Use of WikiLeaks

¶In order to expand its interference in the 2016 U.S. presidential election, the GRU units transferred many of the documents they stole from the DNC and the chairman of the Clinton Campaign to WikiLeaks. GRU officers used both the DCLeaks and Guccifer 2.0 personas to communicate with WikiLeaks through Twitter private messaging and through encrypted channels, including possibly through WikiLeaks's private communication system.

WikiLeaks's Expressed Opposition Toward the Clinton Campaign

¶WikiLeaks, and particularly its founder Julian Assange, privately expressed opposition to candidate Clinton well before the first release of stolen documents. In November 2015, Assange wrote to other members and associates of WikiLeaks that "[w]e believe it would be much better for GOP to win . . . Dems+Media+liberals woudl [sic] then form a block to reign in their worst qualities. . . . With Hillary in charge, GOP will be pushing for her worst qualities., dems+media+neoliberals will be mute. . . . She's a bright, well connected, sadisitic sociopath."¹⁵⁶¹⁵⁶ 11/19/15 Twitter Group Chat, Group ID 594242937858486276, @WikiLeaks et al. Assange also wrote that, "GOP will generate a lot oposition [sic], including through dumb moves. Hillary will do the same thing, but co-opt the liberal opposition and the GOP opposition. Hence hillary has greater freedom to start wars than the GOP and has the will to do so." Id.

¶In March 2016, WikiLeaks released a searchable archive of approximately 30,000 Clinton emails that had been obtained through FOIA litigation.¹⁵⁷¹⁵⁷ WikiLeaks, "Hillary Clinton Email Archive," available at https://wikileaks.org/clinton-emails/. While designing the archive, one WikiLeaks member explained the reason for building the archive to another associate:

[W]e want this repository to become "the place" to search for background on hillary's plotting at the state department during 2009-2013. . . . Firstly because its useful and will annoy Hillary, but secondly because we want to be seen to be a resource/player in the US election, because eit [sic] may en[]courage people to send us even more important leaks.¹⁵⁸¹⁵⁸ 3/14/16 Twitter DM, @WikiLeaks to [Redacted: (b) (6), (b) (7)(C)] Less than two weeks earlier, the same account had been used to send a private message opposing the idea of Clinton "in whitehouse with her bloodlutt and amitions [sic] of empire with hawkish liberal-interventionist appointees." 11/19/15 Twitter Group Chat, Group ID 594242937858486276, @WikiLeaks et al.

WikiLeaks's First Contact with Guccifer 2.0 and DCLeaks

¶Shortly after the GRU's first release of stolen documents through dcleaks.com in June 2016, GRU officers also used the DCLeaks persona to contact WikiLeaks about possible coordination in the future release of stolen emails. On June 14, 2016, @dcleaks_ sent a direct message to @WikiLeaks, noting, "You announced your organization was preparing to publish more Hillary's emails. We are ready to support you. We have some sensitive information too, in particular, her financial documents. Let's do it together. What do you think about publishing our info at the same moment? Thank you."¹⁵⁹¹⁵⁹ 6/14/16 Twitter DM, @dcleaks_ to @WikiLeaks. As discussed below, WikiLeaks appears to have responded later through different channels.

¶Around the same time, WikiLeaks initiated communications with the GRU persona Guccifer 2.0 shortly after it was used to release documents stolen from the DNC. On June 22, 2016, seven days after Guccifer 2.0's first releases of stolen DNC documents, WikiLeaks used Twitter's direct message function to contact the Guccifer 2.0 Twitter account and suggest that Guccifer 2.0 "[s]end any new material [stolen from the DNC] here for us to review and it will have a much higher impact than what you are doing."¹⁶⁰¹⁶⁰ Netyksho Indictment ¶ 47(a).

¶On July 6, 2016, WikiLeaks again contacted Guccifer 2.0 through Twitter's private messaging function, writing, "if you have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the DNC is approaching and she will solidify bernie supporters behind her after." The Guccifer 2.0 persona responded, "ok . . . i see." WikiLeaks also explained, "we think trump has only a 25% chance of winning against hillary . . . so conflict between bernie and hillary is interesting."¹⁶¹¹⁶¹ 7/6/16 Twitter DMs, @WikiLeaks & @guccifer_2.

The GRU's Transfer of Stolen Materials to WikiLeaks

¶Both the GRU and WikiLeaks sought to hide their communications, which has limited the

Office's ability to collect all of the communications between them. Thus, although it is clear that the stolen DNC and Podesta documents were transferred from the GRU to WikiLeaks,

¶The Office was able to identify when the GRU (operating through its personas Guccifer 2.0 and DCLeaks) transfened some of the stolen documents to WikiLeaks through online archives set up by the GRU. Assan e had access to the internet from the Ecuadorian Embass in London, En land.

