So if you judge it by whether it "makes the case" against Russia, it will be lacking. We don't need 100 comments pointing that out.
1. Released the same day as the announcement of formal Russian Sanctions
2. Released the same day US made 35 "diplomats" (aka. known Human Intelligence Officers) Persona Non Grata. Which is a big deal.
This type of document is not intended to "make the case" because we don't do that.
Making a case for something by definition, would reveal sources and methods which we highly guard. It also opens the administration up for scrutiny because there are many pieces which cannot be revealed because of classification - so it's impossibly to fully "make a case."
This type of report does however hint suggestively and point in the direction of support. They just let you put the pieces together.
In fact they don't have to put anything out and most people wouldn't even know to ask (outside of possibly FOIA, which won't go far in these cases).
This document says the attack would've failed if the DNC had watched out for SQL injection and if DNC staffers had not fallen for a phishing scheme. We're supposed to believe only a nation-state could've conducted these attacks? This is "Baby's First Hack" level stuff.
This only further proves the government's propaganda policy for dealing with prominent cybersecurity breaches: blame it all on a foreign boogieman, as they did in the case of the Sony leak, so that the public doesn't catch on to just how very vulnerable all their electronic data is to practically anyone with the inclination to attempt to steal it.
No they wouldn't, and you are one of the people here who I would say should very well know it. :p
The DNC screwed up, but the overwhelming majority of everybody else screws up to this level or worse on the regular.
My quip was meant to emphasize that the security breaches described are basic, and likely could've been blocked if the DNC had, at the time, been following good security practice. Many corporations withstand such attacks routinely (and as you note, many don't).
The penetration of the DNC was not something that required professional-level skill, let alone the resources of a nation-state.
[0] http://www.securityweek.com/amex-developers-leave-debug-tool...
If all the docs are boring, isn't that all the more reason to think that a nation state had nothing to do with this?
The NSA would've intercepted your new router in the mail with a backdoor and could've used a TEMPEST van to read your screens from miles away. I have to believe those mighty Russian hackers have figured out comparable tricks by now and aren't reliant on people falling for idiotic phishing scams to get their information.
I mean, they have Snowden, who showed us the NSA's TAO programs... right?
They have the motive to do it, as much or more than anyone else and certainly the capacity. They are tied to a disinformation campaigns [1] that seem to have the goal of sowing suspicion between allies who oppose them and have everything to gain by swaying our political process.
That isn't enough evidence of course, but I'm surprised by the suspicion here and I can only chock it up to the increase in cynicism that is partly a result of these very actions. Because the Bush administration managed to finagle the intelligence enough to justify the war in Iraq we can just ignore our intelligence agencies whenever we want, right?
Internal bullshit like what was going on at the DNC is annoying, frustrating and unfortunate but people are falling for the trap hook line and sinker. This happens everywhere, you can damn be sure it was going on at the RNC as well but republicans wouldn't have abandoned their party (at this point its pretty clear nothing can make a fair number of them abandon their party) but independents and some liberals are doing exactly what the hackers want (whoever they turn out to be, likely the Russians): we are getting cynical and despondent. Rather than getting involved and saying we should clean house, its like "well if you didn't suck so much you wouldn't have lost." while doing nothing to make things suck less.
[1] http://www.nytimes.com/2016/08/29/world/europe/russia-sweden...
The first page states-
>This JAR provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the U.S. Government.
>As part of the administration’s response, the FBI and Homeland Security Department also released a report with technical evidence intended to prove Russia’s military and civilian intelligence services were behind the hacking and to expose some of their most sensitive hacking infrastructure.
There are only two possible explanations for that:
1) A massive conspiracy in which the leaders of practically the entirety of the US military/intelligence community are willing to go on record with a hoax that will easily be unraveled by the incoming administration in a few months
2) There is clear and damning evidence that Russia did it, but it's classified
If they had damning evidence it'd be in their interest to release it.
Not that I don't believe you -- motive and opportunity for Russia are crystal clear here, and given that the results of the election are not going to be overturned, I see little gain for the current administration to lie about this.
Unless the actual perpetrators were the US intelligence community and/or the incoming administration. Then they could both hide their tracks or have no reason to unravel this. But why suspect the group with the most to gain or the community with the most experience doing this? It's not like there's any other examples of a Republican politician breaking into the DNC to tap their communications, using the intelligence agencies to help cover it up...
If the 2 were true, there would be also some conspiration to keep those important infomations classified.
Also, I can't help thinking about Snowden and the blown whistle of the NSA spying scheme.
We know our security agencies (and high level politicians) are not just dishonest, but actively violating the constitution. That people still mock those who distrust these agencies is so strange.
I'm more than willing to believe they're lying but I need something. Some evidence, a credible motive, a plausible story. You can't just say, "Well the FBI says so, and they lie all the time, so we can be sure it isn't so." That's the road that leads to disbelieving the moon landing.
