FBI says foreign hackers penetrated state election systems | Hacker News Reader

FBI says foreign hackers penetrated state election systems

yahoo.com

179 pointsvelodrome163 comments

Voting is such a simple and cheap thing to undertake if you do it on paper.

It's precise, it's easily observable, it's easy for people to understand where their vote goes. It's also easy to grasp how the election is protected from manipulation.

With electronic voting systems it is physically impossible to prevent manipulation and provide control.

I think that the future should lie in digital democracy, where elections and referendums will be held constantly and this will require a well-working electronic system.

I have no faith in current crowd-validation elections.

Well then we will enter the era of constant populism. And politicians having permanently to validate everything against an every shifting public opinion. We will be rules by the press then, by clickbait headlines and populistic extremes I fear.

I do not believe, that people are able to vote for the longer term greater good if they are able to vote for everything in an instant.

Switz and Icelanders were able to pull it, did not they?

Of course this is a skill and it will be acquired for some time. After that, we don't even need politicians that much.

I'll try constant populism because today we live in the era of constant oppression.

Generally, populism implies oppression of the unpopular.

It's difficult enough (maybe impossible) to get a large chunk of the electorate to educate themselves about the issues once every 2, 4, or 6 years. You expect them to stay constantly up-to-date rather than choosing rational irrationality[1]?

[1] https://en.wikipedia.org/wiki/Rational_irrationality

No. I expect people to only vote on issues that they find pressing. By perhaps spending a replenishable "voting score".

That's just what we need. More aspects of our lives relegated to the political sphere, and more of our time devoted to motivating people to one side or the other of every issue.

But you also need to scale these systems. Paper doesn't scale

We did paper elections for ~100 million voters. How much more do you want to scale? Yes, it might take some time post elections to hash out results, but people don't take office the next day making that a non issue.

The benefit of transparent elections outweighs the costs of counting paper.

If we really wanted to do elections cheaply, we'd just hire a couple of undergrads to write a Node.js script and give polling stations some desktop PC's loaded up to the page. Would hardly cost anything. But doing elections cheaply is not the point.

For the USA, precinct-based paper mediated voting is the cheapest option.

We don't need PCs. Self contained scanotronic style systems (think SAT tests) work just fine. In fact, all but the largest jurisdictions (because of ballot size, complexity) could get away with manual counting.

Which is precisely why paper voting is advantageous. A compromised scalable system can have a much larger impact than a non scalable one.

There's an interesting analogy to things like WMDs here. Nukes can also have a much larger impact if abused or compromised, but we still built them. I expect eventually we'll have internet voting in place regardless if the benefits outweigh the potential downsides.

Paper scales linearly. How it's done in the UK: http://www.bbc.co.uk/news/election-2015-england-32533064

That's cute. I'll post the same thing I post every time some non-US reader mentions how _their_ polity votes just fine with paper.

The last time I voted, I had a scantron ballot that was maybe A3 in size and needed filling both front and back. I'm probably forgetting a few offices, but I was voting for:

* President

* Federal Senator

* Federal House representative

* State Governor

* State Secretary of State

* State Senator

* State House representative

* Mayor

* City Council (slate)

* Sheriff

* State corporation commission (slate)

* Judges (slate)

* 5 or 6 ballot initiatives

* 1 or 2 local initiatives (i.e. school funding bond overrides or the like)

How frequently do you get a ballot that size? Are they all on four or two year terms?

Are you highlighting a problem or verifying that a paper ballot worked fine?

18 US states currently do use paper ballots.

https://ballotpedia.org/Voting_equipment_by_state

Precincts are the smallest political jurisdiction. With poll sites, each precinct's election is administered independently. That's how paper scales.

How large is your precinct? Probably somewhere between 0 and 1000. Totally manageable.

And how large is your state? 1000 precincts? So you have to add up 1000 numbers (times number of candidates). Also totally manageable.

Fraud must NOT scale.

It's not like this stuff grows on trees, after all

Population growth in the US is approaching 0.7% annually and has been declining for 2 decades. Not sure what scaling needs you foresee.

Paper counting scales quite well. Infact it is trivially scalable.

Right. Even if the system is fraud proof. It must be so transparent so everybody understands how it works.

The US has not experienced (yet) a candidate that refuses to accept the results of an election. An unloyal candidate will claim fraud without any proof. And enough people would believe him to cause internal division or even a civil war or a coup d'etat.

It's really not possible to have a coup in the US. Government is too distributed for a quick take over. Civil war, on the other hand, could still happen, but I think it would probably end up with just a few stand-off situations and be resolved quickly.

I believe that the population of americans that view politics as reality TV are the majority.

Also, Bush v. Gore, florida election results, 2000. AKA "The Hanging Chad" incident. Also happens to be the year that americans at large learned the words "enjoin" and "disenfranchise."

Is it really viable to apply old world paradigms to USA?

> It's really not possible to have a coup in the US

Then what exactly happened on 9/11? In non-banana variety republics, the person in charge of national air defense would have been minimally subjected to a court martial. This still happens here too [1] for far less serious events.

The general in this case, however, got promoted. [2]

> US. Government is too distributed for a quick take over

How about a very slow and deliberate take over. Would that work?

[1]: http://www.stripes.com/news/middle-east/another-navy-command...

[2]: http://www.jcs.mil/About/The-Joint-Staff/Chairman/General-Ri...

> How about a very slow and deliberate take over. Would that work?

No, that is not what a coup is.

I think you're assuming a coup against the government, which I'm not sure has ever happened anywhere. Any coup would come from a portion of the government, aligned with powerful interests external to the government.

As an example in the U.S., let's say that 3/4s of Republican governors, along with half of Republican Senators, and an absolute majority of the House, the vast majority of their individual financial backers, and a large number of generals decided that Trump lost due to voter fraud that occurred largely in states and cities with Democratic administrations. A group of them then read an open letter on Fox News about it, and the reading, while not carried on major networks, is broadcast on all channels by Comcast, Altice, and Cox Cable. As the letter is being read, a mass email goes out to the Trump email list to converge on the White House in DC and Clinton Foundation headquarters for a peaceful protest, named "Occupy the Crooked Election." As the thousands accumulate, the Governors that can announce that they're going to mobilize the state militias to do a recount, or rerun the election.

Is this impossible? How do you walk it back? Also, didn't we just have a massively blood soaked civil war 150 years ago?

State militia? Are you from the 1800s? The California State Army Reserve is 1500 strong. The California National Guard is 18000.

What's your point exactly? While the term "state militia" is a bit unusual these days, that's effectively what the National Guard is.

The National Guard doesn't report to California.

