A dozen Russian military intelligence officers were indicted Friday on charges they hacked Democrats’ computers, stole their data, and published those files to disrupt the 2016 election – the clearest connection to the Kremlin established so far by special counsel Robert Mueller III’s investigation of interference in the presidential campaign.
The indictment against members of the Russian military agency known as the GRU marks the first time Mueller has taken direct aim at the Russian government, accusing specific military units and their named officers of a sophisticated, sustained effort to hack the computer networks of Democratic organizations and the Hillary Clinton campaign.
Deputy Attorney General Rod Rosenstein announced the charges at a midday news conference. Mueller, as has been his practice, did not attend the announcement. Court records show that a grand jury Mueller has been using returned an indictment Friday morning.
The suspects “covertly monitored the computers, implanted hundreds of files containing malicious computer code, and stole emails and other documents,” Rosenstein said. “The goal of the conspirators was to have an impact on the election. What impact they may have had . . . is a matter of speculation; that’s not our responsibility.”
The indictment comes days before President Donald Trump is due to meet with Russian President Vladimir Putin in Finland. Rosenstein said he briefed Trump earlier this week on the charges.
Trump’s lawyer, Rudy Giuliani, said on Twitter that the indictments “are good news for all Americans. The Russians are nailed. No Americans are involved.” He then called on Mueller “to end this pursuit of the president and say President Trump is completely innocent.”
The 11-count, 29-page indictment describes in granular detail a carefully planned and executed attack on the information security of Democrats, as Russian government hackers implanted hundreds of malware files on Democrats’ computer systems to steal information. The hackers then laundered the pilfered material through fake personas called DC Leaks and Guccifer 2.0, as well as others, to try to influence voters.
One of their conduits, identified in the indictment only as “Organization 1,” was WikiLeaks, the global anti-secrecy group led by Julian Assange, according to people familiar with the case. The indictment describes WikiLeaks communicating with Guccifer 2.0 to obtain material. On July 6, 2016, according to the indictment, WikiLeaks wrote, “if you have anything Hillary related we want it in the next tweo [sic] days prefable [sic] because the DNC [Democratic National Convention] is approaching and she will solidify bernie supporters behind her after,” referring to Clinton’s rival for the Democratic nomination, Sen. Bernie Sanders, I-Vt. WikiLeaks explained, “we think trump has only a 25% chance of winning against hillary . . . so conflict between bernie and hillary is interesting.”
WikiLeaks released nearly 20,000 Democratic National Committee emails on the eve of the convention later that month, providing an embarrassing look at party operations and attitudes to the Sanders campaign.
A former Justice Department official who was previously involved in the Russia probe said the charges should serve as a warning for the U.S. to buttress its election security as Americans prepare to vote in congressional elections later this year.
“The detailed charges in this indictment make it unmistakably clear that the United States faces an aggressive, sophisticated adversary bent on using cyber means to subvert our democratic processes and institutions,” said David Laufman, the former chief of the Justice Department’s Counterintelligence and Export Control Section. “Now is the time for unequivocal recognition of this threat by both the executive branch and Congress, and for a unified and well coordinated commitment to confront it.”
The indictment offers troubling new accusations about the extent of Russian hacking efforts and interactions with Americans.
“On or about August 15, 2016, the conspirators, posing as Guccifer 2.0, received a request for stolen documents from a candidate for the U.S. Congress,” the indictment states. “The conspirators responded using the Guccifer 2.0 persona and sent the candidate stolen documents related to the candidate’s opponent.” The indictment does not identify the candidate.
The indictment also describes an online conversation between the GRU, posing as Guccifer 2.0, and a “person who was in regular contact with senior members of the presidential campaign.” People familiar with the case said that person is longtime Trump adviser Roger Stone. In August 2016, the hacker persona wrote to Stone: “please tell me if i can help u anyhow… it would be a great pleasure to me.”
Stone’s lawyer Grant Smith said “it is clear from the indictment issued today that our client, Roger Stone, was not in any way involved with any of the alleged hacking of the 2016 election. As he testified before the House Intelligence Committee under oath, his 24-word exchange with someone on Twitter claiming to be Guccifer 2.0 is benign, based on its content, context and timing.”
U.S. officials identified one of the GRU sections that carried out the operations as Unit 26165, which worked out of a building about four miles from the Kremlin. It was responsible for hacking the DNC and the Democratic Congressional Campaign Committee, according to the indictment, which accuses Viktor Netyksho of being the military officer in command of Unit 26165 at the time.
Though the DNC was able to kick the Russian hackers out of its system in June of 2016, the indictment says three months later the GRU “successfully gained access to DNC computers hosted on a third-party cloud-computing service” which held “test applications related to the DNC’s analytics,” according to the indictment. The hacker stole that data from the DNC, the indictment said.
Another group of Russian military officers, Unit 74455, working out of a building that GRU officers referred to as the “Tower,” used fake online personas to spread stolen files, officials charged. The indictment identifies Col. Aleksandr Osadchuk as the commanding officer of that unit.
The indictment also notes an interesting development on July 27, 2016 – the day then-candidate Trump gave a press conference declaring his hope that missing Clinton emails would be found and made public, saying: “Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing.”
The indictment says “on or about” that same day, “the conspirators attempted after hours to spearphish for the first time email accounts at a domain hosted by a third-party provider and used by Clinton’s personal office. At or around the same time, they also targeted seventy-six email addresses at the domain for the Clinton campaign.”
The Russian foreign ministry rejected the indictment’s allegations as lacking evidence and described the charges as a clear effort to derail the Helsinki summit.
“It is unfortunate that distributing false information has become the norm in Washington, and that criminal cases are being initiated based on clearly political motives,” the ministry said. Referring to the Mueller investigation, the statement went on: “The question remains how long this shameful comedy that is embarrassing the United States will go on.”
Rosenstein said the hackers interacted with some Americans in the course of their efforts but noted that those people had not been charged with a crime.
“When we confront foreign interference in American elections, it is important for us to avoid thinking politically as Republicans or Democrats and instead to think patriotically as Americans. Our response must not depend on who was victimized,” he said. “There will always be adversaries who work to exacerbate domestic differences and try to confuse, divide and conquer us. So long as we are united in our commitment to the values enshrined in the Constitution, they will not succeed.”
Mueller and a team of prosecutors have been working since May 2017 to determine whether any Trump associates conspired with Russia to interfere in the election. With the new indictment, his office has filed charges against 32 people on crimes including hacking, money laundering and lying to the FBI. Twenty-six of those charged are Russians who are unlikely to ever be put on trial in the United States.
In February, Mueller indicted a group of Russian Internet trolls who worked out of the Internet Research Agency, a company based in St. Petersburg and owned by a wealthy associate of Putin.
Trump’s former campaign manager, Paul Manafort, is in jail in Alexandria, Virginia, awaiting trial this month on financial fraud charges brought by Mueller but stemming from activities that predated the Trump campaign.
Mueller’s probe has come under sustained attack from Trump and at a press conference in England Friday before Rosenstein spoke, the president again labeled the investigation a “witch hunt.”
“I think that we’re being hurt very badly by the — I would call it the witch hunt,” said Trump as he stood beside British Prime Minister Theresa May. “It really hurts our relationship with Russia.”
Rosenstein said of his decision to brief Trump, “It was important for the president to know what information we’ve uncovered because he’s got to make very important decisions for the country. He needs to understand what evidence we have of foreign election interference.”
The Washington Post’s Spencer S. Hsu in Washington and Amie Ferris-Rotman in Moscow contributed to this report. This story originally appeared on The Washington Post.
