Six GRU Officers Charged in Connection with Worldwide Deployment of Malware | Hacker News Reader

Six GRU Officers Charged in Connection with Worldwide Deployment of Malware

justice.gov

212 pointsFDSGSG112 comments

I'm torn when it comes to the utility of making public indictments of this sort when the truth is there will never be any arrest or trial.

Making them public lets Russia know we're aware of their actions, which in turn may drive them to greater efforts to make these actions harder to detect and therefore harder to defend against. I also wonder if making these public, detrimental and unnecessary, is just a cynical ploy before an election to give the appearance that this administration has been tough on Russia, when actual toughness on Russia would mean not just indictments, but also sanctions and other tangible consequences.

On the other hand, absent legal accountability for these individuals and Russia itself, making these indictments public allows the rest of the world to see & know what Russia is up to. That might facilitate action through the softer power of diplomacy, and perhaps also put other countries on notice that they must take greater care in protecting their critical systems as well. And if it is the correct choice to do so, then any political benefit, cynically motivated or not, is an ancillary factor.

I suppose it may be a tough balance to strike. I think I come down on the side of making these issues public knowledge. Just as I similarly believe bad actions on the part of the US should be available for public scrutiny whenever it does not jeopardize the lives and safety of those who fight for our country.

It could also just be done as a thinly veiled threat to discourage people from working there. Even if nobody is arrested, the statement is basically saying "it doesn't matter where you are, or how secretive your work is, we can find you". I can imagine spouses and family would suggest they start looking for a different job after seeing the announcment.

Indeed. And as GP said. If you force your adversary to take more precautions you're driving up the cost, increase the time it takes for them to perform operations, makes them need more experienced/educated personnel, more procedures to catch mistakes, etc. etc.

That's not a bad thing for Russia's adversaries.

It also means that they can't visit countries with an extradition treaty with the U.S. This is not the biggest penalty ever but it's something.

Also assets, interests, and possibly more.

It's basically, "good luck taking the wife & kids on holiday outside of Russia!"

Or investments, purchases, business opportunities, ...

And it's even more of 'something' when you're in a country with a questionable economy and future.

I'd have to think if you're an adequately-compensated-but-not-connected person in Russia, you'd be keeping a Plan B in your back pocket "just in case".

But this is only six people. I'm sure they have hundreds or thousands of people working on "the America project" at the GRU.

We nailed 6 of them. So what? Foreign intelligence agencies weed out a CIA spy every now and then, but that doesn't seem to deter the CIA.

Honestly, having worked for large companies, it's astonishing how few people are working on any given project. It's normally a handful of people actively contributing to any given specific project.

@dx87: “It could also just be done as a thinly veiled threat to discourage people from working there”

Yea, those damn Ruskies are so stupid they left their name and home address in the compiled files.

Not far off from that, it seems:

https://twitter.com/AricToler/status/1318277154908536833

@green_rooster: “Not far off from that, it seems:”

Ни черта не умеют!

A PR indictment of this sort accomplishes nothing besides making the DOJ look even more foolish or amateurish. The only thing interesting is to figure out whom it is supposed benefit.

If anyone were to actually show up to face these charges, they will eventually be dismissed, as happened to two of the Mueller indictees.

https://www.nytimes.com/2020/03/16/us/politics/concord-case-...

Mentioning that those charges were dismissed without providing the reason or context seems rather incomplete, at best.

(That's what the link is for)

That they later dismiss the case strongly suggests that they never thought it would be prosecuted in the first place. Do you really believe that they thought there would be no discovery?

To quote:

With the case set to go to trial next month, prosecutors recommended that the Justice Department drop the charges to preserve national security interests and prevent Russia from weaponizing delicate American law enforcement information, according to the official. The prosecutors also weighed the benefits of securing a guilty verdict against the companies, which cannot be meaningfully punished in the United States, against the risk of exposing national security secrets in order to win in court.

>I also wonder if making these public, detrimental and unnecessary, is just a cynical ploy before an election to give the appearance that this administration has been tough on Russia, when actual toughness on Russia would mean not just indictments, but also sanctions and other tangible consequences.

Honestly, I don't mind cynical ploys as much if they involve an agency doing it's usual job. They might be trying to deflect attention or obscure underlying biases, but conducting an investigation and officially making an announcement based on the facts is a good thing. If only more "October surprises" were like this.

I agree, even if it's driven by cynicism, if it's the right thing to do then it's what should be done.

Given there's never a trial, you never find out if the charges are true either.

Similar in ways to a burn notice:

an official statement issued by an intelligence agency to other agencies. It states that an asset or intelligence source is unreliable for one or several reasons, often fabrication, and must be officially disavowed.

https://en.wikipedia.org/wiki/Burn_notice_(document)

And yes, the video series of the same name is based on the concept.

Here it's effectively a reputational attack which renders its target only viable to, and therefore beholden to, the initiating actor for whom the work/activity triggering the notice was performed.