> A group of them then read an open letter on Fox News about it, and the reading, while not carried on major networks...

Fox isn't a major network? (Or did you mean "not carried on other major networks?)

For a succesful coup, you have to do a few things very quickly (hours),

  *Take over the media (simply not possible in America 
   due to the volume), initially to block 
   information 

  *Take over the Military (Too large and diverse 
   to accomplish in America.)

  *Arrest/Detain all political opposition.  
   (there are simply too many local governments 
   in America for this to happen.)

You have hours to accomplish all of this. If you can't manage it in hours, you will have an uprising and if you aren't quickly put down, you are in for a civil war.

Why would you even need #3? You simply make them persona-non-grata, or make them believe they are the bad guys (and hey, bad guys always complain about being bad guys!)

#1 is entirely feasible. #2 is entirely possible as well - there are lots of revolving doors with defense contractors and the DoD... heck, just read through the Patraeus scandal [1]. This a 4-star General (Commander of CentCom), Director of CIA and was a likely presidential candidate - just read through the tawdry and incestuous relationships within the community, and wonder at how easy it'd be to simply bribe everyone with an offer they couldn't resist.

[1] https://en.wikipedia.org/wiki/Petraeus_scandal

I posit this can be planned indefinitely. Once the hammer drops, yes countdown time is hours, but... take a look at the 2000 election results and the weeks it took to finally stop the clock on vote counting.

2 & 3 are why the coup in turkey failed.

Because the coup in turkey and foreign hacking of elections is so analogous...

There are only six[1] media corporations in the US.

[1]: https://en.wikipedia.org/wiki/Concentration_of_media_ownersh...

Backstory: outsourcing our election administration to corporations. With the business model switching from bulk rates to per voter (whether they voted or not). That's the driver for all these disruptive changes.

With paper based precinct voting, perhaps 20% of the work is done outside. Mostly printing, ballots, pamphlets, poll books. But also buying some simple gear, like the optical (scanotronic style) scanners or punchcards (whatever is used).

Adding touchscreens to the mix outsourced more stuff.

With postal balloting, I'd estimate 50-60% is outsourced. For more printing. Signature matching. Ballot image scanners. A lot of bookkeeping software.

With internet voting, closer to 100% of the elections will be outsourced. What jurisdiction is sophisticated enough to build, run, maintain voting systems? None. So every jurisdiction will be like the state of Georgia, where all of election administration is conducted by a corporation.

Buddy of mine is trying to sell me on blockchain voting. Claims it'll protect privacy via some kinda tor like onion routing whatever.

I don't even care.

If we adopt some magical crypto voting system that actually work for our form of elections (unlikely), we'll completely forfeit the primary function of our governments, which is administrating elections.

Private voting and public counting will be gone.

> Private voting and public counting will be gone.

I may be missing your point or misunderstanding your comment, but what you describe there is a by-product of a successfully developed blockchain-based voting solution.

Everyone's votes are verifiably recorded, but publicly anonymous. You can still conduct public counts and everyone with access to the blockchain's ledger (or a trusted method of viewing the ledger) can confirm that the only votes that count towards the contest are those actually recorded. The additional benefit is that at any point in time, you can revisit your own vote to confirm it is still contributing to the outcome as it should.

I don't see how this in any way undermines or "forfeits the primary function of our government, which is administrating elections." This may be due to our differing opinions on what the role of government is. Generally my reasoning falls closer in line with Milton Friedman's (paraphrased) view:

> Government has three primary functions. It should provide for military defense of the nation. It should enforce contracts between individuals. It should protect citizens from crimes against themselves or their property.[...][1]

--- [1] http://www.goodreads.com/quotes/578626-government-has-three-...

HUMINT is much more resource intensive than SIGINT. Paper voting is much more secure for persons than e-voting / polling.

Blockchains are more easily conducive to side-channel attacks at revealing who a person voted for than paper voting is.

I don't disagree you. I'm not aware of a production-grade blockchain voting protocol that yet exists that is resilient against one or more of the currently known de-anonymization attacks.

I'm not even sure it's possible to build one, given that humans are a portion of the workflow. On the other hand, I'd love to be proven wrong.

Any good suggestions about how blockchain systems propose to securely and anonymously distribute voting power?

In the paper system Michigan uses, ballots are not distributed anonymously, but the identifying information is torn off the ballot before it is counted and secured.

(I think it's pointless to propose a voting system that depends on individuals securely managing a cryptographic wallet; it's pretty clear we don't yet live in a world where that's a good idea. But it'd be interesting to see how they propose to solve the above problem.)

edit: logfromblammo answered my question below: https://news.ycombinator.com/item?id=12382298

"You can still conduct public counts..."

Do you have any examples of corporations submitting to FOIA (public record) requests?

My point is that our elections are being privatized. Internet voting is just the excuse.

"...my reasoning falls closer in line with Milton Friedman's..."

Mine's closer to Abraham Lincoln's:

  of the people, by the people, for the people

Elections are what give a democracy its legitimacy. The right to vote precedes all other rights. Like the Zeroth law of Robotics. It's unstated because it's assumed because we voted ourselves (nation) into existence.

> Do you have any examples of corporations submitting to FOIA..

No, I don't. "Public counts" in my comment refer to how the individual votes would be captured within a blockchain's ledger -- by design, visible and traceable.

I appreciate your follow-up. The right to free expression, and by association, the ability to vote, define our constitutional republic. It's so basic that I didn't consciously recognize it.

Is there anything that can solve this other than what you've described? They will grow and push indefinitely. It's like mass surveillance. Encryption works. It can just be impossible. The truly terrible outcome is if "internet voting" is both an excuse and becomes recognized as such. Then the public will fear "internet voting" for X decades. Even though it's ultimately the solution to this problem.

> The additional benefit is that at any point in time, you can revisit your own vote to confirm it is still contributing to the outcome as it should.

Cryptography is not my strong point, so forgive me if this is obvious to others, but how can we build a system which simultaneously:

1. Allows you to verify that your vote counted in the direction you wanted it to

2. Allows you to be confident that your public "receipt" (half of a key, or whatever you use to confirm your vote counted) is unique, and you aren't sharing it with someone else who voted the same way (lumping multiple votes under the same "verifiable" vote)

3. Prevents you from publicly proving you voted in one direction, thus allowing you to sell your vote?

To put it another way, what good is it to be able to privately verify to myself that I voted in one direction if, when I find a discrepancy, I can't prove to people that the system miscounted my vote? Yet if I can prove it, what's stopping me from selling my vote?

