Here is the bottom-line\u2014despite being hired in late April (or early May) of 2016 to stop an unauthorized intrusion into the DNC, CrowdStrike, the cyber firm hired by the DNC’s law firm to solve the problem, failed abysmally. More than 30,000 emails were taken from the DNC server between 22 and 25 May 2016 and given to Wikileaks. Crowdstrike blamed Russia for the intrusion but claimed that only two files were taken. And CrowdStrike inexplicably waited until 10 June 2016 to reboot the DNC network.<\/p>\n
CrowdStrike, a cyber-security company hired by a Perkins Coie lawyer retained by the DNC, provided the narrative to the American public of the alledged hack of the DNC, But the Crowdstrike explanation is inconsistent, contradictory and implausible. Despite glaring oddities in the CrowdStrike account of that event, CrowdStrike subsequently traded on its fame in the investigation of the so-called Russian hack of the DNC and became a publicly traded company. Was CrowdStrike\u2019s fame for \u201cdiscovering\u201d the alleged Russian hack of the DNC a critical factor in its subsequent launch as a publicly traded company?<\/p>\n
The Crowdstrike account of the hack is very flawed. There are 11 contradictions, inconsistencies or oddities in the public narrative about CrowdStrike\u2019s role in uncovering and allegedly mitigating a Russian intrusion (note–the underlying facts for these conclusions are found in\u00a0Ellen Nakashima’s Washington Post story<\/a>,\u00a0Vicki Ward’s Esquire story<\/a>, the\u00a0Mueller Report<\/a>\u00a0and the\u00a0blog of Crowdstrike<\/a> founder Dmitri Alperovitch):<\/p>\n<\/div>\n Let us start with the very contradictory public accounts attributed to Crowdstrke\u2019s founder, Dmitri Alperovitch. The 14 June 2016 story by Ellen Nakashima of the Washington Post and the October 2016 piece by Vicki Ward in Esquire magazine offer two different dates for the start of the investigation:<\/p>\n When did the DNC learn of the \u201cintrusion\u201d?<\/strong><\/p>\n Ellen Nakashima claims it was the end of April:<\/p>\n \u201cDNC leaders were\u00a0tipped to the hack in late April<\/strong>. Chief executive Amy Dacey got a call from her operations chief saying that their information technology team had noticed some unusual network activity. . . . That evening, she spoke with Michael Sussmann, a DNC lawyer who is a partner with Perkins Coie in Washington. Soon after, Sussmann, a former federal prosecutor who handled computer crime cases, called Henry, whom he has known for many years. Within 24 hours, CrowdStrike had installed software on the DNC\u2019s computers so that it could analyze data that could indicate who had gained access, when and how.<\/p>\n Ward\u2019s timeline, citing Alperovitch, reports the alert came later, on 6 May 2016:<\/p>\n At six o’clock on the morning of May 6, Dmitri Alperovitch woke up in a Los Angeles hotel to an alarming email. . . . late the previous night, his company had been asked by the Democratic National Committee to investigate a possible breach of its network. A CrowdStrike security expert had sent the DNC a proprietary software package, called Falcon, that monitors the networks of its clients in real time. Falcon “lit up,” the email said, within ten seconds of being installed at the DNC: Russia was in the network.<\/p>\n This is a significant and troubling discrepancy because it marks the point in time when CrowdStrike installed its Falcon software on the DNC server. It is one thing to confuse the 30th of April with the 1st of May. But Alperovitch gave two different reporters two different dates.<\/p>\n What did the \u201chackers\u201d take from the DNC?<\/strong><\/p>\n Ellen Nakashima’s reporting is contradictory and wrong. Initially, she is told that the hackers got access to the entire Donald Trump database and that all emails and chats could be read. But then she is assured that only two files were taken. This was based on Crowdstrike’s CEO’s assurance, which was proven subsequently to be spectacularly wrong when Wikileaks published 35,813 DNC emails. How did Crowdstrike miss that critical detail? Here is Nakashima’s reporting:<\/p>\n Russian government hackers penetrated the computer network of the Democratic National Committee and gained access to the entire database of opposition research on GOP presidential candidate Donald Trump, according to committee officials and security experts who responded to the breach.