# Russian government hackers penetrated DNC, stole opposition research on Trump **Russian government hackers caught in DNC's** **networks** **Play Video 1:26** **Russian goverment hackers penetrated the Democratic National Committee and had access to theRussian goverment hackers penetrated the Democratic National Committee and had access to the** **DNC network for about a year, but all were expelled earlier in June. (Jhaan Elker/The WashingtonDNC network for about a year, but all were expelled earlier in June. (Jhaan Elker/The Washington** **Post)Post)** **•• NationalNational** **[By By Ellen NakashimaEllen Nakashima](http://www.washingtonpost.com/people/ellen-nakashima)** **SecuritySecurity** **June 14June 14** **Russian government hackers penetrated the computer network of the DemocraticRussian government hackers penetrated the computer network of the Democratic** **National Committee and gained access to the entire database of opposition research onNational Committee and gained access to the entire database of opposition research on** **GOP presidential candidate Donald Trump, according to committee officials andGOP presidential candidate Donald Trump, according to committee officials and** **security experts who responded to the breach.security experts who responded to the breach.** **The intruders so thoroughly compromised the DNC’s system that they also were able toThe intruders so thoroughly compromised the DNC’s system that they also were able to** **read all email and chat traffic, said DNC officials and the security experts.read all email and chat traffic, said DNC officials and the security experts.** **The intrusion into the DNC was one of severalThe intrusion into the DNC was one of several targeting American political targeting American political** **organizationsorganizations. The networks of presidential candidates Hillary Clinton and Donald. The networks of presidential candidates Hillary Clinton and Donald** **Trump were also targeted by Russian spies, as were the computers of some RepublicanTrump were also targeted by Russian spies, as were the computers of some Republican** **political action committees, U.S. officials said. But details on those cases were notpolitical action committees, U.S. officials said. But details on those cases were not** **available.available.** **_[[[Russia denies DNC hack and says maybe someone ‘forgot the password’Russia denies DNC hack and says maybe someone ‘forgot the password’ ]]](https://www.washingtonpost.com/news/worldviews/wp/2016/06/15/russias-unusual-response-to-charges-it-hacked-research-on-trump/)_** **Russian government hackers caught in DNC's** **networks** **Play Video 1:26** ----- **bodies have been involved in this,” Dmitry Peskov, the Kremlin’s spokesman, told thebodies have been involved in this,” Dmitry Peskov, the Kremlin’s spokesman, told the** **Reuters news agency in Moscow.Reuters news agency in Moscow.** ### Trump captures the nation’s attention on the campaign trail **View Photos** **The Republican candidate continues to dominate the presidential contest.** **Some of the hackers had access to the DNC network for about a year, but all wereSome of the hackers had access to the DNC network for about a year, but all were** **expelled over the past weekend in a major computer cleanup campaign, the committeeexpelled over the past weekend in a major computer cleanup campaign, the committee** **officials and experts said.officials and experts said.** **The DNC said that no financial, donor or personal information appears to have beenThe DNC said that no financial, donor or personal information appears to have been** **accessed or taken, suggesting that the breach was traditional espionage, not the work ofaccessed or taken, suggesting that the breach was traditional espionage, not the work of** **criminal hackers.criminal hackers.** **The intrusions are an example of Russia’s interest in the U.S. political system and itsThe intrusions are an example of Russia’s interest in the U.S. political system and its** **desire to understand the policies, strengths and weaknesses of a potential futuredesire to understand the policies, strengths and weaknesses of a potential future** **president — much as American spies gather similar information on foreign candidatespresident — much as American spies gather similar information on foreign candidates** **and leadersand leaders** ### Trump captures the nation’s attention on the campaign trail **View Photos** **The Republican candidate continues to dominate the presidential contest.** ----- **top cyber-adversary as Russia goes after strategic targets, from the White House andtop cyber-adversary as Russia goes after strategic targets, from the White House and** **State Department to political campaign organizations.State Department to political campaign organizations.