As far as my research goes, we can make a secure system fairly easily which solves 1 and 2, but not 3. Getting all three may even be an impossibility theorem without physical control of the data (e.g. paper ballots). The cryptographic solutions are very new though, and there may be a breakthrough I haven't heard of yet. Still hopeful

How would blockchain voting address the ability to give your votes away prior to the election? (Or does it?)

For example, if I have one "votecoin" that I vote with that isn't tied back to me (as per necessity of private voting), how can the system ensure that it's actually me voting, and not just whoever I gave/sold my vote to beforehand?

Blockchain voting has yet to solve the biggest issue with voting: membership. How do we know that every vote came from a person who is supposed to be registered and that each person cast exactly one vote?

Hard problem.

That's just it, it isn't precise, at all. No one seems to remember 2000. It was a disaster in large part due to the lack of precision of paper voting. Those who don't remember are doomed to repeat I guess.

They were punchcards, not paper.

At this point, there is no reason not to use actual paper. Computer scanning and counting has gotten really good.

That doesn't really help, though. With "marks on paper" voting, you don't have to deal with the hanging chad problem, but you get whole crops of people who don't fill the bubbles completely, or who partially mark two different bubbles, or a whole litany of other potential ambiguities.

I still agree that paper isn't vulnerable to the mass-scale undetectable vote-rigging that electronic machines have the potential to be! But it does have its own weaknesses: people who decided to switch to electronic definitely had credible reasons in mind at the time.

In Germany it's all paper and actual people doing the counting. I know Germany is not as big as the US, but it's not a small country. We usually have the first results at 6pm on voting day and the final results usually don't differ much from the first results.

> With electronic voting systems it is physically impossible to prevent manipulation and provide control.

I don't know with a key tied to your vote that can be verified by yourself isn't half bad. Though then the exploit moves to the tallying of the votes since no one can independently do that...

I feel like electronic voting systems have to be the future but so many seem to think it's impossible it makes me wonder what the ultimate solution will end up being.

Isn't the blockchain technology that Bitcoin uses, perfect for this? It is 100% public, and you can review your vote easily.

Each person just needs a private key, and it could actually be issued once for each election.

However, I am not saying that we are ready for this, as not everyone is able to access the internet still.

That seems like a solution that could work. Granted someone could take your key and vote but they can already do that with paper ballets or a fake ID today anyway. I'm sure there are drawbacks but that's probably closer to the final solution.

We should have some scannable code on the voter registration cards that allow users to easily use their private key when they vote electronically.

all of it will be tallied up electronically regardless and you can manipulate it in any number of ways paper or not, challenged elections have shown as much.

so I don't understand this fantasy that "paper" which is an ambiguous term is bandied about as the ideal solution. From paper ballots to punch cards, there are hundreds of stories of fraud. If you don't just up and lose them or mysteriously get different votes than the district involved would imply. If you can't find fraud you simply challenge the votes until you get the results you want, keep some polls open than longer, or take people to vote and help them.

The ideal solution is getting it out of the hand of politicians into an independent board which can implement and secure it as needed.

The real reason this comes up is because one side or another wants an excuse for losing over and over at various levels. It also is because it is becoming even more difficult to hide fraud that they have to scream its more rampant than ever or lurking right around the corner.

> With electronic voting systems it is physically impossible to prevent manipulation and provide control.

Seems like a double standard. With paper it is impossible to prevent manipulation & provide control as well. To wit, the countless examples of election fraud:

https://en.wikipedia.org/wiki/Electoral_fraud

With either system is a question of risks & mitigation strategies. Neither system can guarantee the elimination of fraud.

It's about preventing easy scaling of voting fraud. To corrupt vote counting at multiple precincts when using a paper-based, manual counting system, requires the bribing of a lot of people in different locations, and is hard to keep quiet and go unnoticed the larger it gets. Using a digital voting system, if the software or firmware of any part of the voting process is compromisable, likely no-one will be able to tell, any many precincts affected.

I would guess that the writer started with a concept along to lines of "with electronic voting systems [that are connected to an external network], it is impossible to physically prevent manipulation and maintain control", which is true. I would guess that (s)he then allowed the hyperbolic urge to switched the formulation to "physically impossible." This is trivially false in a literal sense, an appeal to a qualitative notion of "impossible", which brings the argument into a context that is very familiar to Scotsmen and their imitators.

Within this context, there is indeed a double standard, as indeed it is no more possible to prevent a true Scotsman from committing electoral fraud with paper than to confound him with electrons. However, a claim may be misleading, unfair, or erroneous irrespective of whether it involves a double standard.

I believe that you make an error in seeking relief from the double standard. Essentially you are establishing that if we are to accept the first patently false assertion, we must equally accept the second (which is true)... and then agreeing to accept both.

So we are already quite far into the woods when we come to my reason for responding to you.

What you have presented is an example of the 'appeal to link' fallacy. You have suggested (and believed, probably) that there are countless examples of electoral fraud, and offered a link.

However, the document you have linked does not present or even suggest that there are countless examples of electoral fraud. It is a wikipedia article that enumerates specific methods of electoral fraud, loosely defined.

Furthermore, the document implicitly assumes the truth of the original assertion that is the subject of debate, namely that there are categories of fraud to which electronic voting systems are uniquely susceptible.

I was tempted to conclude that "this is why we can't have nice things", but the truth is that we could have much nicer things if we took a moment to step back and examine what we are discussing just a little more carefully.

Seems like the best system is electronic that prints out a machine readable and human readable tape that the voter can verify, and in the event of a dispute, a human recount based on the tape is the final word on the result.

In 2009 the German Constitutional Court (similar to the U.S. Supreme Court) had to decide about voting machines and made an interesting decision which de-facto banned them. They didn't really ban them, but simply set some requirements (apart from the usual as anonymity etc.) for voting machines which as of today none of them can meet:

"When electronic voting machines are deployed, it must be possible for the citizen to check the essential steps in the election act and in the ascertainment of the results reliably and without special expert knowledge."

So your average neighbor, grandma and co-worker must be able to understand how you came to the result because that's important in a democratic process. Your open-source voting machine software doesn't meet that requirement and neither does your fancy blockchain-based cryptographic system. But paper does: You make a cross on paper, you count them.

You can find an official, full English translation of the ruling here: http://www.bundesverfassungsgericht.de/SharedDocs/Entscheidu... (my quote is from paragraph 119).

Australia has already crossed the Rubicon with electronic counting of votes. The sweeping changes to the preference rules just before the last election also meant all the votes are tallied by Fuji Xerox in Canberra. They produced a video of the entire process and posted it to YouTube with locked comments. I have put a copy of this on Vimeo so others can comment on it as it is the scariest thing I have seen in a long long time. Please give it a watch even from 2:10 when the scanning in batches with the Windows PC is being done... https://vimeo.com/177354514

I find it amazing how strong the anti-Russian rumor mongering is in this election.

