The Perfect Weapon

by David E. Sanger

  “minimally talented spoiled brat”: These details appeared in a story written with my colleague Martin Fackler, who conducted some of the interviews with defectors in Seoul. “N.S.A. Breached North Korean Networks Before Sony Attack, Officials Say,” New York Times, January 19, 2015, www.nytimes.com/2015/01/19/world/asia/nsa-tapped-into-north-korean-networks-before-sony-attack-officials-say.html.

  “Sony Pictures will be bombarded as a whole”: Michael Cieply and Brooks Barnes, “Sony Cyberattack, First a Nuisance, Swiftly Grew into a Firestorm,” New York Times, December 31, 2014, www.nytimes.com/2014/12/31/business/media/sony-attack-first-a-nuisance-swiftly-grew-into-a-firestorm-.html.

  emails from Seth Rogen to studio executive: Martin Fackler, Brooks Barnes, and David E. Sanger, “Sony’s International Incident: Making Kim Jong-un’s Head Explode,” New York Times, December 15, 2014, www.nytimes.com/2014/12/15/world/sonys-international-incident-making-kims-head-explode.html.

  “cyber vandalism”: Eric Bradner, “Obama: North Korea’s Hack Not War, but ‘Cybervandalism,’ ” CNN, December 24, 2014, www.cnn.com/2014/12/21/politics/obama-north-koreas-hack-not-war-but-cyber-vandalism/index.html.

  “the world will see what an awful movie”: Andrea Peterson, “Sony Pictures Hackers Invoke 9/11 While Threatening Theaters That Show ‘The Interview,’ ” Washington Post, December 16, 2014, www.washingtonpost.com/news/the-switch/wp/2014/12/16/sony-pictures-hackers-invoke-911-while-threatening-theaters-that-show-the-interview/?utm_term=.b1ead7061843.

  took the unprecedented step of blaming North Korea: David E. Sanger, Michael S. Schmidt, and Nicole Perlroth, “Obama Vows a Response to Cyberattack on Sony,” New York Times, December 20, 2014, www.nytimes.com/2014/12/20/world/fbi-accuses-north-korean-government-in-cyberattack-on-sony-pictures.html.

  North Koreans had not expected the United States to conclude so quickly: Lewis laid out this argument in greater length in “North Korea and Cyber Catastrophe—Don’t Hold Your Breath,” 38 North, January 12, 2018, www.38north.org/2018/01/jalewis011218/.

  presented a new cyber strategy at Stanford: “Remarks by Secretary Carter at the Drell Lecture Cemex Auditorium,” US Department of Defense, April 23, 2015, www.defense.gov/News/Transcripts/Transcript-View/Article/607043/remarks-by-secretary-carter-at-the-drell-lecture-cemex-auditorium-stanford-grad/.

  the White House announced some weak economic sanctions: Choe Sang-Hun, “North Korea Offers U.S. Deal to Halt Nuclear Test,” New York Times, January 11, 2015, www.nytimes.com/2015/01/11/world/asia/north-korea-offers-us-deal-to-halt-nuclear-test-.html.

  CHAPTER VII: PUTIN’S PETRI DISH

  relying on the advice and services of Paul Manafort: Two years later, Manafort reemerged as chairman of Trump’s 2016 campaign—and my one in-person encounter with him came when Maggie Haberman and I interviewed Trump at the Republican National Convention. After greeting us in Trump’s hotel room, Manafort left before the inevitable Russia questions began.

  Putin’s cyber army went to work: Mark Clayton, “Ukraine Election Narrowly Avoided ‘Wanton Destruction’ from Hackers,” Christian Science Monitor, June 17, 2014, www.csmonitor.com/World/Passcode/2014/0617/Ukraine-election-narrowly-avoided-wanton-destruction-from-hackers.

  announced the phony results: Farangis Najibullah, “Russian TV Announces Right Sector Leader Led Ukraine Polls,” RadioFreeEurope/RadioLiberty, May 26, 2014, www.rferl.org/a/russian-tv-announces-right-sector-leader-yarosh-led-ukraine-polls/25398882.html.

