You might be interested in Micah F. Lee's take: https://theintercept.com/2018/07/18/mueller-indictment-russi...
I would have thought there would have been clear protocols about VPNs, some "we're 99.999% sure this is a clean laptop, don't do anything else here, and only do thing here and inside this brand new VM each day..." kinda stuff that would prevent such mistakes.
They then state that that must mean that the Russians must have forgotten to log onto their VPN first. But I mean, what? Using a dedicated VPN makes no real sense in the era of TOR, and such a mistake would have been literally impossible with TOR. It's also mentioned in the article that "The US (or a partner)" hacked at least two GRU computers. If this is the case then it's safe to assume other actors could have as well, and suddenly what exactly does a login from the GRU IP actually mean?
Or in the machines that the GRU allegedly hacked, their behavior was discovered by the presence of logs that the hackers apparently had to manually delete? State level malware does not automatically delete logs? Wow. And then they allegedly rented servers in Arizona and Illinois for illicit activities, knowing full well that their are a gazillion different domestic digital surveillance programs being carried out by the NSA? And then apparently they were exchanging emails, literally discussing theft of DNC materials, in plain text without encryption?
These things just never really make any logical sense. It simultaneously tries to paint Russians as these super hackers capable of achieving anything. And then it also shows them getting busted making mistakes that I'd like to call amateur, but that implies that these are mistakes even an amateur might reasonably make, which is probably doubtful. It's bizarre.
Beyond that are you saying that some other actor hacked a GRU computer and framed them or something? That's a pretty big leap there without anything to it.
As for logs having your malware just delete logs automatically could be useful at times... less so other times. I would think you would want to choose to do it when you wanted. A lot of malware does log wiping, I'd be tempted to look for log changes over time just to find malware based on that alone..... suddenly missing logs would be a big sign.
Beyond that I'm not going to get into it. These seem like just you and me logicing things out in our head and that doesn't mean we're right or wrong. Humans don't make sense at times, they dork up, that isn't surprising to me.
Just because some of it is curious to me and maybe choices I wouldn't have made, doesn't make it not true, or those choices as odd or wrong as we might thing anyway.
1. The FBI never had physical access to the hacked servers and were relying completely on the report from a third party company, CrowdStrike:
http://thehill.com/policy/national-security/313555-comey-fbi...
2. The former tech director of the NSA, William Binney, claimed that the data could not have been copied remotely because the download speed was around 22 MB/s (176 Mb/s) which he and a team concluded was not possible for a remote hack with servers in Russia and routing through a commercial VPN service:
https://consortiumnews.com/2017/07/24/intel-vets-challenge-r...
>He said they did not, but obtained access from a review of the system performed by CrowdStrike, a third-party cybersecurity firm.
>"We got the forensics from the pros that they hired which -- again, best practice is always to get access to the machines themselves, but this, my folks tell me, was an appropriate substitute," Comey said.
>DNC spokeswoman Adrienne Watson told PolitiFact that the DNC cooperated with the FBI’s requests, which resulted in the DNC providing a copy of their server.
>"An image of a server is the best thing to use in an investigation so that your exploration of the server does not change the evidence (just like you don’t want investigators leaving their own DNA around a physical crime scene) and so that the bad actors cannot make changes to the evidence while you are looking at it," Watson said. "Any suggestion that they were denied access to what they wanted for their investigation is completely incorrect."
http://www.politifact.com/truth-o-meter/statements/2018/jul/...
Your point two is is based on an embarrassingly incorrect assumption.
I agree it makes it less likely because the files could have been copied multiple times which could change the metadata, but that doesn’t prove definitively that they were.
Only saying that if they were dumb enough to do that they may have been dumb enough to go directly too.
Show me where in the indictment it talks about that? I only saw a reference to a much smaller number of emails.
Right, because you can't prove a negative.
It's interesting, this is the second time I've seen this talking point in two days. The first one linked to a slightly less blog-ish source, and pointed out that this "fact" had been established in _The Nation_, a reasonably well-respected and left-sympathetic newspaper.
Here's the article in The Nation:
https://www.thenation.com/article/a-new-report-raises-big-qu...
It now has a gigantic disclosure in front of it which takes most of the weight of the "findings" away.
"In the end, Fidelis, FireEye, SecureWorks, Threat Connect and other CrowdStrike competitors all confirmed Crowdstike’s results."
"I find it interesting that people are so eager to [ignore credible evidence], but willing to accept the forensics of an anonymous blogger, with no reputation, that no one knows anything about”
Holy 2018.
Second, I read the disclosure, and all it does is point out that it is a possibility and not a fact. It also points out that the intelligence agencies have not provided any hard evidence that Russia was behind the leak, and they are the same groups who lied to the public about WMDs in Iraq to justify that invasion.
This article also says that the original reports were published by Consortium News, the source I linked to.
There were two batches of emails published by WikiLeaks. The second batch wasn't published by GRU's front DCLeaks / Guccifer 2.0. So it's possible that the source of that second batch is a different one, and it's certainly possible it could be Seth Rich.