I thought we already had reached the point where 'Terrorism' has replaced 'Russia' as the perpetual enemy figure. Is Trump's soft stand on Russia so scary to some? Apparently attributing anything unattributable to Russia is having a massive comeback right now.

If China and others would at least be occasionally mentioned as potential alternative attackers, these reports would look a lot less as some one sided opinion engineering operations.

This is really due to the increasing tension between the two super powers. Russia has been on the loose, and Obama has done little to challenge them to try and reign them in. I would suspect this is why they get blamed for everything - regardless of the evidence. It's very "cold war era" feeling to me when both sides would blame each other for the smallest thing.

Lots of increasing geopolitical drama and it probably won't end anytime soon.

> Obama has done little to challenge them to try and reign them in.

Our sanctions regime crashed their economy (or at minimum, exacerbated their long running problems). It's difficult to say "little to challenge them".

I wasn't aware their economy had crashed. Could you provide a source?

http://www.xe.com/currencycharts/?from=RUB&to=USD&view=5Y

First the illegal annexation of Crimea was "complicated," and now the Russian economy isn't in a freefall? Where are you getting your news?

That's not evidence of a Russian-specific crash. All markets across the globe had a correction in January 2016. According to your chart, Russia has apparently bounced back, just like the rest of the world. This is the DJIA: https://finance.yahoo.com/quote/%5EDJI?p=%5EDJI

Do you have a more specific source?

I think his chart is using the wrong date range. Here is a better one: https://encrypted.google.com/finance/chart?espv=2&q=CURRENCY...

Thanks!

As a US taxpayer, this saber rattling towards Russia makes me unhappy.

Russia has 3 foreign military bases. We have something like 600?

We have announced plans to spend a trillion dollars on more nuclear weapons, and we are placing a few of them near Russia's borders - as far as I know they are not placing weapons along our borders!

Who profits from this? So obvious that I won't even name the usual suspects.

> We have announced plans to spend a trillion dollars on more nuclear weapons

The U.S. spends a trillion dollars on nuclear weapons per 20 years. [1]

I agree that disarmament is a credible and the optimum mechanism for reducing risk of the use of nuclear weapons in war and in testing. I think that using hyperbole discredits earnest efforts to this aim. The broadside against secret profiteers ("the usual suspects"?) compounds this.

[1] http://www.icanw.org/the-facts/catastrophic-harm/a-diversion...

>I find it amazing how strong the anti-Russian rumor mongering is in this election.

Because there's evidence? If there was countervailing evidence that some other organization was at fault, I'm all ears, but there's currently only one probable explanation.

There has been quite a few claims of Russian hacks recently that were based on very weak evidence. Additionally, most of the stronger claims came from anonymous gov sources without any public evidence at all. So this is why people are becoming skeptical of the Russian fear mongering.

And yes,they are a threat and are hacking public networks just like the NSA, GCHQ, PRC, etc but it seems like the automatic reflex to blame Russia for everything. Which is unscientific and risky - for example, it makes it easy for other adversaries to fool the victims into thinking they are Russian just by using a Russian proxy server to conduct attacks.

Because there's evidence. The same way there's evidence of ransomware and other malware industries being propped up by Russia, Russia cheating in the Olympics, Putin murdering journalists and rivals, Putin annexing parts of Ukraine, Putin powering the eastern conflict in Ukraine, Putin purposely bombing US aligned rebels in Syria, etc, etc. All these things were denied by Russia and Russophiles. And that's on top of Russia's incredibly corrupt economic system, where 35% of the wealth in Russia belong to about 100 people.

I think a lot of Russophiles are getting the big dose of reality we've been warning about for quite some some. I don't think how its even possible to start giving Russia this benefit of the doubt considering its leadership's recent actions and the evidence we have. If you think Russia doesn't have a non-stop cyberwar with us then I've got a bridge to sell you.

Ukraine situation is way more complicated than Putin simply annexing it. Lots of history there and lots of US meddling as well as Russia.

Additionally, our economic system is far from perfect too. Ever heard of occupy Wall Street? Lots of wealth inequality here.

Awareness of the facts does not a Russophile make. Russia is a global superpower and it acts like a superpower, as do other superpowers.

> Ukraine situation is way more complicated than Putin simply annexing it.

Look, it's Europe. Everyone here has a history with everyone here.

Russian annexation of Ukrainian territory, in violation of every possible treaty and its own constitution, is not a matter of opinion. It's also first in Europe since WW2.

Russia isn't the only country that violates international treaties and its own constitution...

Ever heard of Victoria Nuland, assistant Secretary of State for European affairs during the Ukrainian crisis? "Fuck the EU" she said: http://www.bbc.com/news/world-europe-26079957

Have you read the transcript outside this phrase? It's always the profanity part being quoted, for lack of anything controversial.

But well, Britain said essentially the same during Brexit, and I don't see Putin fans upset with that.

I know you make it some tit-for-tat scheme, where Russia is justified to retaliate the USA for some real or perceived sin. However Russia doesn't leash off on its stated archenemy, as humiliation of defeat is not something Putin is looking for. Instead it backstabs Ukraine, the nation without a functioning military and reeling from domestic crisis, which is hardly responsible for injustices of the United States.

"Putin fan" is not a term I would use to describe myself or anyone who is seriously analyzing the situation from a rational unbiased perspective. Nor would I use "tit-for-tat," "backstab," and "archenemy" to describe the events that have transpired.

It makes it hard to discuss/analyze history with someone who is assessing the situation in those comic book terms with a clear anti-Russian bias.

My intention was not to defend Russia but simply to give evidence on the complexity of events in Ukraine and the multiple actors involved. Personally I find this complexity extremely interesting.

Is there a specific point you want to get across? Your dramatic retelling of the events in Ukraine is entertaining and I encourage you to adapt it into a screenplay and sell it to Hollywood. Aside from that I'm not quite sure what your specific point is.

> "Putin fan" is not a term I would use to describe myself or anyone who is seriously analyzing the situation from a rational unbiased perspective.

You certainly wouldn't use it as you rightly perceive general hostility to Putin fans over here. I'm not sure what your propaganda fix is. Your casting me as an unsophisticated American, despite my blindingly obvious Russian reference username suggests you are a 2nd gen immigrant, so it's prolly RT. But it's certain you like to think that your opinion is not formed by propaganda in one bit, and you rather arrived to it independently (even if down to same exact talking points) at a bidding of your intellect.

