home > archive > 2017 > this article

By Daniel M. Ryan
web posted January 9, 2017

One of the head-scratchers of these times is the fact that the Never-Trump Conservatives have fallen hook, line and sinker for the "Putin did it!" narrative about the DNC/Podesta hacks. When Donald Trump won the Presidency, those folks signed the pledge and vowed to put aside the primary-rooted squabbling. They vowed to criticize Trump on policy grounds if he did something they deemed unConservative. They also vowed to praise Trump when he did something right. From what I've read and heard on YouTube, they've kept their pledge. They falling in line with the dodgy Putin-interfered-with-the-election claim trumpeted by high officials in the Obama Administration (!) cannot be explained by leftover rancour.

That's why it's baffling: they should know better. Who were the folks who pounced when then-Secretary-of-State Clinton tried to blame the Benghazi disaster on a then-obscure Youtube video? Who were the guys who raised the alarums when Loretta Lynch "innocently" met with Bill Clinton before James Comey punted? You'd think they know better; they certainly did know better earlier.

Last Thursday's testimony - significantly, in front of the McCain-chaired Armed Services Committee instead of the Intelligence Committee - showed that the "Putin did it" narrative suspiciously resembles other cries-of-alarm that aren't quite true: when it comes time to get down to specifics, the goal posts start moving. And, the ones you'd expect to have an interest in flogging the narrative - like good ol' CNN - report it by using a technique of dribble-out.

Open up this CNN article: it serves as a good test in careful reading. Not to mention, a memory test.

Its lede promises:

US intelligence has identified the go-betweens the Russians used to provide stolen emails to WikiLeaks, according to US officials familiar with the classified intelligence report that was presented to President Barack Obama on Thursday.

Did you see what it did there? It buried the fact that "US officials" have backed off from the claim that "the Russians" sent the Emails to Wikileaks directly.

Two paragraphs later, it uses the word "denied" to describe Julian Assange's insistence that the source of the Emails was not Russian. It doesn't mention that the current position of "US Intelligence" is now the same as Mr. Assange's.

The promised "new information" that's supposed to sway us is this:

Included in that new information were intercepted conversations of Russian officials expressing happiness at Trump's win. Another official described some of the messages as congratulatory.

In other words, the "new information" claims Motive. One of the usual tricks in bolstering a sketchy case is to claim that the alleged bad guys really, really wanted to do what they're accused of. If we're old enough to know better, we're old enough to remember all those times we really, really wanted to do something but restrained ourselves. We're prudent enough to know that following through could buy us a ton of trouble. It's one thing to proclaim "Shoot, shovel and shut up" when asked the button-pushing question, "What would you do if you saw a maniac raping your sister?" It's another thing entirely to actually do it, to risk a life sentence or execution if your shooting, shovelling and shutting-up is noticed by someone who's not shy to call the police. Someone who might well know nothing about the rape, but who does know that there's been some suspicious shovelling.

I might be accused of button-pushing myself, but it's very clear that messing around in a United States Presidential election risky enough to be deemed reckless. The same high "US Intelligence" official featured in the CNN story was "pressed" by Senator John McCain to say if the alleged interference constituted an act of war. In case you forgot, Sen. McCain is the chair of the Armed Services Committee.

The link just above contains a name which CNN obligingly omitted. The "US intelligence" official was none other than James Clapper. Remember him? He was the same fellow who resolutely denied that the NSA was conducting mass surveillance. Remember a fellow by the name of Edward Snowden? It was his whistle-blowing that exposed, among other items, that Clapper had been resolutely lying.

The article admits in a desultory fashion that "Officials reiterated that there is no single intercepted communication that qualifies as a ‘smoking gun' on Russia's intention to benefit Trump's candidacy or to claim credit for doing so" - before it quotes both Nancy Pelosi's and Joe Biden's cheerleading. Clearly, this article is aimed at the Dems who have a very clear Motive for believing that the Trump victory was illegitimate.

That's the trouble with relying on Motive, by the way: it's a game that others can play.

