How Israel Caught Russian Hackers Scouring the World for U.S. Secrets

The Israeli officials who had hacked into Kaspersky’s own network alerted the United States to the broad Russian intrusion, which has not been previously reported, leading to a decision just last month to order Kaspersky software removed from government computers.

.. More than 60 percent, or $374 million, of the company’s $633 million in annual sales come from customers in the United States and Western Europe.

.. “Antivirus is the ultimate back door,” Blake Darché, a former N.S.A. operator and co-founder of Area 1 Security. “It provides consistent, reliable and remote access that can be used for any purpose, from launching a destructive attack to conducting espionage on thousands or even millions of users.”

.. Kaspersky reported that its attackers had used the same algorithm and some of the same code as Duqu, but noted that in many ways it was even more sophisticated. So the company researchers named the new attack Duqu 2.0, noting that other victims of the attack were prime Israeli targets.

.. Kaspersky uncovered were hotels and conference venues used for closed-door meetings by members of the United Nations Security Council to negotiate the terms of the Iran nuclear deal — negotiations from which Israel was excluded.

.. Kaspersky noted that its attackers seemed primarily interested in the company’s work on nation-state attacks, particularly Kaspersky’s work on the “Equation Group” — its private industry term for the N.S.A. — and the “Regin” campaign, another industry term for a hacking unit inside the United Kingdom’s intelligence agency

.. It is not clear whether, or to what degree, Eugene V. Kaspersky, the founder of Kaspersky Lab, and other company employees have been complicit in the hacking using their products.

.. Mr. Kaspersky, who attended an intelligence institute and served in Russia’s Ministry of Defense, would have few illusions about the cost of refusing a Kremlin request.

James Comey Is Maxwell Smart

How Comey’s botched mission to safeguard a Hillary presidency elected Trump.

It’s far more likely that Mr. Comey conceived of his intervention as a counterintelligence operation. Hillary would win. Russia’s fake email about Ms. Lynch conspiring to prevent a Hillary indictment would become public and be used by Trump partisans and America’s adversaries to discredit her victory. Therefore he would neutralize this Russian threat by clearing Mrs. Clinton himself. In doing so, it now appears he accidentally secured Mr. Trump’s win.

Free yourself from any hindsight bias. All actors at the time were convinced Hillary would win; for U.S. officials, the urgency was to protect Mrs. Clinton’s inevitable presidency from Russian dirty tricks.

.. Mr. McAuliffe, in last month’s podcast, opined flatly that Russia also expected Mrs. Clinton to win and wanted to destabilize her presidency.

Mr. Comey himself, in public testimony, gave mumbly assent to the “intelligence community’s” now-claim that Russia wasn’t just trying to weaken Mrs. Clinton but elect Donald Trump, arguing that in a two-person race, hurting one necessarily helps the other.

Such sophistries aside, this is implausible. Against all polling, Russia would not have thought trying to elect Mr. Trump a good investment. In effect, this claim about Russian motives is another counterintelligence operation by our own intelligence community to distract from its botched counterintelligence operation that elected Mr. Trump.

To be clear, we’re not talking about a conspiracy exactly, but about intelligence leaders adjusting their statements and emphases on the fly to pretty up an embarrassing picture.

.. Hillary and her surrogates tirelessly flogged an apparent Trump-Putin affinity to her advantage. Mrs. Clinton’s mistake was devoting too many of her resources to the wrong states.

..  It’s useful to recall that what the FBI handed over to Special Counsel Robert Mueller was a “counterintelligence investigation”—an inquiry into the facts of Russia’s meddling, not a criminal investigation seeking something, anything to pin on Donald Trump.

If Mr. Mueller does not see the importance of coming clean on the Comey intervention (whether or not he wants to acknowledge that the Comey intervention may have elected Mr. Trump), then Mr. Mueller is part of the stonewall.

Mueller’s Investigation Must Be Limited and Accountable

To speak in terms of collusion rather than conspiracy—as the Russia investigation coverage often does—only confuses matters. Contrary to what you may have heard from sundry “strategists” and “analysts,” collusion is neither a crime nor a term that has a legally consequential meaning. The word has a pejorative feel, especially in the last seven months. But literally, all it means is “concerted activity.” That could be criminal or noncriminal, sinister or benign.

Thus, if we insist on asking about “collusion” in the context of a criminal investigation, we’re really asking two questions: was there any concerted activity between two or more people, and, if yes, what was the precise nature of the activity—i.e., collusion in what?

That is where we are at with respect to the Trump Tower meeting. In light of the Donald Trump, Jr. emails and the meeting that followed them, it makes little sense to me to claim there was no “concerted activity.” Yet, the “in what?” question remains vital.

.. Since there is now indisputable proof of some kind of concerted activity between Trump campaign staff and potential Russian operatives, it is worth focusing investigative attention on the exact purpose of that activity and the nature of the relationship.

.. Nevertheless, a counterintelligence investigation is the wrong vehicle for such an inquiry. It is not designed to investigate wrongdoing. Its purpose is to collect intelligence in order to understand a foreign power’s designs and to predict its behavior. It is forward-looking, whereas criminal investigations are retrospective. It seeks to assess, not to prove. As such, there are no natural limitations on the investigator’s warrant; it is completely open-ended.

.. It is fair to observe that there was more interaction between Donald Trump’s campaign and the Russian regime (including Putin’s oligarch cronies) than the president and his subordinates acknowledged. Even if that interaction is unrelated to Russia’s cyber-espionage, the nature and extent of the relationship merits investigation.

