Durham investigation (Update: Sussman acquitted) (2 Viewers)

Defendants VIKTOR BORISOVICH NETYKSHO, BORIS ALEKSEYEVICH
ANTONOV, DMITRIY SERGEYEVICH BADIN, IVAN SERGEYEVICH YERMAKOV,
ALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV,
NIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM
ANDREYEVICH MALYSHEV, ALEKSANDR VLADIMIROVICH OSADCHUK, and
ALEKSEY ALEKSANDROVICH POTEMKIN were GRU officers who knowingly and intentionally conspired with each other, and with persons known and unknown to the Grand Jury
(collectively the “Conspirators”), to gain unauthorized access (to “hack”) into the computers of
U.S. persons and entities involved in the 2016 U.S. presidential election, steal documents from
those computers, and stage releases of the stolen documents to interfere with the 2016 U.S.
presidential election.
3. Starting in at least March 2016, the Conspirators used a variety of means to hack the email
accounts of volunteers and employees of the U.S. presidential campaign of Hillary Clinton (the
“Clinton Campaign”), including the email account of the Clinton Campaign’s chairman.
4. By in or around April 2016, the Conspirators also hacked into the computer networks of
the Democratic Congressional Campaign Committee (“DCCC”) and the Democratic National
Committee (“DNC”). The Conspirators covertly monitored the computers of dozens of DCCC
and DNC employees, implanted hundreds of files containing malicious computer code
(“malware”), and stole emails and other documents from the DCCC and DNC.
5. By in or around April 2016, the Conspirators began to plan the release of materials stolen
from the Clinton Campaign, DCCC, and DNC.
6. Beginning in or around June 2016, the Conspirators staged and released tens of thousands
of the stolen emails and documents. They did so using fictitious online personas, including “DCLeaks” and “Guccifer 2.0.”
7. The Conspirators also used the Guccifer 2.0 persona to release additional stolen documents
through a website maintained by an organization (“Organization 1”), that had previously posted
documents stolen from U.S. persons, entities, and the U.S. government. The Conspirators
continued their U.S. election-interference operations through in or around November 2016.
8. To hide their connections to Russia and the Russian government, the Conspirators used
false identities and made false statements about their identities. To further avoid detection, the
Conspirators used a network of computers located across the world, including in the United States,
and paid for this infrastructure using cryptocurrency.

Click to expand...

-Hacking into the DCCC Network
23. Beginning in or around March 2016, the Conspirators, in addition to their spearphishing
efforts, researched the DCCC and DNC computer networks to identify technical specifications and
vulnerabilities.
a. For example, beginning on or about March 15, 2016, YERMAKOV ran a technical
query for the DNC’s internet protocol configurations to identify connected devices.
b. On or about the same day, YERMAKOV searched for open-source information
about the DNC network, the Democratic Party, and Hillary Clinton.
c. On or about April 7, 2016, YERMAKOV ran a technical query for the DCCC’s
internet protocol configurations to identify connected devices.
24. By in or around April 2016, within days of YERMAKOV’s searches regarding the DCCC,
the Conspirators hacked into the DCCC computer network. Once they gained access, they
installed and managed different types of malware to explore the DCCC network and steal data.
a. On or about April 12, 2016, the Conspirators used the stolen credentials of a DCCC
Employee (“DCCC Employee 1”) to access the DCCC network. DCCC
Employee 1 had received a spearphishing email from the Conspirators on or about
April 6, 2016, and entered her password after clicking on the link.
b. Between in or around April 2016 and June 2016, the Conspirators installed multiple
versions of their X-Agent malware on at least ten DCCC computers, which allowed
them to monitor individual employees’ computer activity, steal passwords, and
maintain access to the DCCC network.
X-Agent malware implanted on the DCCC network transmitted information from

