Obama administration punishes Russia for election hacking

Russian President Vladimir Putin takes part in a video link, dedicated to the start of natural gas supplying from mainland Russia to Crimea, in Moscow, Russia, December 27, 2016. Sputnik/Alexei Druzhinin/Kremlin via REUTERS

Obama Strikes Back at Russia for Election Hacking

WASHINGTON — The Obama administration struck back at Russia on Thursday for its efforts to influence the 2016 election, ejecting 35 Russian intelligence operatives from the United States and imposing sanctions on Russia’s two leading intelligence services.

The administration also sanctioned four top officers of one of those services, the military intelligence unit known as the G.R.U., which the White House believes ordered the attacks on the Democratic National Committee and other political organizations.

The expulsion of the 35 diplomats was in response to the harrassment of American diplomats in Russia, officials said. But some individuals involved are believed to be linked to cyberactivity, according to two officials briefed on the intelligence. In addition, the State Department announced the closure of two “recreational facilities” — one in New York, another in Maryland — that it said were used for Russian intelligence activities, although officials would not say whether they were specifically used in the election-related hacks.

In a sweeping set of announcements, the United States also released samples of malware and other indicators of Russian cyberactivity, including network addresses of computers commonly used by the Russians to launch attacks. Taken together, the actions amount to the strongest American response ever taken to a state-sponsored cyberattack aimed at the United States.

The sanctions were in part intended to box in President-elect Donald J. Trump. Mr. Trump has consistently cast doubt that the Russian government had anything to do with the hacking of the D.N.C. or other political institutions, saying American intelligence agencies could not be trusted and suggesting that the hacking could have been the work of a “400-pound guy” sitting in his bed.

Mr. Trump will now have to decide whether to lift the sanctions on the Russian intelligence agencies when he takes office next month, with Republicans in Congress among those calling for a public investigation into Russia’s actions. Should Mr. Trump do so, it would require him to effectively reject the findings of his intelligence agencies.

Asked on Wednesday night at his Mar-a-Lago estate in Palm Beach, Fla., about reports of the impending sanctions, Mr. Trump said: “I think we ought to get on with our lives. I think that computers have complicated lives very greatly. The whole age of computer has made it where nobody knows exactly what is going on. We have speed, we have a lot of other things, but I’m not sure we have the kind, the security we need.”

President Obama, in a statement, put in a subtle dig at Mr. Trump’s unwillingness to talk about Russia’s role. “All Americans should be alarmed by Russia’s actions,” he said. He said he acted after “repeated private and public warnings that we have issued to the Russian government” and called the moves “a necessary and appropriate response to efforts to harm U.S. interests in violation of established international norms of behavior.”

The samples of malware were in what the Obama administration called a “joint analytic report” from the F.B.I. and the Department of Homeland Security that was based in part on intelligence gathered by the National Security Agency. A more detailed report on the intelligence, ordered by President Obama, will be published in the next three weeks, though much of the detail — especially evidence collected from “implants” in Russian computer systems, tapped conversations and spies — is expected to remain classified.

In Moscow, there was a sense that the Obama administration was trying to take unseemly last-minute revenge against Russia and President Vladimir V. Putin.

“We regret that this decision was made by the U.S. administration and President Obama personally,” Dmitri S. Peskov, the spokesman for Mr. Putin, told reporters. “As we have said before, we believe such decisions and such sanctions are ungrounded and illegal from the point of view of international law.”

Russia is studying the details of what Washington did, he said, and some manner of reciprocal answer can be expected.

Konstantin Kosachyov, the head of the foreign affairs committee in the upper house of the Russian Parliament, told Interfax that “this is the agony not even of ‘lame ducks,’ but of ‘political corpses.’”

Despite the fanfare and political repercussions surrounding the announcement, it is not clear how much real effect the sanctions may have, although they go well beyond the modest sanctions imposed against North Korea for its attack on Sony Pictures Entertainment two years ago.

Starting in March 2014, the United States and its Western allies levied sanctions against broad sectors of the Russian economy and blacklisted dozens of people, some of them close friends of Mr. Putin’s, after the Russian annexation of Crimea and its activities to destabilize Ukraine. Mr. Trump suggested in an interview with The New York Times earlier this year that he believed those sanctions were useless, and left open the possibility he might lift them.

Mr. Obama and his staff have debated for months when and how to impose what they call “proportionate” sanctions for the remarkable set of events that took place during the election, as well as how much of them to announce publicly. Several officials, including Vice President Joseph R. Biden Jr., have suggested that there may also be a covert response, one that would be obvious to Mr. Putin but not to the public.

While that may prove satisfying, many outside experts have said that unless the public response is strong enough to impose a real cost on Mr. Putin, his government and his vast intelligence apparatus, it might not deter further activity.