For those expecting hard facts, last Thursday was a second disappointment. The initial claim, made back during election time, was that two groups of Russian hackers, APT 28 or "Cozy Bear" and APT 29 or "Fancy Bear," were responsible for the hackings. The claim came from a private security firm, Crowdstrike. It caused a splash, but some independent security professionals were skeptical about Crowdstrike's claim that APT-28 and APT-29 were organs of the Russian government. Skeptics like Jeffrey Carr noted that this claim was massaged by leaving out the hacks attributed to both groups that had no discernable relation to Russian government objectives. In other words, the claim was ‘proven' by leaving out all the evidence that didn't support it. Even the less-skeptical Guardian noted at the time that the "Putin did it to help Trump" theory was called into question by the timing of the hack: "Cozy Bear infiltrated the DNC months before Trump surprised the political world by winning the nomination." This, in an article that largely took the claim at face value.

In other words "Putin did it to help Trump" - exactly the Motive that Clapper has been claiming! - would require the Russkies to have shown foresight that few professional American pundits had shown. As Wikipedia documents, Cozy Bear started in the summer of 2015. Fancy Bear, according to Crowdstrike, didn't get into the act until April of 2016.

Right then and there, the difference in timing raises a pertinent question: if the two were both ordered into action by the Kermlin, why did one start at least six month prior to the other? What kind of co-ordinated offensive sends one set of troops into the theater and another set six to nine months later, while the first set is succeeding and has no visible need for reinforcements? Why not send in both at once? This discontinuity was explained by the claim that Fancy Bear and Cozy Bear were part of two separate Russian intelligence agencies, the GRU and the FSB respectively. The explainers further claimed that the two agencies were rivalrous and thus were disorganized with respect to each other. If you look at the Wikipedia entries for Cozy Bear and Fancy Bear, you'll see that the narrative depends an awful lot on the report delivered by Crowdstrike, a single firm that was hired by the DNC itself. As Sam Biddle noted, "It's highly unusual for evidence of a crime to be assembled on the victim's dime."

Also noteworthy is the fact that Crowdstrike said at the time that they had a "medium level of confidence" that Fancy Bear was an arm of the GRU. In its entry for Cozy Bear, Wikipedia says "Cybersecurity firm Crowdstrike has suggested that it may be associated with the Russian Federal Security Service (FSB)" That's where we were before the much-ballyhooed joint FBI-DHS report was released on December 29th. Medium level of confidence, suggestions, "may." That's why skeptics were waiting for the December report: they were expecting evidence gathered by either the FBI or DHS to make Crowdstrike's claims more solid. Since the Obama administration had kicked out 35 Russian diplomats and closed down two Russian-owned waterfront estates before that report was released, there was certainly a reasonable expectation that new evidence would be revealed that would make for more than a "medium level of confidence."

That's why the skeptics found the report to be such a crashing disappointment. It only reiterated the original Crowdstrike claim. It did not supply any additional evidence to bump up credibility from Crowdstrike's own "medium level of confidence." Even generally-supportive independents like Robert M. Lee were scratching their heads over it. Lest anyone thinks that he's a curmudgeon like Jeffrey Carr, he wrote in his prefatory Background:

For years there has been solid public evidence by private sector intelligence companies such as Crowdstrike, FireEye, and Kaspersky that has called attention to Russian-based cyber activity. These groups have been tracked for a considerable amount of time (years) across multiple victim organizations. The latest high profile case relevant to the White House's statement was Crowdstrike's analysis of COZYBEAR and FANCYBEAR breaking into the DNC and leaking emails and information. These groups are also known by FireEye as the APT28 and APT29 campaign groups.

The White House's response is ultimately a strong and accurate statement. The attribution towards the Russian government was confirmed by the US government using their sources and methods on top of good private sector analysis. I am going to critique aspects of the DHS/FBI report below but I want to make a very clear statement: POTUS' statement, the multiple government agency response, and the validation of private sector intelligence by the government is wholly a great response. This helps establish a clear norm in the international community although that topic is best reserved for a future discussion.

Clearly, Lee did not show the same skepticism about Crowdstrike that Carr did!