** **_[[[Russian hackers breach some White House computersRussian hackers breach some White House computers]]](https://www.washingtonpost.com/world/national-security/hackers-breach-some-white-house-computers/2014/10/28/2ddf2fa0-5ef7-11e4-91f7-5d89b5e8c251_story.html)_** **“It’s the job of every foreign intelligence service to collect intelligence against their“It’s the job of every foreign intelligence service to collect intelligence against their** **adversaries,” said Shawn Henry, president of CrowdStrike, the cyber firm called in toadversaries,” said Shawn Henry, president of CrowdStrike, the cyber firm called in to** **handle the DNC breach and a former head of the FBI’s cyber division. He noted that it ishandle the DNC breach and a former head of the FBI’s cyber division. He noted that it is** **extremely difficult for a civilian organization to protect itself from a skilled andextremely difficult for a civilian organization to protect itself from a skilled and** **determined state such as Russia.determined state such as Russia.** **Trump calls Putin 'strong,' but insists 'strong doesn't mean** **good'** **Play Video 1:42** **Donald Trump has repeatedly called Vladimir Putin a "strong" leader, but toes a fine line�Donald Trump has repeatedly called Vladimir Putin a "strong" leader, but toes a fine line�** **on praising the Russian president. (Peter Stevenson/The Washington Post)on praising the Russian president. (Peter Stevenson/The Washington Post)** **“We’re perceived as an adversary of Russia,” he said. “Their job when they wake up“We’re perceived as an adversary of Russia,” he said. “Their job when they wake up** **every day is to gather intelligence against the policies, practices and strategies of theevery day is to gather intelligence against the policies, practices and strategies of the** **U.S. government. There are a variety of ways. [Hacking] is one of the more valuableU.S. government. There are a variety of ways. [Hacking] is one of the more valuable** **because it gives you a treasure trove of information.”because it gives you a treasure trove of information.”** **[Russian President Vladimir Putin Russian President Vladimir Putin has spoken favorably about Trump,has spoken favorably about Trump, who has called for who has called for](https://www.washingtonpost.com/world/putin-no-major-gaps-with-washington-over-efforts-to-end-syria-conflict/2015/12/17/a178255e-a431-11e5-8318-bd8caed8c588_story.html?tid=a_inl)** **better relations with Russia and expressed skepticism about NATO. But unlike Clinton,better relations with Russia and expressed skepticism about NATO. But unlike Clinton,** **whom the Russians probably have long had in their spy sights, Trump has not been awhom the Russians probably have long had in their spy sights, Trump has not been a** **politician for very long, so foreign agencies are playing catch-up, analysts say.politician for very long, so foreign agencies are playing catch-up, analysts say.** **“The purpose of such intelligence gathering is to understand the target’s proclivities,”“The purpose of such intelligence gathering is to understand the target’s proclivities,”** **said Robert Deitz, former senior councillor to the CIA director andsaid Robert Deitz, former senior councillor to the CIA director and** **a former general counsel ata former general counsel at** **Trump calls Putin 'strong,' but insists 'strong doesn't mean** **good'** **Play Video 1:42** ----- **relevant to understanding how he would deal with countries where he has thoserelevant to understanding how he would deal with countries where he has those** **investments” should he be elected, Deitz said. “They may provide tips for understandinginvestments” should he be elected, Deitz said. “They may provide tips for understanding** **his style of negotiating. In short, this sort of intelligence could be used by Russia, forhis style of negotiating. In short, this sort of intelligence could be used by Russia, for** **example, to indicate where it can get away with foreign adventurism.”example, to indicate where it can get away with foreign adventurism.”** **_[[[The not-completely-crazy theory that Russia leaked the Panama PapersThe not-completely-crazy theory that Russia leaked the Panama Papers]]](https://www.washingtonpost.com/news/worldviews/wp/2016/04/09/the-not-completely-crazy-theory-that-russia-leaked-the-panama-papers/)_** **Other analysts noted that any dirt dug up in opposition research is likely to be madeOther analysts noted that any dirt dug up in opposition research is likely to be made** **public anyway. Nonetheless, DNC leadership acted quickly after the intrusion’spublic anyway. Nonetheless, DNC leadership acted quickly after the intrusion’s** **discovery to contain the damage.discovery to contain the damage.