  The strategy was hardly a state secret: “The Value of Science in Anticipating,” Military-Industrial Courier [in Russian], February 26, 2013, www.vpk-news.ru/articles/14632.

  “What’s new is not the basic model”: Joseph S. Nye Jr., “How Sharp Power Threatens Soft Power,” Foreign Affairs, January 24, 2018, www.foreignaffairs.com/articles/china/2018-01-24/how-sharp-power-threatens-soft-power.

  There were many critiques of the Gerasimov doctrine: A good example of such a critique is Michael Kofman and Matthew Rojansky, “A Closer Look at Russia’s ‘Hybrid War,’ ” Kennan Cable 7, The Wilson Center, April 2015, www.wilsoncenter.org/sites/default/files/7-KENNAN%20CABLE-ROJANSKY%20KOFMAN.pdf.

  We own you.: Some of this chapter draws on a paper I wrote for the Aspen Strategy Group. See David E. Sanger, “Short of War: Cyber Conflict and the Corrosion of the International Order,” in The World Turned Upside Down: Maintaining American Leadership in a Dangerous Age, Aspen Strategy Group, 2017.

  handed it over to the Ukrainians: Ivo H. Daalder, “Responding to Russia’s Resurgence: Not Quiet on the Eastern Front,” Foreign Affairs 96, November/December 2017, 30–38.

  Putin sought to boost the legitimacy of his actions: David Adesnik, “How Russia Rigged the Crimean Referendum,” Forbes, March 18, 2014, www.forbes.com/sites/davidadesnik/2014/03/18/how-russia-rigged-crimean-referendum/#774963966d41.

  the United States was oddly passive: Jeffrey Goldberg, “The Obama Doctrine,” The Atlantic, April 2016, www.theatlantic.com/magazine/archive/2016/04/the-obama-doctrine/471525.

  He did it in typical Trumpian style: “Transcript: Donald Trump Expounds on His Foreign Policy Views,” New York Times, March 27, 2016, www.nytimes.com/2016/03/27/us/politics/donald-trump-transcript.html.

  “Cyber Pearl Harbor”: Elisabeth Bumiller and Thom Shanker, “Panetta Warns of Dire Threat of Cyberattack on U.S,” New York Times, October 12, 2012, www.nytimes.com/2012/10/12/world/panetta-warns-of-dire-threat-of-cyberattack.html.

  anything that went wrong: Emily O. Goldman and Michael Warner, “Why a Digital Pearl Harbor Makes Sense…and Is Possible,” in George Perkovich and Ariel E. Levite, eds., Understanding Cyber Conflict: 14 Analogies (Washington, DC: Georgetown University Press, 2017), 147–61.

  already inside the American electric grid: Nicole Perlroth and David E. Sanger, “Cyberattacks Put Russian Fingers on the Switch at Power Plants, U.S. Says,” New York Times, March 16, 2018, www.nytimes.com/2018/03/15/us/politics/russia-cyberattacks.html.

  that distinction may mean little: Martin C. Libicki, Cyberspace in Peace and War (Annapolis, MD: Naval Institute Press, 2016), 288.

  turned out the lights for only 225,000 customers: Robert M. Lee, Michael J. Assante, and Tim Conway, “Analysis of the Cyber Attack on the Ukrainian Power Grid,” SANS ICS and the Electricity Information Sharing and Analysis Center, March 18, 2016, ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf.

  “the outages were caused by the use of the control systems”: Ibid., 3.

  government had been hit by 6,500 cyberattacks: “Ukraine Power Cut ‘Was Cyber-attack,’ ” BBC News, January 11, 2017, www.bbc.com/news/technology-38573074.

  Andy Greenberg of Wired wrote: Andy Greenberg, “How an Entire Nation Became Russia’s Test Lab for Cyberwar,” Wired, June 20, 2017, www.wired.com/story/russian-hackers-attack-ukraine/.

