s/presented/investigated
There's a lot of things to investigate https://foreignpolicy.com/2018/12/21/how-russian-money-helpe... but since the whole world saw what happened on the 6th and what did not after I don't think there'll ever be evidences extraordinary enough to act on any kind of claims.
Even tho Euromaidan had US senators in person riling up protesters for regime change [0] and the new interim PM, after a bloody revolution, was sponsored by literally the US DoS and NATO [1].
Pointing this pretty blatant evidence out just gets one called a "Russian troll". While in the US some extremely obscure financial connections to Russia, are allegedly responsible for singlehandedly deciding a whole election and making the following one also a rather close call.
Maybe it's just me, but this seems like a pretty blatant double standard, one that also disfranchises a substantial part of the US population, as allegedly being nothing than "idiots" brainwashed by Russia.
It's no wonder how this kind of narrative keeps increasing the hostility and tribalism, even if Russia wouldn't do anything at all.
[0] https://www.theguardian.com/world/2013/dec/15/john-mccain-uk...
[1] https://web.archive.org/web/20200328203654/https://openukrai...
https://greenwald.substack.com/p/questions-about-the-fbis-ro...
The whole world saw what the FBI wanted them to see on the sixth. Time will tell what actually happened.
>Russians hack DNC
It seems to be rather hard to actually cite this mountain of evidence without looking like a partisan hack.
That said, if you have this “plenty of evidence” please lay it forth at the feet of humanity very clearly. It would be tremendously valuable and conclusive.
In practice we have waving again and again with more hand waving and assurance on top. A heroic confabulation of nonsense.
The Veteran Intelligence Professionals for Sanity has members who have done good work for the public and the country. However, the memo referenced in your link did not even have the backing all the group's members and its arguments have been persuasively criticized.
https://en.wikipedia.org/wiki/Veteran_Intelligence_Professio...
But since you did bring him up, it reminded me that in July 2016, weeks after the DNC announced being breached, he publicly called on Russia to release information about Clinton. Candidate Donald J. Trump, verbally and in writing, called on a foreign government to interfere with the presidential campaign against his opponent; doing it in public doesn't make it okay.
"Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing, I think you will probably be rewarded mightily by our press. Let’s see if that happens. […] By the way, they hacked — they probably have her 33,000 emails. I hope they do. They probably have her 33,000 emails that she lost and deleted because you'd see some beauties there. So let's see."
I don't think "collusion" is the right term for what he did (the attempts to access emails had started in March); I don't know what the right term is, I just know it's not okay.
The Mueller report goes into specific detail or you can listen to the lawfare blog podcast that goes through it.
“Collusion” is a poorly defined term, the report found their actions didn’t rise to the level of criminal conspiracy, but there was plenty of evidence that the campaign was interested in support and responded to it (“collusion”).
Donald Trump Jr. just didn’t realize Russia was interested in getting the Magnitsky act revoked when he took the meeting and he was disappointed when the Russians didn’t have the “emails” (from the private server, not the DNC emails). The Russians thought they could manipulate their self-imposed orphan adoption ban issue, but DTJ didn’t care about orphans.
American intelligence agencies (or any intelligence agency) are not going to provide you with the precise methods they use to determine where the attack came from.
I suspect no evidence will meet your extraordinary standard because you’re only looking for evidence that supports an existing position based primarily on political motivated reasoning and cognitive bias.
Let's s start with even minimal evidence before we get to worrying about my cognitive biases.
Read #8 in this article: https://taibbi.substack.com/p/aaugh-a-brief-list-of-official...
"Shawn Henry of Crowdstrike, testifying in secret to congress, ... saying there was not “concrete evidence that data was exfiltrated from the DNC,”"
For example, in the muller report, a more extensive investigation, the specific hacking unit is identified. Whether or not crowdstrike knew in 2017 doesn't matter. Today we know APT-28 was responsible, and they're members of the GRU.
How exactly did they arrive at that attribution?
> Today we know APT-28 was responsible, and they're members of the GRU.
