Also, most clients would be more than happy to have someone proclaim that the reason they got owned was because they were the target of spooky foreign state actors and not because they're bad at security. There's no money in downplaying the sophistication of an attack.
Maybe you missed the part where they were hired by the DNC or the part where the ownership is not from the reality-based community: http://www.atlanticcouncil.org/about/experts/list/dmitri-alp...
But the biggest indicator is their attribution based on internally coherent narratives instead of facts - that's not how actual digital forensic experts operate.
Until I see evidence of Russia involvement I don't want to make any judgments. I am just tired of constant narration "you know it was Russia, you don't need proofs". It would be great to see some real proofs this time.
It was attributed to Russians first before the election, and by a private cybersecurity that has never, AFAIK -- even since the attribution -- been accused of Democratic partisanship. So the idea that the Russians are being blamed by the Democrats because the Democrats lost everything in the election, while a convenient political narrative for Republicans, isn't consistent with the facts.
Sure, this can be one side of the coin but attributing something to someone without proofs will not make it a fact, doesn't it? I don't recall seeing any proofs. Maybe it was just convenient to democrats to just flow with that tide, they benefit from that for sure in current situation. But then there is second side of the coin, that Russia indeed was behind that hack and then what you wrote would be true. That's why I am not making any judgments.
If you're looking for firewall logs or hard drives with definitive proof that malware on certain machines was linking back to particular servers then you're out of luck. However Crowdstrike, the firm that the DNC used to investigate the intrusion, published a report that shows some of the code used and other IOCs from the attack [0].
A security firm like Crowdstrike would have lots of familiarity with these APT groups from previous investigations, so when they identify these groups they have evidence (i.e. they found specific malware or tools that are known to have been used in previous attacks, connections to or from known bad domains, IP addresses etc.) that links the attacks to these groups.
This, however, doesn't prove that APT 28 and 29 are Russian, but if you search for information about these groups, their Tools Techniques and Procedures (TTPs), who they have targeted etc. you can draw your own conclusions.
Note, this was long before the election and before there was politics surrounding the attribution. However this data is only about the intrusion into the DNC's network, and not necessarily linked to the release of personal emails of Podesta & co.
[0] https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
I'm not sure I get your analogy, but no, I wouldn't expel anyone for "radar touching my planes", but in this case that's the equivalent of browsing the DNC website. If someone had broken into my airforce base, stolen security badges to get into other airforce bases, was photographing planes and stealing and leaking blueprints then you better believe I'd take action