What About Those Lawyers Hired by the DNC?

Perkins Coie’s Myriad Roles Raise DNC Conflict Questions

Beck/Law.com: Perkins Coie’s domination of the Democratic federal election scene has long been a point of pride for the firm and the envy of its competitors.

But now, with the uproar triggered by the release of emails hacked from the Democratic National Committee, the firm’s multiple roles for Democratic committees and candidates have raised questions about potential conflicts, and whether these conflicts contributed to the DNC’s troubles.

Since at least March 2015, Perkins Coie partner Marc Elias, chair of the firm’s political law practice, has been lead outside counsel to Hillary Clinton for America, the presidential candidate’s campaign entity. Elias’ partner, Graham Wilson, has worked with him for the Clinton campaign. (For her ill-fated 2008 presidential campaign, Clinton did not use Perkins Coie, having instead relied on Lyn Utrecht of Washington, D.C.’s Utrecht, Kleinfeld, Fiori, Partners.)

In another corner of Perkins Coie’s office in Washington, D.C., is partner Robert Bauer, a former White House counsel to President Barack Obama. Bauer now serves as lead outside counsel to the DNC.

Since March 2015, the Clinton campaign has paid the firm $905,219.93, according to Federal Election Commission filings.

Perkins Coie has also earned at least $1,318,375.92 from DNC affiliates, including $657,340.20 from the Democratic Congressional Campaign Committee and $661,035.72 from the DNC Services Corp. (Expenditure filings for the Democratic Senatorial Campaign Committee are not available electronically.)

A review of DNC emailsposted online by WikiLeaks raises questions about whether Perkins Coie lawyers blurred the lines between its clients. Elias, the Clinton campaign’s lead counsel, was included in several email exchanges in which DNC staffers discussed strategy. In one email, Elias urged DNC officials to attack Vermont Sen. Bernie Sanders for allegedly lying when he accused the DNC of improperly using campaign money in a “Joint Victory Fund” to help Clinton.

Both Bauer, counsel to the DNC, and Wilson, counsel to the Clinton campaign, are included in other email discussions about how to defuse this issue with the press.

“I can understand why the Sanders’ campaign might be uncomfortable with this,” said Lawrence Noble, general counsel of the nonprofit Campaign Legal Center, about Perkins Coie’s multiple roles. Noble, a former general counsel at the FEC, also previously worked in the political law group at Skadden, Arps, Slate, Meagher & Flom. “If Perkins Coie represents the party people, and you’re not represented by Perkins Coie, you may feel you’re at a disadvantage,” Noble said.

The Sanders campaign, which has now publicly thrown its support behind Clinton at the Democratic National Convention this week in Philadelphia, declined to comment on the matter. Perkins Coie did not return requests for comment.

Two lawyers who do political work and asked not to be named said Perkins Coie’s near monopoly on federal Democratic politics has drawn criticism before this scandal erupted. One said it wasn’t a good idea for the DNC to be advised by the same firm that’s representing one of the party’s candidates. “You really do have to be careful about appearances as well as actual conflicts,” this person said.

The leaked emails have roiled the Democratic Party nomination process because they indicate that some DNC officials tried to sabotage Sanders’ presidential campaign. Sanders supporters heckled DNC chairman Debbie Wasserman Schultz, who resigned Sunday as a result of the controversy, during an appearance Monday that showed some Democratic disunity in the City of Brotherly Love.

The DNC has professed publicly that it did not favor Clinton before she became the party’s official nominee. On Monday it issued a statement offering “a deep and sincere apology” to Sanders, his supporters and the Democratic Party “for the inexcusable remarks made over emails.” The organization added: “These comments do not reflect the values of the DNC or our steadfast commitment to neutrality during the nominating process.”

The Republicans have not concentrated so much of their work in one law firm. The Republican National Committee is using more than a dozen firms, according to FEC filings, with no firm earning more than $45,000 in the month of May, the most recent month for which data is available. The RNC is relying on at least one major firm that also represents nominee Donald Trump—it paid $13,367.46 in May to Jones Day, but that was not the RNC’s largest payment to a law firm.

Katelyn Polantz and Meghan Tribe contributed to the reporting of this story.