Yet, Lee said that the report - despite its promise of techie-centered data that would help network admins defend against like attacks - "reads like a poorly done vendor intelligence report stringing together various aspects of attribution without evidence." He noted that there was no differentiation between declassified government data and private-sector data, leaving a more skeptical sort to wonder if the attribution claims were based on nothing more than Crowdstrike. In addition, the report's list of "Reported Russian Military And Civilian Intelligence Services (RIS)" was a disorganized dog's-breakfast combination of malware campaigns, malware and at least one generic malware capability ("Powershell Backdoor.") The CSV list of suspicious IP addresses were similarly disorganized: Lee said that ~30% of them were useless because they were generic bad-guy IPs like Tor exit nodes which are used by different parties at different times. (Some of these, like Tor exit nodes, are sometimes used by ordinary privacy-seekers.) "IP addresses and domains are constantly getting shuffled around the Internet and are mostly useful when seen in a snapshot of time."

So it should be no wonder that the aforementioned Jeffrey Carr , unlike Lee, was bluntly undiplomatic:

It adds nothing to the call for evidence that the Russian government was responsible for hacking the DNC, the DCCC, the email accounts of Democratic party officials, or for delivering the content of those hacks to Wikileaks.

It merely listed every threat group ever reported on by a commercial cybersecurity company that is suspected of being Russian-made and lumped them under the heading of Russian Intelligence Services (RIS) without providing any supporting evidence that such a connection exists.

In other words, the only escalation in the attribution area was in the rhetoric. Cozy Bear and Fancy Bear, plus whatever could be called " Russian Intelligence Services," were thrown together in a fancy package labeled "Grizzly Steppe." Wow!

Note the pattern here: no new substantiation combined with an escalation of rhetoric. Also note the technique of throwing in disorganized semi-related data: it resembles the old technique of throwing mud at the wall in the hopes that some will stick.

Remember that CNN story that I picked through? Did you notice that "medium level of confidence" has been escalated to "high confidence?" By none other than the resolute James Clapper?

Well, we have our chance to see if this escalation of rhetoric has been accompanied by an escalation of evidence. Last Friday, the same duo of FBI and DHS released another report, this time with the CIA to make for a new trio. [PDF file] Its title, "Background to ‘Assessing Russian Activities and Intentions in Recent US Elections': The Analytic Process and Cyber Incident Attribution", certainly promises something like more evidence. After its stirring introduction, it assures us that "Information available as of 29 December 2016 was used in the preparation of this product." In other words, information available as of the day the prior "Grizzly Steppe" report was published. The one, discussed above, which was a disappointment.

This new report also assures us that the aforementioned CIA has had a hand in preparing it, and it states that all three are presenting a united front: "When we use the term ‘we' it refers to an assessment by all three agencies." After assuring us that "we" suspended judgment on the effect of the Wikileaks dumps on the U.S. election, it assures us: "New information continues to emerge, providing increased insight into Russian activities." So, despite that date-disclaimer, there should be more than regurgitating Crowdstrike, right?

Besides: DHS-FBI did get that pushback from its earlier report, a sample of which you've already read. You'd think they'd be embarrassed and, for this report, show that they've tightened up.

They haven't: they've done the opposite. In that entire 25-page PDF file, the terms Cozy Bear, Fancy Bear, APT-28 and APT-29 are not mentioned once. Even the sexier Grizzly Steppe is absent. So are "Russian Intelligence Services" and the associated RIS. Again, we see goal posts that are not where they used to be.

If one were uncharitable, one would be wondering if "we" discarded an earlier trick that didn't work.

Instead, in the main part, we see a focus on RT America with a side mention of "paid trolls" - those same trolls you've almost certainly heard about because they stick out like the proverbial sore thumb. The main body of the report is chock full of claims with very little evidence to back them up. The "Annex", discussing 2012 and RT America latching onto Occupy Wall Street, is by comparison evidence-unpoor. But in the main part of the report, the delivery on the title's promise is little more than "Trust us."

It's almost as if this report were a pedagogical tool for a unit on critical thinking. One useful tool, which the indefatigable Sharyl Attkisson relies upon, is Find-And-Replace. In addition to helping flush out bias, it's a useful way to gauge claims to see how targeted or scattershot they are. There's a world of difference between a police-artist sketch of a perp and a vague description like "brown hair short and parted, medium height, medium build, clean-shaven." The latter type of description will generate a lot of misidentifications; the former type will call forth far fewer.

