Obama Directs Intelligence to be Shared with Cuba

Ah what?

In part from CubaToday: Diaz-Balart, a member of the House Defense Appropriations Subcommittee, said Cuba shares intelligence with Russia and Iran, among others. Earlier this year, Gen. James Clapper, the director of national intelligence, told the Senate Armed Services Committee that Cuba was among four countries that pose the greatest espionage threat to the United States. The others were Russia, China and Iran.

“The threat from foreign intelligence entities, both state and non-state, is persistent, complex and evolving,” Clapper testified in a February hearing on “Worldwide Threats.” “Targeting collection of U.S. political, military, economic and technical information by foreign intelligence services continues unabated.”  

Over the course of five decades, Fidel Castro built one of the world’s most active intelligence services, whose missions included spying on U.S. military facilities in South Florida and infiltrating leading Cuban exile organizations in Miami. More here.

Previously on this site, it was published that Cuba’s largest source of revenue is stealing and selling intelligence and secrets to enemies of the United States.

Now it appears, Barack Obama is not finished with his new friends in Cuba and handing off gifts to them.

Today, I approved a Presidential Policy Directive that takes another major step forward in our efforts to normalize relations with Cuba. This Directive takes a comprehensive and whole-of-government approach to promote engagement with the Cuban government and people, and make our opening to Cuba irreversible.  Read more here.

It gets worse…..

China and Russia have maintained a sophisticated spy base in Cuba for many years.

The White House
Office of the Press Secretary
For Immediate Release

Presidential Policy Directive — United States-Cuba Normalization

October 14, 2016

 

SUBJECT: United States-Cuba Normalization

I. Introduction

On December 17, 2014, I announced that the United States would chart a new course with Cuba, ending an outdated policy that had failed to advance U.S. interests and support reform and a better life for the Cuban people on the island over several decades. Under the new policy, the United States expands and promotes authorized engagements with Cuba to advance cooperation on areas of mutual interest, and increase travel to, commerce with, and the free flow of information to Cuba. The objective of the new policy is to help the Cuban people to achieve a better future for themselves and to encourage the development of a partner in the region capable of working with the United States to confront regional challenges, such as climate change, disease, and illicit trafficking.

Endogenous changes underway in Cuba offer opportunities to advance U.S. interests and shift away from an embargo, which is an outdated burden on the Cuban people and has impeded U.S. interests. My Administration has repeatedly called on the Congress to lift the embargo. United States policy is designed to create economic opportunities for the Cuban people; promote respect for human rights; further advances on regional security and defense issues, such as health, law enforcement, and migration; and pursue cooperation with the Cuban government that can strengthen our leadership in the hemisphere. We recognize Cuba’s sovereignty and self-determination and acknowledge areas of difference. We seek to address such differences through engagement and dialogue, and by encouraging increased understanding between our governments and our peoples.

The large Cuban-American community in the United States has an integral role to play in normalization, and in reconciliation between members of the diaspora who left Cuba and those who remain on the island. Normalization necessarily extends beyond government-to-government rapprochement — it includes rebuilding bridges between individuals and families.

This directive: (1) describes the U.S. vision for normalization with Cuba and how our policy aligns with U.S. national security interests; (2) assesses progress toward normalization; (3) describes the current and foreseen strategic landscape; (4) describes priority objectives for normalization; and (5) directs actions required to implement this PPD.

II. Vision for United States-Cuba Normalization

The vision of the United States for U.S.-Cuba normalization is guided by the following national security interests, as described in the 2015 National Security Strategy:

  • The security of the United States, its citizens, and U.S. allies and partners.
  • A strong, innovative, and growing U.S. economy in an open international economic system that promotes opportunity and prosperity.
  • Respect for universal values at home and around the world.
  • A rules-based international order that promotes peace, security, and opportunity.

Our vision for U.S.-Cuba normalization reflects my Administration’s support for broad-based economic growth, stability, increased people-to-people ties, and respect for human rights and democratic values in the region. In the long-term, the United States seeks the following end-states:

1. Enhanced security of the United States and U.S. citizens at home and abroad. We seek to ensure U.S. citizens traveling to Cuba are safe and secure and the United States is protected from: those seeking to exploit increased connectivity for illicit ends, irregular migration, and natural or man-made hazards. Our policy advances bilateral cooperation in areas of mutual interest, including diplomatic, agricultural, public health, and environmental matters, as well as disaster preparedness and response, law enforcement, migration, and other security and defense topics. Our policy also supports increased cooperation with Cuba on regional initiatives on behalf of these interests.

2. A prosperous, stable Cuba that offers economic opportunities to its people. Increased travel and economic interconnectedness supports improved livelihoods for the Cuban people, deeper economic engagement between our two countries, as well as the development of a private sector that provides greater economic opportunities for the Cuban people. Efforts by the Cuban authorities to liberalize economic policy would aid these goals and further enable broader engagement with different sectors of the Cuban economy. United States policy helps U.S. businesses gain access to Cuban markets and encourages the sustainable growth of the Cuban economy. The U.S. private sector, scientific and medical researchers, agriculture industry, foundations, and other groups have new avenues for collaboration that can provide opportunities for Cuban entrepreneurs, scientists, farmers, and other professionals. At the same time, increased access to the internet is boosting Cubans’ connectivity to the wider world and expanding the ability of the Cuban people, especially youth, to exchange information and ideas. The United States is prepared to support Cuban government policies that promote social equality and independent economic activity.

3. Increased respect for individual rights in Cuba. Even as we pursue normalization, we recognize we will continue to have differences with the Cuban government. We will continue to speak out in support of human rights, including the rights to freedoms of expression, religion, association, and peaceful assembly as we do around the world. Our policy is designed to support Cubans’ ability to exercise their universal human rights and fundamental freedoms, with the expectation that greater commerce will give a broader segment of the Cuban people the information and resources they need to achieve a prosperous and sustainable future. In pursuit of these objectives, we are not seeking to impose regime change on Cuba; we are, instead, promoting values that we support around the world while respecting that it is up to the Cuban people to make their own choices about their future.

4. Integration of Cuba into international and regional systems. We seek Cuban government participation in regional and international fora, including but not limited to, those related to the Organization of American States (OAS) and Summit of the Americas to advance mutually held member objectives. We believe that a Cuba that subscribes to the purposes and standards of such fora will benefit, over time, from bringing its domestic economic and political practices in line with international norms and globally accepted standards. Our policy strengthens the U.S. position in international systems by removing an irritant from our relationships with our allies and partners and gaining support for a rules-based order.

III. Progress Toward United States-Cuba Normalization

Since the United States announced on December 17, 2014, that it would chart a new course with Cuba, we have re-established diplomatic relations and have made progress toward the normalization of our bilateral relationship. We opened our respective embassies, six U.S. cabinet secretaries visited Havana, four Cuban ministers visited the United States, and I became the first sitting U.S. President to visit Cuba since 1928. We established a Bilateral Commission to prioritize areas of engagement, and we concluded non-binding arrangements on environmental protection, marine sanctuaries, public health and biomedical research, agriculture, counternarcotics, trade and travel security, civil aviation, direct transportation of mail, and hydrography. We launched dialogues or discussions on law enforcement cooperation, regulatory issues, economic issues, claims, and internet and telecommunications policy.

Given Cuba’s proximity to the United States, increased engagement by U.S. citizens, companies, and the nongovernmental sector holds extraordinary promise for supporting our national interests. Bearing in mind the limits imposed by the Cuban Liberty and Democratic (LIBERTAD) Solidarity Act of 1996 (“Libertad Act”) and other relevant statutes, the Departments of the Treasury and Commerce implemented six packages of regulatory amendments to the Cuba sanctions program, easing restrictions on travel, trade, and financial transactions. United States individuals, firms, and nongovernmental organizations are availing themselves of these regulatory changes to visit Cuba, and authorized travel to Cuba increased by more than 75 percent from 2014 to 2015. Future U.S. citizen travel will be supported by scheduled air service, which began in August 2016, and the first U.S. cruise liner visited Cuban ports in May 2016. We also commenced direct transportation of mail between our two countries, and U.S. telecommunications firms established direct voice and roaming agreements with Cuba. For its part, the Cuban government has continued to pursue incremental economic reforms and launched more than 100 public Wi-Fi hotspots across the island.

These developments lay the foundation for long-term engagement with Cuba that advances U.S. interests. But we have a great deal more to do to build on that foundation based on a realistic assessment of the strategic landscape surrounding normalization.

IV. Strategic Landscape

Cuba is experiencing several transitions in areas such as leadership, the economy, technological development, civil society, and regional and global integration. Cuba’s leaders recognize the need to transition to the next generation, but they prioritize gradual, incremental changes to ensure stability.

