The FRONTLINE Interviews
Ellen Nakashima
The Washington Post
Ellen Nakashima is a national security reporter for The Washington Post.
This is the transcript of an interview with FRONTLINE's Michael Kirk conducted on July 25, 2017. It has been edited in parts for clarity and length.
Editor's note: This transcript was updated on Oct. 28, 2017 to remove parts of two answers that included incorrect information.
This interview appears in:
TOP
Ellen Nakashima
Chapters
Text Interview:
Highlight text to share it
Intervention in the U.S. Election
Let’s talk about your first story, the June 14 story.Where does it come from?When you first hear about this, what do you think, and how do you make sense of it?
It turns out that the Democratic National Committee discovered, basically in late April, that they had been hacked.They had been hacked by the Russians, and not just one Russian hacker group, but two competing Russian intelligence spy agencies had been in their systems and had owned them in a big way.
The DNC realized that this information was going to leak, and they wanted to get out in front of the story.They wanted to be able to control the story a bit.
So in mid-June I got a call from Michael Sussman, who’s the DNC's cyber lawyer, and he told me there was a story I'd be interested in.[He] called me over to his office and sat me down and introduced me to Amy Dacey, who was the executive director of the DNC, and sat me down with Shawn Henry, who was the president of CrowdStrike, one of the leading cyber incident response firms, who had also happened to be the head of the FBI's Cyber Division back in 2008 when China hacked into the [then-Sen. Barack] Obama campaign and the [Sen. John] McCain campaigns.… They walked me through this series of incidents where Amy had basically gotten the call in late April from her IT guy saying, “We've discovered some unusual activity in the networks.”That's when she decided she had to call Sussman, and Sussman got Shawn.They started, within 24 hours, putting their technology on the DNC networks remotely.They were able to scan the audit logs, look for traces of activity, find out who had been in, when they got in, how long they’d been in, what they had taken, that sort of thing.
At that point in time, when they discovered that there were these two rival intelligence agencies inside the networks competing, in a sense, for Putin's favor to see who can bring in the best stuff, they wrote up this report.At the time, we were all thinking, wow, this is pretty amazing.But what is this for?This looks like traditional political espionage, because after all, the Russians have been doing this a long time; so have the Chinese.The Chinese hacked into the campaigns in 2008.Nation-states hacked into the campaigns in 2012.They're always after political information.This is straight political espionage, looking for plans and intentions of adversaries [or] potential next presidents, although there was some speculation about whether the Russians might pass off some of this oppo research on Trump to the Trump campaign.
I wrote the story.It popped on June 14, and within 24 hours, the next day, an individual or persona calling himself Guccifer 2.0 claims online, in a post, that he, a Romanian hacker, had hacked the DNC.To prove it, he put up some opposition research from the DNC, the Trump report.It wasn't very earth-shattering, but he put it up.He also released some files on the million-dollar donors to Hillary's campaign as evidence.
That was the first sign to me and to analysts that well, maybe this wasn’t just your traditional political hack.Was this Russia putting up a false flag trying to deflect attention away from its hack?This Guccifer 2.0 character continued to release information hacked from the DNC over the coming days and weeks, both on his own blog site [and] on a site called DCLeaks.The DCLeaks site and Guccifer were tied by the intelligence agency to this GRU information operation campaign.
So Guccifer is Russian?
In the end, Guccifer 2.0 yes, definitely Russian. …
Putin and Hybrid Warfare
This is a wild world.Did you know the world when you started the—
Not at all.I mean, I had heard about Russian information operations before, but up until that point, Russia was known as just the major adversary of the United States in cyberspace.In fact, in 2015, another Russian intelligence service had hacked the White House, the State Department and the Joint Chiefs of Staff, their unclassified networks.They had gotten in, and they had started to exfiltrate information.If you look back, in retrospect, I think there are signs that Russia was stepping up its aggression.
Those hacks by the Russian intel agency into the State Department and the White House were actually a little bit different from the ones they had traditionally done.They were starting to get much more aggressive.Usually when the Russians hack in, when the NSA and other defenders kick them out, they skulk away, and they go dark for maybe a year, and then they come back.
Well, this time, especially with the State Department, they were fighting back.It was, as Rick Ledgett, the former deputy director of the NSA, said, it was hand-to-hand combat.The NSA would try to kick them out; they would fight back.It was like thrust and parry, thrust and parry.
In retrospect, if you look back, signs like that, as well as their hacks of Ukraine, their intrusions into the energy grid in December of 2015 and December 2016, show an increasing aggression in cyberspace.There were signs that Russia was maybe starting to up its game.In fact, in 2014, the Russian GRU carried off a cyberattack, a digital assault on Ukraine central election commission, which nearly took it down, nearly disabled it on the eve of a very important presidential vote.That's another sign that they were starting to really move in the cyber world.
You mean they got into an election system?
They did a [Distributed] Denial of Service [DDoS] attack that nearly crippled the election commission before this important vote.So looking back, these are all sort of signs, you could say, that Russia was starting to move in the cyber world, but no one really saw that, no one.Not the FBI, not the NSA, not the CIA in early 2016 saw that Russia was about to launch the most brazen influence operation campaign in U.S. history.In history.