** **“The security of our system is critical to our operation and to the confidence of the“The security of our system is critical to our operation and to the confidence of the** **campaigns and state parties we work with,” said Rep. Debbie Wasserman Schultz (Fla.),campaigns and state parties we work with,” said Rep. Debbie Wasserman Schultz (Fla.),** **the DNC chairwoman. “When we discovered the intrusion, we treated this like thethe DNC chairwoman. “When we discovered the intrusion, we treated this like the** **serious incident it is and reached out to CrowdStrike immediately. Our team moved asserious incident it is and reached out to CrowdStrike immediately. Our team moved as** **quickly as possible to kick out the intruders and secure our network.”quickly as possible to kick out the intruders and secure our network.”** **_[[[Debbie Wasserman Schultz’s Worst Week in WashingtonDebbie Wasserman Schultz’s Worst Week in Washington](https://www.washingtonpost.com/news/the-fix/wp/2016/05/21/debbie-wasserman-schultzs-worst-week-in-washington/)_** **_]]_** **Clinton called the intrusion “troubling” in an interview with Telemundo. She also said,Clinton called the intrusion “troubling” in an interview with Telemundo. She also said,** **“So far as we know, my campaign has not been hacked into,” and added that“So far as we know, my campaign has not been hacked into,” and added that** **cybersecurity is an issue that she “will be absolutely focused on” if she becomescybersecurity is an issue that she “will be absolutely focused on” if she becomes** **president. “Because whether it’s Russia, or China, Iran or North Korea, more and morepresident. “Because whether it’s Russia, or China, Iran or North Korea, more and more** **countries are using hacking to steal our information, to use it to their advantage,” shecountries are using hacking to steal our information, to use it to their advantage,” she** **said.said.** **A spokeswoman for the Trump campaign referred questions to the Secret Service.A spokeswoman for the Trump campaign referred questions to the Secret Service.** **DNC leaders were tipped to the hack in late April. Chief executive Amy Dacey got a callDNC leaders were tipped to the hack in late April. Chief executive Amy Dacey got a call** **from her operations chief saying that their information technology team had noticedfrom her operations chief saying that their information technology team had noticed** **some unusual network activitysome unusual network activity** ----- **Dacey said. And they knew it was serious enough that they wanted experts toDacey said. And they knew it was serious enough that they wanted experts to** **investigate.investigate.** **That evening, she spoke with Michael Sussmann, a DNC lawyer who is a partner withThat evening, she spoke with Michael Sussmann, a DNC lawyer who is a partner with** **Perkins Coie in Washington. Soon after, Sussmann, a former federal prosecutor whoPerkins Coie in Washington. Soon after, Sussmann, a former federal prosecutor who** **handled computer crime cases, called Henry, whom he has known for many years.handled computer crime cases, called Henry, whom he has known for many years.** **Within 24 hours, CrowdStrike had installed software on the DNC’s computers so that itWithin 24 hours, CrowdStrike had installed software on the DNC’s computers so that it** **could analyze data that could indicate who had gained access, when and how.could analyze data that could indicate who had gained access, when and how.** **The firm identified two separate hacker groups, both working for the RussianThe firm identified two separate hacker groups, both working for the Russian** **government, that had infiltrated the network, said Dmitri Alperovitch, CrowdStrike co-government, that had infiltrated the network, said Dmitri Alperovitch, CrowdStrike co-** **founder and chief technology officer. The firm had analyzed other breaches by bothfounder and chief technology officer. The firm had analyzed other breaches by both** **groups over the past two years.groups over the past two years.** **_[[[U.S. suspects Russia in hack of Pentagon computer networkU.S. suspects Russia in hack of Pentagon computer network]]](https://www.washingtonpost.com/world/national-security/us-suspects-russia-in-hack-of-pentagon-computer-network/2015/08/06/b80e1644-3c7a-11e5-9c2d-ed991d848c48_story.html)_** **One group, which CrowdStrike had dubbed Cozy Bear, had gained access last summerOne group, which CrowdStrike had dubbed Cozy Bear, had gained access last summer** **and was monitoring the DNC’s email and chat communications, Alperovitch said.and was monitoring the DNC’s email and chat communications, Alperovitch said.** **The other, which the firm had named Fancy Bear, broke into the network in late AprilThe other, which the firm had named Fancy Bear, broke into the network in late April** **and targeted the opposition research files. It was this breach that set off the alarm. Theand targeted the opposition research files. It was this breach that set off the alarm. The** **hackers stole two files, Henry said. And they had access to the computers of the entirehackers stole two files, Henry said. And they had access to the computers of the entire** **research staff — an average of about several dozen on any given day.research staff — an average of about several dozen on any given day.