b. WikiLeaks's First Contact with Guccifer 2.0 and DCLeaks
Shortly after the GRU's first release of stolen documents through dcleaks.com in June
2016, GRU officers also used the DCLeaks persona to contact WikiLeaks about possible
coordination in the future release of stolen emails. On June 14, 2016, @dcleaks _ sent a direct
message to @WikiLeaks, noting, "You announced your organization was preparing to publish
more Hillary's emails. We are ready to support you. We have some sensitive information too, in
particular, her financial documents. Let's do it together. What do you think about publishing our
info at the same moment? Thank you."159 Investigative Technique
Any of those documents supplied by Russia has to be viewed with a great deal of skepticism. I am quite confident if scrutinized there are changes made to suit Putin's hate of her.
Around the same time, WikiLeaks initiated communications with the GRU persona
Guccifer 2.0 shortly after it was used to release documents stolen from the DNC. On June 22,
2016, seven days after Guccifer 2.0's first releases of stolen DNC documents, WikiLeaks used
Twitter's direct message function to contact the Guccifer 2.0 Twitter account and suggest that
Guccifer 2.0 "[s]end any new material [stolen from the DNC] here for us to review and it will have
a much higher impact than what you are doing." 160
After the Russians published material on their own, Wikileaks actually solicited them to publish them on Wikileaks with hopes of having a greater impact. They may be right. The Russians were having success with their espionage sites though, at least in the USA.
On July 6, 2016, WikiLeaks again contacted Guccifer 2.0 through Twitter's private
messaging function, writing, "if you have anything hillary related we want it in the next tweo [sic]
days preferable [sic] because the DNC is approaching and she will solidify bernie supporters behind
her after." The Guccifer 2.0 persona responded, "ok ... i see." WikiLeaks also explained, "we
think trump has only a 25% chance of winning against hillary ... so conflict between bernie and
hillary is interesting." 161
Wikileaks does have an agenda.
c. The GRU's Transfer of Stolen Materials to WikiLeaks
Both the GRU and WikiLeaks sought to hide their communications, which has limited the
Office's ability to collect all of the communications between them. Thus, although it is clear that
the stolen DNC and Podesta documents were transferred from the GRU to WikiLeaks, Investigative Technique
Footnote 158 3/14/16 Twitter DM, @WikiLeaks to Personal Privacy Less than two weeks earlier, the same
account had been used to send a private message opposing the idea of Clinton " in whitehouse with her
bloodlutt and amitions [sic] of empire with hawkish liberal-interventionist appointees." 11/19/15 Twitter
Group Chat, Group ID 594242937858486276, @WikiLeaks et al.
Footnote 159 6/14/16 Twitter DM, @dcleaks_ to @WikiLeaks.
Footnote 160 Netyksho Indictment ,r 47(a).
Footnote 161 7/6/16 Twitter DMs, @WikiLeaks & @guccifer_2.
The Office was able to identify when the GRU ( operating through its personas Guccifer 2.0
and DCLeaks) transferred some of the stolen documents to WikiLeaks through online archives set
up by the GRU. Assange had access to the internet from the Ecuadorian Embassy in London,
England. Investigative Technique
On July 14, 2016, GRU officers used a Guccifer 2.0 email account to send WikiLeaks an
email bearing the subject "big archive" and the message "a new attempt."163 The email contained
an encrypted attachment with the name "wk dnc link I .txt.gpg."164 Using the Guccifer 2.0 Twitter
account, GRU officers sent WikiLeaks an encrypted file and instructions on how to open it.165 On
July 18, 2016, WikiLeaks confirmed in a direct message to the Guccifer 2.0 account that it had
"the 1 Gb or so archive" and would make a release of the stolen documents "this week." 166 On
July 22, 2016, WikiLeaks released over 20,000 emails and other documents stolen from the DNC
computer networks. 167 The Democratic National Convention began three days later.
Similar communications occurred between WikiLeaks and the GRU-operated persona
DCLeaks. On September 15, 2016, @dcleaks wrote to @WikiLeaks, "hi there! I'm from DC
Leaks. How could we discuss some submission-related issues? Am trying to reach out to you via
your secured chat but getting no response. I've got something that might interest you. You won't
be disappointed, I promise." 168 The WikiLeaks account responded, "Hi there," without further
elaboration. The @dcleaks_ account did not respond immediately.
