaltargetsinUkraineandGeorgia,andatNATOinstallations.

Thatlargelyrulesoutcybercriminalsandmostcountries,Mr.Alperovitchsaid.
Theresnoplausibleactorthathasaninterestinallthosevictimsotherthan
Russia,hesaid.Anotherclue:TheRussianhackinggroupstendedtobeactive
duringworkinghoursintheMoscowtimezone.
Totheirastonishment,Mr.Alperovitchsaid,CrowdStrikeexpertsfoundsigns
thatthetwoRussianhackinggroupshadnotcoordinatedtheirattacks.FancyBear,
apparentlynotknowingthatCozyBearhadbeenrummaginginD.N.C.filesfor
months,tookmanyofthesamedocuments.
InthesixweeksafterCrowdStrikesarrival,intotalsecrecy,thecomputer
systemattheD.N.C.wasreplaced.Foraweekend,emailandphoneswereshutoff
employeesweretolditwasasystemupgrade.Alllaptopswereturnedinandthe
harddriveswipedclean,withtheuninfectedinformationonthemimagedtonew
drives.
ThoughD.N.C.officialshadlearnedthattheDemocraticCongressional
CampaignCommitteehadbeeninfected,too,theydidnotnotifytheirsister
organization,whichwasinthesamebuilding,becausetheywereafraidthatitwould
leak.
AllofthisworktookplaceasthebittercontestfortheDemocraticnomination
continuedtoplayoutbetweenMrs.ClintonandMr.Sanders,anditwasalready
causingamajordistractionforMs.WassermanSchultzandtheD.N.C.schief
executive.
Thiswasnotabumpintheroadbumpsintheroadhappenallthetime,she
saidinaninterview.TwodifferentRussianspyagencieshadhackedintoour
networkandstolenourproperty.Andwedidnotyetknowwhattheyhadtaken.But
weknewtheyhadverybroadaccesstoournetwork.Therewasatremendous
amountofuncertainty.Anditwaschilling.
TheD.N.C.executivesandtheirlawyerhadtheirfirstformalmeetingwith
seniorF.B.I.officialsinmidJune,ninemonthsafterthebureausfirstcalltothe
techsupportcontractor.Amongtheearlyrequestsatthatmeeting,accordingto
participants:thatthefederalgovernmentmakeaquickattributionformally

blamingactorswithtiestoRussiangovernmentfortheattacktomakeclearthatit
wasnotroutinehackingbutforeignespionage.
Youhaveapresidentialelectionunderwayhereandyouknowthatthe
RussianshavehackedintotheD.N.C.,Mr.Sussmannsaid,recallingthemessageto
theF.B.I.WeneedtotelltheAmericanpublicthat.Andsoon.

TheMediasRole
InmidJune,onMr.Sussmannsadvice,D.N.C.leadersdecidedtotakeaboldstep.
Concernedthatwordofthehackingmightleak,theydecidedtogopublicinThe
WashingtonPostwiththenewsthatthecommitteehadbeenattacked.Thatway,
theyfigured,theycouldgetaheadofthestory,winalittlesympathyfromvotersfor
beingvictimizedbyRussianhackersandrefocusonthecampaign.
Buttheverynextday,anew,deeplyunsettlingshockawaitedthem.Someone
callinghimselfGuccifer2.0appearedontheweb,claimingtobetheD.N.C.hacker
andhepostedaconfidentialcommitteedocumentdetailingMr.Trumpsrecordand
halfadozenotherdocumentstoprovehisbonafides.
#Guccifer2#DNCsservershackedbyalone
hacker.#Trumpreporthttps://t.co/5fsKlkVouD
pic.twitter.com/AMIRp5sf2e
GUCCIFER 2.0 (@GUCCIFER_2)
June 20, 2016

AnditsjustatinypartofalldocsIdownloadedfromtheDemocrats
networks,hewrote.Thensomethingmoreominous:Themainpartofthepapers,
thousandsoffilesandmails,IgavetoWikiLeaks.Theywillpublishthemsoon.
ItwasbadenoughthatRussianhackershadbeenspyinginsidethecommittees
networkformonths.Nowthepublicreleaseofdocumentshadturnedaconventional
espionageoperationintosomethingfarmoremenacing:politicalsabotage,an
unpredictable,uncontrollablemenaceforDemocraticcampaigns.

