I think I did a good job of laying out the core hypotheses last time, save two: the Iranian government or a disgruntled Democrat did it. I think I can pick them up on-the-fly, so let’s skip ahead to step 2.
The Priors
What’s the prior odds of the Kremlin hacking into the DNC and associated groups or people?
I’d say they’re pretty high. Right back to the Bolshevik revolution, Russian spy agencies have taken an interest in running disinformation campaigns. They have a word for gathering compromising information to blackmail people into doing their bidding, “kompromat.” Putin himself earned a favourable place in Boris Yeltsin’s government via some kompromat of one of Yeltsin’s opponents.
As for hacking elections, European intelligence agencies have also fingered Russia for using kompromat to interfere with elections in Germany, the Netherlands, Hungary, Georgia, and Ukraine.
That’s all well and good, but what about other actors? China also has sophisticated information warfare capabilities, but they seem more interested in trade secrets and tend to keep their discoveries under wraps. North Korea is a lot more splashy, but recently have focused on financial crimes. The Iranian government has apparently stepped up their online attack capabilities, and have a grudge against the USA, but apparently focus on infrastructure and disruption.
The DNC convention was rather contentious, with fans of Bernie Sanders bitter at how it turned out, and putting Trump in power had been preferred to voting for Clinton, for some, but it doesn’t fit the timeline: the DNC was suspicious of an attack in April, documents were leaked in June, but Sanders still had a chance of winning the nomination until the end of July.
An independent group is the real wild card, with any number of motivations and due to their lack of power eager to make it look like someone else did the deed.
What about the CIA or NSA? The latter claims to be just a passive listener, and I haven’t heard of anyone claiming otherwise. The CIA has a long history of interfering in other countries’ elections; in 1990’s Nicaragua, they even released documents to the media in order to smear a candidate they didn’t like. It’s one thing to muck around with other countries, however, as it’ll be nearly impossible for them to extradite you over for a proper trial. Muck around in your own country’s election, and there’s no shortage of reporters and prosecutors willing to go after you.
Where does all this get us? I’d say to a tier of prior likelihoods:
- “The Kremlin did it” (A) and “Independent hackers did it” (D) have about the same prior.
- “China,” (B) “North Korea,” (C) “Iran,” (H) and “the CIA” (E) are less likely than the prior two.
- “the NSA” (F) and “disgruntled insider” (I) is less likely still.
- And c’mon, I’m not nearly good enough to pull this off. (G)
The Evidence
I haven’t placed quantities to the priors, because the evidence side of things is pretty damning. Let’s take a specific example: the Cyrillic character set found in some of the leaked documents. We can both agree that this can be faked: switch around the keyboard layout, plant a few false names, and you’re done. Do it flawlessly and no-one will know otherwise.
But here’s the kicker: is there another hypothesis which is more likely than “the Kremlin did it,” on this bit of evidence? To focus on a specific case, is it more likely that an independent hacking group would leave Cyrillic characters and error messages in those documents than Russian hackers? This seems silly; an independent group could leave a false trail pointing to anyone, which dilutes the odds of them pointing the finger at a specific someone. Even if the independent group had a bias towards putting the blame on Russia, there’s still a chance they could finger someone else.
Put another way, a die numbered one through six could turn up a one when thrown, but a die with only ones on each face would be more likely to turn up a one. A one is always more likely from the second die. By the same token, even though it’s entirely plausible that an independent hacking group would switch their character sets, the evidence still provides better proof of Russian hacking.
What does evidence that points away from the Kremlin look like?
President Vladimir Putin says the Russian state has never been involved in hacking.
Speaking at a meeting with senior editors of leading international news agencies Thursday, Putin said that some individual “patriotic” hackers could mount some attacks amid the current cold spell in Russia’s relations with the West.
But he categorically insisted that “we don’t engage in that at the state level.”
Is this great evidence? Hell no, it’s entirely possible Putin is lying, and given the history of KGB and FSB it’s probable. But all that does is blunt the magnitude of the likelihoods, it doesn’t change their direction. By the same token, this ….