To prepare for the game, I've clipboarded the subsection "Putin Ordered Campaign To Influence US Election" which kicks off the section "Russia's Influence Campaign Targeting the 2016 US Presidential Election."

As a simple prep example, assess the statement "Nazi Germany murdered six million Jews" find-and-replace'd into "Great Britain murdered six million Jews." This makes no sense; it's clearly ludicrous.

Even replacing "Nazi Germany" with "The Soviet Union" doesn't make sense. Even though the U.S.S.R was the second-bloodiest dictatorship in modern history, the Soviet masters did nothing close to the Holocaust with respect to Jews. You can substitute any government over the last two hundred years for "Nazi Germany" and you'll wind up with an alternate claim that's out of whack with the facts. Thus, this simple find-and-replace prep shows that the claim "the Nazis were uniquely evil in their genocidal policies" does hold up. Instead of scattershot, it's well-targeted.

With that prep out of the way, with the point behind the game established, here we go:

We assess with high confidence that Fox News anchor Sean Hannityordered an influence campaign in 2016 aimed at the US presidential election, the consistent goals of which were to undermine public faith in the US Democrat Party, denigrate Secretary Clinton, and harm her electability and potential presidency. We further assess Hannity and Fox News developed a clear preference for President-elect Trump. When it appeared to Hannity that Secretary Clinton was likely to win the election, the Fox News influence campaign then focused on undermining her expected presidency.

Okay: some of you may be thinking that I'm playing foul ball here. The loyal Mr. Hannity, being a United States citizen who's entitled to the privileges and immunities thereof, has every right to influence the votes and support of his fellow citizens. Vladimir Putin is categorically different in this regard. But Mr. Hannity is also a professional broadcaster, who has to keep his eye on the ratings. He won't keep his ratings up unless he tells his target audience what they want to hear. In case you're wondering why I'm making a deal about this, the report spends a lot of words claiming that Putin's primary tool of influence is the broadcaster RT America. This raises the question of whether RT America is pushing an assumed Kremlin line or is trying to up its own ratings.

So let's continue with the Find-and-Replace:

We also assess Hannity and Fox Newst aspired to help President-elect Trump's election chances when possible by discrediting Secretary Clinton and publicly contrasting her unfavorably to him. All three agencies agree with this judgment. CIA and FBI have high confidence in this judgment; NSA has moderate confidence.

See anything odd yet? Something that would be as jarring as "Sean Hannity ordered troops into the Ukraine"? Just to remind you, that's what we're looking for: a find-and-replace that's clearly out of whack.

In trying to influence the US election, we assess Fox Newssought to advance its longstanding desire to undermine the Democrat-led liberal democratic order, the promotion of which Hannity and other senior Fox News anchors view as a threat to America and the Republican Congress.

Arguably, this one looks a little off-kilter.

Hannity publicly pointed to the Panama Papers disclosure and the Olympic doping scandal as Democrat-directed efforts to defame the heartland, suggesting he sought to use disclosures to discredit the image of the Democrat Party and cast it as hypocritical.

Okay: for this one we've got a real fish. It makes no sense, so the original does make sense as something Vladimir Putin specifically would be interested in pushing. But I'm missing the connection between the above and the recent election.

Hannity most likely wanted to discredit Secretary Clinton because he has publicly blamed her since 2012 for the Benghazi disaster, and because he holds a grudge for comments he almost certainly saw as disparaging him. We assess Hannity, his Fox colleagues, and Fox News developed a clear preference for President-elect Trump over Secretary Clinton.

Granted: I cut-and-paste a little more with this one, but me doing so illustrates the thinness of the report's focus on Motive. There's very little about Opportunity, and the Means largely focus on the RT America broadcasting network. Oh yes, and paid Internet trolls that are about as nondescript as the participants in a San Francisco gay-pride parade.

Beginning in June, Hannity's public comments about the US presidential race avoided directly praising President-elect Trump, probably because Fox News officials thought that any praise from Hannity personally would backfire in Washington. Nonetheless, Hannity publicly indicated a preference for President-elect Trump's stated policy to work with Fox News, and pro-Fox News figures spoke highly about what they saw as his Fox-News-friendly positions on Syria and Ukraine. Hannity publicly contrasted the President-elect's approach to Fox News with Secretary Clinton's "aggressive rhetoric."