The notice also tips the issueing agency's hand as to surveillence and intelligence capabilities, and puts on notice others performing similar work, both specifically referenced by USDoJ.

A key aspect of much (not all) state-actor covert ops is impunity. This may be actual legal immunity (e.g., diplomatic cover), or simply the threats of national-level retaliation (across a wide range: sanctions, diplomatic, treaty, counterespionage or ops, military, international courts, UN or other internattional entity sanctions). The impunity is strong but not absolute.

The US DoJ's indictment has little power inside Russia, at least under that country's present leadership, but has significant import elsewhere, including outside the US, or under a possible future Russian government. Say, perhaps, one lead by targets of the present leadership.

The real issue with these indictments is that they put US operators in a tough position. These are military hackers following lawful orders. We are not dealing with criminal acts, but diplomatic issues.

Foreign powers are more than capable of identifying individual US operators, but so far they've opted to not participate in this game.

Here's an op-ed on the subject by an ex-NSA hacker https://www.thedailybeast.com/dont-punish-a-north-korean-hac...

It's a dicey situation. That said, Jake's not being completely truthful about the risks here. The office he worked in (TAO and Specifically the ROC), was a volunteer office, and it was made clear what your actions could lead to. Future travel restrictions and concerns were brought up for this exact reason, just as anyone working field work is given the explanation. In a more basic awareness, simply working a position that is cleared, has you go through plenty of discussions / classes / onboarding videos, that discuss the risks.

At the end of the day, he has to accept that he is accountable for his action as should others, it comes with the job.

I'm more concerned with how candid Jake is (as are most of is former co-workers), but that's another story for another day and not really related here...

Then the foreign powers should declare war and they'll be subject to the Geneva convention. Covert action that is illegal in the target country has always made operatives subject to the local laws. If you want to be treated like a soldier, wear a uniform and fight in a declared war. Otherwise you're subject to the rules for spies.

@cameldrv: “Then the foreign powers should declare war and they'll be subject to the Geneva convention”

Question: Which military power has threatened to bomb the International Criminal Court in the Hague, if its military are brought before the court. a) The Russian Federation or b) The United States of America.

* and the answer is ‘b’

https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-be...

The ICC hasn't been given any power by the United States (nor by Russia or China). If US _military_ personnel were brought there, it's obviously going to have a diplomatic/military response. It would be be an act of aggression.

I don't see the relevance here. If you do something that's illegal in the U.S., don't go to a country that has an extradition treaty with the U.S. The only exception is war. If your country invades the U.S., and you are a normal soldier and shoot some people, if you're captured you'll be treated as a prisoner of war and released when the war is over.

If you covertly come to the U.S. and shoot some people, you'll be put on trial, convicted, and then imprisoned or executed. If the other side has someone to trade for you, you might get released. This is how spying works.

I am much more confused by another point: isn’t the GRU a military department? Can you charge military personnel with a crime like this when they are acting in accordance with their orders?

It feels like this is a cop out: the US knows that it is the Russian government that’s responsible but charges individual officers so as to not cause any kind of international stir.

Even if these six were tried and convicted and sent to prison, nothing would change since I’m sure there are others who could take their place. The directive won’t change, just the people carrying it out.

Yes, because they aren't performing traditional military operations. They were performing espionage and sabotage. The United States would prosecute these Russian military members if they were caught doing the same actions inside the US

That is not always the case that there is no legal accountability:

https://europeangaming.eu/portal/latest-news/2018/09/11/2789...

In case you would like to know more about this kind of things check this: https://darknetdiaries.com/episode/76/

The US federal government has already imposed a wide range of sanctions on Russia. What other tangible consequences are you asking for?

https://crsreports.congress.gov/product/details?prodcode=IF1...

When a person commits a crime and is punished, we don't say "they were already punished, what more are you asking for?" When they go on to commit yet another crime.

So what I'm asking for should be obvious: Additional sanctions for each additional hostile act. Keep making it harder and harder, the consequences higher, each time. Use diplomacy with our allies to get them to do the same.

Which sanctions specifically? Is there evidence that additional sanctions would have any effect?

Interesting details:

> These GRU hackers and their co-conspirators engaged in computer intrusions and attacks intended to support Russian government efforts to undermine, retaliate against, or otherwise destabilize: (1) Ukraine; (2) Georgia; (3) elections in France; (4) efforts to hold Russia accountable for its use of a weapons-grade nerve agent, Novichok, on foreign soil; and (5) the 2018 PyeongChang Winter Olympic Games after Russian athletes were banned from participating under their nation’s flag, as a consequence of Russian government-sponsored doping effort.

Is this clear from the evidence or are these the allegations against them?

That's a tricky thing with indictments like this. For now, these are the allegations against them. Evidence would be introduced at trial and the prosecutors would be loathe to introduce any evidence that exposes "sources and methods" of intelligence. And the defendants will likely never set foot in a place where they could be extradited to stand trial.

So, sort of a paper tiger.