And you as a naif walking into it suddenly are about to really ride the tiger for a number of months?
… What really drove this home was on July 22, on the eve of the Democratic National Convention, WikiLeaks dumped 20,000 or so emails that had been hacked from the DNC onto their website, and some of these were quite damaging, were embarrassing to the Hillary Clinton campaign.They showed that internally within the campaign, there were discussions about ways to cast doubt on Bernie Sanders, her Democratic rival for the nomination, on his faith, on his religion.It’s showing that the DNC was not just neutral but that they seemed to favor Hillary Clinton in that.
These emails were so embarrassing and damaging, they forced the resignation of Debbie Wasserman Schultz, the DNC chairwoman, on the eve of the convention, as well as Amy Dacey, the executive director.
Intervention in the U.S. Election
There's a moment in the history of all this, going back to the beginning again, where an FBI agent, I guess, somehow notices that somebody is inside the DNC, and whoever he talks to at the DNC doesn’t believe it’s an FBI agent.There's a period of time where nothing, absolutely nothing, happens.Can you fill me in on what that was all about?
The first intrusion into the DNC—these were initially detected by the NSA [National Security Agency], who shares the information with the FBI.Those intrusions, first intrusions, in 2015 were by the group known as APT29 or Cozy Bear, as CrowdStrike likes to call them.They were really the SVR, the Foreign Intelligence Service.The FBI did try to notify the DNC.Evidently, it got to a lower-level technician, and for whatever reason, the word did not get up to the senior executive level like Amy Dacey until much later.Now, the FBI did notify—I'm told, law enforcement officials say they did try to make multiple efforts to notify the officials and in person as well.
But there were, I guess, missed signals.Even in March when the other hacker group, the GRU, compromised the DNC, there were again efforts to try to notify the agency, not just the DNC, but also other Democratic groups that were hacked by the Russians, by the GRU, at that time.
How do they know?How does CrowdStrike, or even the FBI before that, how do you know that this is happening?
I think a lot of this was detected first by the NSA who was monitoring networks overseas and gets the information.Sometimes, the FBI finds it on their own, too, but I think in this case it was really the NSA.They shared the information with the FBI, and the FBI, in this case, the Washington field office, would go out and notify the victims, whether it’s the DNC or Colin Powell.
When CrowdStrike starts to do their investigation, how do they know who it is?How does it work?
CrowdStrike has been following these Russian, they call them threat factor groups, for years, Cozy Bear and Fancy Bear.Cozy Bear is APT29, the SVR; Fancy Bear is APT28, or the GRU.CrowdStrike has been tracking their campaigns into not just the State Department, the White House and the Pentagon, but into energy systems, petrochemical, media companies, aeronautical in the U.S. and overseas.So they know their—they call them tactics, techniques and procedures, their IP addresses, technical clues that are like signatures for each of these groups; the servers they use, the Internet Protocol addresses they use, the sorts of techniques they use to get in, to stay inside, to not get detected, to move around in networks.
They track all of these digital clues, and they say these are the sets of clues that tell us this is Cozy Bear, and these are the clues that tell us that these are Fancy Bear, and they also have other types of bears, but those are the two that we're talking about here.
You said earlier that they get in, and I don't remember what the words you used were, but it sounded like they were just basically taking everything.They were in for a long time, and they could get it all.How?
Once you're inside a system and you have access to it, you can basically make copies of the information and take it out.CrowdStrike, as I recall, wasn’t entirely sure whether information had been exfiltrated at the time they did their investigation.
When they dumped the emails, suddenly now they’ve weaponized the data, right?It's not just espionage.This is something else.There's a political or a kompromat justification for what they're doing.
That's right.When Russia dumped the emails out into the public online, they had suddenly taken this operation to a new level.It was no longer just political espionage; it was information warfare.It was weaponizing information, using it to in this case sow some confusion and discord in the midst of a very contentious political campaign on the eve of the Democratic National Convention.It led directly to the resignation of the DNC chairwoman and her executive director.It was unprecedented, really.
From the beginning, from your story when it first runs in the middle of June, are there skeptics?Are there nonbelievers?Do you get a pushback from anybody in the government?
Some Russia analysts and experts I interviewed who were skeptical that Putin really wanted to or had a preference for, say, Donald Trump and was helping Trump win or trying to undermine Clinton.Yes, the Russians likely were interested in trying to create some chaos and confusion, but really, trying to help Trump win?Maybe not.After all, Hillary Clinton might be the better president for him since she's very predictable; she's known.As one analyst said to me: “He can run circles around her.Why wouldn't he prefer her?”
But there was a lot of anxiety and angst inside the Democratic Party at that time.They were thinking WikiLeaks is going to dump this 20,000.What more are they going to come out with?They were living in fear and great concern week to week about what was going to come out next.They knew that the Russians had so much on them, so many emails that they could dump, and WikiLeaks was promising to do so.
Did they know they’d gotten [Clinton campaign chair John] Podesta’s stuff by then?