Now this cut-and-paster does raise an eyebrow. It looks like we got our second fish. Was Putin's statement out-of-line with respect to what a foreign leader would say? After a bit of Googling, I didn't find any opinion expressed by Mexican President Enrique Peña Nieto saying that he would prefer Hillary Clinton as President. But I did find this item, dated November 5 2016: "Mexican Senators Attacked for Supporting Hillary Clinton." If yours truly came across this during the campaign and were an American, I would have thundered about it. But with post-campaign calm, plus keeping in mind the subtitle "If Mexico voted for the U.S. president, Clinton would win in a landslide", it's a reasonable guess that those Mexican senators had their own elections in mind. They saw "I'm With Her" as a sure vote-grabber for their own re-election campaigns.

It's true that former President Vincente Fox trolled President-Elect Trump after the report was released, but it's important to keep in mind that Sr. Fox is retired. He's now a private citizen.

In contradistinction, current Presidente Nieto went out of his way to be even-handed during the campaign. He invited both Candidate Trump and Candidate Clinton for meetings. (Trump accepted; Clinton declined.) Up in my home and native land, Prime Minister Justin Trudeau kept his own opinion private - even though, if Canadians could vote in the U.S. election, Hillary would have won Canada even more lopsidedly than the state of California.

The behavior of these two leaders, of the other two NAFTA countries, provides a good baseline to assess Vladimir Putin's remarks. They show that he did cross the line of international decorum when he observed that a Trump Presidency would be good for Russia.

But does a Head of State saying something untoward rate a crack-down on the scale of expelling 35 diplomats and shutting down two resorts? Doesn't this faux-pas deserve the usual Obama Administration response: a letter of protest or/and a strongly-worded rebuke? Why more?

Time to get back to the find-and-replace:

Fox News also saw the election of President-elect Trump as a way to achieve an international counterterrorism coalition against the Islamic State in Iraq and the Levant (ISIS).

Yeah: I had to make the last substitution. This snippet is iffy: it's not a neat fit.

Hannity has had many positive experiences working with Western political leaders whose business interests made them more disposed to deal with Fox News, such as former Italian Prime Minister Silvio Berlusconi and former German Chancellor Gerhard Schroeder.

Hmm...seems more of a fit for Breitbart, but it's not obviously wacky.

Hannity, Fox News pundits, and other pro-Conservative pundits stopped publicly criticizing the US election process as unfair almost immediately after the election because Fox News probably assessed it would be counterproductive to building positive relations.

You don't say! The last part doesn't fit all that well, but the rest does make for a pretty good fit. Remember: in the report, "Putin" mainly means "RT America." You know: the station that's betting its ratings on reaching the disaffected Americans that have been shut out of the Overton Window. As a pure business strategy, it's not dumb. The venerable Guardian has demonstrated that corralling the misfit market gives you an evergreen niche that the mainstream media will not dare compete with.

We assess the influence campaign aspired to help President-elect Trump's chances of victory when possible by discrediting Secretary Clinton and publicly contrasting her unfavorably to the President-elect. When it appeared to Fox News that Secretary Clinton was likely to win the presidency the Fox News influence campaign focused more on undercutting Secretary Clinton's legitimacy and crippling her presidency from its start, including by impugning the fairness of the election.

Well, well, well. This one makes for a neat fit, doesn't it? In other words, "Moscow" - meaning RT America - sounds like they were trying to reach the pro-Trumpers who thought that Fox was too tame or compromised. Stating that this "influence campaign" came from "Putin" is like claiming that the pushing of multiculturalism is a deliberate campaign stage-managed by the Government of Canada. As with multi-culti, there are obvious all-domestic, home-grown, organic interests for pushing that "influence campaign." Too many interests for it to be stage-managed by a foreign government.

Before the election, Conservative pundits had publicly denounced the US electoral process and were prepared to publicly call into question the validity of the results. Pro-Conservative bloggers had prepared a Twitter campaign, #DemocracyRIP, on election night in anticipation of Secretary Clinton's victory, judging from their social media activity.

O rly?