Guccifer2.0borrowedthemonikerofanearlierhacker,aRomanianwhocalled
himselfGucciferandwasjailedforbreakingintothepersonalcomputersofformer
PresidentGeorgeW.Bush,formerSecretaryofStateColinL.Powellandother
notables.ThisnewattackerseemedintentonshowingthattheD.N.C.scyberexperts
atCrowdStrikewerewrongtoblameRussia.Guccifer2.0calledhimselfalone
hackerandmockedCrowdStrikeforcallingtheattackerssophisticated.
Butonlineinvestigatorsquicklyundercuthisstory.Onawhim,Lorenzo
FranceschiBicchierai,awriterforMotherboard,thetechandculturesiteofVice,
triedtocontactGuccifer2.0bydirectmessageonTwitter.
Surprisingly,heansweredrightaway,Mr.FranceschiBicchieraisaid.But
whoeverwasontheotherendseemedtobemockinghim.Iaskedhimwhyhedid
it,andhesaidhewantedtoexposetheIlluminati.HecalledhimselfaGuccilover.
AndhesaidhewasRomanian.
ThatgaveMr.FranceschiBicchieraianidea.UsingGoogleTranslate,hesent
thepurportedhackersomequestionsinRomanian.Theanswerscamebackin
Romanian.Butwhenhewasoffline,Mr.FranceschiBicchieraicheckedwitha
coupleofnativespeakers,whotoldhimGuccifer2.0hadapparentlybeenusing
GoogleTranslateaswellandwasclearlynottheRomanianheclaimedtobe.
CyberresearchersfoundothercluespointingtoRussia.MicrosoftWord
documentspostedbyGuccifer2.0hadbeeneditedbysomeonecallinghimself,in
Russian,FelixEdmundovichanobviousnomdeguerrehonoringthefounderof
theSovietsecretpolice,FelixEdmundovichDzerzhinsky.Badlinksinthetextswere
markedbywarningsinRussian,generatedbywhatwasclearlyaRussianlanguage
versionofWord.
WhenMr.FranceschiBicchieraimanagedtoengageGuccifer2.0overaperiod
ofweeks,hefoundthathisinterlocutorstoneandmannerchanged.Atfirsthewas
carelessandcolloquial.Weekslater,hewascurtandmorecalculating,hesaid.It
seemedlikeagroupofpeople,andaverysloppyattempttocoverup.
ComputerexpertsdrewthesameconclusionaboutDCLeaks.com,asitethat
sprangupinJune,claimingtobetheworkofhacktivistsbutpostingmorestolen