There was a campaign that began in about March by the GRU, again, sending out spear-phishing emails.Spear phishes are a term of art in cyber world for emails that are meant to look legitimate, like they come from a coworker or a friend or maybe from Google’s IT office saying in this case: “Someone’s tried to use your password to check into your account.Please click on this link and change your password immediately.”These spear phishes were getting sent to Hillary campaign officials and members and other Democrats, and some of them were clicking on them.
Apparently, that's how John Podesta's personal Gmail account got compromised, was by clicking on one of these spear phishes and giving the Russians access to his Gmail account.
Once they get it, what do they do?
Well, now we know that in October, the Russians started dumping all of John Podesta's emails.
OK, so don’t go there; we’ll get there in October.Does the FBI or the CIA know that Podesta's account was grabbed early?
I would have to check my notes on that one.I think they did notify Podesta on that one.
The FBI?
Yeah.If not him, [they told] the campaign that there had been these compromises.I know they notified the campaign that there were compromises of these personal Gmail accounts.I don't know that it was taken all that seriously.
So if you’re John Podesta you sit there and think the clock is ticking, talk about the other shoe dropping, right?
Right.Well, do you remember—I guess it was Roger Stone who tweeted out that “Soon it will be John Podesta's time in the tank,” a reference to the emails coming out.
Supposedly Stone was talking to Guccifer?
Supposedly Stone was talking to Guccifer.I mean, Guccifer was talking to reporters.He wasn’t exactly just hiding in the closet.
Did you talk to Guccifer?
I didn’t.I tried to make contact, but he did not respond.
The U.S. Response to Russian Measures
In the process of the first stories, the first story, do you start to formulate a personal opinion, or do you research who is Putin and why would Putin do this?
By July, I was convinced that the Russians were behind an influence operation campaign, an information operations campaign.To me, the questions were, where are they going with this, and what is the Obama administration going to do about it?Are they going to come out publicly and point the finger at Putin and at Moscow and say they're behind this influence operation?Are they going to try to call it out?Are they going to try to take any steps to deter further actions?Are they going to use the executive order on cybersanctions that Obama had signed in, what, 2014, 2015?… What were they going to do?I started making calls and reporting it out.… What I was hearing, even in July, was that the White House was very concerned about saying anything publicly for fear of appearing too political and of appearing to favor Hillary Clinton.They were really concerned about that.That was one of the reasons they were not likely to say anything publicly at that point.
I know from my reporting that there were midlevel officials, lower than the deputy secretary's level, who were discussing potential response options, they call them, or measures of retaliation or punishment for Russia—economic sanctions, cyber measures, diplomatic measures, maybe even another dumping embarrassing personal or financial details on Putin and other Kremlin officials.But none of those seemed to be going anywhere throughout the summer from what I could gather.
It turns out there was very intense internal debate.At the senior-most levels, the deputy secretaries and above, and in particular at the White House with President Obama, his national security adviser, his deputy national security adviser, his chief of staff, there was a great reluctance to say anything publicly or take any response actions before the election because of a fear of escalation, number one, and number two, a fear of appearing to be putting their thumb on the scales in favor of Hillary Clinton, two big concerns.
What do you mean by escalation?
That Putin would retaliate either in cyberspace—after all, the U.S. is even more vulnerable than Russia in terms of our network.We have so many critical systems that are connected to the Internet, so much online: our banking systems, our financial, transportation, energy, technology, all online—and/or he might, beyond fake news, do other things that could be quite damaging to the U.S.There was that fear of Putin's retaliating.
There was also a sense that everyone expected—I think even Donald Trump expected—that Hillary Clinton was going to win.If so, why get in the middle of things now, risk escalation and play into Putin's hands by saying that Russia is meddling in the election, which might only confirm America's fears that there is meddling and become self-fulfilling prophesy?So there was that.Then there was the sense that if Clinton was going to win, well, there would be ample time after the election to take action.
The White House says that they always planned to have a response, to take action, and why not wait until after the election at this point? …
When did [then-Director John] Brennan—when did the CIA probably get their hands on this information, and how quickly did they believe it was Russia, that you know?
I don't know exactly when the CIA got their hands on the information, but I do know that in early August, the CIA learned through exquisite channels of intelligence that Russia not only wanted to meddle, but that Vladimir Putin himself directed the information operation, the influence campaign, to undermine Hillary Clinton and her chances of becoming the next president and to help Donald Trump.They were so sure of this information, which came from deep within the Kremlin, that they felt it needed to be communicated to the White House.
Brennan sent a courier in early August to the White House with an envelope marked “Eyes Only” to be seen by only four people: President Obama, the national security adviser, chief of staff and the deputy national security adviser.This information contained the intelligence about conveying Putin's specific instructions [and] was so sensitive that the CIA director, John Brennan, kept it out of the President's Daily Brief, because even that restricted report, the PDB, had a distribution that was too large for him, and he did not want this information to get out and get compromised at that point.
… So, at that point, they start to convene very secret level meetings in the White House Situation Room, where it’s so secret that even the video feed to some of the NSA aides was shut off.The last time apparently that had been done in any sustained way was in the lead-up to the Osama bin Laden raid when they were discussing that operation.So people knew this was something pretty significant and in close hold.