Now that the find-and-replace session is over, we see that there's a substantial - but not complete - overlap between "the Kremlin" and a bunch of patriotic American Conservatives whose loyalty to America is beyond question. So much of an overlap, it does make the above point a serious one: did RT America jump on the Trump Train in order to build their audience? If you read the report's Annex carefully - it deals with RT America glomming on to the Occupy Wall Street movement - you'll notice that it's eye-openingly muddy about whether RT America's goal was to present a favourable picture of Russia, push a Kremlin line (these are not the same thing: there are lots of my fellow Canadians who'll talk up Canada's single-payer health-care system but not peddle the policies of the Trudeau Liberals), or to simply boost their ratings Guardian-style.

I have to say that the report verges into cute when it adduces the former Soviet Union and the Cold War. Back then, the Soviets played the long game and preferred being unobtrusive to obtruding. They counted on salami-slicing, under-the-radar subversion and eschewing open aggression. The closest they came to the last was the 1979 invasion of Afghanistan, a country that was right beside the Soviet Union. Even then, they observed their usual fig-leaf cover-up by setting up a Communist government in Afghanistan in 1978. The only bellicosity they showed was in their rhetoric: the holier-than-capitalist self-righteousness that grated many an ear and ground many a molar in the West.

More to the point, the KGB also relied upon blackmail. If the KGB-trained Putin were true to his roots - and, if Russian intelligence did have those filched Emails in their possession - it would be far more in his interest to see Hillary Clinton win the Presidency, so he or his Ambassador could sit down for some nice rounds of Arkansas hardball. The Russian America-watchers know durn well that Hillary has broken her promises before, and they surely remember that the original Russian reset was promised by Obama during Hillary's term as Secretary of State with no objection from her. She claims that she changed her mind after the Crimea flap, but she also claimed she changed her mind about the Trans-Pacific Partnership. Had Putin read a summary of those Emails, he would have come across her taking out of the other side of her mouth to her Goldman Sachs buddies. From this, he would conclude that Hillary Clinton would be "flexible" as President.

Imagine an inside-job blackmailer who's got some very profitable dirt on a soon-to-be heiress. You can see instantly that he'd be plumb stupid to publish the dirt before she won her bequest. What good would it do him if publication gets her cut out of the will? Even if the substitute heir thinks highly of the blackmailer (which would change if he found out!) it's still too much of a risk for the blackmailer. Particularly if the blackmailer were trained to play the long game and be patient, to always choose salami-slicing over the big grab.

Adducing the Cold War is cute in another way. Cold Warriors like Sen. McCarthy, and Cold-Warrior writers like Eugene Lyons (The Red Decade, 1941) and J. Edgar Hoover (Masters of Deceit, 1955), did not stick to naked claims about Soviet subversion. They supplied specifics: lots of ‘em. Mr. Lyons named a lot of names in his discussion of 1930s Communist front groups. Mr. Hoover gladly supplied specific behavior patterns of Soviet spies and subversives. And as we all know, Sen. McCarthy and his fellow warriors was not shy in naming names: the liberals of the time howled about it.

Although the Truman Administration was quietly looking into the matter in 1947, after the Lee List was brought to then-Secretary of State George Marshall's attention, the campaign didn't get into gear until August 3rd 1948 when a fellow named Whittaker Chambers swore an oath to tell the truth in front of the House Un-American Activities Committee. He then testified that he himself had been a Communist spy, and had been part of a spy ring. In other words, the campaign to root out Soviet Russian subversion did not gain traction until after the smoking gun was unveiled to the public. And even then, as any old Cold Warrior will gladly tell you, it was an uphill slog.

Try contrasting the generalities in last Friday's report with the specifics that permeate The Red Decade. Try contrasting the naked claims in the report with the detail-orientation in Masters of Deceit. You'll see how profoundly different the standards were when the Cold War was in its early days.

The campaign against Soviet subversion ended in tragedy. As for the "Putin did it" claim, an appropriate label is "farce."

Daniel M. Ryan, as Nxtblg, is shepherding the independently-run Open Audi Initiative Prediction Market Shadowing Project. He has stubbornly assumed all the responsibility and blame for the workings and outcome of the project.

Home

Home

Site Map

E-mail ESR