** **The computers contained research going back years on Trump. “It’s a huge job” to digThe computers contained research going back years on Trump. “It’s a huge job” to dig** **into the dealings of somebody who has never run for office before, Dacey said.into the dealings of somebody who has never run for office before, Dacey said.** **CrowdStrike is not sure how the hackers got in. The firm suspects they may haveCrowdStrike is not sure how the hackers got in. The firm suspects they may have** **targeted DNC employees with “spearphishing” emails. These are communications thattargeted DNC employees with “spearphishing” emails. These are communications that** **appear legitimate — often made to look like they came from a colleague or someoneappear legitimate — often made to look like they came from a colleague or someone** ----- **software that enables a hacker to gain access to a computer. “But we don’t have hardsoftware that enables a hacker to gain access to a computer. “But we don’t have hard** **evidence,” Alperovitch said.evidence,” Alperovitch said.** **The two groups did not appear to be working together, Alperovitch said. Fancy Bear isThe two groups did not appear to be working together, Alperovitch said. Fancy Bear is** **believed to work for the GRU, or Russia’s military intelligence service, he said.believed to work for the GRU, or Russia’s military intelligence service, he said.** **CrowdStrike is less sure of whom Cozy Bear works for but thinks it might be the FederalCrowdStrike is less sure of whom Cozy Bear works for but thinks it might be the Federal** **Security Service, or FSB, the country’s powerful security agency, which was once headedSecurity Service, or FSB, the country’s powerful security agency, which was once headed** **by Putin.by Putin.** **_[[[How Russian special forces are shaping the fight in SyriaHow Russian special forces are shaping the fight in Syria](https://www.washingtonpost.com/news/checkpoint/wp/2016/03/29/how-russian-special-forces-are-shaping-the-fight-in-syria/)_** **_]]_** **The lack of coordination is not unusual, he said. “There’s an amazing adversarialThe lack of coordination is not unusual, he said. “There’s an amazing adversarial** **relationship” among the Russian intelligence agencies, Alperovitch said. “We have seenrelationship” among the Russian intelligence agencies, Alperovitch said. “We have seen** **them steal assets from one another, refuse to collaborate. They’re all vying for power, tothem steal assets from one another, refuse to collaborate. They’re all vying for power, to** **sell Putin on how good they are.”sell Putin on how good they are.”** **The two crews have “superb operational tradecraft,” he said. They often use previouslyThe two crews have “superb operational tradecraft,” he said. They often use previously** **unknown software bugs — known as “zero-day” vulnerabilities — to compromiseunknown software bugs — known as “zero-day” vulnerabilities — to compromise** **applications. In the DNC’s case, the hackers constantly switched tactics to maintain aapplications. In the DNC’s case, the hackers constantly switched tactics to maintain a** **stealthy presence inside the network and used built-in Windows tools so that they didn’tstealthy presence inside the network and used built-in Windows tools so that they didn’t** **have to resort to malicious code that might trigger alerts. “They flew under the radar,”have to resort to malicious code that might trigger alerts. “They flew under the radar,”** **Alperovitch said.Alperovitch said.** **The two groups have hacked government agencies, tech companies, defense contractors,The two groups have hacked government agencies, tech companies, defense contractors,** **energy and manufacturing firms, and universities in the United States, Canada andenergy and manufacturing firms, and universities in the United States, Canada and** **Europe as well as in Asia, he said.Europe as well as in Asia, he said.** **Cozy Bear, for instance, compromised the unclassified email systems of the WhiteCozy Bear, for instance, compromised the unclassified email systems of the White** **House, State Department and Joint Chiefs of Staff in 2014, Alperovitch said.House, State Department and Joint Chiefs of Staff in 2014, Alperovitch said.** **“This is a sophisticated foreign intelligence service with a lot of time a lot of resources“This is a sophisticated foreign intelligence service with a lot of time a lot of resources** ----- **was not engaged in a fair fight. “You’ve got ordinary citizens who are doing hand-to-was not engaged in a fair fight. “You’ve got ordinary citizens who are doing hand-to-** **hand combat with trained military officers,” he said. “And that’s an untenable situation.”hand combat with trained military officers,” he said. “And that’s an untenable situation.”