**** As a reminder going back to 2008, Bob Bauer worked for the Obama campaign and was for a time White House counsel. His wife, Anita Dunn –> Anita Dunn: A corruptocrat flack and a Mao cheerleader  Oh and another item from history, Shore Bank.

****

Attorney Robert Bauer has been mentioned as a possible pick for White House Counsel in an Obama administration. The ABA Journal recently assessed his chances:

HuffPo: As a partisan regular with a street-fighter’s zeal, Bauer has earned a reputation among some Republicans as the “focus of all evil.” But they weren’t all that crazy about him in the Hillary Clinton campaign either. In March, Bauer crashed a Clinton campaign conference call with reporters, calling into question a charge that Obama workers had violated Texas party rules during post-primary caucuses. An early Obama supporter, Bauer is a regular contributor to the Huffington Post website.

He helped represent Minority Leader Tom Daschle during the Senate impeachment trial of Bill Clinton and was general counsel to Bill Bradley’s presidential campaign. He’s considered one of the nation’s top experts on the intricacies of campaign finance and writes about it regularly on More Soft Money Hard Law, a law blog devoted to campaign finance.

Bauer has also blogged for HuffPost. Read his work here.

bin Ladin Just Recorded an Audio Message, What?

Message from Bin Laden’s son exposes ‘Iran’s revival of al-Qaeda’

al-Arabiya: An audio message released recently by Osama Bin Laden’s son Hamza has signaled the “continuation of Iranian sponsorship” of terrorism within al-Qaeda, a report by a US-based think tank has found.

 It is also important to note, Hamza has brothers.

In the message released on May 9 and titled “Jerusalem is but a bride, and her dowry is blood,” Hamza called on all Syrian militant groups to unite and “liberate Palestine.”

According to a report released this week by SAPRAC, the Saudi American Public Relations Affairs Committee, “Al-Qaeda observers believe the new message released by Hamza Bin Laden signals the continuation of Iranian sponsorship of Bin Laden’s son, which started after the tragic events of 9 / 11.

“Blatantly defying world powers, Tehran hosted Hamza Bin Laden and provided him with necessary security, according to many intelligence agencies across the world.”

Believed to be 24 or 25 years old, Hamza is expected by experts to potentially become the next al-Qaeda leader

The SAPRAC report added that on March 16, before the release of the audio message,” American intelligence declassified 113 hand written messages by Osama Bin Laden. These included instructions on how Al-Qaeda should deal with Iran.”

The messages also revealed that Bin Laden said Iran is ‘the chief pathway for our money, men, communiqué, and hostages”.

Bin Laden also urged his men “not to start a front against Iran.”

According to SAPRAC, “this confirms the strong and warming ties between Al-Qaeda and the Islamic Republic of Iran.”

Infographic: Who is Hamza Bin Laden. (Al Arabiya English)

Three senior al-Qaeda members linked to Iran

The United States recently imposed sanctions on three senior al-Qaeda members living in Iran, shining a brighter spotlight on Tehran’s involvement in violent extremism in the region.

The US Treasury department specifically designated Faisal Jassim Mohammed Al-Amri Al-Khalidi, Yisra Muhammad Ibrahim Bayumi, and Abu Bakr Muhammad Muhammad Ghumayn as “Specially Designated Global Terrorists,” according to their findings published last week.

“Today’s action sanctions senior al-Qaeda operatives responsible for moving money and weapons across the Middle East,” Adam J. Szubin, Acting Under Secretary for Terrorism and Financial Intelligence, said in a statement.

Related reading: But John Kerry, Iran Does Support al Qaeda

“The Treasury remains committed to targeting al-Qaeda’s terrorist activity and denying al-Qaeda and its critical support networks access to the international financial system.”

Infographic: Extremists with a presence in Iran. (Al Arabiya English)

Al-Khalidi is a senior al-Qaeda official who was an emir of a brigade and part of a new generation of al-Qaida operatives, according to the US Treasury report. In May 2015, as al-Qaeda Military Commission Chief, he participated in an annual council meeting with other al-Qaeda commanders to discuss weapons acquisition.

As of 2011, al-Khalidi was responsible for liaising between al-Qaeda associates and al-Qaeda Central Shura members and leaders within the US-designated terrorist group Tehrik-e Taliban Pakistan.