I won't even bother you asking the shebboleth of "чей Крым", as I certainly know the kind of "it's complicated" Putin-fan-in-a-hostile-environment answer it would entail. If it walks like a duck, looks like a duck, and quacks like a duck...

The narrative you have invented for yourself to understand me with limited information is fascinating. You have a gift for storytelling!

You should really start writing fiction. Not kidding at all. I loved Rainbow Six. Actually Clancy in general. It's just fun stuff to read. Throwing in Cyrillic makes it exciting.

As for my propaganda fix, that's kind of unfair. I mean... What's your propaganda fix? Why are you so intent on labeling me? I'm a human with a brain like you dude... we're brothers on this planet. I read Wikipedia for the most part, read the Times, the Post. I monitor CNN and BBC, also Fox News from time to time. Lots of others less so, e.g. Vox, The Guardian, Slate, The Atlantic, Vice. I actually don't watch RT much at all outside of randomly linked YT clips, I'm not even totally sure what they air... You?

Back to the topic at hand, what exactly was your point w.r.t. to the Ukraine situation? Do you disagree that it's a complicated geopolitical issue with multiple stake-holding actors?

BTW Your conspiracy theory that I'm a low-key "Putin fan" reminds me of medieval witch hunting. Honestly, HN really isn't a hostile environment to be a "Putin fan," but you know what is? Ukraine! rim-shot

It's sad that, in these modern, presumably more civilized, times, one can't offer a more complex analysis of world events without being labeled a "Putin fan" or being accused of being brainwashed by Russian propaganda. What a time to be alive!

Let me renounce the devil for you and calm your paranoid anxieties. I am not a "Putin fan." Putin sux0rZ! Feel better? Can you not burn me at the stake now?

Yeah, he annexed it covertly, denied it was him, his loyal supporters denied it was him, and then when it turned out it was him, suddenly his loyal supporters justified with "lots of history and lots of US meddling."

That does make you a Russophile.

I don't believe I justified any of Russia's actions. It's a complicated situation and there are lots of questionable actors...

For example, there is credible speculation that the US funded anti-Russian neonazis in Ukraine http://www.thedailybeast.com/articles/2015/07/04/is-the-u-s-...

Am I saying the US is "bad"? Am I saying that Russia is "good"? No, I'm saying proxy conflicts like this are gray and complicated and it's not a typical "good guy" "bad guy" situation.

Betteridge's law of headlines applies to your linked article.

> The House unanimously adopted bipartisan amendments to H.R. 2685, the “Department of Defense Appropriations Act of 2015.” And one of them specifically blocks training of the “Ukrainian neo-Nazi paramilitary militia ‘Azov Battalion.’”

> This is in addition to criteria established in an amendment to the Foreign Assistance Act of 1961, originally sponsored by Sen. Patrick Leahy, known as “the Leahy Vetting Process.” The Leahy process consists of screening foreign forces applying for U.S. Government training and support to certify that they haven’t committed any “gross human rights violations.” If they are found to have done so, support is withheld.

So, no, the US is not intentionally funding neonazis and in fact, is trying very hard not to. They are providing training requested by the Ukrainian Ministry of Interior against a Russian aggressor that has shot down a civilian passenger aircraft, among many other crimes.

It's undeniable that the euromaidan protests had a strong right-wing nationalist component. They were violent and essentially terrorized the country.

This essentially led the president of Ukraine to resign. That right-wing faction then controlled Ukraine's government, and is still very strong in Ukraine.

We immediately recognized that new government and provided them with aid. That is insane! In the west, their only saving grace was that they were anti-Russian.

The logic of Putin apologists never ceases to amaze me.

I remember when the situation in Ukraine/Crimea was just unfolding and I was discussing it with a friend. At first his position was "There is no proof Russia is in Ukraine, that is just Western propaganda. What do you think, Putin is trying to annex Ukraine? Come on, that's ridiculous" a few months later, Putin annexes Crimea. All of a sudden, his argument changes to "Well Crimea has a very interesting history, and plus, all the people living there really want to be part of Russia" you can't win with these people. They will keep changing their argument. If Putin annexes all of Ukraine tomorrow, you will see the same changes in their arguments with justifications for his terrible decisions.

Also, you can always bet on them saying something along the lines of "Well the US did X, so that totally validates Russia doing Y"

Ukraine is not an isolated event. It's yet another chess piece in a long and drawn out American/Russian chess game that's been played since WW2.

Yes, Russia is being bullish on Ukraine. This is happening after America has expanded NATO into multiple ex-Warsaw pact countries eastward of the Berlin Wall after an agreement was made for that not to happen. http://spiegel.de/international/world/a-663315.html

Given that there is evidence that America was also meddling in the future of Ukrainian government, it's not hard to see that Ukraine is an important geopolitical asset that both superpowers are willing to manipulate. It's not as simple as Putin annexing Ukraine for some evil world domination plan, it looks more defensive than offensive on their part in the grand scheme of things.

The fact that your friend was wrong does not make all geopolitical analyses that are more complex than Russia being the bad guy and America being the good guy incorrect. Any argument that the situation is morally clear cut is overly simplistic and harmful.

Which country joined NATO due to tanks rolling through it?

It's intellectually dishonest to act like a country choosing to join an alliance is the same as a country being invaded and annexed. If that region wanted to become part of Russia, why did tanks have to do it? If it's defensible that Russia rolled tanks through a sovereign state, why did Russia deny it was them?

NATO arguably going against its word does not warrant a clear cut violation of state sovereignty.

Both countries have been meddling in other countries for decades but the key difference is that Russia annexed a part of another country, the US has not. That is a very important difference you need to appreciate.

I never said I didn't appreciate it but context also matters. Tactics matter, I agree, but so do intentions. Russia has more to lose than America has to gain. If Ukraine joins NATO, Russian then borders NATO. Ukraine is essentially their queen on the European front. There would be no Ukraine crisis if we hadn't courted ex-Warsaw pact countries into NATO in the first place. You need to appreciate that, unless you think Russia should be destroyed. I'm an advocate for peace and balance so we would subjectively disagree at that juncture.

There is a reason we gave Poland to Russia after WW2. Buffer countries ease tensions between superpowers.

Of course context matters, and I fully understand that no country here is innocent, but it is important to gauge the severity of one action over another. In this case, the US is making allies with Russia's neighbors, and Russia is annexing another country. Do you agree that Russia's actions are much more severe than the US's? One could also argue that Russia's actions in this instance has sped up the exact thing they do not want (more countries joining NATO). What was the ideal outcome for Putin in Crimea? Ruin relationships with Ukraine and the US while scaring many bordering neighbors into joining NATO and/or building up their military? For what?