Cuba has important economic potential rooted in the dynamism of its people, as well as a sustained commitment in areas like education and health care. Yet the Cuban government faces significant economic challenges, including eliminating its dual-exchange-rate system, making its state-run enterprises more efficient and transparent, developing a financial system that provides expanded services to individuals and the private sector, and reducing its reliance on foreign subsidies. Cuba remains highly dependent on food and energy imports, yet must cope with limited sources of hard currency to pay for import needs. Significant emigration of working age Cubans further exacerbates Cuba’s demographic problem of a rapidly aging population.

A series of statutes limits U.S. economic engagement with Cuba, precluding a complete lifting of restrictions on U.S. travel to Cuba, prohibiting United States Government export assistance and the provision of U.S. credit for Cuban purchases of agricultural commodities, and requiring that the embargo not be suspended or terminated unless the President determines that a transition or democratically elected government has come to power in Cuba.

Due to Cuba’s legal, political, and regulatory constraints, its economy is not generating adequate foreign exchange to purchase U.S. exports that could flow from the easing of the embargo. Even if the U.S. Congress were to lift the embargo, Cubans would not realize their potential without continued economic reform in Cuba. Cuban government regulations and opaque procurement practices hamper transactions with U.S. companies that would be permitted under U.S. law.

Normalization efforts have raised Cubans’ expectations for greater economic opportunities. With an estimated 1 in 4 working Cubans engaged in entrepreneurship, a dynamic, independent private sector is emerging. Expansion of the private sector has increased resources for individual Cubans and created nascent openings for Cuban entrepreneurs to engage with U.S. firms and nongovernmental organizations. We take note of the Cuban government’s limited, but meaningful steps to expand legal protections and opportunities for small- and medium-sized businesses, which, if expanded and sustained, will improve the investment climate.

Cuba is not a member of international financial institutions (IFIs), such as the International Monetary Fund, the World Bank, and the Inter-American Development Bank, which could provide expertise and potentially finance economic reforms and viable investment projects.

Although Cuba has reached agreement with several creditor nations on bilateral debt relief through restructuring and forgiveness, it remains in default to the United States Government on pre-Cuban revolution bilateral debts and does not participate in international capital markets. Cuba and the United States are both members of the World Trade Organization (WTO); however, neither country applies the agreement to the other because of the U.S. embargo toward Cuba.

Rapprochement has enabled us to increase our engagement with Cuba on regional issues such as the Colombia peace process and healthcare in Haiti, and has undermined an historic rallying point for regimes critical of the United States. Although Cuba has expressed no interest in participating in the OAS, it did attend the Summit of the Americas in 2015. We also welcome engagement between Cuba and other U.S. allies from around the world, including our European and Asian treaty allies. At the same time, we recognize that Cuba and the United States will continue to have differences on many regional and global issues.

U.S. engagement with the Cuban government will also be constrained by Cuba’s continued repression of civil and political liberties. We anticipate the Cuban government will continue to object to U.S. migration policies and operations, democracy programs, Radio and TV Marti, the U.S. presence at the Guantanamo Bay Naval Station, and the embargo. The United States Government has no intention to alter the existing lease treaty and other arrangements related to the Guantanamo Bay Naval Station, which enables the United States to enhance and preserve regional security.

In this strategic environment, the policies and actions the United States pursues to advance our vision for U.S.-Cuba normalization will significantly shape the future of bilateral and regional relations, as well as our shared security and prosperity.

V. Six U.S. Objectives for the Medium-Term U.S.-Cuba Relationship

To advance the four end-state goals associated with our strategic vision for U.S.-Cuba normalization, the United States will move concurrently on the following six priority objectives:

1. Government-to-Government Interaction

We will continue high-level and technical engagement in areas of mutual interest, including agriculture, the economy and small businesses, transportation, science and technology, environment, climate, health, law enforcement, migration, national security, disaster preparedness and response, and counterterrorism. Through the Bilateral Commission, we will identify and prioritize areas of collaboration and engagement that advance our end-state goals. Stronger diplomatic ties will enable constructive engagement on bilateral differences, including our democracy and broadcasting programs, while protecting our interests and assets, such as the Guantanamo Bay Naval Station. We will utilize engagement to urge Cuba to make demonstrable progress on human rights and religious freedom. As the United States and Cuban governments build trust through more frequent engagement, we will increasingly conduct working-level interactions between Cuban ministries and U.S. agencies and departments that lessen the need for high-level conversations on routine matters. Given the lack of diplomatic relations over the past several decades, we will seek broad engagement across the Cuban government, including ministries and local officials. When appropriate and legally available, we will engage with Cuba to normalize trade relations fully.

2. Engagement and Connectivity

The United States will continue to encourage people-to-people linkages through government and privately sponsored exchanges, including those involving educational, cultural, business, science, environment, technology, and sports. As permitted by law, we will continue to support the development of scheduled and chartered air service and maritime links, including ferries. An ongoing partnership with the Cuban-American community is of particular importance given Cuban-Americans’ strong family and socio-cultural ties, as well as their natural role as citizen-ambassadors. We will facilitate opportunities for Cuban-Americans to rebuild and create new bonds with family to support reconciliation. To facilitate Cuba’s goal of increasing its internet access from 5 percent to 50 percent of the population by 2020, we will seek the establishment of a bilateral working group to expand internet connectivity. We will seek opportunities that enable U.S. foundations and universities to establish linkages with Cuba.

3. Expanded Commerce

The United States Government will seek to expand opportunities for U.S. companies to engage with Cuba. The embargo is outdated and should be lifted. My Administration has repeatedly called upon the Congress to lift the embargo, and we will continue to work toward that goal. While the embargo remains in place, our role will be to pursue policies that enable authorized U.S. private sector engagement with Cuba’s emerging private sector and with state-owned enterprises that provide goods and services to the Cuban people. Law enforcement cooperation will ensure that authorized commerce and authorized travelers move rapidly between the United States and Cuba. Although we recognize the priority given to state-owned enterprises in the Cuban model, we seek to encourage reforms that align these entities with international norms, especially transparency.

United States regulatory changes have created space for the Cuban government to introduce comparable changes. In tandem with the Department of the Treasury’s regulatory change to expand Cuba’s access to the U.S. financial system and U.S. dollar transit accounts, the Cuban government announced in early 2016 plans to eliminate the 10 percent penalty on U.S. dollar conversion transactions, subject to improved access to the international banking system. We will sustain private and public efforts to explain our regulatory changes to U.S. firms and banks, Cuban entrepreneurs, and the Cuban government.

4. Economic Reform

While the Cuban government pursues its economic goals based on its national priorities, we will utilize our expanded cooperation to support further economic reforms by the Cuban government. Recent exchanges among financial service institutions and regulators have provided greater mutual understanding of our respective financial system and economic priorities. We will undertake government-to-government dialogues to discuss options for macro- and microeconomic reform, with the goal of connecting the changes in U.S. policy with Cuban reforms in a manner that creates opportunity for U.S. firms and the Cuban people.

If and when the Congress lifts the embargo, my Administration will engage with the Congress and stakeholders on preparatory commercial and economic exchanges and dialogues. My Administration would then similarly engage the Congress on the substance and timing of a new bilateral commercial agreement to address remaining statutory trade requirements.

5. Respect for Universal Human Rights, Fundamental Freedoms, and Democratic Values

We will not pursue regime change in Cuba. We will continue to make clear that the United States cannot impose a different model on Cuba because the future of Cuba is up to the Cuban people. We seek greater Cuban government respect for universal human rights and fundamental freedoms for every individual. Progress in this area will have a positive impact on the other objectives. We will encourage the Cuban government to respect human rights; support Cuba’s emerging, broad-based civil society; and encourage partners and nongovernmental actors to join us in advocating for reforms. While remaining committed to supporting democratic activists as we do around the world, we will also engage community leaders, bloggers, activists, and other social issue leaders who can contribute to Cuba’s internal dialogue on civic participation. We will continue to pursue engagements with civil society through the U.S. Embassy in Havana and during official United States Government visits to Cuba. We will seek to institutionalize a regular human rights dialogue with the Cuban government to advance progress on human rights. We will pursue democracy programming that is transparent and consistent with programming in other similarly situated societies around the world. We will utilize our increased ability to engage regional partners, both bilaterally and through regional bodies, to encourage respect for human rights in Cuba. We will consult with nongovernmental actors such as the Catholic Church and other religious institutions. Finally, we will work with the European Union and likeminded international organizations and countries to encourage the Cuban government to respect universal values.

6. Cuban Integration into International and Regional Systems

We will expand dialogue with Cuba in the organizations in which it already holds membership, such as the WTO and the World Customs Organization (WCO), and we will encourage Cuba to move toward rules-based engagement, subject to statutory requirements. We will encourage Cuba to bring its legal framework, particularly its commercial law, in line with international standards. We will encourage Cuba to meet WCO standards for supply chain security. To the extent permitted by and consistent with applicable law, we will facilitate integration into international bodies, including through the use of technical assistance programs. We will pursue cooperation with Cuba on regional and global issues (e.g., combating the Ebola outbreak and the Colombia peace process). Ending the embargo and satisfying other statutory requirements relating to trade will allow the United States to normalize trade relations with Cuba.