It took a while for the other two main major intelligence agencies, the NSA and the FBI, to come to the same conclusion with a high degree of confidence.They eventually did come around, but it did take some time, partly because they have different means of gathering intelligence than the CIA.So that was part of it.Part of it was they also had to review the intelligence and come to their own level of comfort that this was what it was.
But you knew already in your story.
I knew instinctively that this was Russia and, of course, if you have an information operations campaign like this, it could only be that Putin was directing it.These things don’t happen without his knowledge and assent.But to get the intelligence that corroborates that was the coup for the CIA.Putin is a master spy, former KGB officer.He rarely communicates by phone or email or anything electronic.So for them to get this kind of intelligence was pretty significant.
… This envelope shows up by courier on Aug. 4, and four people can read it, and it's got to be returned to the CIA, yes?
It's got to be returned.Eventually more people were read in.More officials, Cabinet secretaries were read into the intelligence, but initially, it was a very restricted group.
And the president's response?You said in the story that it was grave, that he—how did he respond?
He was very concerned.In fact, so he ordered the intelligence agencies, all of them, to a review of the intelligence to try to come to a consensus, high-level, high-confidence consensus, as to what Russia's role and intent was in this operation.
From what you can tell, is that the first time Obama knew about it?
From what I can tell, that is the first time that—yes, that he knew about it, which is when Brennan talked to him about it, when Brennan told him, yeah.
So now this is early August.On another track, but not entirely, from June, July, August, they're also feeding a lot of fake news flying around.Do we know Russia is behind a lot of that stuff as well?
I wasn't tracking that part too closely.But … If you read the Intelligence Community assessment from Jan. 5 or 6—it came out publicly—there's a whole annex in the back that tracks Russian propaganda operations in the U.S. elections going back—in this case, it went to 2012, and they talked about how RT America, the Russian Television, Kremlin-funded sponsored television in America, that network was doing programs in the run-up to the 2012 election, fake documentaries, about vote fraud and meddling in election systems in the 2012 election.They did a piece on Occupy Wall Street showing how America was run by Wall Street titans and just not as democratic as they were making themselves out to be.All of this is going on.
It’s an environment that you're reporting in during June, July, August.What are you coming to believe as you do your reporting across those three months?
I was seeing that there was ever-increasing concern on the part of, especially of some lawmakers and folks who really know and track Russia, that they were going to be getting away with something big, and the Obama administration was just too reluctant to come out publicly and say so, and that this would be a bad thing; this would be an error.There was tension, let's say, going on at that point between in fact, some lower-level officials within the administration, lawmakers, and then the senior-most levels of the administration of the White House, who were apparently very wary of doing a public finger-pointing or blaming, much less taking any response.
Brennan will tell you they did a series of warnings.On Aug. 4, Brennan called Alexander Bortnikov, the head of the FSB, and warned him.“Don’t you dare do anything more, or else you will pay the consequences.”Of course, President Obama spoke to President Putin on the sidelines at the G-20 in Hangzhou, China, in September, warning him basically that if they tried in any way to mess with the outcome of the election, alter the votes, there would be hell to pay, that they’d do something, crater the economy or something like that. …
Obama and those guys don’t have a strategy right away when they get that missive from Brennan in early August and go down to the Situation Room and begin to have their own private conversations off the grid.
What their focus was at that point in time, their foremost concern was protecting the integrity of the vote, making sure that Russia didn't alter the vote tallies, making sure they didn't get into any of these state election systems, voter registration systems, and change information.
Did they have a hint that that was happening?
Yes.Toward the end of July, beginning of August, the FBI started to see evidence that Russia was probing the voter registration systems of various states and passed that information to the White House, which the White House got really concerned about this.They set up a task force made up of people at the White House, the Department of Homeland Security, the FBI, the Office of Science and Technology Policy, to look into the prospect, the potential for Russian interference in the vote tallies and the voter registration systems.Could this really take place?
They put in charge, well, they called Ed Felten, who was on the OSTP, the Office of Science and Technology Policy, and a real expert in voting machines, as well as a Princeton University professor.He fairly quickly concluded that it wasn't likely that the Russians, or anyone, really could mess with the vote tallies, the systems, because there are several thousand voter jurisdictions in the country.Each one has some different system of voting machines, and most of them, for the most part, are not connected to the Internet.So it would be virtually impossible to affect the outcome of the tally of the vote in any systematic way.So they turned their attention—
But at that time, they really cared a lot about it?
They cared a lot about it, but they started thinking about whether the voter registration systems could be messed with.If you could hack into them and let’s say flip two digits in every address or delete every 10th voter, when the voter shows up at the polls, his information won't mesh with what's there.So that was a concern.That could cause great confusion on Election Day if that were to happen.They also thought that maybe Russia could do some sort of disinformation campaign like put up a video on YouTube of someone hacking an election machine and say, “Hey, we've done this 10,000 times.”And who knows?People might fall for that.
Do you have a sense of whether the president was especially worried about that or especially worried about fake news or especially worried about something coming from John Podesta's or somebody’s computer?