As for wanting Russia destroyed, why would I wish that on my home country? I love Russia and its culture and ~5 years ago I was excited to finally see the relations between Russia and the US finally maturing and opening up to one another. Putin's terrible decision in Crimea (among others) has ruined any chance of that happening anytime soon.

Yes Russia's actions were more severe, that much is true. I'm simply putting it into context. Ukraine is of the utmost importance, so I can see severe circumstances culminating in severe actions. Again, these present circumstances were slowly aggravated by the US over the passed 20 years, that can't just be ignored. There are lots more chapters to this story that we haven't even discussed.

I don't see Russia offensively invading other countries right now, Ukraine seems more like a defensive move after lots of US-led political meddling in Ukraine specifically (this is NOT normal http://youtu.be/AmkvO_IwsZ0). When Russia initiates unprovoked military invasions on other countries (which some publications have speculated on) then I will gladly unilaterally condemn their foreign policy. Right now it all seems very gray.

How are you still denying that a covert military operation to seize land from another country is the very definition of an unprovoked military invasion.

Unless "provocation" to you includes "they started to like America?"

Ukraine was in total disarray due to a violent revolution to depose its democratically elected president. The Russian annexation, i.e. intervention, was arguably done to stabilize the situation on their part. A referendum was held after the fact. Not to mention that Crimea was previously a Russian subject not 60 years prior.

I don't see this as unprovoked in the same vein as the invasion of Iraq, for instance.

The Ukrainian conflict is ineffably more complicated than they "started to like America." This sort of thinking is not productive when trying to make sense of world events. There are lots of factors at play here, economic, cultural, historical, political, and so forth.

This has been my only thesis from my OP. If you disagree with me, you're saying the Ukraine situation is as simple as Putin being an evil invader. I think that is a flawed, incomplete, and unproductive analysis of the situation. If you are interpreting me as defending Russia you are totally missing the point.

> Lots of history there and lots of US meddling as well as Russia.

You're using a classic Soviet argument tactic: https://en.wikipedia.org/wiki/Whataboutism

You're not responding to the above poster on merit at all, you're deflecting.

No, you're not responding on the merits. Mentioning the fact that America is involved with a faction in Ukraine and Russia is involved with a different faction in Ukraine when discussing Ukraine is not "whataboutism." Mentioning the fact that America is involved in any situation in the world ("how can they judge us on this when they do that?") that wasn't the exact situation under question could be "whataboutism."

The OP didn't even express any disapproval of what Russia did in Ukraine, so how could it be "whataboutism?"

Accusing someone of using a classic Soviet argument tactic is a classic Ad Hominem tactic.

> Accusing someone of using a classic Soviet argument tactic is a classic Ad Hominem tactic.

This.

> Because there's evidence.

Maybe I'm not up to date but what kind of evidence are you talking about exactly? Could you point me to a source?

As for your other points, I'm not sure what you're trying to achieve here. Your points have nothing to do with each other, so if you're just trying to portrait Russia and/or Putin as the "source of all evil", then I've got some bad news: One could easily turn your points on the head and do the same with the United States.

Examples:

> Putin purposely bombing US aligned rebels in Syria

The fact they're US-aligned doesn't make them good. Newsflash: The US have been supporting extremists in the Middle East for decades, as long as it fits their bill. Besides, in terms of international laws, the West is the party that is illegally engaging in Syria, not Russia.

> Putin powering the eastern conflict in Ukraine

The same thing could be said about the West, if you look at engagement in the Ukraine, financial support for various groups there, one-sided media reports that are closer to propaganda than anything else…

And don't even get me started about US engagement in the Middle East and powering conflicts there.

Besides, I'm always thinking about what the United States would do if there was a conflict / civil war in front of their borders… clearly they would engage.

Conclusion: I'm not trying to defend Russia at all or justify its actions, I just find it funny that we in the Western World tend to only look at what bad things other countries do when we're probably not any better.

I fully agree with the sentiment of saynsedit's post farther down:

> Am I saying the US is "bad"? Am I saying that Russia is "good"? No, I'm saying proxy conflicts like this are gray and complicated and it's not a typical "good guy" "bad guy" situation.

> Maybe I'm not up to date but what kind of evidence exactly? Could you give a source?

Wired: "According to a number of top cybersecurity researchers, they're probably right." (https://www.wired.com/2016/07/heres-know-russia-dnc-hack/) Wired cites the following firms: Crowdstrike, Fidelis Cybersecurity, Mandiant... and a professor named Thomas Rid. Apparently Crowdstrike is the firm hired by the DNC specifically (https://www.washingtonpost.com/world/national-security/russi...) but there's more than one organization mentioned.

New York Times: "American intelligence agencies have told the White House they now have “high confidence” that the Russian government was behind the theft of emails and documents from the Democratic National Committee, according to federal officials who have been briefed on the evidence." (http://www.nytimes.com/2016/07/27/us/politics/spy-agency-con...)

Reuters: "U.S. intelligence officials told top congressional leaders a year ago that Russian hackers were attacking the Democratic Party, three sources familiar with the matter said on Thursday, but the lawmakers were unable to tell the targets about the hacking because the information was so secret." (http://www.reuters.com/article/us-usa-election-democrats-hac...)

The Daily Beast: "The researchers, at Arlington, Va.-based ThreatConnect, traced the self-described Romanian hacker Guccifer 2.0 back to an Internet server in Russia and to a digital address that has been linked in the past to Russian online scams. Far from being a singly, sophisticated hacker, Guccifer 2.0 is more likely a collection of people from the propaganda arm of the Russian government meant to deflect attention away from Moscow as the force behind the DNC hacks and leaks of emails, the researchers found." (http://www.thedailybeast.com/articles/2016/07/26/dnc-hacker-...)

If you want notes from the cybersecurity organizations, why not head to both Crowdstrike's blog on the subject (https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...) or ThreatConnect's blog (https://www.threatconnect.com/blog/tapping-into-democratic-n...) or a link to Fidelis Cybersecurity's blog (http://www.threatgeek.com/2016/08/fancy-bear-has-an-it-itch-...)?

This honestly doesn't seem like weaksauce evidence at first glance. Of course since this is politics / national relations, "you never know". But what I don't see yet via a Google search is a post in a cybersecurity research organization's blog saying Russia didn't hack the DNC.

If you come across that, let me know. At present, the argument some are making -- that the evidence that Russia didn't hack the DNC -- seems weak to me. There's just no evidence I am encountering that Russia wasn't involved.

Aside from the fact that Russia really does seem to be implicated in this...

