The evidence has been released by both Crowdstrike and FireEye. They both have fairly detailed writeups of them. Attribution is an important part of computer security. FireEye has a similar reputation for attribution and forensics as Kaspersky.
It is extremely difficult, maybe impossible, to completely conceal one's pivots, implants, and exfiltration in a computer network. True, it is possible that an attacker that is more capable than GRU/Cozy Bear and FSB/Fancy Bear did just that and exfiltrated the emails and documents. But this is going beyond what the evidence suggests.
The white house has used classified reports to publicly justify a conclusion that isn't in the original reports. WMDs in Iraq is a perfect example of this. They did this with Hillary's emails too.
For all we know the evidence is nothing but a Russian IP address in an access log.
> In the meantime, the hackers moved on to targets outside the D.N.C., including Mrs. Clinton’s campaign chairman, John D. Podesta, whose private email account was hacked months later.
> Even Mr. Podesta, a savvy Washington insider who had written a 2014 report on cyberprivacy for President Obama, did not truly understand the gravity of the hacking.
This is the first I'm hearing of any ties to Podesta's emails and Russians. If anything, I always assumed that particular attack was some teenager in Tennessee[0].
In this case the CIA & co absolutely need to publish all the evidence they have linking Russia to the intrusions. The evidence they are claiming could be anything from something as tenuous as "превед"[1] in a log file to something as concrete as a CIA mole participating in the attacks from within the walls of the Kremlin. Right now we the people are being bombarded from all sides with 100% unhelpful bullshit.
[0] https://en.wikipedia.org/wiki/Sarah_Palin_email_hack
[1] https://en.wikipedia.org/wiki/Preved