VI. Policy Implementation

1. Roles and Responsibilities

To facilitate the effective implementation of this directive, departments and agencies will have the following roles and responsibilities, consistent with the relevant legal authorities and limits:

The National Security Council (NSC) staff will provide ongoing policy coordination and oversight of the implementation of this PPD and the overall Cuba strategy as necessary.

The Department of State will continue to be responsible for formulation of U.S. policy toward and coordination of relations with Cuba. This includes supporting the operations of Embassy Havana and ensuring it has adequate resources and staffing. Other responsibilities include the issuance of nonimmigrant and immigrant visas, refugee processing, promotion of educational and cultural exchanges, coordination of democracy programs, and political and economic reporting. State will continue to lead the U.S.-Cuba Bilateral Commission and coordinate a number of dialogues, such as the Law Enforcement Dialogue, annual migration talks, and meetings to resolve outstanding claims.

State will continue to co-lead efforts with the U.S. Agency for International Development to ensure democracy programming is transparent and consistent with programming in other similarly situated societies. State will coordinate efforts to advance science and technology cooperation with Cuba. State will support telecommunications and internet access growth in Cuba and provide foreign policy guidance to the Departments of Commerce and the Treasury on certain exports, financial transactions, and other license applications.

The U.S. Mission to the United Nations (USUN), in coordination with State, will oversee multilateral issues involving Cuba at the United Nations. USUN will identify areas of possible collaboration with Cuba that could help foster a more collaborative relationship between the United States and Cuba at the United Nations. The USUN will also participate in discussions regarding the annual Cuban embargo resolution at the United Nations, as our bilateral relationship continues to develop in a positive trajectory.

The Department of the Treasury is responsible for implementation of the economic embargo restrictions and licensing policies. The Treasury will continue its outreach to help the public, businesses, and financial institutions understand the regulatory changes. The Treasury will continue to review and respond to public questions and feedback on regulations and public guidance that could be further clarified and to discuss with State any novel license requests that the Treasury receives from the public to determine whether such requests are consistent with the regulatory changes and existing law. The Treasury will make use of available channels for bilateral dialogue to understand Cuba’s economic and financial system and encourage reforms and will continue to engage in dialogue with the Cuban government about our regulatory changes.

The Department of Commerce will continue to support the development of the Cuban private sector, entrepreneurship, commercial law development, and intellectual property rights as well as environmental protection and storm prediction. If statutory restrictions are lifted, Commerce will promote increased trade with Cuba by providing export assistance to U.S. companies. In the meantime, Commerce will continue a robust outreach effort to ensure that U.S. companies understand that U.S. regulatory changes provide new opportunities to obtain licenses or use license exceptions to increase authorized exports to Cuba, including to Cuban state-owned enterprises that provide goods and services to meet the needs of the Cuban people. Additionally, Commerce will continue to engage in dialogue with the Cuban government about our regulatory changes, as well as the need for simplification of the Cuban import process, transparency in Cuban business regulations, and other steps that will lead to full realization of the benefits of our regulatory changes.

The Department of Defense (DOD) will continue to take steps to expand the defense relationship with Cuba where it will advance U.S. interests, with an initial focus on humanitarian assistance, disaster relief, and counternarcotics in the Caribbean. The DOD will support Cuba’s inclusion in the inter-American defense system and regional security and defense conferences, which will give Cuba a stake in hemispheric stability. The DOD will continue to make contingency preparations and support the capacity of the Department of Homeland Security and State to address mass migration and maritime migration issues pursuant to Executive Orders 12807 and 13276 and consistent with other applicable interagency guidance and strategy.

The Department of Homeland Security (DHS) will engage, together with the Department of Justice, with the Cuban government to combat terrorism and transnational organized crime. In support of U.S. security and foreign policy objectives, DHS will develop protocols for investigative cooperation with Cuba in coordination with other departments and agencies. The DHS will strengthen the security and efficiency of cross-border supply chains and travel systems in support of people-to-people engagement and authorized U.S. trade with the Cuban private sector. The DHS will safeguard the integrity of the U.S. immigration system, to include the facilitation of lawful immigration and ensure protection of refugees. The Secretary of Homeland Security, the United States Government lead for a maritime migration or mass migration, with support from the Secretaries of State and Defense, will address a maritime migration or mass migration pursuant to Executive Orders 12807 and 13276 and consistent with applicable interagency guidance and strategy.

The Department of Justice (DOJ) will engage, together with DHS, with the Cuban government to combat terrorism and transnational organized crime. The DOJ will work with Cuba to expand security and law enforcement cooperation, increase information sharing, and share best practices with Cuban counterparts. This work will build upon, and strengthen, current law enforcement cooperation with Cuba under the umbrella of the U.S.-Cuba Law Enforcement Dialogue and its various working groups, which focus on counterterrorism, counternarcotics, cybercrime, human trafficking, and other areas of criminal activity.

The Small Business Administration (SBA) will continue to engage with the Cuban government, entrepreneurs, small businesses, and cooperative enterprises. The SBA will support exchanges with the Cuban government in areas of mutual interest, particularly on formalization of small businesses and to spur the growth of new enterprises.

The Office of the United States Trade Representative will provide trade policy coordination in international fora and, consistent with statutory requirements and restrictions, prepare for negotiations to normalize and expand U.S.-Cuba trade.

The Department of Agriculture (USDA) will work to increase U.S. food and agricultural exports to Cuba by building market opportunities, improving the competitive position of U.S. agriculture, and building Cuba’s food security and agricultural capacity, while protecting plant, animal, and human health. USDA will work with the Government of Cuba to advance cooperation outlined in the U.S.-Cuba agricultural memorandum of understanding signed in March 2016. The USDA will build the U.S.-Cuba trade and development relationship to the extent permitted by and consistent with applicable law.

The Department of Health and Human Services (HHS), in accordance with the June 2016 memorandum of understanding between HHS and the Ministry of Public Health of the Republic of Cuba, will collaborate with Cuban counterparts in the areas of public health, research, and biomedical sciences, including collaboration to confront the Zika virus, dengue, chikungunya, and other arboviruses. The HHS will promote joint work, such as development of vaccines, treatments, and diagnostics; partner with Cuba to prevent, detect, and respond to infectious disease outbreaks; collaborate in the field of cancer control, treatment programs, and joint research; and exchange best practices related to access to healthcare.

The United States Agency for International Development (USAID) will coordinate with departments and agencies the United States Government’s response to unplanned environmental occurrences, such as natural or manmade disasters. The USAID will co-lead efforts with State to ensure that democracy programming is transparent and consistent with programming in other similarly situated societies.

The Department of Transportation (DOT) will continue to develop air and surface transportation links between the United States and Cuba in support of transportation providers, authorized travelers, and commerce, while providing required regulatory and safety oversight of transportation providers and systems.

The Office of the Director of National Intelligence (DNI) will support broader United States Government efforts to normalize relations with Cuba, with Intelligence Community elements working to find opportunities for engagement on areas of common interest through which we could exchange information on mutual threats with Cuban counterparts.

The Department of the Interior (DOI) will continue cooperation with Cuba on marine protected areas and continue to engage Cuban counterparts to finalize arrangements on wildlife conservation, terrestrial national protected areas, and seismic records.

2. Congressional Outreach

Strong support in the Congress for U.S.-Cuba normalization would contribute to the speed and success of the aforementioned goals, particularly with respect to the embargo and adequate embassy staffing. We will seek to build support in the Congress to lift the embargo and other statutory constraints to enable expanded travel and commerce with Cuba and accelerate normalization. We will regularly engage with Members of Congress and staff on challenges and opportunities in Cuba, advocate for United States Government policies and sufficient staff and resources to implement the aforementioned goals and policy priorities, and encourage and facilitate congressional travel to the region.

3. Monitoring and Oversight

The Interagency Policy Committee (IPC), or its future equivalent, will have primary responsibility for coordinating and overseeing the implementation of this policy. The NSC staff will convene regular IPC and Deputies Committee meetings as necessary to monitor implementation and resolve obstacles to progress. The following departments and agencies will designate senior individuals responsible for managing policy implementation in their agency: State, the Treasury, Commerce, DOD (Office of the Secretary of Defense and Joint Staff), DHS, DOJ, USDA, HHS, DOT, USUN, the Office of the United States Trade Representative, USAID, SBA, and DNI.

4. Previous Guidance

Executive Order 13276, Delegation of Responsibilities Concerning Undocumented Aliens Interdicted or Intercepted in the Caribbean Region, dated November 15, 2002, and Executive Order 12807, Interdiction of Illegal Aliens, dated May 24, 1992, remain in effect.

BARACK OBAMA

Former NSA Contractor Stole 50,000 Gigabytes of Data

NYT’s/WASHINGTON — Investigators pursuing what they believe to be the largest case of mishandling classified documents in United States history have found that the huge trove of stolen documents in the possession of a National Security Agency contractor included top-secret N.S.A. hacking tools that two months ago were offered for sale on the internet.