From the president on down, they were very worried about any prospect of the actual vote being meddled with, being altered, so much so that they tried to get—first of all, the DHS secretary, Department of Homeland Security secretary, Jeh Johnson, he tried to have the election systems declared critical infrastructure, which meant if it’s declared a critical infrastructure, they get priority in cybersecurity protection from the federal government, putting them on a par with the defense industry or banks.
But in a conference call he had with a number of state elections officials, they were all very resistant to that idea.
Because it was like federalizing the—
This would be federalizing a state function.The elections are up to the states and the local localities.They did not want the federal government coming in and taking those over.It would be an intrusion into states’ rights, so he backed off on that.Then the White House decided to try to go for a bipartisan statement of support from Congress condemning Moscow for its interference in the election, as well as urging the states to accept federal help, DHS help, in shoring up the security of their systems.
And how did that go?
Not very well.I guess it was in September, Jeh Johnson, the DHS secretary, Jim Comey, the FBI director, Lisa Monaco, the president's homeland security adviser, went up to the Hill and met with about a dozen senior lawmakers from both parties and made an appeal to them.
The Democrats were on board, and they thought it would be a good thing to both issue a statement and get the states to accept federal help, but the Republicans were very resistant for the reasons we just said.They did not want the federal government appearing to be meddling in states’ elections.And Mitch McConnell, who’s the majority leader in the Senate, was even outright skeptical of the intelligence that was underlying this conclusion that Russia was meddling in the election.So that went nowhere.The whole meeting just devolved into partisan bickering.
He still didn’t, McConnell, still didn't believe it by whenever this is, middle of September?
He had been briefed by the intelligence agencies on what they had about Putin and the interference.
But by now, the president really believes it?
Oh, yes.
And everybody at the White House that matters believes it?
Yes. No question that they all believed, that they all knew it.It was what do you do about it?
So that brings us to the G-20 in Hangzhou.What is the president's intent?He's sort of running out of other options.I mean, they haven’t really done anything yet, have they?They’ve been talking about it since early August, but what else have they done? …
They're trying to help the states secure their networks.
But the states don’t want anything to do with them.
Some of them accept the help, but a lot of them don’t.The Republican states are resistant.There was a lot of talk about what sort of options they had, because I guess the thinking was they do it after the election.Now, they [the Obama administration] sent a message through the Russian Embassy in September.Then on Oct. 31, they also used this hotline or this channel set up at the State Department which was used to try to avert a nuclear exchange.They used that channel to send a message to Moscow, again saying: “We've detected efforts by you to target our election systems.Any interference on your part will be seen as a very serious matter, and we will take appropriate consequences.”So they warned the Russians there.They didn't hear back until after the election.
So much for the Risk Reduction line, right?
The Risk Reduction line, exactly.Now, so the one thing they did do was—I should say after the meeting on the Hill, when that didn't produce what the White House wanted, two senior Democratic lawmakers, Adam Schiff, who’s the ranking Democrat on the House Intelligence Committee, and Dianne Feinstein, the ranking member on the Senate Intelligence Committee, put out a statement of their own basically saying, “Based on intelligence briefings we have, we know that the Russians have directed an influence operation against targeting the 2016 election, and this could only have come from the senior-most levels of the Russian government.”
They put that out.They did not say that Putin was himself directing it, but they said the senior-most levels.They did that on Sept. 22.Now interestingly, the White House had asked them earlier to hold off on putting out the statement for fear of politicizing the issue when they were trying to get bipartisan statement and the states on board, and the two lawmakers agreed.But once they saw that the meeting on the Hill wasn’t really yielding results, they decided to put out their statement.
… The president of the United States, knowing that the president of Russia is messing around with the American election, of all things, there's a sacred thing you think nobody would actually do.But he doesn’t step up and pull a press conference and have Trump and Hillary there or something and say, “Hey, everybody, something really horrible is happening.”
Part of the thinking was if President Obama were to hold a press conference in the Oval Office and say, “Putin is trying to help Trump get elected,” they were thinking that wouldn’t go over very well, and it would look like the president was using the office of the president of the United States for an overt political purpose, which they felt would just backfire.
I can understand that, because in August, Trump says, “The election is rigged; this election is rigged.”He starts that thing.
Their thinking was this would just play into the hands of Putin and Russia and just seem to confirm that the election, in fact, was rigged.Why risk all that when they were thinking Hillary Clinton was going to win?They could take some action afterward.
Were you talking to people at the White House and other places that were in some level of authority who were kind of livid about the lack of response from the White House?
I don't know if I'd say livid, but there was sort of frustration that this idea that the fear of politicizing the issue in a way stymied or just paralyzed the White House from taking action, so much so that in the end, that fear of politicizing the issue meant that, in essence, Obama let politics shape a decision in response to what should have really been a national security matter.
In fact, he let Putin shape American policy more than—you know what I mean?—more than himself.