How do we know that? No offense, but out of all the places I thought at least people on HN should be aware about the massive caveats that modern-day cyber attribution comes with.
The vast majority of times it's just "educated guesses" based on identifiers that any smart adversary will know how to spoof and thus utilize as false leads.
It's something that feels like was generally recognized and agreed on circa a decade ago, but somehow got lost in the flood of sensationalist headlines trying to sell any nmap scan or somewhat noteworthy ransomware infestation as Russia/China/Iran starting cyber world war 3.
> The vast majority of times it's just "educated guesses" based on identifiers that any smart adversary will know how to spoof and thus utilize as false leads.
No, I'd say people on hn often vastly overstate the lengths people are willing to go to to create these false flag attacks. If we believed hn, no attacks are done, every cyber attack is actually spoofed by an even more formidable spy ring.
Sometimes the simplest answer is the right one. The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian.
The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia.
I'm not sure I can think of any attack where someone tried to successfully frame another nation. This doesn't mean they don't happen, but that they're rare. It also means that if they do happen, they're always successful, which seems unlikely. Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating.
Why can't you just spell out the method of attribution, instead requiring me to read trough dozens of, mostly political, reports?
> The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian.
Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public.
That's been the reality of the "cyber theater" for decades: It's asymmetric, there's been more than one example of some lone kid on the spectrum, living in their parents basement, pwning very important and advanced national infrastructure at scale.
That's why I'm very skeptical when a cyber incident is instantly declared as "state level!", usually that's just part of PR and damage control script, along the lines of: "The adversary was a whole nation state, there's nothing we could have done to prevent this from happening!".
Even when the methods deployed are anything but exclusive to nation state actors: Spear-phishing and social engineering are not types of attacks that require nation state resources or knowledge, there's a whole grey market industry offering such attacks as a service.
> The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia.
Why would that be the only alternative? Your alternative assumes that the attribution to the Russian cyber intelligence is a fact beyond doubt.
> I'm not sure I can think of any attack where someone tried to successfully frame another nation.
That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem.
> Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating.
As mentioned before: Nobody needs to impersonate a state cyber attack because by now that's the default assumption not just by media but often enough by those affected themselves to cover up for their own InfoSec negligence.
"We got pwned by the whole Russian intelligence apparatus using massive resources!" sounds much more impressive, and sympathy inducing ,than "We got pwned by some kid from Ukraine because we don't patch our stuff/one of our employees got phished".
So, yes, someone would need to have piggybacked on Russian state controlled servers.
> Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public
Do you work in this field? I've basically only seen lay people suggest this.
> That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem.
Hence my second point: that we've never seen evidence of an unsuccessful attempt, meaning that there's a 100% success rate of spoofing. You're telling me that's realistic? That the spoofers are just so incredibly more competent than everyone else that they never fuck up? That the random Ukrainian kid is so much better at hacking than various state agencies that when he impersonates them he always does it perfectly? That every Ukrainian kid is that competent? Come on.
Your thesis is essentially that state actors are the least competent "cyber actors", because everyone can impersonate them and none of them can tell. That's counter to basically everything else we know.
If you could be more specific, we could address this. However, you cannot, because the allegations are all this vague. If it's the assertion that I think it is, the "command and control servers" were asserted by Crowdstrike to be under Russian control, and its evidence for this, again, were somewhere deep in a rabbit warren of cross- and circular references[1].
> Do you work in this field? I've basically only seen lay people suggest this.
I have seen journalists claim that only lay people suggest this.
To your vague and amorphous allegations of "state actors", I reply with this specific analysis of the few concrete indicators of compromise supplied by the departments of the government making the allegation. It's farcical. If Russiagate were to be true, the Russian hackers are no better than script kiddies, using outdated PHP malware as they do. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hac...