“They are concerned about controlling retaliation,” said James A. Lewis, a cyberexpert at the Center for Strategic and International Studies in Washington.

The Obama administration was riven by an internal debate about how much of its evidence to make public. Although the announcement risks revealing sources and methods, it was the best way, some officials inside the administration argued, to make clear to a raft of other nations — including China, Iran and North Korea — that their activities can be tracked and exposed.

In the end, Mr. Obama decided to expand an executive order that he issued in April 2015, after the Sony hacking. He signed it in Hawaii on Thursday morning, specifically giving himself and his successor the authority to issue travel bans and asset freezes on those who “tamper with, alter, or cause a misappropriation of information, with a purpose or effect of interfering with or undermining election processes or institutions.”

Mr. Obama used that order to immediately impose sanctions on four Russian intelligence officials: Igor Valentinovich Korobov, the current chief of a military intelligence agency, the G.R.U., and three deputies: Sergey Aleksandrovich Gizunov, the deputy chief of the G.R.U.; Igor Olegovich Kostyukov, a first deputy chief, and Vladimir Stepanovich Alekseyev, also a first deputy chief of the G.R.U.

But G.R.U. officials rarely travel to the United States, or keep their assets here, so the effects may be largely symbolic. It is also unclear if any American allies will impose parallel sanctions on Russia.

The administration also put sanctions on three companies and organizations that it said supported the hacking operations: the Special Technologies Center, a signals intelligence operation in St. Petersburg; a firm called Zor Security that is also known as Esage Lab; and the Autonomous Noncommercial Organization Professional Association of Designers of Data Processing Systems, whose lengthy name, American officials said, was cover for a group that provided special training for the hacking.

“It is hard to do business around the world when you are named like this,” a senior administration official with long experience in Russia sanctions said on Thursday morning. The official spoke on the condition of anonymity because of the sensitive nature of the intelligence.

But the question will remain whether the United States acted too slowly — and then, perhaps, with not enough force. Members of Hillary Clinton’s election campaign argue that the distractions caused by the leaks of emails, showing infighting in the D.N.C., and later the private communications of John D. Podesta, the campaign chairman, absorbed an American press corps more interested in the leaks than in the phenomena of a foreign power marrying new cybertechniques with old-style information warfare.

Certainly the United States had early notice. The F.B.I. first informed the D.N.C. that it saw evidence that the committee’s email systems had been hacked in the fall of 2015. Months of fumbling and slow responses followed. Mr. Obama said at a new conference he was first notified early this summer. But one of his top cyberaides met Russian officials in Geneva to complain about cyberactivity in April.

By the time the leadership of the D.N.C. woke up to what was happening, the G.R.U. had not only obtained those emails through a hacking group that has been closely associated with it for years, but, investigators say, also allowed them to be published on a number of websites, from a newly created one called DC Leaks to the far more established WikiLeaks. Meanwhile, several states reported the “scanning” of their voter databases — which American intelligence agencies also attributed to Russian hackers. But there is no evidence, American officials said, that Russia sought to manipulate votes or voter rolls on Nov. 8.

Mr. Obama decided not to issue sanctions ahead of the elections, for fear of Russian retaliation ahead of Election Day. Some of his aides now believe that was a mistake. But the president made clear before leaving for Hawaii that he planned to respond.

The question now is whether the response he has assembled will be more than just symbolic, deterring not only Russia but others who might attempt to influence future elections.


Obama orders sanctions against Russia, expels operatives, in response to hacking

The Obama administration announced sanctions Thursday against Russia’s intelligence services, while ejecting dozens of intelligence operatives from the U.S. as part of a response to what it says are efforts by Moscow to influence the 2016 election.

In a two-sentence response almost four hours after the administration's announcement, President-elect Donald Trump said it was "time for our country to move on to bigger and better things." He added he would meet with leaders of the intelligence community next week to be updated on the situation.

Using an executive order, President Obama sanctioned the GRU and the FSB -- two of Russia's intelligence services as well as other entities and individuals associated with the GRU. The cybersecurity firm hired by the Democratic National Committee to investigate the hack of its emails earlier this year concluded the hacking came from the Fancy Bear group, believed to be affiliated with the GRU, Russia's military intelligence agency.

In addition to the sanctions, the State Department has declared 35 Russian intelligence operatives "persona non grata" in the U.S., giving them 72 hours to leave, and is shutting down two Russian compounds in Maryland and New York.

The Maryland property is a 45-acre property at Pioneer Point, and was purchased by the Soviet government in 1972.

The New York property is on Long Island and is 14 acres and was purchased by the Soviet government in 1954.