The US also designated Bayumi for acting for or on behalf of al-Qaeda. He is a veteran al-Qaeda member who has been located in Iran since 2014 and a member of al-Qaeda since at least 2006.

Related reading: The PR and Resurgence of al Qaeda

As of mid-2015, Bayumi was reportedly involved in freeing al-Qaeda members in Iran. As of early 2015, he served as a mediator with Iranian authorities.

The third named operative, Ghumayn, is a senior leader who has served in several financial, communications, and logistical roles for the group. As of 2015, Ghumayn assumed control of the financing and organization of al-Qaeda members located in Iran.

On Tuesday, Iran denied the claims by Washington that the three senior al-Qaeda figures are based in the country, the official IRNA news agency reported.

Related reading: Palestinian Terrorism: No Different Than ISIS and Al Qaeda

Foreign Ministry spokesman Bahram Ghasemi was quoted as saying that Iran doesn’t have “any information about their presence on its soil.”

Revealing more Iran links

The recent sanctions come on the heels of documents leaked in March that reveal the level of ties between al-Qaeda and Iran, particularly on the situation in Iraq where the two sides allegedly sought to reach a deal.

One of those leaked documents was a letter written by an al-Qaeda operative in which he tells a fellow operative named Taqfik that he had met with someone in Tehran and that the Iranians wanted to build contacts with someone representing the “mayor,” a codename for former al-Qaeda Chief Osama bin Laden.

The trove of letters also revealed Bin Laden ordered his al-Qaeda deputies not to attack Iran, which he called a “main artery” for his organization’s operations.

The order was part of a collection of 112 letters taken from bin Laden’s compound by US special ops forces after he was killed in 2011.

Those documents also revealed further names of operatives with links to Iran:

Abu Hafs the Mauritanian

Status: Returned to Mauritania in 2012

He was Bin Laden’s religious adviser and al-Qaeda in Iran’s expert on Islamic law. His official name is Mahfouz Ould al-Walid.

Abu al-Kayr al-Masri

Status: Presumed to have at one point been in Iran. Released in prisoner exchange with al-Qaeda in 2015. Whereabouts unknown

He was the Chairman of al-Qaeda’s Management Council and former chief of foreign relations for al-Qaeda, including liaison to the Taliban. He is reported to have long-standing ties to current al-Qaeda leader Ayman al-Zawahiri.

Saif al-Adel

Status: Presumed to have at one point been in Iran. Released in prisoner exchange with al-Qaeda in 2015. Whereabouts unknown

He was a member of al-Qaeda’s Management Council and was involved in planning operations and directing al-Qaeda propaganda efforts. He was a former chief of military operations and worked closely with Abu Muhammad al-Masri. There is currently a $5mln reward for information leading to his capture.

Abu Muhammad al-Masri

Status: Presumed to be in Iran. Released in prisoner exchange with al-Qaeda in 2015. Whereabouts unknown

He was a member of al-Qaeda’s Management Council and is considered the “most experienced and capable operational planner” not in US or allied custody. He is former chief of training and worked closely with Saif al-Adel. $5 million reward for information leading to his capture.

Sulaiman Abu Ghaith

Status: He was captured and tried in US federal court in New York. Sentenced to life in prison.

He was a member of al-Qaeda’s Management Council and official spokesman for al-Qaeda before detention

Abu Dahhak, aka Ali Saleh Husain al-Tabuki

Status: Presumed to have at one point been in Iran

He is an al-Qaeda facilitator and former representative of Chechen mujahideen in Afghanistan

Abu Layth al-Libi, aka Ali Ammar Ashur al-Rufayi’l

Status: Killed in US drone strike

He was a paramilitary commander and active in Eastern Afghanistan and Pakistan-Afghanistan border region. He is said to exercise significant autonomy and enjoys long-standing ties to senior managers.

Abd al-Aziz al-Masri, aka Ali Sayed Muhammad Mustafa Al-Bakri

Status: Presumed to have at one point been in Iran

Al-Qaeda associate; senior poisons and explosives expert; involved in nuclear research since late 1990s; had close relationships with Saif al-Adel and Khalid Sheik Muhammad.