Politics ended up shaping their response.And you know, there were—it’s not as if it was uniformly the senior-most people were always against it.No, there were times when there were deputies—like the FBI deputy director, Andy McCabe, the NSA deputy director Rick Ledgett, were among the more forward-leaning advocating in discussions, advocating taking more forceful steps prior to the election.There were people at that level who were making the case that the United States should take a strong position because of course Putin responds only to strength, was the thinking, right?
Of course there was the Cyber Response Group [CRG], which is meeting all the time and saying, “Let’s go.”
Another key group of players here was the Cyber Response Group, which is made up of members, officials from various agencies around the Beltway, from the Department of Homeland Security, FBI, NSA, CIA, DoD, you name it, and at different times, different other agencies would get pulled in.They throughout the summer were discussing various options, potential response options, that the government could take to punish and to deter Russia.Ran the gamut from the cyber to the diplomatic to the economic and informational.One of the more fanciful ones was to put a message in Cyrillic in the administrative section of the DCLeaks site, the one that Guccifer 2.0 was putting stuff up on, just to kind of say, “Hey, we know who you are and how you're doing it.”They never did that.
Another idea they batted around was maybe using law enforcement tools to seize domain name servers that were helping the Russians in their intelligence gathering so as to disrupt it, the cyber espionage.Again, that didn't go anywhere.But I guess the ones that people kept coming back to were the economic sanctions, economic and cyber.There were also some cyber ideas to affect some of the systems that the Russians were using. …
When did the FBI know?What did your reporting reveal that the FBI knew?
… They’d been tracking those groups for years.They knew back in 2015 APT29 [also known as Cozy Bear] had gotten into the DNC, and they knew that APT28 [also known as Fancy Bear] had gotten into the DNC in March of 2016.
So very early, what we know is you know, Brennan and the CIA know, and the FBI knows?
The FBI cyber people definitely knew the Russians had hacked the DNC.They went and informed the DNC in 2015 and 2016.There's no doubt about that.There was some debate about what was the intention here.Again, was this just for political espionage, traditional espionage purposes?At the time, everyone thought this was just straight spying, cyber spying: Hack in, get the information, use it for your own purposes.
… What they didn't know about Putin was what?
What they didn't know was that Putin had given the order that this information be used in an information operation campaign to get leaked to WikiLeaks, put out online and to help damage Hillary Clinton's campaign.
And if he did do it, why would he do it?I suppose everybody’s asking that question.
Yeah.
I mean, to what end?Now we see in hindsight that he really did have a preference for Donald Trump.He also has a visceral hatred for Hillary Clinton, held her personally responsible for the protests in 2010, ’11 and ’12 in Moscow.He felt that he really did want to, either if she was going to win make sure he could damage her presidency, or try to stop her from winning. …
During this whole time, though, while they wait for an agreement from the American intelligence agencies, Obama is—and I guess by then, Obama has made a decision: We're not going to go hard at this. …We're going to wait until after the election.He has of course ordered a thorough analysis, and that is revealed, the DNI [Director of National Intelligence] report, on one of the craziest days in the history of this whole story, Oct. 7, when early afternoon, the report comes out that says at least three of the intelligence agencies say—
… On Oct. 7, at 3:30 in the afternoon, a Friday I remember, a statement comes out from the Office of the Director of National Intelligence and the Department of Homeland Security, saying that Russia was behind the hacks of—they say “political organizations,” was clear that was a reference to the DNC, and that this was done with the intent of interfering in the U.S. election of 2016.
Are you in the newsroom when it comes?
I am.I actually was prepared for it, and I had the story up within minutes of the statement coming out.
So it’s a big story at the time.
It's a big deal story.Public attribution for the first time to Russia.In the statement, they say that these sorts of activities could only have been directed from the highest levels of the Kremlin.We know it’s Putin.They could have said Putin, but they didn't.Earlier drafts of that statement included Putin by name, but his name got taken out in the final statement because of a concern over sources and methods and of concern about appearing to be too provocative, I guess.
That statement comes out at 3:30, and for a while, it’s huge news—for about half an hour.And then The Washington Post puts up a story about Donald Trump's lewd remarks on this Access Hollywood tape.That then becomes the big story of the season, the day, the week.It just overwhelms everything.… And a half hour after that, come the first Podesta emails on WikiLeaks.It was one of the most incredible days of the 2016 election.
The Podesta release is not an accident.
No, not an accident.
Is it meant to counterbalance the DNI statement or the Trump crude remarks?
I really don’t know.At the time I thought maybe the statement, then I thought maybe it’s both, certainly both.But clearly it was an effort to really punch back, punch back hard, and I think it had the desired effect.Practically every day from that point on through the Election Day, there was a steady drip, drip, drip of emails from Podesta's account that while no one email was entirely damaging or fatal, it just kept the spotlight on Hillary Clinton's email problems at a time when the campaign desperately wanted to shift the subject away to Donald Trump and his lewd remarks about women or on her campaign and what she was going to do for the country.Instead, they were having to deal with questions about emails on, for instance, Hillary's speeches to Wall Street banks where she basically suggests that Wall Street can regulate itself, things like that, that were really just distractions for the campaign. …
OK, so that's Oct. 7.In the next month, what happens?