Russian President Vladimir Putin's spokesman said in response to the announcement that Moscow will consider retaliatory measures.

 "We think that such steps by a U.S. administration that has three weeks left to work are aimed at two things: to further harm Russian-American ties, which are at a low point as it is, as well as, obviously, to deal a blow to the foreign policy plans of the incoming administration of the president-elect," Dmitry Peskov told reporters in Moscow.

The Russian Embassy in the UK took a different approach, tweeting out a picture of a lame duck and blasting what it called "Cold War deja vu."

The Treasury Secretary meanwhile has named two individuals -- Evgeniy Mikhailovich Bogachev and Aleksey Alekseyevich Belan -- it says were involved in "malicious cyber-enabled activities."

"These actions follow repeated private and public warnings that we have issued to the Russian government, and are a necessary and appropriate response to efforts to harm U.S. interests in violation of established international norms of behavior," Obama said in a statement.

Obama also announced that the Department of Homeland Security and the FBI will release declassified information on Russian cyberactivity to help "identify, detect and Russia's global campaign of malicious cyber activities."

Obama also said that the administration will be providing a report to Congress "in the coming days" about Russian attempts to interfere in the election, as well as previous election cycles.

The president also hinted that his administration intends to do more to hold Russia accountable.

"These actions are not the sum total of our response to Russia's aggressive activities," Obama said. "We will continue to take a variety of actions at a time and place of our choosing, some of which will not be publicized."

U.S. intelligence services have concluded that the Russians interfered in the election to try and help President-elect Donald Trump win. Trump has dismissed the conclusions.

However, House Speaker Paul Ryan, R-Wis. welcomed the move in a statement.

"Russia does not share America's interests. In fact, it has consistently sought to undermine them, sowing dangerous instability around the world. While today's action by the administration is overdue, it is an appropriate way to end eight years of failed policy with Russia," Ryan said.

Incoming Senate Minority Leader Chuck Schumer, D-NY., also praised the move in a statement late Thursday.

House Homeland Security Committee Chairman Michael McCaul, R-TX., called Obama's actions "long overdue," while House Permanent Select Committee on Intelligence Chairman Devin Nunes said he's been "urging" Obama for years to take action and that this "indecision and delay" explains why "American's influence has collapsed."


Obama slaps Russia with expulsions and broad sanctions for meddling in the U.S. election

President Obama ordered the expulsion of 35 Russian diplomats, closed two rural estates used by Russian spies, and slapped sanctions on two Russian intelligence organizations and other entities Thursday for their alleged role in what the White House says was a Kremlin-directed effort to interfere with the 2016 presidential race.

The sweeping retaliation follows an intense review of what Obama called "aggressive harassment" of U.S. diplomats in Moscow and "cyber operations aimed at the U.S. election,” a hacking campaign that U.S. officials code-named “Grizzly Steppe.”

It also signaled the worst major cyber clash of the modern era, with the two former Cold War adversaries now increasingly focused on penetrating each other’s digital networks and communications.

In the most dramatic move, the State Department declared 35 intelligence operatives at the Russian Embassy in Washington and the Russian Consulate in San Francisco as  persona non grata. They were given 72 hours to leave the country with their families for “acting in a manner inconsistent with their diplomatic status.”

The Obama administration also said it would block access after noon on Friday to two properties owned by the Russian government — a 45-acre estate along the Chesapeake Bay in Maryland and 14-acre compound in Long Island, N.Y. —  that it said were used by Russian personnel for gathering intelligence.

The broad penalties, three weeks before Obama hands over the White House to Donald Trump, mark a new low point in post-Cold War relations with Russia amid rising tensions over President Vladimir Putin’s military operations in Syria and Ukraine.

“All Americans should be alarmed by Russia’s actions,” Obama said in a statement. He said the U.S. moves follow “repeated private and public warnings” to Moscow.

“These actions are not the sum total of our response to Russia’s aggressive activities,” Obama added. “We will continue to take a variety of actions at a time and place of our choosing, some of which will not be publicized.”

Obama said the Russian effort was aimed at interfering with the U.S. election. He stopped short of endorsing FBI and CIA conclusions that the cyber-attack was aimed, at least in part, at helping Trump win.

Earlier this month, Obama all but blamed Putin personally, telling reporters that very little happens in the Russian government without Putin’s knowledge.

Trump has repeatedly dismissed conclusions from the Office of the Directorate of National Intelligence and the Department of Homeland Security that senior Russian officials directed a campaign aimed at interfering with the fall election.

In a statement Thursday night, he made clear he is still not convinced.

“It's time for our country to move on to bigger and better things,” he said. “Nevertheless, in the interest of our country and its great people, I will meet with leaders of the intelligence community next week in order to be updated on the facts of this situation."