[1] Furthermore, IP addresses change constantly. Again, if you're referring to the assertion I think you are, that IP address had been defunct for over 2 years before the attack See https://www.wordfence.com/blog/2017/01/election-hack-faq/
An IP that was being used by Russian Intelligence today to hack a target may be used by another attacker to hack a different target a few days later. This can happen for several reasons:
- A hacked IP can be used by one attacker and then be compromised by a different attacker later on to also launch attacks.
- IP addresses change ownership from time to time. A Linode IP may be hacked by Russia and used to launch attacks. Then it may be shut down by Linode, change ownership and the new owner’s site can get hacked. Then that IP address is attacking once again, but the attacker is someone else.
- IP addresses are also dynamic if they belong to an internet service provider (ISP). Some of the IP’s in the Grizzly Steppe report do belong to ISP’s. For example we can see IP’s belonging to Yota.ru, a Russian internet service provider. The hostnames are ‘wimax-client.yota.ru’ which suggests that they are wifi customers. These IP’s are probably dynamic and regularly change hands. They may be used by one attacker today and a different attacker tomorrow.
Why do you cite older and less extensive reporting as though it debunks more recent and more thorough investigation?
> Furthermore, IP addresses change constantly
Yes, and if this was the only evidence, you'd maybe have a point. But, the collection of evidence is:
- a russian-state associated IP was used to
- deploy software developed by the Russian government
- to steal data that would be beneficial to Russia if published
- and was ultimately published via channels known to be associated with Russia (I'm not talking strictly WikiLeaks here, but also how they got the data)
Your alternative explanation is what, exactly? A random ukranian group hacking for the lulz successfully stole this info and either did it so well that the us thought it was actually Russia, or the us lied and claimed it was Russia. That lulzy group proceeded to publish the data via russian-appearing channels or Russia then stole the data from the hackers to publish it. And said group never took credit, even though "we tricked the CIA" is about as much cyber hacker cred as you can get.
I apply Occam's razor. What's your excuse?
Keep in mind, I can apply exactly your logic and say that appearing amateurish is good operational practice for a state actor as it will make it more likey for people to claim that the attacker wasn't a state actor. That's the problem with unfalsifiable claims like yours, I can simply invent a better conspiracy, so to speak.
Not an argument or a refutation. A fallacy, in point of fact. Its age has nothing to do with the correctness of its argument.
Have you not read any of the comments above? All of these "more recent and thorough reports" - and again, here, as to which specific reports you're being as vague as the "reports" themselves - are obfuscating, designed to confuse and redirect, at the end of which is always "trust us, here are some other trustworthy reports that say the same thing".
By contrast, the word fence report goes through specific allegations and adresses them point by point. Clear, simple, straightforward. In all of the reports demonstrating that Russians hack the DNC, not one is as clear and straightforward, because it never can be.
Your alternative explanation is what, exactly?
You haven't really refuted anything here, and your reference to Occams Razor should come only after clear logical steps from evidence to conclusion, which you do not have.
I don't know who did it. Which is the point. No one does, and no one can know, given the evidence presented so far.
I can tell you this, though: politically, the content of the emails themselves were deeply embarrassing to the DNC. Collusion with the media, including the Washington Post and the New York Times, to kneecap Sander's campaign; Donna Brazile passing debate questions to Clinton; Clinton's strategy to promote Trump as the easy win, etc.
Now, however, any time anyone discusses the content of the emails, true believers such as yourself will interrupt to talk about how Trump won only because of Russians. It was such a stupidly transparent strategy I was stunned it actually grew legs and walked. Skeptical, but open, I eagerly awaited the evidence which never materialized, sadly.
...us lied and claimed it was Russia. That lulzy group proceeded to publish the data via russian-appearing channels or Russia then stole the data from the hackers to publish it. And said group never took credit, even though "we tricked the CIA" is about as much cyber hacker cred as you can get.
Here you kind of rhetorically descend into incoherence. I get it. You don't want to steel-man alternative ideas, because "Russians" is what you have been told and "Russians" is what you believe. But almost any other explanation is as plausible as Russians.