The election happens.The White House will say that their warnings to Moscow and to Putin they felt actually had some impact in getting Putin to dial back on some of the actions, because, in the end, the Russians did not change the vote in any way.… But the result was a huge surprise to everyone, and the atmosphere at the White House afterward was funereal.One person described it as a funeral parlor.People were stunned.They were in shock at the result.
They carried on with their work, but for a while, they were just trying to process what had happened.
Were there recriminations about, jeez, we should have done more?We should have known this?We should have dove in in August or September?
…There were people who had frustrations.But I think at that point, it was more or less a sense of, OK, so what do we do now?What do we do next?There was clearly a determination to take action, but things didn't really start moving until December.
… On Dec. 9, Obama orders up a comprehensive review of Russian meddling and interference into U.S. elections going back to 2008.And as the Intelligence Community is doing this review, they are going back through intelligence reports and intercepts and they're finding things that—they're digging up things.
They're now, in a way, able to maybe piece together some information that they hadn’t really focused on before prior to the election, and it’s starting to sink in in deeper fashion just how brazen and bold this campaign was, and how significant, how serious.
Like what?
They were finally starting to piece together the fact that Putin himself directed this, that this operation combined—it wasn’t just a cyber operation, not just a hack, but a complete information operation campaign with propaganda, with hacks and releases of information with continued efforts to try to get into these networks in a way that would really throw the whole election into kind of a state of—I mean, it really injected discord and confusion.
There was already a lot of acrimony and disharmony, but the Russians were able to exploit these divisions with their operations.That was what was so masterful about it. …
… Obama gives a press conference on the 9th of December, and he’s unbelievably—I mean, for him, he really lets it fly about Moscow and about the hack.
He makes clear that the United States has cyber capabilities that if we used them, they could really hurt—that we could punish Moscow in a way that they’d feel it.
He threatens them.
He’s basically threatening them, right. … Some senior administration officials were all for sanctioning Putin himself.Some wanted to revive the idea of putting out damaging information, personal or financial, but the thinking was that, well, if we did that, we’d be lowering ourselves to the Russians’ level and playing their game, and besides, it could come back to bite us.Some people wanted very hard-hitting economic sanctions that might hit entire sectors, maybe even technology and maybe sanctioning, say for instance, Kaspersky, which is a Russian software company that does business also in the United States and around the world.But the thinking was if you did that, that could also have impacts on businesses in the U.S. and Europe.
In the end, [on] Dec. 29, the Obama administration announced its package of sanctions.They slapped economic sanctions on two Russian spy agencies, the GRU and the FSB.Now initially it was only going to be the GRU, but some people argued for more punishments, so they added the FSB, which had also enabled some of this interference.They sanctioned four GRU officials and three tech companies that were in some way linked to the cyber operations by the Russians.
They also announced the expulsions of 35 Russian diplomats and the closure of two Russian compounds, one up in New York on Long Island and one on the eastern shore of Maryland, which the Intelligence Community says had been used for surveillance purposes. …
… I gather from people we've talked to at the White House, the Obama White House, that then they held their breath and waited for Putin to come and respond to the sanctions and the expulsions.
The Obama White House was expecting a response in kind after the expulsions were announced on the 29th.Everyone was quite surprised, actually, when none happened.When Putin didn't respond, he actually was quite restrained.In fact, there was an initial report that they were going to close the American School, I think, in Moscow, and then it turned out it didn't happen.What we later learned was that Mike Flynn, who was Trump's incoming national security adviser, had a phone call with Ambassador Sergey Kislyak, the Russian ambassador, around the 29th to discuss sanctions and had basically let him know that “Look, don’t take any actions now; don't retaliate, because when we take over, things will be better, and we can work together.” …
… Let’s see what we've missed, and then I have some final questions to ask you.
The U.S. Response to Russian Measures
… Susan Rice ended up being the one to put the proposals out on—to be voted on before the meetings that took place.… Can you tell us that part of the story?
… Susan Rice, who had been seen as one of the brakes on the process earlier on, by now in December had flipped.Here she was one of the ones who was being just much more aggressive and forceful about moving.She pressed people in these meetings to just take it to the max of their comfort zones, and it was as if now she felt that we're going to take some actions, and we're going to do the strongest actions we can take.
At one point, the discussion about closing the compounds, she turns to Andy McCabe, who’s the deputy director of the FBI, and says: “You guys have been begging to do this for years.Well, now’s your chance.”It was sort of a flipping of Susan Rice, of her—
Do you know why?
From the best I can tell, they knew all along they wanted to take some action.They just thought they were going to have more time to do it, and it was going to be under different circumstances, with an administration that was going to carry out their actions.The sense of the shock of the election result and combined with— I don't know if there was any regret, but the sense that we now really need to do something, I think maybe combined in Susan to say, “OK, we're going to—” and with the knowledge that Putin had personally directed this, and whatever else they were finding out in December, finally dawned on her, “This is our chance to do something, and we’d better take it.” …
Putin and Trump
Last from me.I don't think we covered it: the fact that the FBI from really July were looking at the Trump campaign contacts with Russia officials.What were you reporting about that?