  CHAPTER VIII: THE FUMBLE

  “I cannot forecast to you the action of Russia”: Alan Cowell, “Churchill’s Definition of Russia Still Rings True,” New York Times, August 1, 2008, www.nytimes.com/2008/08/01/world/europe/01iht-letter.1.14939466.html.

  suspicious Russian intrusion into the computer networks: Eric Lipton, David E. Sanger, and Scott Shane, “The Perfect Weapon: How Russian Cyberpower Invaded the U.S.,” New York Times, December 14, 2016, www.nytimes.com/2016/12/13/us/politics/russia-hack-election-dnc.html.

  Golos, the only independent election monitoring group: “ ‘Hacking Attacks’ Hit Russian Political Sites,” BBC News, BBC, March 8, 2012, www.bbc.com/news/technology-16032402.

  “She set the tone for some actors in our country”: David M. Herszenhorn and Ellen Barry, “Putin Contends Clinton Incited Unrest over Vote,” New York Times, December 9, 2011, www.nytimes.com/2011/12/09/world/europe/putin-accuses-clinton-of-instigating-russian-protests.html?mcubz=2.

  The United States did not exactly have clean hands: Two informa
tive sources on this history are Evan Osnos, David Remnick, and Joshua Yaffa, “Trump, Putin, and the New Cold War,” New Yorker, March 6, 2017, www.newyorker.com/magazine/2017/03/06/trump-putin-and-the-new-cold-war; and Calder Walton, “ ‘Active Measures’: A History of Russian Interference in US Elections,” Prospect, December 23, 2016, www.prospectmagazine.co.uk/science-and-technology/active-measures-a-history-of-russian-interference-in-us-elections.

  Putin’s moral equivalence: As Jackson Diehl of the Washington Post would later suggest of the 2016 US election: “Putin developed an obsession with ‘color revolutions,’ which he is convinced are neither spontaneous nor locally organized, but orchestrated by the United States…Putin is trying to deliver to the American political elite what he believes is a dose of its own medicine. He is attempting to ignite—with the help, unwitting or otherwise, of Donald Trump—a U.S. color revolution.” See “Putin’s Hope to Ignite a Eurasia-Style Protest in the United States,” October 16, 2016, www.washingtonpost.com/opinions/global-opinions/putins-hope-to-ignite-a-eurasia-style-protest-in-the-united-states/2016/10/16/0f271a60-90a4-11e6-9c85-ac42097b8cc0_story.html?utm_term=.f8bb8e047e48.

  in the bad old days: Scott Shane, “Russia Isn’t the Only One Meddling in Elections. We Do It, Too,” New York Times, February 18, 2018, www.nytimes.com/2018/02/17/sunday-review/russia-isnt-the-only-one-meddling-in-elections-we-do-it-too.html.

  Patient Zero: Susan B. Glasser, “Victoria Nuland: The Full Transcript,” Politico, February 5, 2018, www.politico.com/magazine/story/2018/02/05/victoria-nuland-the-full-transcript-216936.

  the audio, edited, suddenly appeared on YouTube: “US Blames Russia for Leak of Undiplomatic Language from Top Official,” Guardian, February 6, 2014, www.theguardian.com/world/2014/feb/06/us-russia-eu-victoria-nuland.

  the man who would work to alter the 2016 election: Neil MacFarquhar, “Yevgeny Prigozhin, Russian Oligarch Indicted by U.S., Is Known as ‘Putin’s Cook,’ ” New York Times, February 17, 2018, www.nytimes.com/2018/02/16/world/europe/prigozhin-russia-indictment-mueller.html.

  social media could just as easily incite disagreements: Adrian Chen, “The Real Paranoia-Inducing Purpose of Russian Hacks,” New Yorker, July 27, 2016, www.newyorker.com/news/news-desk/the-real-paranoia-inducing-purpose-of-russian-hacks.

  rose pretty fast: “United States of America v. Internet Research Agency,” indictment of the 13 Internet Research Agency members, filed by Special Counsel Robert Mueller, February 16, 2018, www.justice.gov/file/1035477/download.

  took the propaganda battle to the enemy’s territory: Adrian Chen, “The Agency,” New York Times, June 7, 2015, www.nytimes.com/2015/06/07/magazine/the-agency.html.

  learned to “troll” critics of Putin and journalists: Alexis C. Madrigal, “Russia’s Troll Operation Was Not That Sophisticated,” The Atlantic, February 19, 2018, www.theatlantic.com/technology/archive/2018/02/the-russian-conspiracy-to-commit-audience-development/553685.