Does the US Government (as represented by these prosecutors) have a good faith belief these individuals committed these crimes? Probably, though you might believe otherwise. I would say my trust is very high in that statement, despite everything else going on in politics right now. The government doesn't make indictments like this lightly, and the grand jury saw at least enough evidence to establish probable cause. At the same time, there is a saying about ham sandwiches and indictments.

Will we ever see the underlying evidence? I doubt we will.

Should we trust the US Government's representations in this case? Again, I would - but you may have priors to suggest you shouldn't.

This is a press release from the department of justice. There are two attachments at the end.

Is this clear from the evidence or are these the allegations against them?

The evidence is presented at the trial, not in the initial press release announcing there has been an indictment.

One would expect that there is clear evidence, or there wouldn't be an indictment. You can't win a court case without evidence.

It's a long PDF [0], but these indictments are usually very detailed.

[0] https://www.justice.gov/opa/press-release/file/1328521/downl...

> The department is also grateful to Google, including its Threat Analysis Group (TAG); Cisco, including its Talos Intelligence Group; Facebook; and Twitter, for the assistance they provided in this investigation.

I am also grateful. I don't know if it would make any sense to go into this analysis without input from security teams at some of the most attacked sites/hardware vendors.

Going through the indictment with a quick read: it seems most of the attacks began as spearfishing.

Which goes to show: the human link is still the weakest one.

Can someone explain how individuals are identified when we are talking about state sponsored hackers?

By detractors? By cyberattacks? Good old espionage?

I have wondered about the same.

HUMINT probably.

Sometimes you catch them on camera https://apnews.com/article/ef3b036949174a9b98d785129a93428b

they probably have a database of the entire GRU hackers squad (Unit 74455) and cross-matched the actions with people's background (people have resumes, social networks, educational background, etc.).

also google location services might have some data on them too

In the past they have texted specific GRU agents on their personal phones: https://www.wired.com/story/cyber-command-ira-strike-sends-s...

> As The New York Times reported last October, Cyber Command operators sent direct messages to individual Russian staffers that they had identified as involved in election interference, and were tracking their activity. The Post reports that the IRA was troubled enough by those messages that they launched an internal investigation to identify potential leakers.

I have a feeling that the US and allied countries are pretty deep into the Russians with this stuff.

IRA is not GRU

lol.

The difference between the government, the corporate sector (oligarchy) and the mafia in Russia is nominal. It's all the same people, operating out of different organizational fronts.

It's a super-organization that transcends what we think of elsewhere as being different sectors (of varying degrees of legality)

There's a big difference between the GRU and the SVR and the FSB. There's an even bigger difference between GRU and the IRA.

These are completely different things, it's downright silly to imply otherwise.

IRA staffers certainly aren't "GRU agents"

I don't disagree with anything you say.

But nothing you say argues against what I said.

Thats probably the real interesting story here...

The Dutch secret service MIVD caught a couple of GRU "diplomats" who were trying to do MITM (with a Pineapple) on e.g. the organisation in The Hague who were investigating MH17. One even had a taxi receipt with him from GRU HQ to Moscow airport.

Meanwhile, the Dutch secret service AIVD had access to GRU HQ camera feeds.

Before all that happened a high ranking Russian police officer got reprimanded (IIRC send to gulag) for working together with the Dutch police on high level cyber crime.

what kind of taxi receipt shows the pick up point?

https://images.wired.it/wp-content/uploads/2018/10/18184147/...

has his name and signature on it. i guess he kept it to expense the $10. a bit too convenient. if true, it means this guy is a spy carrying a ticket in his pocket that says "i spy for russia". he is so bad at his job that we have nothing to worry about

Theory has it it was a routine job for them, hence the complacency.

Counter intelligence operations ran by NSA and CIA. They most likely have compromised infrastructure used by the attackers. At the end of the day, Russian cyber ops are still a governmental organization - which means they keep records, have JIRA (or similar) tickets, logs of work to support promotions, etc.

CIA likely has human assets within the ranks of the military intelligence units that could provide information or details of written documents.

I’ve assumed the use something outdated like paper orders, but yes, there might be some sort of a ticket «kill Navalny» that has gone through some interesting states and comments.

It's often through a single mistake made once that allows you to link some pseudonymous profile to a real person. For example, I recall reading about a particular case where some command&control server was identified and being monitored, and once one of the operators accidentally logged in to his personal profile on a social media site over the 'secure VPN' connection.

Also, there have been cases where authorities have been 'subcontracting' certain services or tools from local cyber criminals working on online financial fraud - where those criminals were later arrested abroad, and have agreed to testify against their former partners/employers.

I didn't even see them point out which one was "Guccifer 2.0"

There's a fantastic book about this group published recently titled "Sandworm" by Andy Greenberg.

https://www.goodreads.com/en/book/show/41436213-sandworm

Do you really have to give space to this Neocon cyber BS on a respectable tech forum. Cyber BS by people who seem to be desperate to re-start the cold-war. Fortunatly, the Russians won't come out to play. Neither will the Chinese, Iran or North Korea.

Reply on news.ycombinator.com