documents.It,too,seemedtobeaclumsyfrontforthesameRussianswhohad
stolenthedocuments.Notably,thewebsitewasregisteredinApril,suggestingthat
theRussianhackingteamplannedwellinadvancetomakepublicwhatitstole.
InadditiontowhatGuccifer2.0publishedonhissite,heprovidedmaterial
directlyonrequesttosomebloggersandpublications.ThesteadyflowofGuccifer
2.0documentsconstantlyundercutDemocraticmessagingefforts.OnJuly6,12
daysbeforetheRepublicanNationalConventionbeganinCleveland,Guccifer
releasedtheD.N.C.sbattleplanandbudgetforcounteringit.ForRepublican
operatives,itwasinsidergold.
ThenWikiLeaks,afarmoreestablishedoutlet,begantopublishthehacked
materialjustasGuccifer2.0hadpromised.OnJuly22,threedaysbeforethestart
oftheDemocraticNationalConventioninPhiladelphia,WikiLeaksdumpedout
44,053D.N.C.emailswith17,761attachments.Someofthemessagesmadeclear
thatsomeD.N.C.officialsfavoredMrs.Clintonoverherprogressivechallenger,Mr.
Sanders.
ThatwasnoshockMr.Sanders,afterall,hadbeenanindependentsocialist,
notaDemocrat,duringhislongcareerinCongress,whileMrs.Clintonhadbeenone
ofthepartysstarsfordecades.Buttheemails,someofthemcrudeorinsulting,
infuriatedSandersdelegatesastheyarrivedinPhiladelphia.Ms.WassermanSchultz
resignedunderpressureontheeveoftheconventionwhereshehadplannedto
preside.
Mr.Trump,bynowtheRepublicannominee,expresseddelightatthe
continuingjoltstohisopponent,andhebegantouseTwitterandhisstump
speechestohighlighttheWikiLeaksreleases.OnJuly25,hesentoutalighthearted
tweet:Thenewjokeintown,hewrote,isthatRussialeakedthedisastrousD.N.C.
emails,whichshouldneverhavebeenwritten(stupid),becausePutinlikesme.
ButWikiLeakswasfarfromfinished.OnOct.7,amonthbeforetheelection,the
sitebegantheserialpublicationofthousandsofprivateemailstoandfromMr.
Podesta,Mrs.Clintonscampaignmanager.

Thesameday,theUnitedStatesformallyaccusedtheRussiangovernmentof
beingbehindthehackings,inajointstatementbythedirectorofnational
intelligenceandtheDepartmentofHomelandSecurity,andMr.Trumpsufferedhis
worstblowtodate,withthereleaseofarecordinginwhichhebraggedabout
sexuallyassaultingwomen.
ThePodestaemailswerenowherenearassensationalastheTrumpvideo.But,
releasedbyWikiLeaksdayafterdayoverthelastmonthofthecampaign,they
providedmaterialforcountlessnewsreports.TheydisclosedthecontentsofMrs.
Clintonsspeechestolargebanks,whichshehadrefusedtorelease.Theyexposed
tensionsinsidethecampaign,includingdisagreementsoverdonationstotheClinton
FoundationthatstaffmembersthoughtmightlookbadforthecandidateandMs.
TandenscomplaintthatMrs.Clintonsinstinctsweresuboptimal.
Iwasjustmortified,Ms.Tandensaidinaninterview.Heremailswere
releasedontheeveofoneofthepresidentialdebates,sherecalled.Iputmyhands
overmyheadandsaid,Icantbelievethisishappeningtome.Thoughshehad
regularlyappearedontelevisiontosupportMrs.Clinton,shecanceledher
appearancesbecauseallthequestionswereaboutwhatshehadsaidintheemails.
Ms.Tanden,likeotherDemocratswhosemessagesbecamepublic,saiditwas
obvioustoherthatWikiLeakswastryingitsbesttodamagetheClintoncampaign.
Ifyoucareabouttransparency,youputalltheemailsoutatonce,shesaid.But
theywantedtohurther.Sotheyputthemout1,800to3,000aday.
TheTrumpcampaignknewinadvanceaboutWikiLeaksplans.Daysbeforethe
Podestaemailreleasebegan,RogerStone,aRepublicanoperativeworkingwiththe
Trumpcampaign,sentoutanexcitedtweetaboutwhatwascoming.
Wednesday@HillaryClintonisdone.#Wikileaks.
Roger Stone (@RogerJStoneJr)
Oct. 2, 2016

Butinaninterview,Mr.Stonesaidhehadnoroleintheleakshehadjustheard
fromanAmericanwithtiestoWikiLeaksthatdamningemailswerecoming.

