Андрей Солдатов - The Red Web - The Struggle Between Russia's Digital Dictators and the New Online Revolutionaries

This step, however, had no immediate consequences. The hacking operation seemed to be suspended, but not the publication of kompromat : on October 2 Roger Stone, a longtime unofficial adviser to Donald Trump, tweeted cheerfully:

Wednesday @HillaryClinton is done. #Wikileaks . [38] Lindsey Ellefson, “Roger Stone Tweets Mysteriously About Wikileaks Doing Something to Hillary Clinton Wednesday,” Mediaite, October 2, 2017, www.mediaite.com/online/roger-stone-tweets-mysteriously-about-wikileaks-doing-something-to-hillary-clinton-wednesday .

He was mistaken: the WikiLeaks publication came out not on Wednesday but had been postponed until Friday, October 7, when WikiLeaks published thousands of emails from John Podesta’s Gmail account. [39] Edward Moyer, “WikiLeaks Posts ‘Podesta Emails’ Clinton Wall Street Speeches,” CNET, October 8, 2016, www.cnet.com/uk/news/hillary-clinton-goldman-sachs-speeches-leaked-paid-wikileaks-john-podesta-julian-assange . The emails had excerpts from Clinton’s paid speeches, including the speeches at Goldman Sachs. Three days later, on Monday, Trump was at a campaign rally in Wilkes-Barre, Pennsylvania. “This just came out. I love WikiLeaks!” he told the crowd. Trump then read aloud quotes from Clinton’s speeches revealed by WikiLeaks. [40] Mark Hensch, “Trump: I Love WikiLeaks,” Hill , October 10, 2017, http://thehill.com/blogs/ballot-box/presidential-races/300327-trump-i-love-wikileaks . In his hand Trump also had an email he said had been sent by Clinton adviser Sidney Blumenthal, in which Blumenthal appeared to admit that the killing of a US ambassador in Benghazi had had been “almost certainly preventable.” Next Trump read, “Clinton was in charge of the State Department and it failed to protect US personnel at an American consulate in Libya.” Trump said this email had come from the WikiLeaks trove. But it hadn’t. In fact, the Russian pro-Kremlin agency Sputnik had fabricated this quote. A Newsweek journalist had actually originated the quote in an article, and Blumenthal had copied and pasted it to Clinton. Sputnik, however, reported the comment as having been written by Blumenthal. [41] Kurt Eichenwald, “Dear Donald Trump and Vladimir Putin, I Am Not Sidney Blumenthal,” Newsweek , October 10, 2017, www.newsweek.com/vladimir-putin-sidney-blumenthal-hillary-clinton-donald-trump-benghazi-sputnik-508635 .

By then the WikiLeaks website was hosted at least partially on the premises of the Russian hosting company HostKey on Barabanny Lane in the east of Moscow—WikiLeaks had moved its hosting to Russia in August. [42] Grant Stern, “BREAKING: WikiLeaks Switched to Russian Web Hosting During Election,” OccupyDemocrats, March 14, 2017, http://occupydemocrats.com/2017/03/14/breaking-wikileaks-switched-russian-web-hosting-election . Researchers of CitizenLab independently checked the information. According to their information, WikiLeaks used two IP addresses hosted in Russia, one from 2011 and the second one starting in August 2016.

On November 6, on the eve of the election, WikiLeaks released a second collections of DNC emails, more than 8,263 in total.

On the US election day of November 8, at 3:45 p.m. Moscow time, when the polling stations in the United States just opened, Putin summoned his Security Council. This time the marble-covered hall in the Kremlin palace was more crowded. Along with the April group, Putin invited Prime Minister Dmitri Medvedev; Foreign Minister Sergei Lavrov; Minister of Defence Sergei Shoigu; the new head of the Administration of the President, Anton Vaino; and Vyacheslav Volodin, the Speaker of the Duma.

Officially Putin convened the meeting to talk about the pension system and how reform could affect servicemen. But this could hardly explain the presence in the room of Sergei Ivanov. And it didn’t explain the presence of Sergei Lavrov either, who was evidently nervous and drummed his fingers during Putin’s opening remarks, the only part of the meeting the Kremlin press office allowed to record. [43] “Meeting of the Security Council,” President of Russia, November 8, 2016, http://kremlin.ru/events/president/news/53217 .

The next morning when the results of the election became known, Trump’s victory was met with jubilation in Moscow. Parties were given and, in the State Duma, champagne bottles were popped.

Russian officials openly praised Trump on TV. But the anxiety was also palpable—Trump was not expected to win, and nobody thought his victory would go over easily in Washington. Lots of people started asking themselves what the American intelligence services might do now about Trump’s Russian connections.

For the Kremlin it was time to cover some tracks. [44] The account below is based on the authors’ conversations with sources in the Russian secret services and Russian private cybersecurity companies.

Unlike in Soviet times, these days Moscow is extremely well lit at night; in fact, the authorities take a special pride in the capital’s sparkling lights. Even so, no one driving along Leningradskoe highway toward the city center could possibly miss the two five-story, cube-shaped buildings of Kaspersky Lab: day and night the offices radiate electric light. Thanks to transparent walls, everyone who passes can see Kaspersky Lab’s employees at their desks at all hours, working on their black Dell computers. However, on the first floor of the main building the glass walls are always shuttered.

This floor houses Kaspersky’s investigation unit, headed by Ruslan Stoyanov. In Russian, Stoyanov’s unit goes by the acronym ORKI (from Otdel Rassledovania Kompruternikh Incidentov), which calls to mind Orcs, a race of creatures in Tolkien’s fantasy books who live underground and fight the men of the West. This was not a coincidence—Stoyanov has a weakness for symbolic names. The company he had founded before joining Kaspersky was called Indrik, a fabulous beast in Russian folklore—a gigantic bull with a head of a horse and an enormous horn, the king of all animals, who also spends his time wandering underground.

Stocky and short cut with a goatee, Stoyanov has always had strong patriotic feelings and likes to spend his holidays off-roading his four-wheel winch-equipped Niva (a Russian version of a Landrover Defender) through the woods.

Stoyanov built his reputation serving in the famous K Department of the Interior Ministry (the same one that, presumably, the Trump Dossier meant to refer to). In the K Department Stoyanov spent six years investigating cybercrimes. In 2006 he left the Ministry. Four years later he launched Indrik, which provided DDoS-protection to the corporate market. Before long, Stoyanov’s company’s future was all but secured when Kaspersky Lab began providing Indrik’s services to its customers. In 2012 they joined forces. Working for Kaspersky now, Stoyanov formed his investigation unit, the orcs—ORKI. Next Stoyanov became the contact point between Kaspersky’s big clients—banks and corporations under cyber attack who wanted to find their attackers—and the Interior Ministry and the FSB. Stoyanov’s role was to provide expertise for criminal investigations, but Kaspersky worried that the influx of requests for help from the FSB and the Interior Ministry were getting out of control. So they decided that Stoyanov should be the company’s single entry point for the secret services. Stoyanov cultivated his contacts with his former colleagues in the K Department of the Interior Ministry and with its counterpart in the FSB, the Information Security Center. At the FSB Stoyanov dealt primarily with the Information Security Center’s deputy head, Colonel Sergei Mikhailov. Mikhailov had a tarnished reputation outside the Lubyanka—in 2011 he had tried to force the online media Roem.ru, specializing in web enterprises and social networks, to disclose the identity of one of its journalists. Surprisingly, he failed—the General Prosecutor’s Office found his interest unlawful. [45] See Chapter 7, for details. But Mikhailov also served as a handler of companies running crucial parts of the Russian Internet infrastructure.