> but I need something
That's how a lot of people feel about this whole "Russians rigged the election" thing, we'd like some evidence a little more substantial than "trust us", or at least we'd like to hear those words from someone we can trust, although no names come to mind. I can't think of very many public figures that I would trust these days.
It is perhaps significant that the "further analysis" leakfest started after Trump had already disappointed the spooks by bagging their special briefings, rather than back when all of the actual underlying facts were publicized well before election day. They always think they've got a thick enough profile of the incoming executive to bend him as far as they want. For example, Obama never closed their favorite EST Caribbean vacation-and-torture resort, even though doing so was a major campaign plank the first time around. Who knows what incriminating documents proved so persuasive? Maybe this time we've somehow elected someone who won't be in their pocket from Day One?
I agree on Obama, I think something must happen in the first few days where the new President is sat down and gets told how things really work. I would think that is what happened to many of Obama's promises. I doubt anyone would look forward to having that talk with Donald Trump.
Perhaps Obama is trying to make Trump's new administration look illegitimate?
Quite predictable, since they also considered the wild accusations of various politicians of a high level Russian conspiracy to be evidence.
In my view, they are all self-serving career politicians and none have shown any particular reason they should be trusted or respected. They were the ones who urged the knee-jerk reaction in Iraq which has cost trillions of dollars and many lives, among many other bad decisions that they all agree on.
So it's not nearly as low of a bar as you think. It's like you're claiming we must trust pharmaceutical representatives from competing companies when they both agree that we all need more pills.
Why is there urgency to rush to judgment about alleged Russian election meddling?
If it happened, then unless anyone thinks the outcome of the election should be reversed, we have four years to get to the bottom of it, take action, and prevent it from happening again.
It's very much reminiscent of the blind urgency to invade Iraq on shaky evidence. Note that one tactic used to get people to act is to create urgency. The simplest example is "this offer expires in 5 minutes..."
It's not so much that I give no credit to any officials as having authority, it's that they all agree on the knee-jerk urgency when there is no apparent need to do so, and none feel obligated to offer a point by point probability assessment of whatever information, inference, or intelligence has them 100% convinced, since the information disclosed so far paints a vague, circumstantial picture.
This sort of elitist disregard for the basic rationality of the public is not something I can stomach, so I simply can't take their assurances at face value.
This likely transcends party lines in the same way that support for wall street or the oil industry transcends party lines.
But my impression is that [Trump vs. Clinton] is way more powerful than any other bias right now.
I think this is correct, and largely why the Russia meddling has become more an article of faith than a highly concerning possibility.
http://www.newyorker.com/magazine/2003/05/12/selective-intel...
> The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations.
This is an official joint statement from the USIC, which is an official body composed of 16 different intelligence organizations:
https://en.wikipedia.org/wiki/United_States_Intelligence_Com...
Also, not sure how the agency count helps anything. Exactly what did agencies like the NRO and Coast Guard contribute here?
Most of this report is pretty simple social engineering tactics/table stakes.
If this is all there is; then the skepticism coming from the incoming administration is warranted.
You mean the point of the persons who wrote it? Probably not.
But the intent of those who decided to release it today? It most likely was. If so many HN commenters--sophisticated computer users and people with cognitive abilities way above average--feel like it doesn't go without saying, how many CNN or Fox News will realise it doesn't make the case against Russian?
They'll just remember that some documents were released by some US intel agencies, proving that the Russians did "it" (without even a clear idea of what "it" might be), while the US govt punished them. That's good enough for people who saw no problem with going to war against Iraq because of 9/11.
What worries me is that all of this Russian hackers + Fake News agitprop is that it looks like a perfect prelude to justify Internet censorship in Western democracies. When Internet allowed Obama to "steal" the Democratic party from Clinton in 2008, it was OK: maybe a bit embarrassing, but his policies weren't really that different from hers. But in 2016, with Sanders almost stealing the party again, and Trump taking the GOP then the general election by storm, politicians and their sponsors realised they didn't effectively influence voters through mainstream media any more. They've finally realised how scared they should be of Internet, and they'll want to "civilise" it, i.e. make it as controllable as billionaire-owned TV channels and newspaper. I hope they'll fail, but some of them will try to.
> Previous JARs have not attributed malicious cyber activity to specific countries or threat actors. However, public attribution of these activities to RIS is supported by technical indicators from the U.S. Intelligence Community, DHS, FBI, the private sector, and other entities. This determination expands upon the Joint Statement released October 7, 2016, from the Department of Homeland Security and the Director of National Intelligence on Election Security.
Yet it doesn't actually make a case for Russian Malicious Cyber Activity. People are pointing out the obvious spin on this especially since it's extremely light on technical details or a reason to exist other than propaganda. Reasonable companies don't need to be taught about phishing attacks.