JulianAssange,theWikiLeaksfounderandeditor,hasresistedtheconclusion
thathissitebecameapassthroughforRussianhackersworkingforMr.Putins
governmentorthathewasdeliberatelytryingtoundermineMrs.Clintons
candidacy.Buttheevidenceonbothcountsappearscompelling.
Inaseriesofemailexchanges,Mr.Assangerefusedtosayanythingabout
WikiLeakssourceforthehackedmaterial.Hedeniedthathehadmadehisanimus
towardMrs.Clintonclearinpublicstatements(False.Butwhatisthis?Junior
high?)orthatthesitehadtimedthereleasesformaximumnegativeeffectonher
campaign.WikiLeaksmakesitsdecisionsbasedonnewsworthiness,includingfor
itsrecentepicscoops,hewrote.
Mr.AssangedisputedtheconclusionoftheOct.7statementfromthe
intelligenceagenciesthattheleakswereintendedtointerferewiththeU.S.election
process.
Thisisfalse,hewrote.Asthedisclosingpartyweknowthatthiswasnotthe
intent.Publisherspublishingnewsworthyinformationduringanelectionispartofa
freeelection.
ButaskedwhetherhebelievedtheleakswereonereasonforMr.Trumps
election,Mr.Assangeseemedhappytotakecredit.Americansextensivelyengaged
withourpublications,hewrote.AccordingtoFacebookstatisticsWikiLeakswas
themostreferencedpoliticaltopicduringOctober.
ThoughMr.Assangedidnotsayso,WikiLeaksbestdefensemaybetheconduct
ofthemainstreamAmericanmedia.Everymajorpublication,includingTheTimes,
publishedmultiplestoriescitingtheD.N.C.andPodestaemailspostedby
WikiLeaks,becomingadefactoinstrumentofRussianintelligence.
Mr.Putin,astudentofmartialarts,hadturnedtwoinstitutionsatthecoreof
Americandemocracypoliticalcampaignsandindependentmediatohisown
ends.Themediasappetiteforthehackedmaterial,anditsfocusonthegossipy
contentinsteadoftheRussiansource,disturbedsomeofthosewhosepersonal
emailswerebeingrepostedacrosstheweb.

Whatwasreallysurprisingtome?Ms.Tandensaid.Icouldnotbelievethat
reporterswerecoveringit.

DevisingaGovernmentResponse
InsidetheWhiteHouse,asMr.Obamasadvisersdebatedtheirresponse,their
conversationturnedtoNorthKorea.
Inlate2014,hackersworkingforKimJongun,theNorthsyoungand
unpredictableleader,hadcarriedoutawellplannedattackonSonyPictures
EntertainmentintendedtostoptheChristmastimereleaseofacomedyabouta
C.I.A.plottokillMr.Kim.
Inthatcase,embarrassingemailshadalsobeenreleased.Buttherealdamage
wasdonetoSonysownsystems:Morethan70percentofitscomputersmelted
downwhenaparticularlyvirulentformofmalwarewasreleased.Withinweeks,
intelligenceagenciestracedtheattackbacktotheNorthanditsleadership.Mr.
ObamacalledNorthKoreaoutinpublic,andissuedsomenotveryeffective
sanctions.TheChineseevencooperated,brieflycuttingofftheNorthsinternet
connections.
AsthefirstSituationRoommeetingsontheRussianhackingbeganinJuly,it
wasclearthatRussiawasgoingtobeamuchmorecomplicatedcase,saidone
participant.TheRussiansclearlyhadamoresophisticatedunderstandingof
Americanpolitics,andtheyweremastersofkompromat,theirtermfor
compromisinginformation.
Butaformalattributionreportstillhadnotbeenforwardedtothepresident.
Ittookforever,onesenioradministrationofficialsaid,complainingaboutthe
paceatwhichtheintelligenceassessmentsmovedthroughthesystem.
InAugustagroupthatcalleditselftheShadowBrokerspublishedasetof
softwaretoolsthatlookedlikewhattheN.S.A.usestobreakintoforeigncomputer
networksandinstallimplants,malwarethatcanbeusedforsurveillanceorattack.