The Russians were controlling the information they sent to Wikileaks. They didn't send all of it at once. It was staged.
The same day, the Twitter account@guccifer_2 sent @dcleaks_ a direct message, which
is the first known contact between the personas. 169 During subsequent communications, the Guccifer 2.0 persona informed DCLeaks that WikiLeaks was trying to contact DCLeaks and
arrange for a way to speak through encrypted emails. 170
Footnote 162 Investigative Technique
Footnote 163 This was not the GRU's first attempt at transferring data to WikiLeaks. On June 29, 2016, the
GRU used a Guccifer 2.0 email accou~ted file to a WikiLeaks email account.
6/29/16 Email, guccifer2@mail.com IT (The email appears to have been
undelivered.)
Footnote 164 See SM-2589105-DCLEAKS, serial 28 (analysis).
Footnote 165 6/27/16 Twitter DM, @Guccifer_2 to @WikiLeaks.
Footnote 166 7/18/16 Twitter OM, @Guccifer_2 & @WikiLeaks.
Footnote 167 "DNC Email Archive," WikiLeaks (Jul. 22, 2016), available at https://wikileaks.org/dnc-emails.
Footnote 168 9/15/16 Twitter DM, @dcleaks_ to @WikiLeaks.
Footnote 169 9/15/16 Twitter DM, @guccifer _ 2 to @dcleaks _.
An analysis of the metadata collected from the WikiLeaks site revealed that the stolen
Podesta emails show a creation date of September 19, 2016. 171 Based on information about
Assange's computer and its possible operating system, this date may be when the GRU staged the
stolen Podesta emails for transfer to WikiLeaks (as the GRU had previously done in July 2016 for
the DNC emails). 172 The WikiLeaks site also released PDFs and other documents taken from
Podesta that were attachments to emails in his account; these documents had a creation date of
October 2, 2016, which appears to be the date the attachments were separately staged by
WikiLeaks on its site. 173
Beginning on September 20, 2016, WikiLeaks and DCLeaks resumed communications in
a brief exchange. On September 22, 2016, a DCLeaks email account dcleaksproject@gmail.com
sent an email to a WikiLeaks account with the subject "Submission" and the message "Hi from
DCLeaks." The email contained a PGP-encrypted with the filename
"wiki_mail.txt.gpg." 174 Investigative Technique The email, however, bears a
number of similarities to the July 14, 2016 email in which GRU officers used the Guccifer 2.0
persona to give WikiLeaks access to the archive of DNC files. On September 22, 2016 (the same
day of DCLeaks' email to WikiLeaks), the Twitter account dcleaks sent a single message to
WikiLeaks with the string of characters Investigative Technique
The Office cannot rule out that stolen documents were transferred to WikiLeaks through
intermediaries who visited during the summer of 2016. For example, public reporting identified Andrew Mueller-Maguhn
Mr. Muller-Maguhn is not a covert figure. I think the hacking business in Europe is regarded differently than in the USA. I believe he is a business man.
Andy Müller-Maguhn (click here) is a member of the German hacker association Chaos Computer Club. Having been a member since 1986, he was appointed as a spokesman for the club in 1990, and later served on its board until 2012
as a Wikileaks associate who may have assisted with the transfer of these stolen documents to Wikileaks. 175
The FBI had no problem coming to conclusions even when the material was Wikileaks.
Footnote 170 See SM-2589105-DCLEAKS, serial 28; 9/15/16 Twitter DM, @G uccifer_2 & @WikiLeaks.
Footnote 171 See SM-2284941, serials 63 & 64 Investigative Technique
Footnote 172 Investigative Technique At the time, certain Apple operating systems used a setting that left a
downloaded file's creation date the same as the creation date shown on the host computer. This would
explain why the creation date on WikiLeaks's version of the files was still September 19, 2016. See SM2284941, serial 62 Investigative Technique
Footnote 173 When WikiLeaks saved attachments separately from the stolen emails, its computer system
appears to have treated each attachment as a new file and given it a new creation date. See SM-2284941,
serials 63 & 64.
Footnote 174 See 9/22/16 Email, dcleaksproject@gmail.com
Footnote 175 Ellen Nakashima et al., A German Hacker Offers a Rare Look Inside the Secretive World ofJulian Assange and WikiLeaks (click here), Washington Post (Jan. 17, 2018).