But an investigation of a president necessarily compromises an administration’s capacity to govern. That can harm the country. Therefore, the investigation must have parameters.

.. The applicable regulations make it incumbent on the Justice Department to specify what exactly a special counsel is authorized to investigate. The Justice Department has failed to do this, a dereliction that must be rectified. Complying with this requirement would not prevent special counsel Mueller from seeking an expansion of his jurisdiction were he to discover behavior that warrants additional investigation. But limits must be imposed.

If they are not, there is no telling where the probe will wander, how long it will take, and how paralyzing it will be. And that does not serve the country well.

Trump Jr.’s Russia meeting sure sounds like a Russian intelligence operation

Russian lawyer Natalia Veselnitskaya fits the profile of someone who might serve as a “cut-out” or “access agent” sent to assess and test a high-priority target’s interest in cooperation

.. But everything we know about the meeting — from whom it involved to how it was set up to how it unfolded — is in line with what intelligence analysts would expect an overture in a Russian influence operation to look like. It bears all the hallmarks of a professionally planned, carefully orchestrated intelligence soft pitch designed to gauge receptivity, while leaving room for plausible deniability in case the approach is rejected. And the Trump campaign’s willingness to take the meeting — and, more important, its failure to report the episode to U.S. authorities — may have been exactly the green light Russia was looking for to launch a more aggressive phase of intervention in the U.S. election.

.. My read, as someone who has been part of the U.S. intelligence community for more than four decades, is that Veselnitskaya is probably too well-connected to have independently initiated such a high-level and sensitive encounter. If she had, her use of known Trump and Kremlin associates (Aras and Emin Agalarov) to help make introductions and the suggestion, in Goldstone’s account, that she wanted to share “official documents and information” as “part of Russia and its government’s support” for Trump could have gotten her into significant trouble.

.. A better explanation is that Veselnitskaya is far enough removed from Moscow’s halls of power to make her a good fit as an intermediary in an intelligence operation — as a “cut-out” with limited knowledge of the larger scheme and as an “access agent” sent to assess and test a high-priority target’s interest in cooperation.

.. Trump Jr.’s assertion that Veselnitskaya didn’t deliver the promised dirt in that meeting is also consistent with how Russian intelligence operates.

.. Russia would have wanted to feel out the campaign before sharing its most prized material. Intelligence officers prefer to dip their toes in the water before taking a plunge. And it’s too risky to attempt a blunt approach to an extremely sensitive target (such as the son of the Republican front-runner for president), especially on hostile (in this case, American) soil.

.. Formalizing a relationship with the Trump campaign would be left for another day. If and when that day came, the pitch would be carried out by an experienced intelligence officer in favorable circumstances, with the right Trump associate and on friendly turf.

.. standard Russian intelligence practice would require making clear what was on offer. The point is to test the target. Are they open to entering into a compromising relationship? Will they rebuff the mere suggestion of such impropriety? Will they alert authorities and thus stand in the way of Russian efforts?

.. the deal should have been obvious to everyone. Moscow intended to discredit Clinton and help get Trump elected, and in exchange it hoped the Republican would consider its interests — in sanctions relief and otherwise. The Russian government appears to have signaled its direct involvement and real intention in advance of the meeting, presumably to avoid the possibility that its offer might be misconstrued, perhaps naively, as an innocent gesture of support and nothing more.

.. From the Russian perspective, the fact that Trump Jr. agreed to the meeting would have been the first promising sign. That veteran political operative Paul Manafort and senior adviser Jared Kushner showed up with him would have furthered the impression that there was strong interest in Russian assistance (and vulnerability to compromise) on the part of the campaign. But, according to standard espionage tradecraft, the most notable achievement of this encounter lay in the campaign’s failure to report it to the appropriate U.S. authorities

.. the Steele dossier suggests that the Kremlin was trying to cultivate the Trumps as far back as 2011.

.. And it would have allowed Russian intelligence to be comfortable initiating the next phase of its operation — systematically leaking information on Clinton and trying to penetrate the U.S. voting process — with the knowledge that the Trump campaign was interested in such Russian government assistance.

.. Although the Kremlin could have meddled without active or tacit approval from the campaign, having the campaign on board would have made the meddling more effective. For example, Russia could be sure that its actions would fit with Trump campaign strategy. Even Trump Jr.’s initial thought to drop the Clinton information later in the summer would be valuable for the Kremlin to know in terms of best timing.

.. Russia also would have wanted an implicit if not explicit agreement that intelligence assistance would be rewarded by a grateful Trump administration willing to relieve sanctions and embark on a more constructive relationship.

.. And after Russia’s overtures to the Trump campaign and the Trump campaign’s public denials that it had ever interacted with Russians, Vladi­mir Putin may have had the kompromat he needed to indirectly influence the Republican Party (such as the GOP platform on Ukraine) and Trump if he made it to the White House. The worst outcome would be that Trump would lose the election and, as a billionaire with global interests, still be a very useful ally for Putin.

.. Had this Russian overture been rejected or promptly reported by the Trump campaign to U.S. authorities, Russian intelligence would have been forced to recalculate the risk vs. gain of continuing its aggressive operation to influence U.S. domestic politics. Russian meddling might have been compromised in its early stages and stopped in its tracks by U.S. intelligence and law enforcement agencies before it reached fruition by the late fall.

So the suggestion that this was a nothing meeting without consequence is, in all likelihood, badly mistaken.