The criminal complaint filed September 13, 2016 is here.

They have been hunting for electronic clues that could link those cybertools — computer code posted online for auction by an anonymous group calling itself the Shadow Brokers — to the home computers of the contractor, Harold T. Martin III, who was arrested in late August on charges of theft of government property and mishandling of classified information.

Harold T. Martin III and his wife Deborah Shaw in an undated photo. Credit Deborah Shaw

But so far, the investigators have been frustrated in their attempt to prove that Mr. Martin deliberately leaked or sold the hacking tools to the Shadow Brokers or, alternatively, that someone hacked into his computer or otherwise took them without his knowledge. While they have found some forensic clues that he might be the source, the evidence is not conclusive, according to a dozen officials who have been involved in or have been briefed on the investigation.

All spoke on condition of anonymity because they were not authorized to discuss it publicly.

An anonymous hacker group, calling itself the Shadow Brokers, announced in August a sale of computer codes stolen from the National Security Agency.

Mr. Martin, an enigmatic loner who according to acquaintances frequently expressed his excitement about his role in the growing realm of cyberwarfare, has insisted that he got in the habit of taking material home so he could improve his skills and be better at his job, according to these officials. He has explained how he took the classified material but denied having knowingly passed it to anyone else.

 

“As a contractor, he gets to see a slice of the overall picture,” said one person familiar with the exchanges, summarizing Mr. Martin’s explanation. “He wanted to see the overall picture so that he could be more effective.”

Mr. Martin’s home in Glen Burnie, Md., with car parked outside. Credit Nate Pesce for The New York Times

The material the F.B.I. found in his possession added up to “many terabytes” of information, according to court papers, which would make it by far the largest unauthorized leak of classified material from the classified sector. That volume dwarfs the hundreds of thousands of N.S.A. documents taken by Edward J. Snowden in 2013 and exceeds even the more voluminous Panama Papers, leaked records of offshore companies obtained by a German newspaper in 2015, which totaled 2.6 terabytes. One terabyte of data is equal to the contents of about one million books.

Image result for harold t martin nsa  NBCNews

F.B.I. agents on the case, advised by N.S.A. technical experts, do not believe Mr. Martin is fully cooperating, the officials say. He has spoken mainly through his lawyers, James Wyda and Deborah Boardman of the federal public defender’s office in Baltimore. They declined to comment before a detention hearing set for Friday in federal court.

Investigators discovered the hacking tools, consisting of computer code and instructions on how to use it, in the thousands of pages and dozens of computers and data storage devices that the F.B.I. seized during an Aug. 27 raid on Mr. Martin’s modest house in suburban Glen Burnie, Md. More secret material was found in a shed in his yard and in his car, officials said.

The search came after the Shadow Brokers leak set off a panicked hunt at the N.S.A. Mr. Martin attracted the F.B.I.’s attention by posting something on the internet that was brought to the attention of the N.S.A. Whatever it was — officials are not saying exactly what — it finally set off an alarm.

The release of the N.S.A.’s hacking tools, even though they dated to 2013, is extraordinarily damaging, said Dave Aitel, a former agency employee who now runs Immunity Inc., an information security company.

“The damage from this release is huge, both to our ability to protect ourselves on the internet and our ability to provide intelligence to policy makers and the military,” Mr. Aitel said.

The N.S.A.’s hacking into other countries’ networks can be for defensive purposes: By identifying rivals’ own hacking methods, the agency can recognize and defend against them, he said. And other countries, with some of the N.S.A.’s tools now in hand, can study past hacks and identify the attacker as the N.S.A., learn how to block similar intrusions, or even decide to retaliate, Mr. Aitel said.

Mr. Martin, 51, a Navy veteran who was completing a Ph.D. in information systems at the University of Maryland, Baltimore County, has worked for several of the contracting companies that help staff the nation’s security establishment. After stints at the Computer Sciences Corporation and Tenacity Solutions, where he was assigned to the Office of the Director of National Intelligence, he joined Booz Allen Hamilton in 2009. He worked on that firm’s N.S.A. contract until 2015, when he was moved to a different Pentagon contract in the area of offensive cyberwarfare.

He has long held a high-level clearance and for a time worked with the N.S.A.’s premier hacking unit, called Tailored Access Operations, which breaks into the computer networks of foreign countries and which developed the hacking tools later obtained by the Shadow Brokers. According to one person briefed on the investigation, Mr. Martin was able to obtain some of the hacking tools by accessing a digital library of such material at the N.S.A.

theshadowbrokers @shadowbrokerss

@cyberwar@guardian@VICE@mashable@wired@kaspersky@symantec Equation Group – Cyber Weapon Auction http://pastebin.com/NDTU5kJQ 

Mediterranean Sea is Getting Crowded with Russian Navy

Russia possibly mapping underwater internet cables in Mediterranean

WT: Approximately one year ago, the Russian navy caused quite a stir by hanging around internet cables in the Atlantic for some period of time.

Steffan Watkins, an open-source intelligence analyst who monitors Russian ship movements, said the Russian navy sends vessels such as Yantar to the region to check on existing U.S. underwater sensors or cables that have been detected previously. The ships also search for new equipment on the sea floor that would reveal U.S. operations.

Steffan Watkins, an open-source intelligence analyst who monitors Russian ship movements, said the Russian navy sends vessels such as Yantar to the region to check on existing U.S. underwater sensors or cables that have been detected previously. The ships also search for new equipment on the sea floor that would reveal U.S. operations.

The accusation was the Russians were mapping the cables in order to be able to sever them in times of conflict.

The Russian fleet in the Mediterranean seems to be doing the same thing this week over cables off the Syrian coast.

News.com.au writes, “Author and military analyst H.I. Sutton is one of several observers who have noted the unusual activity of a suspected Russian survey ship, the Yantar, in waters between Cyprus, Syria, Lebanon and Turkey in recent weeks.

It’s reported positions have been coinciding with the tracks of three major undersea fibre-optic cables. Mr Sutton’s blog suggests the extremely slow speed and frequent stopping of the ship suggest it could be deploying a submersible to the sea floor.”

If internet cables were severed that were supporting Western information flow, this could cause great economic disruption and take a very long time to repair, especially in time of war.

It seems likely that Russia wants this capability to inflict great damage on the European and American economies if need be.

Another possibility is that the Russian navy could be deploying devices to monitor information through the cables for espionage reasons.

(Bloomberg) — U.K. warships are monitoring a Russian aircraft-carrier group sailing past Britain’s eastern coast to the Mediterranean Sea to supplement President Vladimir Putin’s forces in the region, as international condemnation mounts of Russia’s military campaign in Syria.

A photo taken from a Norwegian surveillance aircraft shows a group of Russian navy ships in international waters off the coast of Northern Norway on October 17, 2016. 333 Squadron, Norwegian Royal Airforce/NTB Scanpix/Handout via Reuters ATTENTION EDITORS - THIS IMAGE WAS PROVIDED BY A THIRD PARTY. FOR EDITORIAL USE ONLY. NORWAY OUT.A photo taken from a Norwegian surveillance aircraft shows a group of Russian navy ships in international waters off the coast of Northern Norway on October 17, 2016. 333 Squadron, Norwegian Royal Airforce/NTB Scanpix/Handout via Reuters

The deployment signals Putin’s determination to assert Russian interests as U.S. and European leaders accuse him of war crimes and dangle the threat of sanctions in response to the bombing of Aleppo by Russian warplanes.

Putin floated a possible extension of a cease-fire for the besieged Syrian city during a late-night meeting in Berlin on Wednesday with French President Francois Hollande and German Chancellor Angela Merkel that she portrayed as testy. Merkel and Hollande will meet again in Brussels on Thursday for a two-day summit of the EU’s 28 leaders that will consider a common response to Russia’s actions in support of Syrian President Bashar Al-Assad.

“We must show a robust and united European stance in the face of Russian aggression,” U.K. Prime Minister Theresa May told reporters as she arrived for her first summit. While Britain is leaving the EU, until it does “it’s vital that we work together to continue to put pressure on Russia to stop its appalling atrocities, its sickening atrocities in Syria,” she said.

May’s comments hint at the growing outrage over the bombing by Russian and Syrian forces of Aleppo, where some 275,000 inhabitants remain trapped. Syria’s government opened two crossings for fighters who want to leave the rebel-held eastern part of the contested city, a day after announcing a three-day humanitarian pause to its offensive.

Northern Fleet

Russia’s Northern Fleet, based at Severomorsk near the Finnish border, said last week that a naval group had set out for the northeast Atlantic en route to the Mediterranean “to ensure naval presence in the important areas” of the seas, according to the TASS news agency. The ships include the Admiral Kuznetsov, Russia’s only aircraft carrier.

“When these ships near our waters we will man-mark them every step of the way,” U.K. Defense Secretary Michael Fallon said in an e-mailed statement on Thursday. “We will be watching as part of our steadfast commitment to keep Britain safe.”