That might not be entirely 100 percent accurate.It’s more like by late July, in late July, the FBI opened a full-fledged investigation into the Russian hacking and involving also the counterintelligence people, not just the cyber.From that point on, the investigation really was a counterintelligence one.It would grow to encompass also potential contacts between Trump associates and Russian officials and look at whether there was any potential collusion between them.
What does it mean, counterintelligence?What's the difference from cyber to counterintelligence?
The cyber guys are the ones who are looking at the 1s and zeroes and the hacks and the intrusions into the systems.The counterintelligence guys, they're the spies, the spooks, the ones who are tracking spies in the U.S. and what they're doing to spy on Americans.Who are they?What are they up to?What are they doing?They work closely with their counterparts at the CIA.So you were combining the espionage, counterespionage people at the FBI with the cyber people.
As early as July?
Yeah. …
Intervention in the U.S. Election
The Russians we've talked to have expressed some doubt about whether Putin has the ability or was laser-like running this thing.They say it’s quite possible that the people who did it were trying to impress him; they were trying to earn brownie points with the boss; that it's a clan system, and there's a lot of internal jockeying and competition; that it's much messier than Putin, the ex-KGB officer, directing the laser beam at Hillary and wiping her out.What do you think? Is that possible?
I'm sure he wasn't micromanaging it, and I think it was more or less just that the grand big-picture strategic goal of hurting Hillary and helping to elect Trump was something that came from Putin.The how do you get there, he left to others.
And you think that that conclusion about his intent was pretty solid before the election, or do you think the realization of what their motive was only gelled after?
I think the CIA was pretty convinced of Putin's intention earlier on.It took some time for the other intelligence agencies to also get on the same page.If you read the intelligence report that came out on Jan. 6, it says all three, the NSA, FBI and CIA, were in agreement with high confidence that Russia intended to interfere in the campaign and targeted the election and wanted to hurt Hillary Clinton's chances and had a preference for Donald Trump.
It’s on the point of Putin, I guess, wanting to help Trump get elected by contrasting Hillary Clinton unfavorably to him where you have the NSA having moderate confidence, whereas the two other agencies were high confidence.Now, that doesn't mean that the NSA disagreed, because in fact, moderate confidence is still— their conclusion is still yes, Putin wanted Trump to win.It’s just that their confidence level is slightly lower on that.
That actually reflects the analytic process by which the agencies come to their conclusions.And Rick Ledgett has spoken publicly about this, how he feels that—and so has Mike Rogers, the head of NSA—they feel that this is actually a strength of the process by which they come up with these assessments, because everyone goes through the same intelligence, all these agencies.The analysts are looking at the same intelligence, but they don’t want groupthink.In the end, they did come to that conclusion. …
Intervention in the U.S. Election
So what do you make of all the events?What did Putin want?
Putin wanted to create some confusion in the election, disrupt the election a bit, humiliate the great American democracy and try to show that U.S.-style Western democracy wasn’t as clean and shiny as all it’s cracked up to be [and] by comparison make Russia, Mother Russia, look strong again.What he was interested in is trying to regain some stature and power that he’s lost.Russia, in a sense, isn't a resurgent power, but it is a country that's learned to master cyberspace and use the Internet, the digital tools, as a low-cost but high-impact weapon to achieve its ends.
[Former CIA Director Gen.] Mike Hayden called what Putin did in the 2016 election “the most successful covert operation in history.”It really took the American public and government Intelligence Communities by surprise as to how successful he was in basically just using information as a weapon to his own ends.
Are we at war with him?Is he at war with us?
It’s a war over ideas, a war over cultures and a way of life.Russia is doing this not just in the United States but in Germany and France, in Ukraine.Part of it is what it’s always done.Soviet Union has long used information operations and propaganda, but Putin has taken it to a new level using cyber, and is using it both for propaganda and strategic geopolitical aims, as well as just to, I think, mess with Americans, because this is not something that we're used to doing.We don’t play this game.Some people talk about the United States government needing to get more sophisticated in counterintelligence or counter influence operations.But the U.S. government is a little wary of getting into those sorts of things these days.
Thank you.
Thank you.
Latest Interviews
Latest Interviews
Explore
Policies
Teacher Center
Jon and Jo Ann Hagler on behalf of the Jon L. Hagler Foundation
Koo and Patricia Yuen
FRONTLINE is a registered trademark of WGBH Educational Foundation. Web Site Copyright ©1995-2025 WGBH Educational Foundation. PBS is a 501(c)(3) not-for-profit organization.
Funding for FRONTLINE is provided through the support of PBS viewers and by the Corporation for Public Broadcasting, with major support from Ford Foundation. Additional funding is provided the Abrams Foundation, Park Foundation, John D. and Catherine T. MacArthur Foundation, Heising-Simons Foundation, and the FRONTLINE Trust, with major support from Jon and Jo Ann Hagler on behalf of the Jon L. Hagler Foundation, and additional support from Koo and Patricia Yuen. FRONTLINE is a registered trademark of WGBH Educational Foundation. Web Site Copyright ©1995-2025 WGBH Educational Foundation. PBS is a 501(c)(3) not-for-profit organization.