I listed 4 bullet points. You've agreed with 2 of them (the first, that a russian-state associated IP was used in the hack), and 3, that the data if published would be beneficial to russia (by being beneficial to trump). Those 4 evidence based claims, some of which you've admitted you agree are true, point to a simple answer: Russia was the culprit.
Yes, there are other alternative explanations, but all are vastly more complex, or fail to sufficiently address all of the evidence presented, hence my reference Occam's razor.
> Now, however, any time anyone discusses the content of the emails, true believers such as yourself will interrupt to talk about how Trump won only because of Russians.
I've never said this.
> I get it. You don't want to steel-man alternative ideas, because "Russians" is what you have been told and "Russians" is what you believe. But almost any other explanation is as plausible as Russians.
No, that's my point. That was my steel man. Your argument is incoherent. You're free to prove me wrong. Its easy: provide the alternative explanation that is more likely than it haivng been russia. Provide an explanation that better explains the facts we agree on:
1. A russian state-affiliated IP was used in the attack
2. The data stolen and leaked was geopolitically beneficial to russia.
Looking directly at the evidence, the simplest, and far and away most likely answer, is that Russia was the culprit. Other answers are, perhaps, possible, but that doesn't make them as likely, unless you want to pretend that two explanations of the same phenomena are always equally likely. That's simply a failure to reason correctly, and I'd expect better of someone who wants to bring up fallacies.
Put another way, there's some evidence that supports the claim that it was Russia. There's no evidence that supports the claim that it was the Ukraine. This doesn't mean that it had to be Russia, yes, alternative explanations are possible, but looking solely at the evidence, all of it points to Russia, and none of it points to anyone else.
You can create alternate hypothesis, but they all rely on the evidence being somehow misleading ("The US government is lying", "The Ukranian teenager spoofed a Russian attack"). By Occam's Razor, those explanations are less likely, because they are more complex. You're welcome to present some additional evidence that makes those explanations more likely, but you haven't presented any, you've simply said the evidence we have isn't conclusive (which I agree with), and because of that all possibilities are equally likely, which is terrible reasoning.
An extraordinary claim should have unambiguous, clear, unassailable proof. A skeptic should be able to look at all the evidence and verify it for oneself. One cannot do that with each important assertion. Instead, one must rely on assertions by "persons familiar with the matter".
A flood of circumstantial evidence of dubious provenance, no matter how earnestly believed by the politically motivated, should not be enough to destabilize the Office of US Presidency (no matter how much one finds the holder of the office distasteful) nor make dangerous accusations of foreign nations.
This is a no-brainer. Yet here we are, talking about 2-year old IP addresses as if it were some smoking gun.
Perhaps I'm confused here, what do you believe the facts are? I don't want to misrepresent you, so here are my questions, numbered for easy reference:
1. Was the IP address in the crowdstrike report you cited ever affiliated with the Russian government?
2. Who or what developed the X-Agent software?
3. Do you believe the X-agent software was used in the DNC attack? If not, how do you believe the DNC hacked?
4. Do you believe the data stolen in the DNC hack and later leaked was geopolitically useful to the Russian government? (keep in mind that the Democratic party has recently been far more anti-Russia than the Republican Party, so the evidence I have suggests that Democratic foreign policy would be more aggressive towards Russia than Republican. Obama, Trump, and Biden's actual foreign policy actions, e.g. in Syria, support this hypothesis)
5. Do you believe the account in [0] is reliable? If not, what is your explanation of what occurred, and what evidence do you use to reach your conclusion?
6. Do you believe that this[1] highly redacted senate report is evidence? That is, do you put believe that anything can be inferred from the fact that US intelligence services believe that this attack was undertaken by Russia, and have presented that conclusion (and, presumably, some evidence supporting this conclusion) to the Senate Intelligence Committee? Related does it hold any value to you that no one on the SIC has denied that this hack was Russian-originated (and in fact a number of Repulbican members have agreed that he hack was done by Russian state actors)?
Please note "I don't know" isn't a valid answer to any of these questions, you must have some belief that is most likely, even if none is held with much confidence, please provide that belief.