Russia said last month that its permanent naval group already stationed in the Mediterranean numbers about 10 warships and support vessels. Igor Konashenkov, a Defense Ministry spokesman in Moscow, declined to comment on the additional deployment.

Russian Responsibility

Speaking after the Berlin talks that stretched into early Thursday, Putin said Russia would halt its bombing of Aleppo as long as “terrorist forces” aren’t active. At a separate news conference alongside Merkel, Hollande said Putin didn’t specify how long such a cease-fire might last. “We hope it’s as long as possible” to allow for humanitarian aid to reach all parts of the city, he said.

European foreign ministers will work on getting aid to the area, which would “at least be a first step that we haven’t seen in a long time,” Merkel said. “It was right to use this blunt language” in the talks with Putin because “Russia bears a clear responsibility in Syria, including exerting influence over” Assad, the German leader said.

Merkel and Hollande kept the threat of sanctions against Russia on the table, while saying the focus had to be on helping civilians in Aleppo.

Hollande said that at best the European Union could target individuals, while Merkel limited herself to saying that “you can’t deny yourself the option.” Either way, any sanctions would require the approval of all 28 member states and the most ardent support for such an approach came from the U.K, which has voted to leave the bloc. Russia already is under EU and U.S. sanctions for its encroachment on Ukraine.

“The conclusion in the European Union is that we don’t believe in new sanctions at this phase because we already have sanctions and these run until the end of January,” Finnish Prime Minister Juha Sipila said in an interview in Helsinki on Wednesday. “In December or January we will have a discussion about the future of sanctions.’’

Minsk Accord

The Syria talks followed a discussion on Ukraine that was also attended by Ukrainian President Petro Poroshenko. Merkel and Poroshenko said the four leaders agreed to work on a “road map” of measures to advance last year’s Minsk accords for ending the conflict in eastern Ukraine between government forces and Russian-backed separatists.

In Brussels, Estonian Prime Minister Taavi Roivas, whose country borders Russia, said EU leaders must deliver “a very clear message to both the Syrian regime and its allies, mainly Russia.” He compared Aleppo with the Chechen capital, Grozny, that was reduced to rubble by Russian aerial bombing in the 1990s. “This is absolutely unacceptable,” Roivas said.

Czech Police Arrest Russian Hacker of U.S.

Czech police arrest Russian with alleged connections to hacking in U.S.

 

WashingtonPost: A Russian man thought to have connections to hacking in the United States has been arrested in the Czech Republic, authorities there said Tuesday.

Czech police worked with the FBI to detain the man at a hotel in Prague, according to a statement published online Tuesday evening.

The arrest is not related to the Russian hacks of the Democratic National Committee and other political organizations or the ongoing probe of Russian interference in the U.S. election, federal law enforcement officials said.

“As cyber crime can originate anywhere in the world, international cooperation is crucial to successfully defeat cyber adversaries,” the FBI said in a press statement Wednesday. The arrest, the bureau noted, was made pursuant to an INTERPOL red notice, highlighting the collaboration between U.S. law enforcement and international partners.

Immediately after his arrest, authorities said, the man collapsed. He was provided first aid and was later hospitalized.

Czech courts will decide whether to extradite the man to the United States.

It was unclear what hacking attacks the man was suspected of participating in. A police spokesman declined to provide Reuters with additional information about the arrest. In Moscow, a Russian Foreign Ministry official said the Kremlin opposed the extradition.

Konstantin Dolgov, whose group monitors legal and rights issues at the Foreign Ministry, called the plans to move the suspect to the United States an “unacceptability,” according to the Interfax news agency.

Dolgov said Russian officials were monitoring the case and ready to provide the suspect with assistance, including legal help. “We expect that his procedural rights won’t be violated,” Dolgov was quoted as saying.

Although there are no apparent links between the arrest and hacking of U.S. political groups, the case is certain to draw closer attention to data infiltration tactics with suspected Russian fingerprints.
Nearly two weeks ago, the Obama administration officially accused Russia of attempting to interfere with the 2016 U.S. election, a claim that had been reported widely for months but not formally alleged by the federal government.

The alleged hacks have included digital intrusions into systems at the Democratic National Committee this summer that was followed by a major leak of emails that, in turn, led to the resignation of the committee’s chairwoman, Rep. Debbie Wasserman Schultz (Fla.). Russia has also been blamed for hacking and, later, leaking emails of the Democratic Congressional Campaign Committee. In the October statement officially accusing Russia of the hacking attacks, the federal government said an online persona calling himself Guccifer 2.0 had claimed responsibility for the intrusions and said that it thinks only top Russian officials could have authorized them.

“This is some sort of nonsense,” Dmitry Peskov, press secretary for Russian President
Vladimir Putin, told The Washington Post earlier this month. “Every day, Putin’s site gets attacked by tens of thousands of hackers. Many of these attacks can be traced to U.S. territory. It’s not as though we accuse the White House or Langley of doing it each time it happens.”

****

Tuesday, February 17, 2015

Russian National Charged in Largest Known Data Breach Prosecution Extradited to United States

Defendant Brought From Netherlands

After Fighting Extradition for Over Two Years

****

Russian Hackers of DNC Said to Nab Secrets From NATO, Soros

Bloomberg: Weeks before the Democratic convention was upended by 20,000 leaked e-mails released through WikiLeaks, another little-known website began posting the secrets of a top NATO general, billionaire George Soros’ philanthropy and a Chicago-based Clinton campaign volunteer.

Security experts now say that site, DCLeaks.com, with its spiffy capitol-dome logo, shows the marks of the same Russian intelligence outfit that targeted the Democratic political organizations.

The e-mails and documents posted to the DCLeaks site in early June suggest that the hackers may have a broader agenda than influencing the U.S. presidential election, one that ranges from the Obama administration’s policy toward Russia to disclosures about the hidden levers of political power in Washington.

It also means the hackers may have much left in their grab bag to distribute at will. The subjects of the DCLeaks site include a former ranking intelligence official who now works for a major defense contractor and a retired Army officer whose wife serves on the USS Nimitz, the nuclear-powered aircraft carrier. Some of the e-mails go back years.

Open Society Foundations, the Soros group, reported the breach to the Federal Bureau of Investigation in June, said spokeswoman Laura Silber, who added that an investigation by a security firm found the intrusion was limited to an intranet system used by board members, staff and foundation partners.

NATO Commander

The biggest revelation on DCLeaks involves U.S. Gen. Philip Breedlove, who retired in May and was formerly the top military commander of the North Atlantic Treaty Organization. E-mails from Breedlove’s personal account show him complaining that the Obama administration wasn’t paying enough attention to European security. (“I do not see this WH really ’engaged’,” he writes at one point, later wondering “how to work this personally with the POTUS.”) The Intercept subsequently wrote a story about the e-mails, picked up by some cable news channels, inflaming tensions between the U.S. and its European allies.

Breedlove told CNN in July that the e-mails were stolen as part of a state-sponsored intelligence operation and didn’t respond to a request for comment this week.

The leaks highlight the effectiveness of some of the hackers’ tricks, including the targeting of private e-mail accounts to gather sensitive military and political intelligence. DCLeaks also offers some insight for investigators on what appears to be the hackers’ early missteps and ad hoc approach.

Harried Schedule

A cache of hacked Google e-mails from a Clinton volunteer, for example, doesn’t add up to much: They purport to be from the account of Sarah Hamilton, who works for a public relations firm in Chicago and volunteers for Hillary for America, and show little but the harried schedule of the campaign staff. Hamilton didn’t respond to a request for comment.

Similarly, a trove of “redacted” documents from the William J. Clinton Library were declassified and have been publicly available on the library’s website for several years, a spokeswoman for the library said.

“It really looks like the hackers tried a couple of things that just weren’t really working before they hit on using WikiLeaks,” said John Hultquist, the manager of cyberespionage intelligence at FireEye Inc. “With this earlier stuff, it looks like they were experimenting.”

Describing itself as the work of American hacktivists, DCLeaks.com was registered in April, and many of the documents were posted in early June. A DCLeaks administrator, who identified himself by e-mail as Steve Wanders, didn’t respond to written questions, including why much of the material focuses on Russia or Russian foreign-policy interests.

Voracious Appetites

The site seems designed to cater to the U.S. media’s voracious appetites for leaks. It has related Twitter and Facebook accounts that push out nuggets from purloined documents and that suggest angles journalists might pursue.

The Russian government has dismissed the idea that it was involved in the hack of the Democratic National Committee, and WikiLeaks founder Julian Assange said there’s “no proof whatsoever” that Moscow was involved.

Security experts see links to a larger Russian information operation. That’s in part, according to two people familiar with the probe, because the e-mail addresses of Breedlove and Hamilton were among thousands targeted in a several-month campaign that began last fall by a Russian hacking group that cybersecurity firms have referred to by monikers including Fancy Bear, APT28 and the Sofacy Group.