  Then they moved on to advertising: Scott Shane, “The Fake Americans Russia Created to Influence the Election,” New York Times, September 8, 2017, www.nytimes.com/2017/09/07/us/politics/russia-facebook-twitter-election.html.

  Putin’s trolls posed as Americans: April Glaser, “What We Know About How Russia’s Internet Research Agency Meddled in the 2016 Election,” Slate, February 16, 2018, slate.com/technology/2018/02/what-we-know-about-the-internet-research-agency-and-how-it-meddled-in-the-2016-election.html.

  Ryan Lizza’s reporting in the New Yorker: Ryan Lizza, “How Trump Helps Russian Trolls,” New Yorker, November 2, 2017, www.newyorker.com/news/our-columnists/how-trump-helps-russian-trolls.

  The agency dispatched two of their experts: Ivan Nechepurenko and Michael Schwirtz, “The Troll Farm: What We Know About 13 Russians Indicted by the U.S.,” New York Times, February 17, 2018, www.nytimes.com/2018/02/17/world/europe/russians-indicted-mueller.html.

  the trolls tested out a new tactic: Editorial Staff, “How the ‘Troll Factory’ Worked in the US Elections,” RBC (in Russian), October 17, 2017, www.rbc.ru/magazine/2017/11/59e0c17d9a79470e05a9e6c1.

  The magazine reported: Hannah Levintova, “Russian Journalists Just Published a Bombshell Investigation About a Kremlin-Linked ‘Troll Factory,’ ” Mother Jones, October 18, 2017, www.motherjones.com/politics/2017/10/russian-journalists-just-published-a-bombshell-investigation-about-a-kremlin-linked-troll-factory.

  Kevin Mandia and his firm’s: Relevant reports by Fireye, Mandia’s firm, viewable at www.fireeye.com/content/dam/fireeye-www/solutions/pdfs/st-senate-intel-committee-russia-election.pdfl and www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html.

  their White House tour: Michael S. Schmidt and David E. Sanger, “Russian Hackers Read Obama’s Unclassified Emails, Officials Say,” New York Times, April 26, 2015, www.nytimes.com/2015/04/26/us/russian-hackers-read-obamas-unclassified-emails-officials-say.html.

  “hand-­to-­hand combat”: Joseph Marks, “NSA Engaged in Massive Battle with Russian Hackers in 2014,” Nextgov, April 3, 2017, www.nextgov.com/cybersecurity/2017/04/nsa-engaged-massive-battle-russian-hackers-2014/136683/.

  Tamene and his colleagues had met the FBI: Eric Lipton, David E. Sanger, and Scott Shane, “The Perfect Weapon: How Russian Cyberpower Invaded the U.S.”

  CHAPTER IX: WARNING FROM THE COTSWOLDS

  The Doughnut’s design was very Silicon Valley: In one of those great transcontinental reversals, the Doughnut helped inspire Apple’s design for its own headquarters, a bit more than five thousand miles away.

  the “Five Eyes”: For a good discussion of Five Eyes, see Levi Maxey, “Five Eyes Intel Sharing Unhindered by Trump Tweets,” The Cipher Brief, February 20, 2018, www.thecipherbrief.com/five-eyes-intel-sharing-unhindered-trump-tweets.

  “summer project for Menwith”: The best description of this operation appeared in the British newspaper The Guardian, which also published many of the Snowden papers. See Ewen MacAskill, Julian Borger, Nick Hopkins, Nick Davies, and James Ball, “GCHQ Taps Fibre-Optic Cables for Secret Access to World’s Communications,” June 21, 2013, www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa.

  they worked twelve-hour shifts: Neil MacFarquhar, “Inside the Russian Troll Factory: Zombies and a Breakneck Pace,” New York Times, February 19, 2018, www.nytimes.com/2018/02/18/world/europe/russia-troll-factory.html.

  had been hacked by not one Russian intelligence group but two: Dmitri Alperovitch, “Bears in the Midst: Intrusion into the Democratic National Committee,” CrowdStrike, June 15, 2016, www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/.