Abu Dujana al-Masri

Status: Presumed to have at one point been in Iran

Explosives instructor before detention. He was a member of Egyptian Islamic Jihad and is Zawahiri’s son-in-law

Muhammad Ahmad Shawqi al-Islambuli, aka Muhammad Ahmad Shawqi Islambouli

Status: Presumed to have at one point been in Iran

He was an al-Qaeda facilitator and senior member of Egyptian Al-Gamaat Al-Islamiyah. Has former ties to Iranian Ministry of Intelligence and is the brother of Anwar Sadat assassin Khalid al Islambuli.

Thirwat Shihata

Status: Has left Iran. Believed to have traveled to Libya

He is a former Zawahiri deputy and experienced operational planner. Considered as a respected among al-Qaeda rank and file with previous ties to Zarqawi.

Khalid al-Sudani

Status: Presumed to be in Pakistan, Jordan or Iran

Member of the al-Qaeda Shura Council.

Qassim al-Suri aka Yasin Baqush

Status: Presumed to have at one point been in Iran

Provides communications link between al-Qaeda leaders in Waziristan, Pakistan, and Iraq. Planning, coordinating attack plots in Europe with several al-Qaeda and al-Qaeda-affiliated cells. There is a $10mln reward for information leading to his capture

Ali Mujahid Tekushir

Status: Presumed to have at one point been in Iran

Provides explosives, computer and Internet training to al-Qaeda recruits. Facilitates movement of senior-level extremists from Iran into Iraq. Reports link him to plots against the New York subway system in December 2005.

Abu Talha Hamza al-Baluchi

Status: Presumed to have at one point been in Iran

Iran-based al-Qaeda facilitator

Jafar al Uzbeki, aka Jafar the Uzbek

Status: Presumed to have at one point been in Iran

Representative of al-Qaeda senior leadership working to negotiate the release of al-Qaeda members held by Iran

Anas al Liby, aka Abu Anas al-Libi

Status: Captured by US commandos in Libya but died of liver cancer before he was able to stand trial in federal court in New York

Believed to have been involved in the 1998 East Africa bombings; senior member of al-Qaeda; member of Libyan Islamic Fighting Group security committee

The Games of Russia and the IRGC, that Kidnapped our Sailors

Seems the importance of NATO becomes more important, right? Read on for more convincing detail.

The tournament is set to begin on August 1 in several cities in Russia and Kazakhstan and will run through August 14.

رزمایش بیت المقدس در اصفهان

 

 

 

 

 

 

 

 

 

 

 

Last year’s competitors included Russia, Angola, Armenia, Belarus, China, Egypt, India, Kuwait, Kyrgyzstan, Mongolia, Nicaragua, Pakistan, Serbia, Tajikistan and Venezuela.

According to the rules of the games, each team has the use of four tanks and must employ military tactics and navigation to outmaneuver teams from the other nations. The racing course is usually about 20 kilometers long and is provided with obstacles, including fire, and gunnery exercises. More here.

Iran‘s Army and forces attending International Army Games in .
Iran sends 7 teams to Russia for intl. military tournament

TEHRAN, Jul. 23 (MNA) – Seven military teams from Iran’s Armed Forces have been dispatched to Russia to participate in the annual World Tank Biathlon in Moscow in August.

The seven teams which include tank biathlon, airborne and seaborne attack, as well as shooting and diving, comprises 204 highly qualified military forces from the Army, IRGC, Law Enforcement and Basij.

The International Army Games is welcoming 17 nations to participate in 7 categories in Russia and Kazakhstan.

The tournament is set to begin on August 1 in several cities in Russia and Kazakhstan and will run through August 14.

Last year’s competitors included Russia, Angola, Armenia, Belarus, China, Egypt, India, Kuwait, Kyrgyzstan, Mongolia, Nicaragua, Pakistan, Serbia, Tajikistan and Venezuela.

According to the rules of the games, each team has the use of four tanks and must employ military tactics and navigation to outmaneuver teams from the other nations. The racing course is usually about 20 kilometers long and is provided with obstacles, including fire, and gunnery exercises.  ****

Representatives of Azerbaijan’s armed forces will attend the International Army Games 2016 to be held in the Russian Federation from July 30 to August 13, Azertac writes.

The Azerbaijani servicemen will take part in the “Caspian Sea Cup-2016” and “Tank biathlon – 2016” events.

