FBI Got Everything It Asked for in DNC Investigation, Refuting ‘Missing Server’ Myth

“I would like you to do us a favor, though,” President Donald Trump told his Ukranian counterpart in the infamous July 2019 phone conversation that led to his impeachment. “Because our country has been through a lot and Ukraine knows a lot about it. I would like you to find out what happened with this whole situation with Ukraine, they say CrowdStrike… The server, they say Ukraine has it.” 

Trump was only the latest to perpetuate a myth surrounding Russian hackers’ 2016 theft of emails from the Democratic National Committee: that the theft was an inside job, that a server mysteriously disappeared in a purported coverup. In fact, all available evidence says the theft was carried out by two groups allegedly connected to Moscow’s intelligence agencies: APT-28 and APT-29, aka Fancy Bear and Cozy Bear.

The pile of evidence grew deeper on Thursday evening, when the House Permanent Select Committee on Intelligence released more than 50 transcripts of FBI interviews conducted in 2017 and 208 under Robert Mueller’s investigation into Russia’s meddling in the 2016 election. One in particular stands out.

The interview with Yared Tamene Wolde Yohannes, who ran the DNC’s IT in 2015 and 2016, reveals a few important facts. It confirms that the FBI knew that at least one Russian actor, Cozy Bear, had penetrated the DNC network by the fall of 2015 and, Yohannes suggests, possibly as far back as July. It also reveals that the FBI wasn’t direct or forthcoming with DNC about what they were seeing. They asked for information without telling the DNC who really was after them.

“I would say that the information that the FBI was providing, honestly, was frustrating in how redacted it was,” Yohannes complains. He said the FBI agent who told him about the intrusion “didn't say ‘Russian state-sponsored actor.’ He said Russians in general.” The FBI didn’t even hand over data that could have helped Yohannes secure his network — like timestamped screenshots of documents or emails or network logs — until February 2016. 

The DNC only learned that the Russian government was targeting them in the spring of 2016, from CrowdStrike, a cybersecurity company.

The transcript also reveals that the DNC gave the FBI everything it asked for: roughly 15 gigabytes of server logs and related metadata showing intrusion activity.

“We eventually delivered those logs. I think the actual date that we were able to get it to the FBI was 10 days later. So like April 29, I think, was the date that we actually sent them the logs. And the FBI agent confirmed receipt by sending me a text message saying: ‘You know, thank you for sending that. That's great, very helpful. I'll let you know what we find’,” Yohannes says in the transcript 

Yohannes concludes the interview with a wish that the FBI would have shared more about what it knew was happening to the DNC. 

“What I would like to see…is better sharing of information at the declassified level, I mean, they do that already. They have websites, they have maybe even seminars, that kind of stuff. But these are not readily available, easily digestible, well-marketed. I would love to see, you know, a small organization like the DNC, which has a really big profile but it's a really small nonprofit organization, can use that kind of assistance from the U.S. intelligence community and others, potentially, right? Yeah, so I would love to see that kind of thing.”

The transcript confirms what others have reported via anonymous sources: that the U.S. intelligence community was well aware that Russians had penetrated DNC networks long before the group knew it had been compromised. 

The emails were dumped to Wikileaks in the summer and fall of 2016. The IC might have announced then that the thieves were Russian, and that the theft was part of a coordinated effort to sway the upcoming election. Instead, the IC made its first formal statement on the matter on Oct. 7. That delay allowed someone to sow doubt in the public’s mind about what really happened, doubt that persists today.

In some ways, the intelligence community appears to have learned from this failure. In July 2018, the NSA formed a group to disrupt Russian active measures aimed at the United States. 

But other signs show that the Intelligence community is still not forthcoming about the attacks that the country faces. Earlier this week, The U.S. Cybersecurity and Infrastructure Security Agency and UK’s National Cyber Security Centre released a joint statement saying that powerful cybercriminals were targeting healthcare organizations amid the pandemic. But officials with both organizations rebuffed repeated requests to identify who those attackers were, showing that old habits, even unhelpful ones, are hard to purge.