Intelligence agency leaders repeated their determination Thursday that only “the senior most officials” in Russia could have authorized recent hacks into Democratic National Committee and Clinton officials’ emails during the presidential election.Director of National Intelligence James Clapper affirmed an Oct. 7 joint statement from 17 intelligence agencies that the Russian government directed the election interference…
…. counts as evidence in favour of the Kremlin being the culprit, even if you think James Clapper is a dirty rotten liar. Again, we can quibble over how much it shifts the balance, but no other hypothesis is more favoured by it.
We can carry on like this through a lot of the other evidence.
- Crowdstrike, hired by the DNC to check for an intrusion, fingered the Kremlin. One line of evidence mentioned is the use of the X-Agent implant, which isn’t in wide circulation and has been used on Russian opponents.
- SecureWorks declares “with moderate confidence that the group” which hacked the DNC “is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government.” A key bit of evidence is the use of a DNS address used to launch spear phishing attacks.
- Researchers at Fidelis Cybersecurity, looking at the same evidence, conclude Russia is the likely actor.
- Researchers at ThreatConnect, looking at the same evidence as Crowdstrike, concur that the Kremlin is likely behind the hack.
- Researchers at Malidant concur that the Kremlin is likely behind the hack, based on malware samples provided to them.
- A US intelligence report states they were helped by British intelligence, which saw the DNC hack well before anyone else did and believed it to be a Kremlin operation. No-one from British intelligence has confirmed or denied this, though one British official claimed the Kremlin was capable of such attacks.
- While they haven’t analysed the evidence behind the DNC hacks, both FireEye and F-Secure believe the actors identified by others are tied to the Kremlin.
- Sean Gallagher, an IT correspondent for Ars Technica, reviews the above public information and concurs that the Kremlin is likely responsible.
- The aforementioned reports from the US intelligence community mentioned “human resources” as being critical in identifying Russian responsibility. The public release of that tid-bit should have triggered a mole search within their intelligence community, had it been accurate, and indeed a number of Russians were later arrested for treason. Some reports state this treason took the form of supplying information to US agencies; the Kremlin denied those reports, but gave no details on the sort of treason.
- Sergei Markov, a political analyst with ties to the Kremlin, denies any Russian attempt to interfere with the election but claimed “maybe we helped a bit with WikiLeaks,” which hosted the hacked emails.
- “Guccifer 2.0,” the hacker claiming responsibility for the DNC hacks, says they aren’t Russian. As hinted at before, some are skeptical.
- Julian Assange says the DNC emails published on Wikileaks did not come from Russia or any other state actor. He may mean they did not come “directly” from those sources, as he’s also stated “these [documents] look very much like they’re from the Russians. But in some ways, they look very amateur, and almost look too much like the Russians.”
- Craig Murray claims that an insider leaked the DNC emails, due to anger of how Bernie Sanders was treated.
- John McAfee, a famed IT security researcher, claims the Iranian government hacked the DNC citing sources on the “dark web.”
- Infowars suggest the CIA staged the DNC hacks in order to hurt Donald Trump. They take their inspiration from Wikileak’s dump of a suite of CIA hacking tools, which the latter hints could be used to launch false flag attacks.
- When asked about Russian meddling in the election, Donald Trump said “I’ll go along with Russia. Could’ve been China, could’ve been a lot of different groups.”
I can’t find anyone who’s suggested North Korea or the NSA did it. The consensus seems to point towards the Kremlin, and while there are scattered bits of evidence pointing elsewhere there isn’t a lot of credibility or analysis attached, and some of it is “anyone but Russia” instead of “group X,” which softens the gains made by other hypotheses.
The net result is that the already-strong priors for “the Kremlin did it” combine with the direction the evidence points in, and favour that hypothesis even more. How strongly it favours that hypothesis depends on how you weight the evidence, but you have to do some wild contortions to put another hypothesis ahead of it. A qualitative analysis is all we need.
Now, to some people this isn’t good enough. I’ve got two objections to deal with, one from Sam Biddle over at The Intercept, and another from Marcus Ranum at stderr. Part three, anyone?