¶On July 14, 2016, GRU officers used a Guccifer 2.0 email account to send WikiLeaks an email bearing the subject "big archive" and the message "a new attempt."¹⁶³¹⁶³ This was not the GRU's first attempt at t:ransfening data to WikiLeaks. On June 29, 2016, the GRU used a Guccifer 2.0 email account to send a lruj e enc ted file to a WikiLeaks email account. 6/29/16 Email, guccifer2@mail.com undelivered.) [Q>IQI@IQ> QI@_ 11 (The email appears to have been The email contained an encryp ted attachment with the name "wk dnc linkl.txt.gpg." 164 Using the Guccifer 2.0 Twitter account, GRU officers sent WikiLeaks an encryp ted file and instructions on how to open it. 165 On July 18, 2016, WikiLeaks confin ned in a direct message to the Guccifer 2.0 account that it had "the 1Gb or so archive" an d would make a release of the stolen documents "this week. " 166 On July 22, 2016, WikiLeaks released over 20,000 emails an d other documents stolen from the DNC computer networks. 167 The Democratic National Convention began three days later.

¶Similar collllllunications occuned between WikiLeaks and the GRU-operated persona DCLeaks. On September 15, 2016, @dcleaks wrote to @WikiLeaks, "hi there! I'm from DC Leaks. How could we discuss some submission-related issues? Am hying to reach out to you via your secured chat but getting no response. I've got something that might interest you. You won't be disappointed, I promise."¹⁶⁸¹⁶⁸ 9/ 15/ 16 Twitter DM, @dcleaks_ to @WikiLeaks. The WikiLeaks account responded, "Hi there," without fmi her elaboration. The @dcleaks_ account did not respond illllllediately.

¶The same day, the Twitter account @guccifer_2 sent @dcleaks_ a direct message, which is the first known contact between the personas.¹⁶⁹¹⁶⁹ 9/ 15/ 16 Twitter DM, @guccifer_2 to @dcleaks_. During subsequent communications, the

¶Guccifer 2.0 persona infon ned DCLeaks that WikiLeaks was tiying to contact DCLeaks and an ange for a way to speak through enc1ypted emails.¹⁷⁰¹⁷⁰ See SM-2589105-DCLEAKS, serial 28; 9/ 15/ 16 Twitter DM, @Guccifer_2 &@WikiLeaks.

¶An analysis of the metadata collected from the WikiLeaks site revealed that the stolen Podesta emails show a creation date of September 19, 2016.¹⁷¹¹⁷¹ See SM-2284941, serials 63 & 64 (analyzing metadata of stolen files on WikiLeaks site). e as the creation .e shown on the host . explain why the creation date on WikiLeaks's version of the files was still September 19, 2016. See SM- 2284941 , se1ial 62 [Redacted: (b) (7)(A), (b) (7)(E)] 2 Based on info1m ation about Assange's computer an d its possible operating system, this date may be when th e GRU staged the stolen Podesta emails for transfer to WikiLeaks (as the GRU had previously done in July 2016 for the DNC emails) .172 The WikiLeaks site also released PDFs an d other documents taken from Podesta that were attachments to emails in his account; these documents had a creation date of October 2, 2016, which appears to be the date the attachments were separately staged by WikiLeaks on its site.173

¶Beginning on September 20, 2016, WikiLeaks and DCLeaks resumed collllllunications in a brief exchange. On September 22, 2016, a DCLeaks em ail account dcleaksproject@gmail.com sent an email to a WikiLeaks account with the subject "Submission" and the message " Hi from DCLeaks." The email contained a PGP-enc1 ted m essage with the filename "wiki_mail.txt.gpg."¹⁷⁴¹⁷⁴ See 9/22/ 16 Email, dcleaksproject@gmail.com [Redacted: (b) (7)(A), (b) (7)(E)] The email, however, bears a number of similarities to t e Ju y 14, 2016 em a1 m w 1c GRU officers used the Guccifer 2.0 persona to give WikiLeaks access to the archive of DNC files. On September 22, 2016 (the same day of DCLeaks' email to WikiLeaks), the Twitter account @dcleaks_ sent a single message to @WikiLeaks with th e sti-ing of characters (":::::puyghbfr%78"' 543ij fd:::::") that appears to be a possible password; it is unknown if anoth er message or file was sent through a different communication system .

¶The Office cannot mle out that stolen documents were ti-ansfe1Ted to WikiLeaks through inte1mediaries who visited during the summer of 2016. For example, public repo1i ing identified Andi M .. 11 M hn WikiL ak . t h h . t d ·th th ti fi fth .