the victims’ computers to a GRU-leased server located in Arizona. The
Conspirators referred to this server as their “AMS” panel. KOZACHEK,
MALYSHEV, and their co-conspirators logged into the AMS panel to use
X-Agent’s keylog and screenshot functions in the course of monitoring and
surveilling activity on the DCCC computers. The keylog function allowed the
Conspirators to capture keystrokes entered by DCCC employees. The screenshot
function allowed the Conspirators to take pictures of the DCCC employees’
computer screens.
d. For example, on or about April 14, 2016, the Conspirators repeatedly activated
X-Agent’s keylog and screenshot functions to surveil DCCC Employee 1’s
computer activity over the course of eight hours. During that time, the Conspirators
captured DCCC Employee 1’s communications with co-workers and the passwords
she entered while working on fundraising and voter outreach projects. Similarly,
on or about April 22, 2016, the Conspirators activated X-Agent’s keylog and
screenshot functions to capture the discussions of another DCCC Employee
(“DCCC Employee 2”) about the DCCC’s finances, as well as her individual
banking information and other personal topics.
25. On or about April 19, 2016, KOZACHEK, YERSHOV, and their co-conspirators remotely
configured an overseas computer to relay communications between X-Agent malware and the
AMS panel and then tested X-Agent’s ability to connect to this computer. The Conspirators
referred to this computer as a “middle server.” The middle server acted as a proxy to obscure the
connection between malware at the DCCC and the Conspirators’ AMS panel. On or about April 10
20, 2016, the Conspirators directed X-Agent malware on the DCCC computers to connect to this
middle server and receive directions from the Conspirators.
-Hacking into the DNC Network
26. On or about April 18, 2016, the Conspirators hacked into the DNC’s computers through
their access to the DCCC network. The Conspirators then installed and managed different types
of malware (as they did in the DCCC network) to explore the DNC network and steal documents.
a. On or about April 18, 2016, the Conspirators activated X-Agent’s keylog and
screenshot functions to steal credentials of a DCCC employee who was authorized
to access the DNC network. The Conspirators hacked into the DNC network from
the DCCC network using stolen credentials. By in or around June 2016, they
gained access to approximately thirty-three DNC computers.
b. In or around April 2016, the Conspirators installed X-Agent malware on the DNC
network, including the same versions installed on the DCCC network.
MALYSHEV and his co-conspirators monitored the X-Agent malware from the
AMS panel and captured data from the victim computers. The AMS panel collected
thousands of keylog and screenshot results from the DCCC and DNC computers,
such as a screenshot and keystroke capture of DCCC Employee 2 viewing the
DCCC’s online banking information.
-Theft of DCCC and DNC Documents
27. The Conspirators searched for and identified computers within the DCCC and DNC
networks that stored information related to the 2016 U.S. presidential election. For example, on
or about April 15, 2016, the Conspirators searched one hacked DCCC computer for terms that
included “hillary,” “cruz,” and “trump.” The Conspirators also copied select DCCC folders,
including “Benghazi Investigations.” The Conspirators targeted computers containing information such as opposition research and field operation plans for the 2016 elections.
28. To enable them to steal a large number of documents at once without detection, the
Conspirators used a publicly available tool to gather and compress multiple documents on the
DCCC and DNC networks. The Conspirators then used other GRU malware, known as
“X-Tunnel,” to move the stolen documents outside the DCCC and DNC networks through
encrypted channels.
a. For example, on or about April 22, 2016, the Conspirators compressed gigabytes
of data from DNC computers, including opposition research. The Conspirators
later moved the compressed DNC data using X-Tunnel to a GRU-leased computer
located in Illinois.
b. On or about April 28, 2016, the Conspirators connected to and tested the same
computer located in Illinois. Later that day, the Conspirators used X-Tunnel to
connect to that computer to steal additional documents from the DCCC network.
29. Between on or about May 25, 2016 and June 1, 2016, the Conspirators hacked the DNC
Microsoft Exchange Server and stole thousands of emails from the work accounts of DNC
employees. During that time, YERMAKOV researched PowerShell commands related to
accessing and managing the Microsoft Exchange Server.
30. On or about May 30, 2016, MALYSHEV accessed the AMS panel in order to upgrade
custom AMS software on the server. That day, the AMS panel received updates from
approximately thirteen different X-Agent malware implants on DCCC and DNC computers.
31. During the hacking of the DCCC and DNC networks, the Conspirators covered their tracks
by intentionally deleting logs and computer files. For example, on or about May 13, 2016, the
Conspirators cleared the event logs from a DNC computer. On or about June 20, 2016, the Conspirators deleted logs from the AMS panel that documented their activities on the panel,
including the login history.