More photos here.

Back in April, the IRGC was quite busy as well.

IRGC Ground Force Airborne Unit Takes Lead in War Game

بالگرد ارتش

TEHRAN (Tasnim) – The Islamic Revolution Guards Corps (IRGC) Ground Force Airborne Unit, which has been founded recently, took an active role in the first day of massive military exercises in southeast Iran.

The Airborne Unit flew its Mil Mi-17 and Bell-208 helicopters in a heliborne operation to deploy combat forces to the rear of the hypothetical enemy’s front. The Cobra choppers also hit targets with rockets.

Codenamed Payambar-e Azam (The Great Prophet), the war game will last for three days in the regions of Saravan, Mirjaveh and Zahedan, in Sistan and Balouchestan province.

The IRGC Special Forces have also taken part in the drill.

Forces attending the war game also practiced hostage rescue operation on Tuesday morning, with the ground troops using T-72 tanks and BMP-2 personnel carriers to launch an attack against the mock enemy.

While the 23-mm cannons have been utilized for air defense, the homegrown drones ‘Sadeq’ and ‘Shahed-129’ were also flown over the drill zone for reconnaissance and aerial operations.

 

According to IRGC Ground Force Commander Brigadier General Mohammad Pakpour, the purpose of the drill is maintaining preparedness for battle, displaying the power of forces and ensuring security in the region with reliance on the local residents.

Lying in a deserted region, the province of Sistan and Balouchestan borders Afghanistan and Pakistan.

Since a couple of years ago, the IRGC has employed a strategy to get advantage of the local forces to ensure regional security in the face of narcotics trafficking or the entry of terrorists and outlaws.

 

 

IRS/FBI Get Clinton Foundation Referral, No DNC?

While this is a very positive step that IRS Commissioner Koskinen has approved an audit of the Clinton Foundation, what is the timeline? Further, a referral has also been made to the FBI and the Federal Election Commission.

Then, the former top attorney general and the Department of Justice told us during his talk at the Democrat convention in Philadelphia that he has known Hillary for 25 years. Ah, so he knows all but, ‘facts don’t matter’, do they? Nah and Holder went on to talk about criminal justice reform. Is all this talk about criminal justice reform really to head off any future prosecution of the powerbrokers in DC? Hah!

The Daily Caller has reported, “The Exempt Organization Program is the division of the IRS that regulates the operations of public foundations and charities. It’s the same division that was led by former IRS official Lois Lerner when hundreds of conservative, evangelical and tea party non-profit applicants were illegally targeted and harassed by tax officials.”  The House referral letter is found here with evidence.

Two particular areas of focus of the requested audit include Laureate Education and Uranium One. Read the complete details here from Daily Caller.

**** So what about the Federal Election Commission and the IRS auditing the entire DNC? Seems lawyers were quite busy as noted here by Free Beacon:

Democratic Party lawyers had to step in repeatedly to prevent illegal or prohibited political fundraising by a new Democratic National Committee group designed to coordinate legal strategy with hundreds of friendly attorneys, internal documents show.

Multiple proposed fundraising pitches by the new Democratic Lawyers Committee (DLC) invoked the names of high-ranking administration officials in what would have been violations of federal laws and White House policies against political activity by administration officials, according to emails between the group’s top staffers and their attorneys.

The hacked emails, released by the group WikiLeaks last week, provide a detailed narrative of the DLC’s formation and its hectic first few months, which saw celebrity attorney Gloria Allred micromanaging the group’s self-described “propaganda,” a senior DNC staffer admonishing colleagues for nearly spoiling its rollout with illicit fundraising asks, and DNC staffers pretending to be then-chair Debbie Wasserman Schultz on email in order to land a venue for a high-dollar fundraiser.

“The stated goal of the DLC is to organize the legal community and [we] must arm them with the information, contacts, and inspiration they need to provide significant support for the Democratic Party’s fight to maintain control of the White House and help elect Democrats up and down the ballot in 2016,” according to talking points circulated internally. More to the story here.

The comes the White House collaborating with the DNC and concocting an event for foreign money. Ya don’t say huh?

