On Monday, June 6, Clinton clinched the Democratic nomination, making history as the first woman in the United States ever to be selected to represent one of the two major parties in a presidential contest. Breathing easier that their secret had held for five weeks, the DNC leadership finally turned to the task of getting rid of the intruders. But as plans took shape for what the cyber team called “Remediation Weekend,” officials knew that word of Russian penetration of a major party was unlikely to hold. Sussmann, the lawyer, recommended preempting this possibility by contacting a reporter at The Washington Post.
ON WEDNESDAY, JUNE 8, ELLEN NAKASHIMA WALKED A FEW BLOCKS from The Washington Post’s building on 13th and K Streets to Sussmann’s office at Perkins Coie. In a sixth-floor conference room, she met Dacey for the first time. Henry was there, too, along with Sussmann. The three of them proceeded to tell her about the dramatic events of the preceding month. Dacey was no expert in cyberattacks, but she was intent on making sure that people knew what happened and understood the stakes.
On the evening of Friday, June 10, after the DNC staff had gone home, a crew of about ten committee technology workers, including Tamene, as well as a separate team of CrowdStrike investigators, arrived at committee headquarters for Remediation Weekend.
The crew worked Friday, Saturday, and Sunday, pausing for only brief stretches of sleep. The entire DNC network was shut down. To keep the mission secret, the committee had told employees the unusual arrangement was required for a system upgrade. The process was tedious and repetitive. The committee had collected hundreds of laptops from staffers—some of whom fretted that this meant their jobs were at risk because Clinton was taking over the party leadership. The remediation team piled the devices in stacks, side by side, on a large rectangular table in a first-floor conference room. Each laptop had to be reimaged, a manual process consisting of wiping the hard drives clean, reinstalling the operating system, and clicking through a series of tiresome fields to select the correct language, time zone, etc. Meanwhile, a parallel team backed up terabytes of committee data to a clean collection of servers. Every laptop, once reimaged, had to have its data restored.
By Sunday night, the project was finished, and Dacey, who came into the office to check on the work, breathed a sigh of relief. In appreciation of the magnitude of the operation, one of CrowdStrike’s founders, Dmitri Alperovitch, a Russian-born expert with degrees from Georgia Tech, showed up to take his exhausted team to dinner at a Brazilian steakhouse. Monday morning, the network was back online, the laptops, with new software running to detect any return of the Russians, redistributed.
DNC officials had shared their account with Nakashima on the condition that it not be published until the committee’s networks had been secured. She began composing a draft of the article and made plans with editors to put the story online on Monday, June 13. But on Sunday the twelfth, as the DNC team was completing its scrub, devastating news broke in Florida: Omar Mateen, a twenty-nine-year-old security guard, had opened fire in the packed Pulse nightclub in Orlando, killing forty-nine people and wounding fifty-three others—then the deadliest mass shooting by a single gunman in U.S. history.
The Post put the hacking story off for an extra day. At 11:30 A.M. on Tuesday it appeared atop the paper’s website, opening, “Russian government hackers penetrated the computer network of the Democratic National Committee and gained access to the entire database of opposition research on GOP presidential candidate Donald Trump.”3 The article emphasized that the hackers had been expelled from the DNC’s systems over the preceding weekend and quoted a range of officials and experts casting the intrusion as a classic case of cyber espionage. Moscow, it was agreed, was far more likely to hoard the stolen material and mine it for insights that could provide critical leverage in global affairs. The prospect that Russia would wage an unprecedented campaign of information warfare—sowing doubt about the democratic process, damaging the candidacy of Hillary Clinton, and ultimately seeking to help elect Donald Trump—was beyond imagining at that moment. Kremlin spokesman Dmitry Peskov quickly denied any Russian involvement.
On June 15, within twenty-four hours of the Post’s story, the website The Smoking Gun posted a story saying it had been contacted by an “online vandal” using the name Guccifer 2.0. Elaborating on a blog site, he claimed to be flattered by accounts depicting the operation as “sophisticated,” insisting that “in fact, it was easy, very easy.” He insisted he was not Russian, but a Romanian who had chosen his moniker partly to honor his hacking predecessor Guccifer but also because he loved the Gucci brand. “I’m a hacker, manager, philosopher, woman lover,” he proclaimed. But in online correspondence with journalists, his persona seemed to crack. Posed questions in Romanian by the journalist Lorenzo Franceschi-Bicchierai, writing for the online tech publication Motherboard, Guccifer 2.0’s responses came back in fractured syntax that seemed to betray a reliance on Google Translate. In subsequent exchanges, his online personality seemed to shift, suggesting more than one hand was operating the Guccifer 2.0 persona.
To establish his credentials, he passed along a collection of pilfered DNC documents. The files included internal memos and a list of donors that catalogued six-figure contributions to the party from, among others, movie star Morgan Freeman, director Steven Spielberg, and Hollywood executive Jeffrey Katzenberg. Guccifer 2.0 referred those interested to the DCLeaks website that GRU hackers had set up in April and where even more DNC material was now placed. The document that got the most attention was a 237-page collection of DNC opposition research.
Marked confidential, “Donald Trump Report” was a sprawling catalogue of Trump’s perceived political vulnerabilities, recounting his privileged upbringing, his lawsuits and bankruptcies, affairs and broken marriages, vacillating party affiliations, crass comments about women, fierce verbal attacks on Muslims, penchant for falsehoods, and alleged racism. “One thing is clear about Donald Trump,” read the file’s first sentence. “There is only one person he has ever looked out for and that’s himself.”
To Democrats, all of this added up to a portrait of an ideal opponent, someone who by any conventional standard had to be considered unelectable. But damning as it was, the material laid out in the document was, for the most part, already widely known. If Democrats were hoarding any bombshells, they weren’t listed in the pages of its “Donald Trump Report.”
Guccifer 2.0’s message labored to divert suspicion from Russia. “Hi. This is Guccifer 2.0 and this is me who hacked Democratic National Committee,” it said. The writer offered a brief account of his or her exploit, explaining that it involved breaching “mail boxes of a number of Democrats” and then exploiting the information to get “into committee servers.” The hacker claimed to have been inside the DNC network for more than a year and stolen “thousands of files and mails.”
In reality, Guccifer 2.0 was a GRU creation, an online persona operated by the same hackers who had rampaged through the DNC and DCCC networks. On June 22, one week after Guccifer 2.0’s debut, the Russian hackers behind this online puppet got a message from an eager ally in their unfolding operation against Clinton: WikiLeaks. The organization, determined not to watch from the sidelines, urged Guccifer 2.0 to send “any new material here for us to review and it will have a much higher impact than what you are doing.” Weeks later, WikiLeaks was pleading again for access to the trove, saying, “if you have anything Hillary related we want it,” noting that the Democratic convention was rapidly approaching and unless the digital saboteurs intervened “she will solidify Bernie supporters behind her.”
THE UNITED STATES AND WIKILEAKS HAD BEEN IN A STATE OF OPEN hostility since the group in 2010 published half a million military records from Afghanistan and Iraq and approximately 250,000 diplomatic cables. That release triggered a criminal investigation of WikiLeaks and indirectly led its Australian founder, Julian Assange, to seek asylum in Ecuador’s embassy in London. Assange had been accused of sexual assault in Sweden and said he feared that if he was extradited there to face charges, he would be ultimately transferred to the United States, regardless