ThecodecamefromtheTailoredAccessOperationsunitoftheN.S.A.,asecretive
groupthatmasteredtheartsofsurveillanceandcyberwar.
Theassumptionstillunprovedwasthatthecodewasputoutintheopenby
theRussiansasawarning:RetaliatefortheD.N.C.,andtherearealotmoresecrets,
fromthehackingsoftheStateDepartment,theWhiteHouseandthePentagon,that
mightbespilledaswell.OneseniorofficialcomparedittothesceneinThe
Godfatherwheretheheadofafavoritehorseisleftinabed,asawarning.
TheN.S.A.saidnothing.ButbylateAugust,AdmiralRogers,itsdirector,was
pressingforamoremuscularresponsetotheRussians.Inhisroleasdirectorofthe
PentagonsCyberCommand,heproposedaseriesofpotentialcountercyberstrikes.
Whileofficialswillnotdiscussthemindetail,thepossiblecounterstrikes
reportedlyincludedoperationsthatwouldturnthetablesonMr.Putin,exposinghis
financiallinkstoRussiasoligarchs,andpunchingholesintheRussianinternetto
allowdissidentstogettheirmessageout.Pentagonofficialsjudgedthemeasurestoo
unsubtleandordereduptheirownsetofoptions.
Butintheend,noneofthosewereformallypresentedtothepresident.
InaseriesofdeputiesmeetingsrunbyAvrilHaines,thedeputynational
securityadviserandaformerdeputydirectoroftheC.I.A.,severalofficialswarned
thatanoverreactionbytheadministrationwouldplayintoMr.Putinshands.
IfwewenttoDefcon4,onefrequentparticipantinMs.Hainessmeetings
said,usingaphrasefromtheColdWardaysofwarningsofwar,wewouldbesaying
tothepublicthatwedidnthaveconfidenceintheintegrityofourvotingsystem.
Evensomethingseeminglystraightforwardusingthepresidentsexecutive
powers,bolsteredaftertheSonyincident,toplaceeconomicandtravelsanctionson
cyberattackersseemedtoorisky.
NoonewasallthateagertoimposecostsbeforeElectionDay,saidanother
participantintheclassifiedmeeting.Anyretaliatorymeasureswereseenthrough
theprismofwhatwouldhappenonElectionDay.

Instead,whenMr.Obamasnationalsecurityteamreconvenedaftersummer
vacation,thefocusturnedtoacrashefforttosecurethenationsvotingmachines
andvoterregistrationrollsfromhacking.Thescenariotheydiscussedmost
frequentlyonethatturnedoutnottobeanissuewasanarrowvoteinfavorof
Mrs.Clinton,followedbyadeclarationbyMr.Trumpthatthevotewasriggedand
moreleaksintendedtoundercutherlegitimacy.
DonnaBrazile,theinterimchairwomanoftheD.N.C.,becameincreasingly
frustratedastheclockcontinuedtorundownonthepresidentialelectionandstill
therewasnobroadpubliccondemnationbytheWhiteHouse,orRepublicanParty
leaders,oftheattackasanactofforeignespionage.
Ms.BrazileevenreachedouttoReincePriebus,thechairmanoftheRepublican
NationalCommittee,urginghimtwiceinprivateconversationsandinalettertojoin
herincondemningtheattacksanofferhedeclinedtotakeup.
Wejustkepthearingthegovernmentwouldrespond,thegovernmentwould
respond,shesaid.Onceuponatime,ifaforeigngovernmentinterferedwithour
electionwewouldrespondasanation,notasapoliticalparty.
ButMr.ObamadiddecidethathewoulddeliverawarningtoMr.Putinin
personataGroupof20summitmeetinginHangzhou,China,thelasttimethey
wouldbeinthesameplacewhileMr.Obamawasstillinoffice.Whenthetwomen
metforatensepullaside,inwhichWhiteHouseofficialswhowerenotpresent
fortheoneononemeetingsayMr.ObamaexplicitlywarnedMr.Putinofastrong
Americanresponseiftherewascontinuedefforttoinfluencetheelectionor
manipulatethevote.
Laterthatday,Mr.ObamamadeararereferencetoAmericasownoffensive
cybercapacity,whichhehasalmostnevertalkedabout.Frankly,bothoffensively
anddefensively,wehavemorecapacity,hetoldreporters.
ButwhenitcametimetomakeapublicassertionofRussiasroleinearly
October,itwasmadeinawrittenstatementfromthedirectorofnationalintelligence
andthesecretaryofhomelandsecurity.Itwasfarlessdramaticthanthepresidents