¶[Redacted: (b) (3), (b) (7)(A), (b) (7)(E)]

¶[Redacted: (b) (7)(A), (b) (7)(E)] (b)(J), [Redacted: (b) (7)(A)], (E)

{D) {;,s), {D) {/){A), {D) {/){t:) On October 7, 2016, WikiLeaks released the first emails stolen from the Podesta email account. In total, WikiLeaks released 33 trnnches of stolen emails between October 7, 2016 and November 7, 2016. The releases included private speeches given by Clinton ; 177 internal communications between Podesta and other high-ranking members of the Clinton Campaign; 178 and conespondence related to the Clinton Foundation. 179 In total, WikiLeaks released over 50,000 documents stolen from Podesta's personal email account. The last-in-time email released from Podesta 's account was dated March 21 , 2016, two days after Podesta received a spea1phishing email sent by the GRU.

WikiLeaks Statements Dissembling About the Source of Stolen Materials

As repo1t s attributing the DNC and DCCC hacks to the Russian government emerged, WikiLeaks and Assange m ade several public statements apparently designed to obscure the source of the materials that WikiLeaks was releasing . The file-transfer evidence described above and other infonnation uncovered during the investigation discredit WikiLeaks's claims about the source of m aterial that it posted.

Beginning in the summer of 2016, Assange and WikiLeaks made a number of statements about Seth Rich, a former DNC staff member who was killed in July 2016. The statements about Rich implied falsely that he had been the source of the stolen DNC emails. On August 9, 2016, the @WikiLeaks Twitter account posted: "ANNOUNCE: WikiLeaks has decided to issue a US$20k reward for infonnation leading to conviction for the murder ofDNC staffer Seth Rich." 180 Likewise, on August 25, 2016, Assange was asked in an interview, "Why are you so interested in Seth Rich's killer?" and responded, "We 're ve1y interested in anything that might be a threat to alleged Wikileaks sources." The interviewer responded to Assange's statement by commenting, " I know you don 't want to reveal your source, but it ce1tainly sounds like you ' re suggesting a man who leaked info1mation to WikiLeaks was then murdered." Assange replied, "If there 's someone who's potentially connected to our publication, and that person has been murdered in suspicious

Netyksho Indictment ,r 43. @WikiLeaks 8/9/16 Tweet.

¶circumstan ces, it doesn't necessarily mean that the two are connected. But it is a ve1y serious matter. ..that type of allegation is ve1y serious, as it's taken ve1y seriously by us ." 181

¶After the U.S. intelligence collllllunity publicly announced its assessment that Russia was behind the hacking operation, Assange continued to deny that the Clinton materials released by WikiLeaks had come from Russian hacking. According to media reports, Assange told a U.S. congressman that the DNC hack was an "inside job," and pmpo1i ed to have ''physical proof' that Russians did not give materials to Assange. 182

Additional GRU Cyber Operations

¶While releasing the stolen emails and documents through DCLeaks, Guccifer 2.0, and WikiLeaks, GRU officers continued to target and hack victims linked to the Democratic campaign and, eventually, to target entities responsible for election administration in several states.

Summer and Fall 2016 Operations Targeting Democrat-Linked Victims

¶On July 27, 2016, Unit 26165 targeted email accounts connected to candidate Clinton 's personal office Earlier that day, candidate Tnunp made public statements that included the following: "Russia, if you ' re listening, I hope you're able to find the 30,000 emails (b)(~)1C that are missing. I think you will probably be rewarded 1nightily by om press."¹⁸³¹⁸³ "Donald Tnnnp on Russian & Missing Hillruy Clinton Emails," YouTube Channel C-SPAN, Posted 7/27/16, available at https://www.youtube.com/watch?v=3kxG8uJUsWU (struting at 0:41). The "30,000 (b)( )( )-4 emails" were apparently a reference to emails described in media accounts as having been stored on a personal server that candidate Clinton had used while serving as Secretaiy of State.

¶Within approximately five hom s ofTrnmp's statement, GRU officers targeted for the first time Clinton 's personal office. After candidate Trnmp 's remai·ks Unit 26165 created and sent malicious link~ tai·get~g 15 ~mail accounts at the ?oma~ account belongmg to Clmton aide

\WJflJPf!I mcl~ding an em~il The mveshgat1on 1 not m d evidence of eai·her

¶GRU attempts to compromise accmmts hosted on this dom ain. It is uncleai· how the GRU was able to identify these email accounts, which were not public. 184

Unit 26165 officers also hacked into a DNC account hosted on a cloud-computing service On September 20, 2016, the GRU began to generate function designed to allow users to produce backups of

¶databases (refene as "snaps ots") . The GRU then stole those snapshots by moving th em to - account that th ey controlled; from there, th e copies were moved to GRU-controlled computers. The GRU stole approximately 300 gigabytes of data from the DNC cloud- based account. 185