“Hi Vet Team, we would like to do a finance event at Hogan Lovells US LLP … on June 14th with White House Political Advisor David Simas and DNC CEO Amy Dacey,” Chalupa wrote in an email. “Can you let us know if this venue passes vet? Thanks!”

One day later, Alan Reed, the DNC’s compliance director, responded to the request by saying that he saw “no real issues.” Reed wanted to make sure everyone was fine with using the venue given the “significant lobbying” that they perform.

Attached to the email was the background check for the firm, which noted, “Hogan Lovells lobbies the federal government on behalf of a number of U.S. groups and organizations.” It contained a list of departments the firm lobbies, which included the House and the Senate along with the Departments of Defense, Energy, Health and Human Services, Homeland Security, State, and Interior, among others.

The event was given the go-ahead.

The background check said Hogan Lovells did not appear in the Justice Department’s Foreign Agents Registration Unit (FARA).

However, the firm does appear on the FARA database and is currently registered to work on behalf of both the Royal Embassy of Saudi Arabia and the government of Japan in 2016, FARA disclosures show. Free Beacon has additional information here.

So, what about the collusion between the DNC and the Clinton Foundation? Ah glad you asked.

Taken in part from the Washington Examiner: A hacker who claims to have infiltrated the Democratic National Committee’s server posted documents on Tuesday he says came from the party’s digital files. Many of the new documents contained information about how the Clinton campaign and its allies should respond to criticism of the Clinton Foundation’s revenue sources given controversy over the fact that the philanthropic network accepted donations from foreign entities while Clinton served as secretary of state. More here.

 

Guccifer 2.0 DNC Clinton files: 2016er Attacks by Washington Examiner on Scribd

Hey FBI, the Investigation into the DNC Hacking is Over Here

Anyone ever see that Jack Ryan movie ‘Shadow Recruit’? It is playing out in a more nefarious form in real time.

May 2016: Director of National Intelligence James Clapper said today that presidential campaigns are a target for cyber intruders and that this political season has already seen some attempted hacks.

“We have already had some indications of that,” he said in response to a question about campaign website hacking, after speaking at the Center for Bipartisan Policy in Washington, D.C.

“I anticipate as the campaigns intensify, we will probably have more of it,” he added. He did not provide specifics about any attacks, but it has been reported that some hacking groups, such as Anonymous, have threatened to launch “total war” against Donald Trump‘s presidential campaign. Read more from ABC here.

Related reading: Clinton Foundation Said to Be Breached by Russian Hackers 

**** So –>> Director of National Intelligence James Clapper says the FBI is helping campaigns tighten up to protect against the threat and how has that worked out so far?

*****

Via ThreatConnect: In our initial Guccifer 2.0 analysis, ThreatConnect highlighted technical and non-technical inconsistencies in the purported DNC hacker’s story as well as a curious theme of French “connections” surrounding various Guccifer 2.0 interactions with the media. We called out these connections as they overlapped, albeit minimally, with FANCY BEAR infrastructure identified in CrowdStrike’s DNC report.

Now, after further investigation, we can confirm that Guccifer 2.0 is using the Russia-based Elite VPN service to communicate and leak documents directly with the media. We reached this conclusion by analyzing the infrastructure associated with an email exchange with Guccifer 2.0 shared with ThreatConnect by Vocativ’s Senior Privacy and Security reporter Kevin Collier. This discovery strengthens our ongoing assessment that Guccifer 2.0 is a Russian propaganda effort and not an independent actor.

Analyzing the Headers from Guccifer 2.0 Emails

On June 21, 2016, TheSmokingGun reported they communicated with Guccifer 2.0 via a French AOL account. We examined the French language settings observed in Guccifer 2.0’s Twitter metadata as well as a pattern of Twitter follows that suggested Guccifer 2.0’s account was created from a French IP address. We hypothesized at the time that Guccifer 2.0 might be using French infrastructure to interact with the media.

During the Email Import process ThreatConnect analyzes an email message header and highlights indicators of interest with a color code that reveals if the indicators already exist within the platform. This helps overburdened eyes or greenhorn analysts quickly understand what they are seeing. At the same time ThreatConnect excludes legitimate or benign details that are not of value to our investigation.