  And both had left plenty of fingerprints: Eric Lipton, David E. Sanger, and Scott Shane, “The Perfect Weapon: How Russian Cyberpower Invaded the U.S.”

  The day after the Post and the Times ran their stories: Ellen Nakashima, “Russian Government Hackers Penetrated DNC, Stole Opposition Research on Trump,” Washington Post, June 15, 2016, www.washingtonpost.com/world/national-security/russian-government-hackers-penetrated-dnc-stole-opposition-research-on-trump/2016/06/14/cf006cb4-316e-11e6-8ff7-7b6c1998b7a0_story.html?; David E. Sanger and Nick Corasaniti, “D.N.C. Says Russian Hackers Penetrated Its Files, Including Dossier on Donald Trump,” New York Times, June 14, 2016, www.nytimes.com/2016/06/15/us/politics/russian-hackers-dnc-trump.html.

  A persona with the screen name Guccifer 2.0: Rob Price, “RESEARCHERS: Yes, Russia Really Did Hack the Democratic National Congress,” Business Insider Australia, June 21, 2016, www.businessinsider.com.au/security-researchers-russian-spies-hacked-dnc-guccifer-2-possible-disinformation-campaign-2016-6.

  said he was Romanian: Lorenzo Franceschi-Bicchierai, “Alleged Russian Hacker ‘Guccifer 2.0’ Is Back After Months Of Silence,” Vice, January 12, 2017, motherboard.vice.com/en_us/article/9a3m7p/alleged-russian-hacker-guccifer-20-i
s-back-after-months-of-silence. The transcript of Lorenzo’s interview with Guccifer 2.0 is viewable at motherboard.vice.com/en_us/article/yp3bbv/dnc-hacker-guccifer-20-full-interview-transcript.

  our second foreign-policy interview with Trump: “Transcript: Donald Trump Expounds on His Foreign Policy Views,” New York Times, March 26, 2016, www.nytimes.com/2016/03/27/us/politics/donald-trump-transcript.html.

  Nicole Perlroth and I wrote: David E. Sanger and Nicole Perlroth, “As Democrats Gather, a Russian Subplot Raises Intrigue,” New York Times, July 25, 2016, www.nytimes.com/2016/07/25/us/politics/donald-trump-russia-emails.html.

  CHAPTER X: THE SLOW AWAKENING

  “hallmark of our democracy”: “Obama’s Last News Conference: Full Transcript and Video,” New York Times, January 18, 2017, www.nytimes.com/2017/01/18/us/politics/obama-final-press-conference.html.

  “high confidence”: David E. Sanger and Scott Shane, “Russian Hackers Acted to Aid Trump in Election, U.S. Says,” New York Times, December 10, 2016, www.nytimes.com/2016/12/09/us/obama-russia-election-hack.html.

  Brennan later argued: Erika Fry, “Ex-CIA Director: Russia Wanted Hillary Clinton ‘Bloodied’ By Her Inauguration,” Fortune, July 19, 2017, fortune.com/2017/07/19/cia-director-russia-hillary-clinton/.

  had similar vulnerabilities: David E. Sanger and Charlie Savage. “Sowing Doubt Is Seen as Prime Danger in Hacking Voting System,” New York Times, September 15, 2016, www.nytimes.com/2016/09/15/us/politics/sowing-doubt-is-seen-as-prime-danger-in-hacking-voting-system.html.

  Fox News on August 1: David Weigel, “For Trump, a New ‘Rigged’ System: The Election Itself,” Washington Post, August 2, 2016, www.washingtonpost.com/politics/for-trump-a-new-rigged-system-the-election-itself/2016/08/02/d9fb33b0-58c4-11e6-9aee-8075993d73a2_story.html?