<\/p>\n The intruders so thoroughly compromised the DNC\u2019s system that they also were able to read all email and chat traffic, said DNC officials and the security experts. . . .<\/p>\n The DNC said that no financial, donor or personal information appears to have been accessed or taken, suggesting that the breach was traditional espionage, not the work of criminal hackers.<\/p>\n One group, which CrowdStrike had dubbed Cozy Bear, had gained access last summer (2015) and was monitoring the DNC\u2019s email and chat communications, Alperovitch said.<\/p>\n The other, which the firm had named Fancy Bear, broke into the network in late April and targeted the opposition research files. It was this breach that set off the alarm.\u00a0The hackers stole two files,<\/strong>\u00a0Henry said. And they had access to the computers of the entire research staff \u2014 an average of about several dozen on any given day. . . .<\/p>\n CrowdStrike is continuing the forensic investigation, said Sussmann, the DNC lawyer. \u201cBut at this time, it appears that no financial information or sensitive employee, donor or voter information was accessed by the Russian attackers,\u201d he said.<\/p>\n The DNC emails that are posted on the Wikileaks website and the metadata shows that these emails were removed from the DNC server starting the late on the 22nd of May and continuing thru the 23rd of May. The last tranche occurred late in the morning (Washington, DC time) of the 25th of May 2016. Crowdstrike\u2019s CEO, Shawn Henry, insisted on the 14th of June 2016 that \u201cONLY TWO FILES\u201d had been taken. This is demonstrably not true. Besides the failure of Crowdstrike to detect the removal of more than 35,000 emails, there is another important and unanswered question\u2014why did Crowdstrike wait until the 10th of June 2016 to start disconnecting the DNC server when they allegedly knew on the 6th of May that the Russians had entered the DNC network?<\/p>\n Crowdstrike accused Russia of the DNC breach but lacked concrete proof.<\/strong><\/p>\n Ellen Nakashima\u2019s report reveals that Crowdstrike relied exclusively on circumstantial evidence for its claim that the Russian Government hacked the DNC server. \u00a0According to Nakashima:<\/p>\n CrowdStrike is not sure how the hackers got in. The firm suspects they may have targeted DNC employees with \u201cspearphishing\u201d emails. These are communications that appear legitimate \u2014 often made to look like they came from a colleague or someone trusted \u2014 but that contain links or attachments that when clicked on deploy malicious software that enables a hacker to gain access to a computer. \u201cBut we don\u2019t have hard evidence,<\/strong>\u201d Alperovitch said.<\/p>\n There is a word in English for the phrases, “Not sure” and “No hard evidence\u201d–that word is, “assumption.” Assuming that the Russians did it is not the same as proving, based on evidence, that the Russians were culpable. But that is exactly what CrowdStrike did.<\/p>\n The so-called “proof” of the Russian intrusions is the presence of Fancy Bear and Cozy Bear?<\/p>\n At first glance,\u00a0Dmitri Alperovitch\u2019s blog postin<\/a>g describing the Fancy Bear and Cozy Bear \u201cintrusions\u201d appears quite substantive. But cyber security professionals quickly identified a variety of shortcomings with the Alperovitch account. For example,\u00a0this malware is not unique nor proprietary to Russia. Other countries and hackers have access to APT28 and have used it.<\/p>\n Skip Folden offers one of the best comprehensive analyses of the problems with the\u00a0Alperovitch explanation<\/a>:<\/p>\n No basis whatsoever<\/strong>:<\/p>\n APT28, aka Fancy Bear, Sofacy, Strontium, Pawn Storm, Sednit, etc., and APT29, aka Cozy Bear, Cozy Duke, Monkeys, CozyCar,The Dukes, etc., are used as \u2018proof\u2019 of Russia \u2018hacking\u2019 by Russian Intelligence agencies GRU and FSB respectively.