Click to expand...

bdb13 said:

What was the confirmation of embellishment in regards to what Papadopoulos said that's being referred to there? I didn't see it.

And even in Downer's account there Papadopoulos said that he was aware "the Russians have information."

Click to expand...

SaintForLife said:

Click to expand...

DocumentCloud

www.documentcloud.org

SaintForLife said:

Without Papadopoulos saying there was "a Russian offer to assist"(which he never said) there wouldn't have been enough to open the investigation.

Click to expand...

bdb13 said:

Is there evidence to show that the justice department was wrong or lying in this indictment?

Click to expand...

SaintForLife said:

Hard to say either way, because that case was never brought to trial. Since an indictment is just an allegation of a crime, if it never goes to trial then we'll never know.

How convenient because in Mueller’s other indictment of Russians he had to drop the case when it went to discovery. Once again, how convenient that as soon as evidence was required to be produced that the case was dropped. More on that case that was dropped:

Click to expand...

SaintForLife said:

Without Papadopoulos saying there was "a Russian offer to assist"(which he never said) there wouldn't have been enough to open the investigation.

Click to expand...

FullMonte said:

It's interesting that in the Durham report (I assume that's where the first part comes from), they say that Downer would have characterized it differently than the Mueller report did....but they don't go into detail about HOW he would have characterized it differently.

Also, he said that Pop simply said that Russians have information. How did Pop know this if he wasn't told that by a Russian?

Click to expand...

FullMonte said:

It's interesting that in the Durham report (I assume that's where the first part comes from), they say that Downer would have characterized it differently than the Mueller report did....but they don't go into detail about HOW he would have characterized it differently.

Also, he said that Pop simply said that Russians have information. How did Pop know this if he wasn't told that by a Russian?

Click to expand...

FBI notes reveal mysterious Maltese professor Joseph Mifsud’s false denials to agents — for which he was never charged - Washington Examiner

Notes on the FBI’s interview with the mysterious Maltese professor Joseph Mifsud were made public Tuesday, showing denials from a key Trump-Russia inquiry figure who special counsel Robert Mueller says lied to investigators yet was never charged. The notes, released as part of a BuzzFeed Freedom...

www.washingtonexaminer.com

bdb13 said:

It seems to me that most of this stuff is subject to our own internal interpretations and biases and that I can read the same thing as you and come to a different or less definitive conclusion.

I view Downer's statement there more as corroborating evidence rather than evidence that the FBI ginned something up. I can't speak to what's true and what's not there because I obviously don't forking know, but I do know it's quite common for people to have differing stories even if both are intent upon telling the truth. And if Mueller and the FBI made all of that up then I am for charging them with whatever they can be charged with but I also don't think I have the evidence before me to indicate that that's more likely than not to have occurred.

Click to expand...

SaintForLife said:

Would you still see Downer's statement as corroborating evidence eventhough Papadopoulos only told Downer what Misfud(likely intelligence official) told him? What about the British intelligence saying the predication for Crossfire Hurricane was thin?

What about Strzok saying "there's nothing to this, but we have to run it to ground.? That's an important statement from Strzok.

Click to expand...

bdb13 said:

So I'm looking at this from an "in totality" perspective in retrospect and here's really where it goes both ways and why I don't really understand why Durham didn't go further down the line of investigating this aspect unless he saw the evidence from Mueller and accepted it because it's crucial to everything else.

I believe it's (much(?)) more likely than not the Russians hacked the DNC and precipitated the release of the info. With that being the case I find it reasonable Papadopoulos may have said more than "the Russians have information" and either way it would have been awfully coincidental to have played out exactly that way.

Of course, "awfully coincidental" is the flip side argument as well.. but like I said the crux of it all is really held within the DNC and related hacks and what you believe.

Most everything else is static and doesn't really forking matter.

Click to expand...

SaintForLife said:

Why would you think Papadopoulos said more than Downer said he did? FBI agent Pientka said what they got from Papadopoulos was thin as far as it being the predicate that launched Crossfire Hurricane. And Strzok and the FBI skipped most of the normal steps required to open a full investigation.

Click to expand...

bdb13 said:

Based upon believing it more likely than not the Russians hacked the DNC.

Click to expand...

bdb13 said:

Based upon believing it more likely than not the Russians hacked the DNC.

Click to expand...