> An extraordinary claim should have unambiguous, clear, unassailable proof.
My claim is that based on the evidence we have, the most likely explanation is that the attack was undertaken by Russia. What about this is "extraordinary"? If you mean the broader claim, "Russia did a successful cyberattack against the US", I again don't see what is extraordinary about that claim.
> A flood of circumstantial evidence of dubious provenance, no matter how earnestly believed by the politically motivated, should not be enough to destabilize the Office of US Presidency (no matter how much one finds the holder of the office distasteful) nor make dangerous accusations of foreign nations.
I'm confused, I'm not making any claim about the any president. I'm making claims about a cyberattack.
I'm unclear what about "The Russian government undertook cyber-espionage against the US" is a dangerous claim. I'd make the same claim, in general, about the US. I'm quite confident that the US undertakes cyber-espionage against Russia too. I just don't have any particular examples at hand, but if you cited one, I wouldn't consider it "dangerous".
> The proof of all of which, if it exists at all, is buried under a warren of circular self-references, and journalists who breathlessly report them as known.
I'm confused, I'm referencing an[0] indictment by Robert Muller against the named GRU agents accused of carrying out the attack in question. There's no journalists involved at all.
[0]: https://www.justice.gov/file/1080281/download
[1]: https://www.intelligence.senate.gov/sites/default/files/docu...
This level of requirement is beyond what’s required to convict someone of murder in a court of law. It’ll basically never be met under any conditions.
It’s also almost certainly selectively applied to cases where they don’t want to accept a conclusion.
It’s admirable to lay out details, but I’m skeptical you’ll make any progress here. If their responses are in good faith maybe it’ll have some affect, maybe they think they’re responding in good faith? It feels strongly driven by motivated reasoning rather than a genuine interest in what’s likely to be true.
Wait, what? I don't know most of these answers. Neither do you.
"Who wrote X-Agent?" "It was definitely Russians" is not a valid answer, either.
An indictment is not evidence. It's an accusation. Show the evidence, let it be examined, cross-examined, etc.
No, spooks' testimony is not credible by itself, not after they repeatedly lied under oath, to both congress and the public.
> "Do you believe the data stolen in the DNC hack and later leaked was geopolitically useful to the Russian government? "
"geopolitically" not to nitpick, but you probably mean plain "politically"
Not necessarily. Clinton was already cosy with the Russians as State Secretary. Trump was an unknown quantity. Asserting anything else is a retcon.
> "The Russian government undertook cyber-espionage against the US"
You're literally putting quotes around something I did not write. The accusation was far stronger than that. The accusation was that the Russians, WikiLeaks and the Trump campaign colluded to get Trump elected in exchange for preferential treatment. The DNC hack was a small part of it. But no, there's no evidence of that small part, either.
Ok, I think it's clear that there's no more fruitful exchange to happen on this topic. I tried to demonstrate that the evidence must be extraordinary and that it does not rise to that level. You disagree. You tried to demonstrate to me that the evidence is extraordinary. I disagree.
Know that I'll read your reply, and absorb it, and think on it, but likely won't answer. Let us amicably agree to disagree on this.
You're absolutely correct, but based on the weight of the evidence we have, we can find a most likely explanation. You've previously stated that all explanations bare equally likely, but that's not true. Bayesian reasoning allows us to look at various pieces of evidence and priors and weigh them, even when all are individually of dubious use.
It's clear you don't want to answer any of those questions. They're simpler questions, my assumption here, again based on the weight of the evidence is that you're avoiding answering them because they demonstrate that Russia being responsible is the most likely answer.
As another user mentions, you're showing lots of examples of motivated reasoning, and that's unfortunate. Even more so that you're then projecting these accusations upon me. Hopefully your inability to engage with the substance of what I've presented will demonstrate that to any other readers.
> You're literally putting quotes around something I did not write.
Yes and, this is a valid rhetorical act when, for example suggesting the abstract idea one is discussing.