ThreatConnect Research Guccifer 2.0: All Roads Lead to Russia 1

As we can see here within ThreatConnect, Guccifer 2.0’s AOL email message reveals the originating IP address as 95.130.15[.]34 (DigiCube SaS – France). This is the IP address of the host which authenticated into AOL’s web user interface and sent the email. We can also tell this IP was not spoofed because the metadata was added by AOL when sent from within their infrastructure with appropriate DomainKeys Identified Mail (DKIM) configurations.

The fact that Guccifer 2.0 is indeed leveraging a French AOL account stands out from a technical perspective. Very few hackers with Guccifer 2.0’s self-acclaimed skills would use a free webmail service that would give away a useful indicator like the originating IP address. Most seasoned security professionals will be familiar with email providers that are more likely to cooperate with law enforcement and how much metadata a provider might reveal about their users. Taken together with inconsistencies in Guccifer 2.0’s remarks that make his technical claims sound implausible, this detail makes us think the individual(s) operating the AOL account are not really hackers or even that technically savvy. Instead, propagandist or public relations individuals who are interacting with journalists.

Drilling into Guccifer 2.0 Infrastructure: Picture of a VPN Starts to Emerge

As we focused in on IP Address 95.130.15[.]34 we queried public sources such as Shodan as well as Censys to discover what services might be enabled on this host. The goal of this was to better understand if this infrastructure is owned and operated, leased or co-opted by Guccifer 2.0 and how the infrastructure might be used to create space between an originating “source” network and investigators, or curious journalists.

ThreatConnect Research Guccifer 2.0: All Roads Lead to Russia 2According to Shodan, OpenSSH (TCP/22), DNS (UDP/53) and Point-to-Point Tunneling Protocol (PPTP) (TCP/1723) services have been enabled on this host. Secure shell (SSH) and point-to-point tunneling protocol services strongly suggest a VPN and/or a proxy, both of which would allow the Guccifer 2.0 persona to put distance between his originating network and those with whom he is communicating.

The SSH fingerprint can be used as an identifier, linking other IP addresses that use the same SSH encryption key. The SSH fingerprint for 95.130.15[.]34 (DigiCube SaS – France) is Fingerprint: 80:19:eb:c8:80:a1:c6:ea:ea:37:ba:c0:26:c6:7f:61. Searching for other servers that share this fingerprint at the time of writing, we discovered six additional IP Addresses over the course of our research (95.130.9[.]198; 95.130.15[.]36; 95.130.15[.]37; 95.130.15[.]38; 95.130.15[.]40;  95.130.15[.]41).

Each IP address falls within the 95.130.8.0/21 network range. This range is assigned to Digicube SAS, a French hosting provider which is assigned the Autonomous System AS196689. An IP address is analogous to the apartment numbers in an apartment building. The entire building is owned and operated by AS196689, but certain IP addresses may be let out to other companies and organizations.

ThreatConnect Research Guccifer 2.0: All Roads Lead to Russia fingerprint

The fact that Guccifer 2.0 would use a proxy service is not surprising, and our first stop was to check with various TOR proxy registration sites. None of these seven IP addresses are part of reported TOR infrastructure from what we were able to uncover. Read the full comprehensive detailed cyber investigation as published here by ThreatConnect.

*****

Meanwhile: FAS: The headquarters complex of the Foreign Intelligence Service (SVR) of the Russian Federation has expanded dramatically over the past decade, a review of open source imagery reveals.

Since 2007, several large new buildings have been added to SVR headquarters, increasing its floor space by a factor of two or more. Nearby parking capacity appears to have quadrupled, more or less.

The compilation of open source imagery was prepared by Allen Thomson. See Expansion of Russian Foreign Intelligence Service HQ (SVR; Former KGB First Main Directorate) Between 2007 and 2016, as of July 11, 2016.

Whether the expansion of SVR headquarters corresponds to changes in the Service’s mission, organizational structure or budget could not immediately be learned.

Russian journalist and author Andrei Soldatov, who runs the Agentura.ru website on Russian security services, noted that the expansion “coincides with the appointment of the current SVR director, Mikhail Fradkov, in 2007.” He recalled that when President Putin introduced Fradkov to Service personnel, he said that the SVR should endeavor to help Russian corporations abroad, perhaps indicating a new mission emphasis.

Russian intel buildings Russian intel from airPhotos courtesy of FAS