<\/p>\n There is no basis whatsoever to attribute the use of known intrusion elements to Russia, not even if they were once reverse routed to Russia, which claim has never been made by NSA or any other of our IC.<\/p>\n On June 15, 2016 Dmitri Alperovitch himself, in an Atlantic Council article, gave only \u201cmedium-level of confidence that Fancy Bear is GRU\u201d and \u201clow-level of confidence that Cozy Bear is FSB.\u201d These assessments, from the main source himself, that either APT is Russian intelligence, averages 37%-38% [(50 + 25) \/ 2].<\/p>\n Exclusivity<\/strong>:<\/p>\n None of the technical indicators, e.g., intrusion tools (such as X-Agent, X-Tunnel), facilities, tactics, techniques, or procedures, etc., of the 28 and 29 APTs can be uniquely attributed to Russia, even if one or more had ever been trace routed to Russia. Once an element of a set of intrusion tools is used in the public domain it can be reverse-engineered and used by other groups which precludes the assumption of exclusivity in future use. The proof that any of these tools have never been reverse engineered and used by others is left to the student – or prosecutor.<\/p>\n Using targets<\/strong>:<\/p>\n Also, targets have been used as basis for attributing intrusions to Russia, and that is pure nonsense. Both many state and non-state players have deep interests in the same targets and have the technical expertise to launch intrusions. In Grizzly Steppe, page 2, second paragraph, beginning with, \u201cBoth groups have historically targeted …,\u201d is there anything in that paragraph which can be claimed as unique to Russia or which excludes all other major state players in the world or any of the non-state organizations? No.<\/p>\n Key Logger Consideration<\/strong>:<\/p>\n On the subject of naming specific GRU officers initiating specific actions on GRU Russian facilities on certain dates \/ times, other than via implanted ID chips under the finger tips of these named GRU officers, the logical assumption would be by installed key logger capabilities, physical or malware, on one or more GRU Russian computers.<\/p>\n The GRU is a highly advanced Russian intelligence unit. It would be very surprising were the GRU open to any method used to install key logger capabilities. It would be even more surprising, if not beyond comprehension that the GRU did not scan all systems upon start-up and in real time, including key logger protection and anomalies of performance degradation and data transmissions.<\/p>\n Foreign intelligence source<\/strong>:<\/p>\n Other option would be via a foreign intelligence unit source with local GRU access. Any such would be quite anti-Russian and be another nail in the coffin of any chain of evidence \/ custody validity at Russian site.<\/p>\n Stated simply, Dmitri Alperovitch’s conclusion that “the Russians did it” are not supported by the forensic evidence. Instead, he relies on the assumption that the presence of APT28 and APT29 prove Moscow’s covert hand. What is even more striking is that the FBI accepted this explanation without demanding forensic evidence.<\/p>\n Former FBI Director James Comey and former NSA Director Mike Rogers testified under oath before Congress that neither agency ever received access to the DNC server. All information the FBI used in its investigation was supplied by CrowdStrike.\u00a0The Hill reported<\/a>:<\/p>\n The FBI requested direct access to the Democratic National Committee\u2019s (DNC) hacked computer servers but was denied, Director James Comey told lawmakers on Tuesday.<\/p>\n The bureau made \u201cmultiple requests at different levels,\u201d according to Comey, but ultimately struck an agreement with the DNC that a \u201chighly respected private company\u201d would get access and share what it found with investigators.<\/p>\n The foregoing facts raise major questions about the validity of the Crowdstrike methodology and conclusions with respect to what happened on the DNC network. This is not a conspiracy theory. It is a set of facts that, as of today, have no satisfactory explanation. The American public deserve answers.<\/p>\n\n