> The accusation was far stronger than that. The accusation was that the Russians, WikiLeaks and the Trump campaign colluded to get Trump elected in exchange for preferential treatment. The DNC hack was a small part of it. But no, there's no evidence of that small part, either.
That's not an accusation I made. Nor did any one else in this thread. And I'd agree that it is less likely than what I'm actually suggesting, which is that there wasn't collusion per say, but simply mutually beneficial actions. This is what is supported by the weight of the evidence and claimed in government reports, for example. That Russia hacked and leaked DNC data, to the benefit of the trump campaign and Russia itself, obviously. I'm unclear why you feel it necessary to inflate the accusations made to something less likely. This feels very motte-and-bailey, although I can't tell if it was intentional or a subconscious way to protect your preconception.
The Trump campaign, at minimum Paul Manafort, colluded with agents of Russia [2].
I'm not going to research how strong the public evidence that Russia was behind the DNC hack but again, it's not an extraordinary claim.
[0] https://en.wikipedia.org/wiki/Trump_Tower_meeting
[1] https://abcnews.go.com/Politics/id-exclusive-interview-trump-listen-foreigners-offered-dirt/story?id=63669304
[2] https://apnews.com/article/donald-trump-paul-manafort-russia-campaigns-konstantin-kilimnik-d2fdefdb37077e28eba135e21fce6ebf A. He wasn't president at the time.
B. While it's natural to assume that a candidate is aware of, and is ultimately responsible for, everything his campaign does, I've distinguished between his campaign colluding and Trump personally colluding.
C. Everything that has already been made public about the campaign makes further claims that are less well documented not extraordinary.
Allow me to spoon-feed an important part to you. Don Jr. publicly released emails about the Trump Tower meeting, those are real and not circumstantial evidence in his desire to collude and others in the campaign attended the meeting with foreknowledge of this. Google 'don jr "i love it"' and there are a zillion news stories about them, I don't know how you missed them at the time. An NPR story linked to a complete PDF [0] of what Don Jr released. Here's the beginning of a NY Times story [1] about them:
> The June 3, 2016, email sent to Donald Trump Jr. could hardly have been more explicit: One of his father’s former Russian business partners had been contacted by a senior Russian government official and was offering to provide the Trump campaign with dirt on Hillary Clinton.
> The documents “would incriminate Hillary and her dealings with Russia and would be very useful to your father,” read the email, written by a trusted intermediary, who added, “This is obviously very high level and sensitive information but is part of Russia and its government’s support for Mr. Trump.”
> If the future president’s eldest son was surprised or disturbed by the provenance of the promised material — or the notion that it was part of a continuing effort by the Russian government to aid his father’s campaign — he gave no indication.
> He replied within minutes: “If it’s what you say I love it especially later in the summer.”
[0] https://s3.documentcloud.org/documents/3892196/Donald-Trump-Jr-Email-Exchange.pdf
[1] https://www.nytimes.com/2017/07/11/us/politics/trump-russia-email-clinton.htmlHere is my reply. Simple.
https://taibbi.substack.com/p/aaugh-a-brief-list-of-official...
Your link is primarily about the press being insufficiently skeptical about sources in stories related to foreign intelligence. At yet it contains lines like this:
> No matter what, the clear aim of this report is to cast certain stories about Joe or Hunter Biden as misinformation, when the evidence more likely shows that material like the Hunter Biden emails is real, just delivered from a disreputable source. [emphasis added]
Taibbi is revealing his bias at the same time he's claiming bias influenced the contents of a report.
I'm all for healthy skepticism in the public and especially as a part of journalists doing their jobs. Journalists absolutely consider what sources have to gain or what axes they may have to grid. But reflexively assuming anything from the government is a lie is just as bad as assuming it's true. And when there's a public statement or report, that is news and needs to be reported on.
> reflexively assuming anything from the government is a lie
While true, this is a non-sequitur. "The government" is not a monolith. Some in "the government" insist that Russia hacked the DNC, usually Democrats, while others in "the government" insist that it's nonsense