Cyberintelligence firms have linked that hacking group to the GRU, Russia’s military intelligence service, whose Moscow headquarters is nicknamed the Aquarium. Three private security groups have linked the DNC incursion to that group and another Russian hacking group associated with the FSB, the country’s civilian intelligence agency. U.S. intelligence agencies have told officials they believe the DNC hack was orchestrated by the Russian government.

Guccifer 2.0

A hacker calling himself Guccifer 2.0 and purporting to be Romanian initially took credit for the DNC hack. That claim was viewed skeptically, in part because the hacker didn’t appear to speak Romanian. Guccifer 2.0 provided the Smoking Gun with leaked e-mails from Sarah Hamilton’s account, according to a story posted on that site on June 28. FireEye believes Guccifer 2.0 is a cover identity for APT28, Hultquist said.

In the case of Soros’s Open Society, hackers stole a trove of documents after accessing the foundation’s internal intranet, a system called Karl, according to a person familiar with its internal investigation. On August 3, the DCLeaks.com Twitter account tweeted “Check George Soros’s OSF plans to counter Russian policy and traditional values,” attaching a screenshot of a $500,000 budget request for an Open Society program designed to counter Russian influence among European democracies.

The hackers may have had access the foundations’ network for nearly a year, according to another person familiar with the investigation. Although Open Society has about 800 full-time staff, as many as 7,000 people have access to Karl, which is used to circulate draft program proposals, budgets and other internal documents.

DCLeaks.com provides a possible outline of the successful tactics used by the suspected Russian hackers, like targeting personal e-mail accounts to scoop up sensitive information.

The hackers were apparently reading Breedlove’s personal e-mails that went back to at least 2012, a period when he was among the highest-ranking U.S. military officers and was commander of the U.S. European Command and NATO Allied Command Operations.

Among Breedlove’s correspondents, according to DCLeaks.com, were former Secretary of the Air Force James Roche, former presidential candidate Wesley Clark and former Secretary of State Colin Powell. Efforts to contact Clark and Powell weren’t immediately successful.

Roche, in an e-mail, said Breedlove is a thoughtful officer who has worked hard for the betterment of the Air Force and his country. Of the Russians, Roche added: “I hope they learned that there are many dedicated officers who are thinking of the best ways to ensure that our country’s leaders can’t be bullied by Mr. Putin and his associates.”

Republicans Hacked, Data Sent to Russian Domain

Republicans hacked, skimmed NRSC donations sent to Russian domain

Hundreds, if not thousands of donations made to the NRSC this year were likely compromised

CSO: Republicans who gave money to the National Republican Senatorial Committee (NRSC) this year, in order to help support incumbent Republican senators, might want to check their credit card statements.

Those who donated to the NRSC between March 16 and October 5, 2016, conducted their transaction on a platform that was compromised by malicious code designed to steal credit card details and personal information. The NRSC quietly corrected the problem sometime around October 6, 2016.

The hacked storefront, which powers the NRSC donation system, was discovered by Willem de Groot – a Dutch developer who discovered thousands of compromised websites running vulnerable versions of the Magento e-commerce platform.

The compromised NRSC transactions included the donor’s first name, last name, email address, billing details (address, city, state, and zip code), employer details, occupation, card type, card number, card expiration, and security code.

Once the data was collected by the malicious code, the compromised transactions were then sent to one of two different domains.

Earlier this year, the criminals responsible for skimming the card data were using jquery-cloud[.]net to receive the compromised records. Later, the code on the NRSC website was altered to send skimmed transactions to jquery-code[.]su.

The malicious .su domain is still operational, and it’s hosted on a network (Dataflow) with some suspicious, if not outright criminal clients – including those that deal with drugs, money laundering, Phishing, and spam.

It isn’t clear who is behind the attack, as anyone can register a domain and obtain hosting. One interesting observation made by de Groot during his research, was that Dataflow and jquery-cloud[.]net came online together during the same week in November of 2015.

As for impact, it’s hard to tell how many transactions on the NRSC website were compromised. Going by traffic, de Groot said that upwards of 3,500 compromised transactions per month were possible.

Based on reporting to the Federal Election Commission, the NRSC collected more than $30 million in contributions since March 2016, when the card skimming code was first observed on their domain. But again, this total is for all funds collected, and doesn’t single out credit card donations.

As mentioned, once the issue became public earlier this month, the NRSC quietly replaced the compromised storefront with a new one powered by WordPress.

Salted Hash attempted to reach out to the NRSC over the weekend, but the committee hasn’t responded to queries. As of October 17, the NRSC website makes no mention of the new storefront, or the compromised e-commerce platform.

Unfortunately, this means GOP supporters who had their credit card information compromised could be caught by surprise once their accounts show signs of fraudulent activity, and left completely unaware of the problem’s root cause.

During his research, de Groot determined that more than 5,400 storefronts were compromised by the same type of malicious code used on the NRSC domain. So far, he has discovered nine variants of the skimming code, suggesting that multiple people (or groups) are involved.

When de Groot reached out to victims, in an attempt to alert them about their compromised domains, many of the website owners failed to understand the full impact of the situation.

Some responded to the warnings by arguing to de Groot that the code added by the criminals didn’t matter because – “our payments are handled by a 3rd party payment provider” or “our shop is safe because we use HTTPS.”

Those responding like this are missing the bigger point; if the code running the payment processing system is compromised, 3rd-party processing and HTTPS will not prevent a criminal from obtaining your card data or personal information.

A full list of the storefronts compromised by the skimming code is available on GitLab. Over the weekend, GitLab removed the list in error, but they’ve since restored the list with an apology.

A video demonstrating how the NRSC hack worked is below:

 

Going deeper, BuzzFeed tells us who Fancy Bear really is:

SAN FRANCISCO — On the morning of March 10, nine days after Hillary Clinton had won big on Super Tuesday and all but clinched the Democratic nomination, a series of emails were sent to the most senior members of her campaign.

At a glance, they looked like a standard message from Google, asking that users click a link to review recent suspicious activity on their Gmail accounts. Clicking on them would lead to a page that looked nearly identical to Gmail’s password reset page with a prompt to sign in. Unless they were looking closely at the URL in their address bar, there was very little to set off alarm bells.

From the moment those emails were opened, senior members in Clinton’s campaign were falling into a trap set by one of the most aggressive and notorious groups of hackers working on behalf of the Russian state. The same group would shortly target the Democratic National Committee (DNC) and Democratic Congressional Campaign Committee (DCCC). It was an orchestrated attack that — in the midst of one of the most surreal US presidential races in recent memory — sought to influence and sow chaos on Election Day.

The hack first came to light on June 15, when the Washington Post published a story based on a report by the CrowdStrike cybersecurity firm alleging that a group of Russian hackers had breached the email servers of the DNC. Countries have spied on one another’s online communications in the midst of an election season for as long as spies could be taught to use computers — but what happened next, the mass leaking of emails that sought to embarrass and ultimately derail a nominee for president, had no precedent in the United States. Thousands of emails — some embarrassing, others punishing were available for public perusal while the Republican nominee for president, Donald Trump, congratulated Russia on the hack and invited it to keep going to “find the 30,000 emails that are missing” from Clinton’s private email server. It was an attack that would edge the US and Russia closer to the brink of a cyberwar that has been simmering for the better part of a decade.

The group behind the hacks is known as Fancy Bear, or APT 28, or Tsar Team, or a dozen other names that have been given to them over the years by cybersecurity researchers. Despite being one of the most reported-on groups of hackers active on the internet today, there is very little researchers can say with absolute certainty. No one knows, for instance, how many hackers are working regularly within Fancy Bear, or how they organize their hacking squads. They don’t know if they are based in one city or scattered in various locations across Russia. They don’t even know what they call themselves.

The group is, according to a White House statement last week, receiving their orders from the highest echelons of the Russian government and their actions “are intended to interfere with the US election process.” For the cybersecurity companies and academic researchers who have followed Fancy Bear’s activities online for years, the hacking and subsequent leaking of Clinton’s emails, as well as those of the DNC and DCCC, were the most recent — and most ambitious — in a long series of cyber-espionage and disinformation campaigns. From its earliest-known activities, in the country of Georgia in 2009, to the hacking of the DNC and Clinton in 2016, Fancy Bear has quickly gained a reputation for its high-profile, political targets.

“Fancy Bear is Russia, or at least a branch of the Russian government, taking the gloves off,” said one official in the Department of Defense. “It’s unlike anything else we’ve seen, and so we are struggling with writing a new playbook to respond.” The official would speak only on condition of anonymity, as his office had been barred from discussing with the press the US response to Fancy Bear’s attacks. “If Fancy Bear were a kid in the playground, it would be the kid stealing all the juice out of your lunch box and then drinking it in front of you, daring you to let him get away with it.”

For a long time, they did get away with it. Fancy Bear’s earliest targets in Georgia, Ukraine, Poland, and Syria meant that few in the US were paying attention. But those attacks were where Fancy Bear honed their tactics — going after political targets and then using the embarrassing or strategic information to their advantage. It was in those earliest attacks, researchers say, that Fancy Bear learned to couple their talent for hacking with a disinformation campaign that would one day see them try to disrupt US elections.