On October 7, 2016, WikiLeaks released the first emails stolen from the Podesta email
account. In total, WikiLeaks released 33 tranches (batches) of stolen emails between October 7, 2016 and
November 7, 2016. The releases included private speeches given by Clinton; 177 internal
communications between Podesta and other high-ranking members of the Clinton Campaign;
178
and correspondence related to the Clinton Foundation.179 In total, WikiLeaks released over 50,000
documents stolen from Podesta's personal email account. The last-in-time email released from
Podesta' s account was dated March 21, 2016, two days after Podesta received a spearphishing
email sent by the GRU.
It must feel pretty lousy to be hacked by a foreign power that is hostile to your own government. I imagine it rattles a person quite a bit. Everyone you care about, everyone you know, business associates are all part of those accounts. I think it is really hard to get your mind around it.
d. WikiLeaks Statements Dissembling About the Source of Stolen Materials
As reports attributing the DNC and DCCC hacks to the Russian government emerged,
WikiLeaks and Assange made several public statements apparently designed to obscure the source
of the materials that WikiLeaks was releasing. The file-transfer evidence described above and
other information uncovered during the investigation discredit WikiLeaks's claims about the
source of material that it posted.
If Assange is considered a journalist then Wikileaks has no obligation to cite sources, but, don't make it up.
Beginning in the summer of 2016, Assange and WikiLeaks made a number of statements
about Seth Rich, a former DNC staff member who was killed in July 2016. The statements about
Rich implied falsely that he had been the source of the stolen DNC emails.
July 9, 2019
By Dell Cameron
A stunning report published Tuesday (click here) by Yahoo News identifies a Russian intelligence service as the origin of a conspiracy theory connecting the unsolved murder of former Democratic National Committee staffer Seth Rich to the leak of thousands of DNC emails in the summer of 2016. The report, authored by Yahoo’s chief investigative correspondent, Michael Isikoff, traces the root of the theory back to a phony intelligence “bulletin” reportedly circulated online by the SVR, Russia’s foreign intelligence service.
Rich, a 27-year-old DNC data specialist, was murdered on July 10, 2016, in what police concluded was a botched robbery. In the following weeks, WikiLeaks began disclosing some 20,000 internal DNC emails online, triggering theories that Rich may have been the anti-secrecy organization’s source. A slew of right-wing personalities, including notorious GOP trickster Roger Stone, helped spread the theory far and wide in an apparent attempt to aid President Trump, whose campaign was at the time under investigation by Special Counsel Robert Mueller....
On August 9, 2016,
the @WikiLeaks Twitter account posted: "ANNOUNCE: WikiLeaks has decided to issue a
US$20k reward for information leading to conviction for the murder of DNC staffer Seth Rich." 180
Likewise, on August 25, 2016, Assange was asked in an interview, "Why are you so interested in
Seth Rich's killer?" and responded, "We're very interested in anything that might be a threat to
alleged Wikileaks sources." The interviewer responded to Assange's statement by commenting,
"I know you don't want to reveal your source, but it certainly sounds like you're suggesting a man
who leaked information to WikiLeaks was then murdered." Assange replied, "If there's someone
who's potentially connected to our publication, and that person has been murdered in suspicious circumstances, it doesn't necessarily mean that the two are connected. But it is a very serious
matter ... that type of allegation is very serious, as it's taken very seriously by us."181
After the U.S. intelligence community publicly announced its assessment that Russia was
behind the hacking operation, Assange continued to deny that the Clinton materials released by
WikiLeaks had come from Russian hacking. According to media reports, Assange told a U.S.
congressman that the DNC hack was an "inside job," and purported to have "physical proof' that
Russians did not give materials to Assange. 182
176 Investigative Technique
177 Personal Privacy
178 Personal Privacy
179 Netyksho Indictment ,r 43.
180 @WikiLeaks 8/9/16 Tweet.
181 See Assange: "Murdered DNC Staffer Was 'Potential' WikiLeaks Source, (click here) " Fox News (Aug. 25,
2016)(containing video of Assange interview by Megyn Kelly).
182 M. Raju & Z. Cohen, A GOP Congressman's Lonely Quest Defending Julian Assange (click here), CNN
(May 23, 2018).
continued in following entry - thank you