The mass expulsion of alleged Russian spies is the largest in decades, and a Kremlin spokesman, Dmitri Peskov, said Moscow would respond in kind. “I can't say what the response will be, but there is absolutely no alternative to the principle of reciprocity,” he said.

Peskov said the U.S. measures were “ungrounded and illegal” and were intended to “undermine” Trump’s calls for warmer relations with Moscow.

In an acerbic statement, Maria Zakharova, Russia's Foreign Ministry spokeswoman, said America had been “humiliated by its own president” and his “hardly literate foreign policy team.”

“Not by international terrorists, not enemy armies. Washington’s own master slapped it on the face by maximally increasing the number of urgent things to be done by the next administration,” she said.

She said Russia would announce counter-measures “and a lot of other things” on Friday.

The State Department said it was expelling the 35 Russian diplomats partly in response to the harassment of U.S. diplomats in Russia over the last four years, including the tackling of a U.S. Embassy official by a Russian security guard that was posted on YouTube in June.

“This harassment has involved arbitrary police stops, physical assault, and the broadcast on State TV of personal details about our personnel that put them at risk,” Mark Toner, the State Department spokesman, said in a statement.  The Russian government has also closed 28 American cultural education centers in Russia and blocked the construction of a new consular office in St. Petersburg.

“Such behavior is unacceptable and will have consequences,” Toner said.

Closing the two Russian compounds may be especially painful for Russian diplomats.

One is a sprawling estate called “Pioneer Point” on Maryland’s Eastern Shore that Russia’s ambassador to Washington long has used as a weekend retreat.

In 2007, Washington Life magazine, described it as a “three-story brick dacha fronting the Chester River.” The parcel was purchased by the Soviet government in 1972 and transferred to the Russian Federation in the 1990s.

Russian diplomats based in New York City or at the United Nations have used the Long Island compound for decades as a weekend retreat. A State Department official described both locations on the condition of anonymity.

Obama used a newly-amended executive order that for the first time authorizes U.S. action in response to attempted “interfering with or undermining” a U.S. election, an expansion of previous authority.

He ordered sanctions against Russia’s Main Intelligence Directorate, known as the GRU, and the Federal Security Service, known as the FSB.

Officials said both took part in the hacking and leaking of tens of thousands of emails and other material from the Democratic National Committee and Hillary Clinton’s campaign manager, among other targets. The stolen digital trove was posted on WikiLeaks and other websites.

The administration also sanctioned four senior GRU officers — the current chief, Igor Valentinovich Korobov Sergey, and three of his deputies — and three Russian companies that provided material support for its cyber-operations.

Also sanctioned were two notorious Russian hackers, Evegniy Bogachev and Aleksey Belan, who U.S. officials said had stolen more than $100 million by breaking into the computers of U.S. banks, universities and online retailers.

In a joint analysis report from the Department of Homeland Security and the FBI, officials said Russian civilian and military intelligence services had sought to “compromise and exploit networks and endpoints associated with the U.S. election.”

It said a GRU-backed hacking group known as Advanced Persistent Threat 29 had “participated in the intrusion into a U.S. political party” in the summer of 2015 and that a separate FSB-backed group had penetrated the computers last spring.

“Both groups have historically targeted government organizations, think tanks, universities and corporations around the world,” it said.

It said the two groups were among at least 48 known Russian intelligence hacking units. Some had colorful codenames, including Chopstick, Eviltoss, Sandworm and Sourface.

“These cyber operations have included spearphishing campaigns targeting government organizations, critical infrastructure, think tanks, universities, political organizations and corporations,” said a separate statement from the FBI, Department of Homeland Security and Office of the Director of National Intelligence.

The administration announced the moves while Obama is on a two week vacation with his family in Hawaii. He also has promised to deliver a classified report to Congress on the hacking before he leaves office on Jan. 20.

Obama’s actions drew broad support in Congress, though with partisan overtones.

House Speaker Paul D. Ryan (R-Wisc.) called the measures "overdue," adding that the Obama administration had waited too long to stand up to Russia.

Sen. Charles E. Schumer (D-NY), the incoming Senate minority leader, applauded the decision to “punch back against Russia,” but he worried about how Trump may react. Since Obama used an executive order, Trump could cancel or ease the crackdown after he takes office.

“I hope the incoming Trump administration, which has been far too close to Russia throughout the campaign and transition, won’t think for one second about weakening these new sanctions or our existing regime,” Schumer said.

Several lawmakers said they plan to further investigate Russia’s role in the hacks and press for harsher penalties against Moscow.

Republican Senators John McCain (R-Ariz.) and Lindsey Graham (R-S.C.) said they will push for stronger sanctions on Russia when Congress returns to Washington Jan. 3.

Share this post