Timeline: DARPA and the DNC Hack

Upon whose analysis did the government rely when it blamed Russia for hacks of Democratic Party emails?

The story just published today on Racket, “Forget Collusion. Was "Interference" Also Fake News?,” adds new information to the public’s understanding of Russiagate. Because the significance of certain documents is tied to dates, and many details have begun to fade from public memory, artist Daniel Medina put together a visual timeline to explain the overall chronology.

This first panel above is comprised of news already known to the public, but there are a few items of note. For one, the DNC reported detection of “unusual activity” on April 30th, but didn’t commence a “remediation event” until over five weeks later, on June 10th.

There’s also a quirk in connection to the June 14th announcement by Democrats and their reseaarchers that Russians had not only “penetrated the computer network of the Democratic National Committee,” but “gained access to the entire database of opposition research on GOP presidential candidate Donald Trump” (the Washington Post used the term, “stole”). Much later, Crowdstrike president Shawn Henry testified to congress about DNC emails that the company lacked “evidence that they were actually exfiltrated. There’s circumstantial evidence, but no evidence that they were actually exfiltrated.”

Despite Henry testifying that “we just don’t have the evidence that says it actually left,” the DNC made its big “The Russians took our data!” announcement on June 14th. This was a day before the Guccifer 2.0 persona began publishing leak material, including Trump oppo research. If they didn’t have evidence anything was “actually exfiltrated,” what exactly was the basis for that Post story?

The next panel shows researchers David Dagon and Manos Antonakakis were looking at the origins of the DNC hack during the same time period that they were working with Neustar executive Rodney Joffe on the ill-fated effort to show a connection between Donald Trump and Russia’s Alfa Bank. This is only certain now because Senator Chuck Grassley was able to elicit an admission from the Pentagon’s Defense Advanced Research Projects Agency, or DARPA, that these researchers produced a “Fancy Bear/APT28 Attribution analysis” on August 7, 2016, roughly the same time frame as the Alfa fiasco.

The Department of Homeland Security announced on October 7th that “the recent disclosures of alleged hacked e-mails on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent with the methods and motivations of Russian-directed efforts.”

The language about the hacks being “consistent” with the “methods and motivations” of “Russian-directed efforts” (Russian-directed?) is oddly weak beer, and came during the same time frame when the story was being hawked to Slate dope Franklin Foer. Emails from Clinton lawyer Michael Sussmann to the FBI on October 13th, meanwhile, show federal law enforcement still did not have data from Crowdstrike when the October 7th announcement was made. More to come.