That you're hearing so much about Russia this year is due to the fact that the Democrats have made it something of a theme of this campaign season [0].

I would suggest that, the Republicans having already "won" terrorism messaging, the Democrats have embraced anti-Russia propaganda so they can have their own bogeyman to fight against. With Trump's documented ties to Russia, the Democrats can "own" attacks on Russia without risk of retaliation.

[0] https://theintercept.com/2016/08/08/dems-tactic-of-accusing-...

All "implicated" means is accused. The fact that the Democrats are accusing the Russians creates an implication. What's short is the evidence.

Democrats are campaigning to the patriotic right of a populist candidate, and they can't be anti-Muslim because the populist candidate planted his flag in that on nearly the first day as far to the right as you could go short of internment camps. Russians are all that is left, and they're stuck with trying to make Ukraine sound like a terrifying first move towards something.

Perhaps there is evidence as others have suggested (as I am sure there is of US involvement in Russian affairs). In fact it would be surprising if Russia weren't at it. This is after all the age of cyber warfare so it is extremely unlikely that all major powers aren't trying to coerce the system to their advantage. That said it seems that most of the Russian scare tactics are coming out of the Hilary camp as an attempt to deflect from her own shortcomings. Every time something illegal she did comes up the Russian scaremongering gets ramped up a notch. Classic deflection tactics. It is also convenient given that Trump seems to be pro-Putin and many Americans have been conditioned to fear the Russians for decades. America has already lost this election regardless of the outcome.

> Apparently attributing anything unattributable to Russia is having a massive comeback right now.

Could that be because the US and Russia are currently engaged in a low level proxy conflict in Syria? The "Great Game" (https://en.wikipedia.org/wiki/The_Great_Game) of exerting economic and political influence continues...

Give me a break. The issue is not only that Trump has taken a "soft stand" on Russia, as you put it. It's that the guy running his campaign (Paul Manafort) has very clear ties to pro-Russian politicians in Ukraine, and Trump himself appears to have financial ties to Russia. Not to mention that everything the guy is saying publicly about Russia is against even the Republican playbook, so it looks like he is aligning closer to Russia over the United States.

http://www.politifact.com/global-news/article/2016/may/02/pa...

http://www.nytimes.com/2016/04/06/us/politics/donald-trump-s...

https://www.washingtonpost.com/politics/inside-trumps-financ...

http://time.com/4433880/donald-trump-ties-to-russia/

I'd imagine that every major US bank, healthcare provider and government department have been breached at some point by unauthorized person or persons. It's almost impossible for this not to be the case to my mind.

"Still, the FBI warning seems likely to ramp up pressure on the Department of Homeland Security to formally designate state election systems as part of the nation’s “critical infrastructure” requiring federal protection"

I can't believe what I am reading!

What are they waiting for ? For the Russians to rig the election? seriously...

Yep. It's bad enough when the democrats and republicans rig elections.

Legal consensus? De-centralised elections are not something we should give away in a panic. The costs and benefits need to be weighed before a prudent plan is developed and implemented.

Rushing to put the nation's electoral system under the federal guidance of an organisation not precisely lauded for its transparency or democratic values is at least a bit troubling.

They could at least provide help to properly secure the state election systems instead of reacting after a breach. Why not try to secure the systems to a higher standard and be proactive?

"Securing" as in reaching in and making changes? Or "securing" as in publishing guidance around best practice?

Latter, I'd be fine with. I'd even go so far as to requuire it by law. The former amounts to an unelected federal body with a nasty history tampering with election electronics.

Publishing guidance around best practice should be mandatory when dealing with government infrastructure, these election systems are not "low level" target they can potentially influence the course of history if they are rigged.

This is why groups like 18F are very important and need to be really well supported by the American People. IMO 18F shouldn't be a part of GSA and should live on it's own.

18F is too small to live on its own in the federal beuracracy. GSA is the correct parent org by alignment. Mandating it's existence in US Code would be helpful, though it may be premature to define it's scope yet.

That's fair, and I agree today it's not appropriate for it to live outside of GSA, I more meant in a perfect world it would be the office of the CTO or something similar where they had real mandate and power to improve things, that being said I'm relatively new to this government stuff so I'm not sure what can and cannot be done.

The racial dimension should not be overlooked: http://www.reuters.com/article/us-usa-election-voting-observ...

The plain facts are that a substantial number of people in and out of US politics do not want elections to be as fair as possible if that would interfere with white supremacy.

Elections are ran at the state level. There's always opposition to moving state responsibilities over to the fed.

And a good thing - else a badly-designed system would make every state and locale vulnerable.

Right, and you lose nearly all ability to change it later as there will be no basis for comparison.

The FBI wants to rig the elections. No need to think as far ahead as Russia.

Wrote and implemented 5 regional healthcare information exchanges. My team shared this assumption.

My thoughts on e-voting have changed as I've grown older.

In high school and college I said technology is the future! It's insane that we're still using paper and pencil for something so important. Computers are better at counting than humans. Yay e-voting!

Then I realized that you can't trust individual company or organization with that much power & any trusted e-voting software would have to be open source so that it could be independently verified by security experts everywhere.

Then I learned more about how many 0-day vulnerabilities exist and are being stock-piled by state actors for every layer of the stack -- routers, firmware, operating systems, browsers, popular code libraries, etc. It's all been compromised. You can't trust any of it. So you'd have to open-source the hardware too & probably keep the whole thing air-gapped from the internet. And still that might not be enough!

Today I believe there's no way to secure a system (electronic or not) without publishing a log of every vote cast. This gets tricky when you have secret ballots, but there are a couple ways to handle it. The first way would to be to allow people to choose whether they want their ballot to be public or private. That way you'd end up with enough public votes that you should be able to tell whether the election was massively rigged or not (assuming you expect the private votes to follow the same distribution as the public ones). The second option would be to assign everyone a private one-time key when they vote -- a receipt they can look up later. Everyone can then look up the key from their voting receipt on the public log and make sure their vote was tallied correctly. The second option has the benefit of keeping secret ballots, but you'd need a separate way to verify that the number of lines in the public log is the same as the number of people who showed up to vote. That can be solved by publishing a list of who showed up to vote.

Of course, we can't know for sure that we've had a fair election while the NSA dragnet continues to exist. We would never know which candidates were forced to drop out from those in power using their access to surveillance intel to blackmail a candidate or leak their dirty secrets to the press.

Don't assume that the private votes follow the same pattern as the public votes. When you have an election where there is public shaming of people voting for one side, even exit polls are off.

