ADVERTISEMENT

Reading Between the Lines on Mueller's Russia Investigation

The most tantalizing clues involve a handful of Americans -- none identified -- who communicated with the Russians.

Reading Between the Lines on Mueller's Russia Investigation
The Spasskaya tower, left, and St. Basil’s cathedral, right, stand silhouetted in Moscow, Russia. (Photographer: Andrey Rudakov/Bloomberg)

(Bloomberg) -- On the morning of July 27th, 2016, Donald Trump made a now-infamous address into the camera.

“Russia, if you’re listening,” began his appeal for hackers to turn up Hillary Clinton’s 30,000 missing emails. Later that very day, it turns out, officials from Russia’s military intelligence agency launched their first concerted attack on Clinton’s personal server.

Reading Between the Lines on Mueller's Russia Investigation

The Russian activities that day are laid out in an indictment released Friday by Special Counsel Robert Mueller. It’s one of several revelations hinting at where where the Russian election meddling investigation could be heading.

All 12 people charged in the indictment are military intelligence officers allegedly assigned to disrupt the U.S. election. But the most tantalizing clues involve a handful of Americans -- none identified -- who communicated with them. They include a candidate for Congress, a Republican lobbyist who ran a Florida politics blog and a political operative who Mueller’s prosecutor said had close ties to the highest levels of the Trump campaign.

There’s no evidence in the indictment that those people knew that the emails and direct messages were going to Russian agents, Deputy Attorney General Rod Rosenstein said Friday in announcing the charges. Yet woven throughout the indictment are signs that Mueller’s team is trying to determine whether anyone connected with the Trump campaign coordinated with the Russian agents to maximize the damage to Democrats.

New Details

The indictment provides other new details: That Russian operatives remained in Democratic servers until October 2016, and that they stole details on 500,000 voters in one U.S. state. In a statement late Friday, Illinois’ board of elections said it had been the victim of a cyber attack on its statewide voter registration database and that the indictment was likely referring to that hack.

Prosecutors allege that the Russian officers waged computer attacks against the Democratic National Committee and Hillary Clinton’s presidential campaign, stealing emails and voter analytics data. After hacking the email accounts of Democratic Congressional Committee and DNC chairman John Podesta in the spring of 2016 (and ultimately failing in its efforts to find Clinton’s personal emails), the Russians set up the online personas DC Leaks and Guccifer 2.0 and used them to offer the stolen information to journalists, political figures and right-wing activists.

Then, using the Guccifer pseudonym, the Russian officers reached out to “a person who was in regular contact with senior members” of the Trump campaign. In mid-August, Guccifer wrote: “Do u find anyt[h]ing interesting in the docs I posted?”

By September 9, Guccifer was seeking that person’s help to make sense of a document stolen from the DCCC. “What do u think of the info on the turnout model for the democrats entire presidential campaign?” Guccifer asked.

“Pretty standard,” the person replied.

Stone Exchange

That exchange matches one previously attributed to Roger Stone, the Republican political operative and longtime Trump adviser.

Guccifer, in posts at the time, characterized himself as a Romanian hacker. Stone has said he doesn’t believe Guccifer was a Russian intelligence officer. In a text message Friday, he said he wasn’t even certain the indictment referred to him. His lawyer, Grant Smith, said Stone’s 24-word interaction with Guccifer was innocuous.

Reading Between the Lines on Mueller's Russia Investigation

"Roger received no information from Guccifer 2.0 or DC Leaks, nor did he provide any counsel to them," Smith said. "Roger’s benign communications first take place many weeks after the alleged hacking events described in today’s indictment.”

The indictment also references a candidate for U.S. Congress who asked Guccifer for stolen documents. The indictment doesn’t name the candidate or the election’s outcome. But it does describe one success: The candidate was sent documents on an opponent after contacting Guccifer on Aug. 15, 2016.

Florida Lobbyist

Russian intelligence officers also used the Guccifer alias to communicate with a person identified as a state lobbyist and blogger, transferring 2.5 gigabytes of data stolen from the DCCC to the person on August 22, 2016. While the indictment does not name the blogger, Bloomberg last year interviewed a Florida lobbyist, Aaron Nevins, who published political reporting under the pseudonym Mark Miewurd on the website HelloFLA.

Nevins told Bloomberg he emailed Guccifer after reading his website in the summer of 2016, asking if there was any hacked information pertaining to Florida politics.

“I mean, what reporter wouldn’t want secret documents dropped on them like the Pentagon Papers,” he said via online chat. “It’s also in line with what I’m trying to do with the site, which is to be more like a ‘Page Six of politics’ with sensational stories and revealing secrets of insiders and politicians.”

Nevins said he got no response for 10 days. Then Guccifer emailed him with instructions to set up a Dropbox account to receive data. Shortly afterward, Nevins said he was flooded with data hacked from the DCCC computers.

"I feel like things happened so fast, and I was chasing the buzz that I got all these documents and had almost an ‘Oh S--t’ moment where I realized I am a political insider with a ton of stolen documents on my computer, and if I don’t publish and the FBI does come by…1. my career is completely over and 2. I’m probably going to prison for a while too."

Nevins said he published several items based on the hacked information. He couldn’t be reached for comment on Friday.

WikiLeaks’ Network

The most prominent player in the release of the stolen emails was the hacktivist organization WikiLeaks, identified in the indictment as Organization 1. In late June 2016 -- after cybersecurity experts said the DNC hack was probably carried out by Russian intelligence -- WikiLeaks began asking Guccifer for the information, saying its distribution network could help heighten the impact of the document release. An email from WikiLeaks on July 6 said: "If you have anything Hillary related, we want it in the next two days" because the Democratic National Convention was about to start and divisive emails could hinder Clinton’s effort to unite the party.

On July 14th, Guccifer began instructing WikiLeaks how to access the hacked emails.

WikiLeaks founder Julian Assange, who has worked for the Russian state media outlet Russia Today and has been living in exile in Ecuador’s embassy in London, has said his organization didn’t receive the emails from a Russian. WikiLeaks didn’t return a call or email requesting comment.

From October 7 through November 7, the day before the election, WikiLeaks released 33 tranches of stolen documents, according to the indictment, including damaging information about Clinton’s fundraising, speeches and intraparty squabbles. The barrage began shortly after an embarrassing disclosure about Trump, a 2005 recording from Access Hollywood in which he bragged about grabbing women and using his celebrity to make sexual conquests.

Donald Trump Jr. exulted over the email release, exchanging a handful of messages with WikiLeaks, via Twitter messages. His father crowed, too, telling supporters, "I love WikiLeaks." He referred to the group more than 130 times during the campaign’s final month.

--With assistance from Jordan Robertson, Billy House, Steven T. Dennis and Tom Schoenberg.

To contact the reporters on this story: David Kocieniewski in New York at dkocieniewsk@bloomberg.net;Greg Farrell in New York at gregfarrell@bloomberg.net;Michael Riley in Washington at michaelriley@bloomberg.net

To contact the editor responsible for this story: Jeffrey D Grocott at jgrocott2@bloomberg.net

©2018 Bloomberg L.P.