“If Fancy Bear were a kid in the playground, it would be the kid stealing all the juice out of your lunch box and then drinking it in front of you, daring you to let him get away with it.”

In late July 2008, three weeks before Russia invaded Georgia in a show of force that altered the world’s perception of the Kremlin, a network of zombie computers was already gearing up for an attack against the Georgian government. Many of the earliest attacks were straightforward — the website of then-President Mikheil Saakashvili was overloaded with traffic, and a number of news agencies found their sites hacked. By Aug. 9, with the war underway, much of Georgia’s internet traffic, which routes through Russia and Turkey, was being blocked or diverted, and the president’s website had been defaced with images comparing him to Adolf Hitler.

 

Sophos Secruity

It was one of the earliest cases of cyberwarfare coinciding with a real-world physical war, and Fancy Bear, say researchers, was one of the groups behind it.

“When this group first sprung into action, we weren’t necessarily paying attention to the various Russian threat actors, inasmuch as we weren’t distinguishing them from each other,” said one former cybersecurity researcher, who has since left the private sector to work for the Pentagon. He said he could not be quoted on record due to his current job, but that in 2010, when he was still employed with a private company, they had only just started to distinguish Fancy Bear from the rest of the cyber operations being run by the Russian government.

Kurt Baumgartner, a researcher with the Moscow-based Kaspersky cybersecurity company, said the group had the types of financial and technical resources that only nation-states can afford. They would “burn through zero days” said Baumgartner, referring to rare, previously unknown bugs that can be exploited to hack into systems. The group used sophisticated malware, such as Sourface, a program discovered and named by the California-based FireEye cybersecurity company, which creeps onto a computer and downloads malware allowing that computer to be controlled remotely. Other programs attributed to Fancy Bear gave them the ability to wipe or create files, and to erase their footsteps behind them. FireEye researchers wrote that clues left behind, including metadata in the malware, show that the language settings are in Russian, that the malware itself was built during the workday in Moscow and St. Petersburg, and that IP addresses used in attacks could be traced back to Russian sources.

It wasn’t surprising to cybersecurity experts at that time that Russia would be at the forefront of a cyberattack on a nation-state. Along with China, the US, and Israel, Russia was considered to have one of the most sophisticated cyber-offensive capabilities in the world. While China appeared to have its offensive cyber teams largely organized within its military, the US under the NSA, and Israel under Unit 8200, much of Russia’s cyber operations remained obscure.

There are reports from inside Russia that have helped draw a better picture of Russia’s cyber ops. Russian investigative journalists, like Andrei Soldatov, author of The Red Web, have reported on how, following the dismantling of the KGB, Russia’s cyber operations were organized under the FSB, the KGB’s main successor agency. It was a unit operating under the FSB, for instance, that US intelligence officials believe was responsible for years-long cyber-espionage operations into the White House and State Department, discovered in the summer of 2015. At some point, Russia’s main foreign intelligence agency, the GRU, began its own cyber ops. Soldatov said it’s not clear exactly when that happened — though he says it was likely around the time of the war with Georgia — but Fancy Bear is the name given to the most notorious, and apparently prolific, group of hackers working under the GRU.

“Russia’s intelligence agency operates differently. You won’t see officers [in] uniform and hacking into infrastructure. They embed people in various infrastructure places, like ISPs, or power companies,” said Vitali Kremez, a cybercrime intelligence researcher with the Flashpoint cybersecurity firm. “To orchestrate the DNC hack wouldn’t require dozens of people, it would take two or three people, even one person, if he was talented enough. That person would have his orders for that part of the operation, and someone else, somewhere else, might have orders for a different part.”

For years, cybersecurity companies wrote up reports about Fancy Bear, often adding only in the postscript that the group they were talking about was working on behalf of Russia’s GRU. It wasn’t until last week that the US government officially named them as being tied to the highest echelons of Russia’s government.

“What first caught our attention about Fancy Bear was the targets it went after,” the Pentagon researcher said. “This was a group interested in high-stakes targets, and given who they were after — Georgia, Poland, Russian dissidents — it seemed obvious that a Russian government agency would be after those targets.”

In the years following Georgia, the targets that Fancy Bear went after grew in size, sophistication, and scope. One report, by Germany’s intelligence agency BfV, categorized the group as engaging in “hybrid warfare,” meaning a mix of conventional warfare and cyberwarfare. It gave the example of a Dec. 23, 2015, attack on Ukraine’s power grid that left more than 230,000 people without power, and said that Fancy Bear had also tried to lure German state organizations, including the Parliament and Angela Merkel’s CDU party, into installing malware on their systems that would have given the hackers direct access to German government systems. It’s unclear if anyone opened the emails that installed the malware.

The BfV report concluded that these “cyberattacks carried out by Russian secret services are part of multiyear international operations that are aimed at obtaining strategic information.” It was the first time a government had publicly named Fancy Bear as a Russian cyber operation. And there was one attack, on a French TV station, that cybersecurity researchers say was a precursor of things yet to come.

BuzzFeed News; Getty

It was just past 10 p.m. on April 8, 2015, when the French television network TV5Monde suddenly began to broadcast ISIS slogans, while its Facebook page started to post warnings: “Soldiers of France, stay away from the Islamic State! You have the chance to save your families, take advantage of it,” read one message. “The CyberCaliphate continues its cyberjihad against the enemies of Islamic State.”

The posts prompted headlines around the world declaring that the ISIS hacking division, known as the “cyber caliphate,” had successfully hacked into the French television network and taken over the broadcast.

It took nearly a month for cybersecurity companies investigating the attack to determine that it had, in actuality, been carried out by Fancy Bear. One of the companies, FireEye, told BuzzFeed News that they had traced the attack back to the group by looking at the IP addresses used to attack the station, and comparing them to IP addresses used in previous attacks carried out by Fancy Bear. The ISIS claims of responsibility planted on TV5Monde were just a disinformation campaign launched by the Russians to create public hysteria over the prospect of a terror group launching a cyberattack.

“Russia has a long history of using information operations to sow disinformation and discord, and to confuse the situation in a way that could benefit them,” Jen Weedon, a researcher at FireEye told BuzzFeed News following the attack. “In this case, it’s possible that the ISIS cyber caliphate could be a distraction. This could be a touch run to see if they could pull off a coordinated attack on a media outlet that resulted in stopping broadcasts, and stopping news dissemination.”

For nearly a month, headlines in France and across Europe had speculated about ISIS’ cyber capabilities and motives for the attack on TV5Monde. The stories setting the record straight, and reporting that a Russian group had, in fact, launched the attack, ran in a handful of newspapers for a day or two after the discovery.

At the same time, Fancy Bear was running other experiments, including a campaign to harass British journalist Eliot Higgins, and his citizen journalist website, Bellingcat. Higgins, who had published a number of articles documenting Russia’s alleged involvement in the shooting down of a Malaysian jetliner over Ukraine and the Russian shelling of military positions in eastern Ukraine, suddenly received an onslaught of spear-phishing emails. It wasn’t until this year, when Higgins saw a report by the ThreatConnect cybersecurity company on the DNC hacks that he realized that the emails targeting his site might have been similar to those targeting the DNC. He forwarded the spear-phishing emails to ThreatConnect, which confirmed that he, as well, had been targeted by Fancy Bear.

“I think it is possible that the things we were reporting on caught the eye of the hackers,” said Higgins. “More than anything it’s a badge of honor if they are going through so much effort to attack us. We must be getting something right.”

Russian media outlets, including Kremlin-owned Sputnik and Russia Today, have run articles suggesting that Bellingcat is linked to the CIA. The Bellingcat website has been defaced with personal photos of a contributor and his girlfriend.

“I think they are worried,” Higgins said. “So they are trying to discredit us.” He said it surprised him that the spear-phishing emails that targeted him and his campaign followed — almost to a formula — those sent to the DNC. The hackers didn’t bother to change the IP address, URL service, or fake Gmail message they used on either his website or the DNC. It was almost, he said, as if they didn’t mind being traced. “They have a government backing them that doesn’t care about taking down airliners, and bombing civilians in Syria so maybe they don’t care about being caught.”

Both Bellingcat and TV5Monde were, researchers now say, practice runs for Fancy Bear on the use of disinformation campaigns. People would remember a story about a ISIS-led cyberattack on France far more than a story pointing out that it was actually the Russians. Bellingcat’s work on exposing Russian operations would forever be linked, at least in the Russian media, to the accusations that they were CIA operatives. Fancy Bear was honing its skills.

The emails that Higgins, Clinton and the rest of the DNC received were variations of the millions of spear-phishing emails that go out each day. The success of those emails is predicated on the idea that everyone, no matter how savvy or suspicious, will eventually succumb to a spear-phishing attempt given enough time and effort by the attackers.