For example, in the "should Scotland leave Great Britain" referendum, there was a lot of public pressure for voting to leave. Those who voted to remain were much more quiet, but in the end, they were the majority. I was actually in vacation just before the vote. Even as an outsider, I could tell that the leave faction was much more vocal, but the remain faction was quietly solid.

They hacked it via sql injection using sqlmapper, now this is serious security.

Sounds alarming - elections at risk!

But its just data taken, right? Aren't voting records public domain already? Is this equivalent to stealing a phone book?

In one case (Illinois) voter registration data was taken. In the other (Arizona) malware was installed.

I'm pretty sure voter registration data is public anyways.

Also, ISTR reading a while back about some guy who discovered a wide open Redis database containing (what appeared to be) millions of voter registration records -- hosted on a Digital Ocean VPS, I think. He reached out to someone (CERT?) who was able to, finally, get in touch with them and get it locked down.

The malware is a much bigger issue, IMO.

If they gained read access, who is to say they didn't also gain write access? What if they started selectively deleting voter registrations from a given party? Or changing the party affiliation to obstruct primary voters?

You just nailed the unspoken vulnerability with the hand count of paper ballots. Despite obvious intent, it is scary how many ballots are dismissed by the colluding parties' representatives.

Just have a SMS message texted to voters once their vote is counted with a link to a scan of their paper ballet. Would make voter fraud a bit harder as each person could validate their vote was correctly counted. If the voter doesn't get their SMS, then provide a 1800 number for them to figure out what happened. This would only stop the changing and non counting of a real voter, but does not stop fake voters from adding their vote....which would need a diff fraud protection scheme.

Voters must not be allowed to prove to others how they voted. That's also a disaster scenario of a different kind. Not just vote selling but voter intimidation.

"If you vote Bob for President and provide proof of your vote, we will give you a free iTunes gift card!"

"We're a Bob for President family, through and through. Everyone get out there and vote, then show me the receipt."

"Hey, did you know that if you forward your receipt to this website with a bitcoin wallet address, they'll send you as much as $20 depending on how you voted?"

Hasn't that ship sailed?

We're all carrying cameras into the voting booth.

Here in the UK you can ask for a replacement ballot paper if you make a mistake.

So you vote for candidate A, photograph it, swap it for a replacement ballot, vote for B, photograph it, etc. and get paid by all the candidates.

Except the candidates know that a photo of a ballot paper proves nothing.

Yes, although (in the UK) it's an offence to photograph your ballot paper and the voting privacy screens are pretty minimal.

How would that prevent voter fraud? I could send you a confirmation for voting one way despite counting your vote differently in the aggregate.

Ha! Let's see those gerrymanders in AZ try and redraw the lines around Chelyabinsk, eh Komrades!

Somebody should throw some blockchain at the remote voting problem and see what happens

Yeah I was thinking blockchain based voting would be cool but how do you hand out keys to people, how to make it easy for anyone and then what about privacy if who you voted for is recorded in the blockchain.

You mail out postcards to registered voters with their asymmetric private key obscured by an opaque scratch-off covering, and a plainly visible public key. If the scratch-off is not intact, the voter requests another via website form, or shows up in person at an office in the county seat. The registration office revokes the key pair for the original card and issues another.

This key is the voter's identity-linked private key.

The registration office then sends a list of public keys without any identifying information information to the ballot office, who encrypts a separate anonymous blockchain key with each public key, and publishes the entire list of results paired with the hash of the blockchain key.

The voter then attempts to decrypt each entry with their private key, and then hash the result. When the hash matches, that is the voter's anonymous blockchain key. Each voter has to make, at most, a number of attempts equal to the number of registered voters in their district before finding their own key.

The ballot office can verify that each blockchain key for that election belongs to a registered voter, but cannot say which one. The registration office can verify that each registered voter has a blockchain key available (by counting), but cannot even tell who bothered to decrypt their key and vote with it, much less what anyone in particular voted for.

Very interesting, but it should come down like two or three orders of difficulty if we want anybody to even remotely attempt something like that.

Going down three orders of difficulty would put us back to dropping colored stones into a jar.

Can you at least identify the bottleneck that makes this system infeasible, in your opinion?

A hard fork?

Would a 2-factor voting model help resolve some of these issues?

My tinfoil-hat wearing twin would like to claim that groundwork is being laid for a massive election fraud this november.

Dear Yahoo.

Look up the definition of TLP:AMBER. You weren't supposed to publish this you asshat.

Love, People who understand TLP

Yahoo is (among other things) a news organization. Of course they are going to publish this, it's clearly newsworthy. Presumably for Yahoo to get ahold of the PDF in the first place, someone else that wasn't supposed to share it did so, but that's not a reason to be mad at Yahoo.

Yet, voting is still not under the purview of the Department of Homeland Security.

> The FBI bulletin listed eight separate IP addresses that were the sources of the two attacks and suggested that the attacks may have been linked, noting that one of the IP addresses was used in both intrusions... “Attempts should not be made to touch or ping the IP addresses directly.”

The whole thing just sounds so basic and rudimentary. They didn't spoof ip addresses or cover their tracks. Then FBI has to remind techs not to contact the hackers directly by resolving the ip. It reminds me that we are a sitting duck if someone with skills wants to do damage.

Just because they used the same IP twice doesn't mean the IP address corresponds directly to an ISP account paid for by the attacker(s). Could just be a zombie or any of a dozen other means of misdirection. It's a safe assumption that the FBI is competent in these matters and knows a lot more about this than they're saying even in this leaked document.

"It's a safe assumption that the FBI is competent in these matters" LOLOL, ok. Clearly you've never listen to James Comey talk at length on, well, any subject at all.

It's also safe to assume that the FBI Director is not in the weeds on highly technical investigations like this.

I mean the guy is a bumbling fool, so I can't imagine he knows how to build a team of competent technologist,something you tend to be charged with doing when you're the director. His congressional hearing talks are embarrassing. eyeroll

You can't really just "spoof ip addresses" with most protocols.

The ip's are prolly proxies/owned boxes/relays.

Yes, which makes me wonder why they're trying so hard to push the "Russians are doing it" narrative. Although I have no more evidence than do they, it feels rather like a diversion.

Can't let people think you aren't capable of attributing attacks.

Yeah, this argument always falls pretty flat with me, it feels like the gov just traces IP's as far back as they have to make their case.

"The attack came from an owned box in the USA that we can trace was connected to from an owned box in France that we can trace to an owned box in Russia, I guess the Russians did it" ....

Not to mention it shouldn't be terribly difficult to hide your tracks connecting to an owned box meaning that any hacker worth their salt can make an attack look like it's coming from wherever they want.

Reply on news.ycombinator.com