appearanceinthepressroomtwoyearsbeforetodirectlyaccusetheNorthKoreans
ofattackingSony.
Thereferenceinthestatementtohackingsonpoliticalorganizations,officials
nowsay,encompassedahackingondatastoredbytheRepublicansaswell.Two
seniorofficialssaytheforensicevidencewasaccompaniedbyhumanandtechnical
sourcesinRussia,whichappearstomeanthattheUnitedStatesimplantsortapsin
Russiancomputerandphonenetworkshelpedconfirmthecountrysrole.
Butthatmaynotbeknownfordecades,untilthesecretsaredeclassified.
AweeklaterVicePresidentJosephR.BidenJr.wassentouttotransmita
publicwarningtoMr.Putin:TheUnitedStateswillretaliateatthetimeofour
choosing.Andunderthecircumstancesthathavethegreatestimpact.
Later,afterMr.BidensaidhewasnotconcernedthatRussiacould
fundamentallyaltertheelection,hewasaskedwhethertheAmericanpublicwould
knowifthemessagetoMr.Putinhadbeensent.
Hopenot,Mr.Bidenresponded.
Someofhisformercolleaguesthinkthatwasthewronganswer.AnAmerican
counterstrike,saidMichaelMorell,theformerdeputydirectoroftheC.I.A.under
Mr.Obama,hasgottobeovert.Itneedstobeseen.
Acovertresponsewouldsignificantlylimitthedeterrenceeffect,headded.If
youcantseeit,itsnotgoingtodetertheChineseandNorthKoreansandIranians
andothers.
TheObamaadministrationsaysitstillhasmorethan30daystodoexactlythat.

TheNextTarget
Astheyeardrawstoaclose,itnowseemspossiblethattherewillbemultiple
investigationsoftheRussianhackingtheintelligencereviewMr.Obamahas
orderedcompletedbyJan.20,thedayheleavesoffice,andoneormore

congressionalinquiries.Theywillwrestlewith,amongotherthings,Mr.Putins
motive.
DidheseektomarthebrandofAmericandemocracy,toforestallantiRussian
activismforbothRussiansandtheirneighbors?OrtoweakenthenextAmerican
president,sincepresumablyMr.PutinhadnoreasontodoubtAmericanforecasts
thatMrs.Clintonwouldwineasily?Orwasit,astheC.I.A.concludedlastmonth,a
deliberateattempttoelectMr.Trump?
Infact,theRussianhackanddoxschemeaccomplishedallthreegoals.
WhatseemsclearisthatRussianhacking,givenitssuccess,isnotgoingtostop.
Twoweeksago,theGermanintelligencechief,BrunoKahl,warnedthatRussia
mighttargetelectionsinGermanynextyear.Theperpetratorshaveaninterestto
delegitimizethedemocraticprocessassuch,Mr.Kahlsaid.Now,headded,Europe
isinthefocusoftheseattemptsofdisturbance,andGermanytoaparticularlygreat
extent.
ButRussiascyberczarshavebynomeansforgottentheAmericantarget.Onthe
dayafterthepresidentialelection,thecybersecuritycompanyVolexityreportedfive
newwavesofphishingemails,evidentlyfromCozyBear,aimedatthinktanksand
nonprofitsintheUnitedStates.
OneofthempurportedtobefromHarvardUniversity,attachingafakepaper.
Itstitle:WhyAmericanElectionsAreFlawed.
KittyBennettcontributedresearch.
GetpoliticsandWashingtonnewsupdatesviaFacebook,TwitterandintheMorning
Briefingnewsletter.

2016TheNewYorkTimesCompany