While Fancy Bear has used sophisticated — and expensive — malware during its operations, its first and most commonly used tactic has been a simple spear-phishing email, or a malicious email engineered to look like it was coming from a trusted source.

“These hacks almost always start with spear-phishing emails, because why would you start with something more complex when something so simple and easy to execute works?” said Anup Ghosh, CEO of the Invincea cybersecurity firm, which has studied the malware found on the DNC systems. “It is the easiest way to get malware onto a machine, just having the person click a link or open an executable file and they have opened the front door for you. Our analysis is on the malware itself, which had remote command and control capabilities. They essentially got the DNC to download malware which let them remotely control their computers.”

Once a spear-phishing email is clicked on, users not only give up their passwords but, in many cases, including in the case of the DNC, download malware onto their computers that gives the attackers instant access to their entire systems.

Cybersecurity experts report that 50% of people will click on a spear-phishing email. In the case of the Democratic Party, Fancy Bear’s success rate was about half of that — but good enough to get them into the accounts of some of the most senior members of the party.

From March 10, 2016, emails appearing to come from Google were sent to 108 members of Democratic presidential nominee Hillary Clinton’s campaign, and another 20 people from the Democratic National Convention (DNC), according to research published by the cybersecurity firm SecureWorks. They found the emails by tracing the malicious URLs set up by Fancy Bear using Bitly, the same service used to target Bellingcat. Fancy Bear had set the URL they sent out to read accounts-google.com, rather than the official Google URL, accounts.google.com. Dozens of people were fooled.

“They did a great job with capturing the look and feel of Google”

“We were monitoring bit.ly and saw the accounts being created in real time,” said Phil Burdette, a senior security researcher at SecureWorks, explaining how they stumbled upon the URLs set up by Fancy Bear. Bitly also keeps data on when a link is clicked, which allowed Burdette to determine that of the 108 email addresses targeted at the Clinton campaign, 20 people clicked on the links (at least four people clicked the link more than once). At the DNC, 16 email addresses were targeted, and 4 people clicked on them.

“They did a great job with capturing the look and feel of Google,” said Burdette, who added that unless a person was paying clear attention to the URL or noticed that the site was not HTTPS secure, they would likely not notice the difference.

Once Democratic Party officials entered their information into the fake Gmail page, Fancy Bear had access to not just their email accounts, but to the shared calendars, documents, and spreadsheets on their Google Drive. Among those targeted, said Burdette, were Clinton’s national political director, finance director, director of strategic communications, and press secretary. None of Clinton’s staff responded to repeated requests for comment from BuzzFeed News.

In their June 14 report, CrowdStrike found that not only was Fancy Bear in the DNC system, but that another group linked to Russia known as Cozy Bear, or APT 29, had also hacked into the DNC and was lurking in the system, collecting information. The report stated, “Both adversaries engage in extensive political and economic espionage for the benefit of the government of the Russian Federation and are believed to be closely linked to the Russian government’s powerful and highly capable intelligence services.”

The linked names, say the cybersecurity researchers who come up with them according to their own personal whims, are no coincidence. While both bears sought out intelligence targets and infiltrated government agencies across the world, their styles were distinct. Cozy Bear would go after targets en masse, spear-phishing an entire wing at the State Department or White House and then lurking quietly in the system for years. Fancy Bear, meanwhile, would be more specific in its targets, aggressively going after a single person by mining social media for details of their personal lives.

Both bears were in the DNC system, but whereas Cozy Bear might have been there for years, undetected in the background, CrowdStrike has said that it was Fancy Bear, with their more aggressive intelligence-gathering operation, that tipped off security teams that something was amiss. It was also Fancy Bear, cybersecurity researchers believe, who was behind the disinformation campaigns that made public the thousands of emails from the DNC and Clinton.

Making those emails public, say cybersecurity experts and US intelligence officials, is what shifted the hack from another Russian cyber-espionage operation to a game changer in the long-simmering US–Russia cyberwar. Using the well-established WikiLeaks platform, as well as newly invented figureheads, ensured that the leaked emails got maximum exposure. Within 24 hours of the CrowdStrike report, a Twitter account under the name @Guccifer_2 was established and began tweeting about the hack on the DNC. One of the first tweets claimed responsibility for hacking the DNC’s servers, and in subsequent private messages with journalists, including BuzzFeed News, the account claimed that it was run by a lone Romanian hacker, and that he alone had been responsible for hacking into the DNC servers and, later, the Clinton Foundation, as well as senior members of Clinton’s staff. The account offered to send BuzzFeed News emails from the hacks and appeared to make the same offer to several US publications, including Gawker and the Smoking Gun.

Julian Assange, founder of the online leaking platform WikiLeaks Steffi Loos / AFP / Getty Images

Within the week, WikiLeaks had published more than 19,000 DNC emails. Though WikiLeaks would not reveal the source, Guccifer 2.0 gleefully messaged journalists that he had been the source of the leak. Few bought the story — a language analysis on the Guccifer 2.0 account showed it made mistakes typical of Russian speakers, and when asked questions in Romanian by reporters in an online chat, Guccifer 2.0 appeared to not be able to answer. Meanwhile, metadata in the docs, such as Russian-language settings and software versions popular in Russia, led cybersecurity experts to believe that not only were the emails leaked by Russia, but that Guccifer 2.0 was an account created by the Russian state to try and deflect attention.

The same week, a site calling itself DCLeaks suddenly appeared, claiming it was run by “American hacktivists,” and began publishing hacked emails as well.

US intelligence agencies now believe that Guccifer 2.0 and DCLeaks were created by Fancy Bear, or a Russian organization working in conjunction with Fancy Bear, in order to disseminate the hacked emails and launch a disinformation campaign about their origin. WikiLeaks, whose founder Julian Assange has been dogged by his own accusations of close ties to Russia, has refused to state how he got the emails.

“We hope to be publishing every week for the next 10 weeks, we have on schedule, and it’s a very hard schedule, all the US election-related documents to come out before Nov. 8,” Assange said in a recent press conference.

Just weeks before Americans go to the polls, no one knows what material is yet to be published.


In a background briefing earlier this year, one US intelligence officer described cyberwar as “a war with no borders, no innocents, and no rules.” The officer, who has been working on US cyberpolicy for over a decade, said he didn’t think it was a question of if the US and Russia would one day be fighting a full-out cyberwar — it was a question of when.

“They’ve been dancing around each other like two hungry bears for a long time. At some point, one of them is going to take a bite,” said the officer. (His use of the word “bears” appeared to be coincidental.)

The White House’s naming of the Russian government as being behind the hacks attributed to Fancy Bear took the US and Russia into uncharted territory. While no one used the word cyberwar, the statement by the Department of Homeland Security and Director of National Intelligence did not mince words.

“The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations. The recent disclosures of alleged hacked e-mails on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent with the methods and motivations of Russian-directed efforts. These thefts and disclosures are intended to interfere with the US election process,” the statement read. “We believe, based on the scope and sensitivity of these efforts, that only Russia’s senior-most officials could have authorized these activities.”

Russian President Vladimir Putin has continued to deny Russia’s involvement in the hacks and said the leaked emails are a “public service.” In a televised address this week, Putin said the hacks were not in Russia’s interest.

Russian President Vladimir Putin Sputnik / Reuters

“There’s nothing in Russia’s interest here; the hysteria has been created only to distract the American people from the main point of what was revealed by hackers. And the main point is that public opinion was manipulated. But no one talks about this. Is it really important who did this? What is inside this information — that is what important,” Putin said.

The US is still “writing the playbook,” as one Department of Defense official put it, on what happens next, though sanctions, diplomatic action, and offensive cyberattacks are all being considered. Members of Congress have come forward, asking the White House to take aggressive action against Russia. The two countries are, undoubtedly, facing the lowest point in relations in decades.

Fancy Bear and other Russian hacking groups are still active. As countries in Europe — including France, the UK, and Germany — face upcoming elections, what is to stop Fancy Bear from engaging in the same type of hacking and disinformation campaigns?

“They did this to the United States — there is nothing to stop them from doing this to our allies in Europe,” said Jason Healey, former White House director of cyber infrastructure, and a senior research scholar at Columbia University’s School of International and Public Affairs. “We need to be working with our allies and sharing what we know so that this group doesn’t interfere with elections across Europe.”

Baumgartner, the researcher with Kaspersky, said he’s noticed big changes with Fancy Bear. They appear to be spreading out their operations and focus, he said.

“What used to be one focused and narrow group is now several subgroups,” he said. “They might be running independent of each other, or in parallel, but they seem to be spreading out operations.”

Higgins, who runs the Bellingcat website, said that after a lull of almost a year, he suddenly started getting spear-phishing emails again this week that look identical to the ones Fancy Bear hackers sent him last year.

“They’re sending them every day again,” said Higgins. “They are clearly not going to stop.”

CORRECTION

The Bellingcat website was defaced by photos of one of its contributors. The original version of this story stated that it was defaced with photos of its founder, Higgins.