** **Russia has always been a formidable foe in cyberspace, but in the past two years,Russia has always been a formidable foe in cyberspace, but in the past two years,** **“there’s been a thousand-fold increase in its espionage campaign against the West,” said“there’s been a thousand-fold increase in its espionage campaign against the West,” said** **Alperovitch, who is also a senior fellow at the Atlantic Council. “They feel under siege.”Alperovitch, who is also a senior fellow at the Atlantic Council. “They feel under siege.”** **Checkpoint newsletterCheckpoint newsletter** **Military, defense and security at home and abroad.Military, defense and security at home and abroad.** **Sign up** **Western sanctions, imposed after Russia’s annexation of Crimea in Ukraine, have hurtWestern sanctions, imposed after Russia’s annexation of Crimea in Ukraine, have hurt** **the economy and led the government to increase its theft of intellectual property to limitthe economy and led the government to increase its theft of intellectual property to limit** **the impact of import restrictions, he said. And Russia’s growing isolation has increasedthe impact of import restrictions, he said. And Russia’s growing isolation has increased** **the need for intelligence to understand and influence political decisions in otherthe need for intelligence to understand and influence political decisions in other** **countries, he added.countries, he added.** **CrowdStrike is continuing the forensic investigation, said Sussmann, the DNC lawyer.CrowdStrike is continuing the forensic investigation, said Sussmann, the DNC lawyer.** **“But at this time, it appears that no financial information or sensitive employee, donor“But at this time, it appears that no financial information or sensitive employee, donor** **or voter information was accessed by the Russian attackers,” he said.or voter information was accessed by the Russian attackers,” he said.** **The firm has installed special software on every computer and server in the network toThe firm has installed special software on every computer and server in the network to** **detect any efforts by the Russian cyberspies to break in again. “When they get kicked outdetect any efforts by the Russian cyberspies to break in again. “When they get kicked out** **of the system,” Henry predicted, “they’re going to try to come back in.”of the system,” Henry predicted, “they’re going to try to come back in.”** **_Tom Hamburger contributed to this report.Tom Hamburger contributed to this report._** **Read more:Read more:** **[Pentagon unveils budget priority for next year: Countering Russia and ChinaPentagon unveils budget priority for next year: Countering Russia and China](https://www.washingtonpost.com/news/checkpoint/wp/2016/02/01/pentagon-unveils-budget-priorities-for-next-fiscal-year-countering-russia-and-china/)** ----- **[Pentagon: U.S. has told Russia where U.S. special forces are in SyriaPentagon: U.S. has told Russia where U.S. special forces are in Syria](https://www.washingtonpost.com/news/checkpoint/wp/2016/02/18/pentagon-russia-knows-where-u-s-special-forces-are-in-syria/)** **FBI wants access to Internet browser history without a warrant in terrorism and spyFBI wants access to Internet browser history without a warrant in terrorism and spy** **casescases** **4.7k Comments** **Ellen Nakashima is a national security reporter for The Washington Post. She focuses on issues** **relating to intelligence, technology and civil liberties.** **[Follow @nakashimae](https://twitter.com/intent/follow?screen_name=nakashimae)** **4.7k Comments** ----- ## 1 Turkey and the Islamic State appear to be headed toward outright war 2 Indian couple accused of faking widely praised Everest climb 3 Venezuelans are storming supermarkets and attacking trucks as food **supplies dwindle** ## 4 What a real ‘Brexit Britain’ would look like 5 Islamic State routs Pentagon-backed Syrian rebels in fresh setback for U.S. **strategy** **[Unlimited Access to The Post. Just 99¢](https://subscribe.washingtonpost.com/acquisition/?promo=default_postmost&oscode=RPWH&wpsrc=CM0000449&tid=s_016)** **Our Online Games** **Play right from this page** **Mahjongg Dimensions** **Strategy game** **Spider Solitaire** ----- **washingtonpost.com** **© 1996-2016 The Washington Post** **[Help and Contact Us](http://help.washingtonpost.com/ics/support/KBSplash.asp?deptID=15080)** **Terms of Service** **Privacy Policy** **Print Products Terms of Sale** **Digital Products Terms of Sale** **Submissions and Discussion Policy** **RSS Terms of Service** **Ad Choices** **12cadb27-3e8c-11e6-995d-0e118be7af43** -----