A new report claims that Russian hackers altered dates in stolen documents to frame the DNC staffer for the theft.
#HisNameWasSethRich and, no, he did not leak stolen DNC info to Wikileaks. A new report shows how Russian military intelligence fueled a conspiracy around the unsolved 2016 murder of the Democratic National Committee staffer, fooling right-wing talk show hosts, journalists, former NSA and CIA officials — to the point that Donald Trump ordered the head of CIA to investigate it.
The report, by investigative British journalist Duncan Campbell, was published on Monday by Computer Weekly, a professional IT online magazine. Campbell asserts that Russian military intelligence, the GRU, manipulated metadata in DNC files that it stole and then released to the public. The GRU’s goal in doing so: to give the false impression that the files were not hacked but copied from one computer to another by a DNC insider — Seth Rich — and then given to Wikileaks. The con job was good enough to persuade William Binney, a former technical director at the NSA, to conclude last year that the DNC files weren’t hacked at all, just stolen from the inside. Binney’s name and credibility helped to propel the conspiracy onto Sean Hannity’s show and then to the President and the head of the CIA.
To understand how the Seth Rich conspiracy made its way from the backwaters of 4Chan to Langley, you have to go back to June 2016. Cybersecurity company Crowdstrike had just reported that the DNC had been hacked and the culprit was likely Russian intelligence.
In order to throw dust over their trail, the Russians created a fake persona, a supposed lone Romanian going by “Guccifer 2.0.” It wasn’t long before a cybersecurity event organizer in London contacted Guccifer 2.0 through Twitter and invited him to a major conference in September.
The U.S. intelligence and cybersecurity communities have concluded that Guccifer 2.0 was actually the GRU. Obviously, the Russian military officers skipped that fun London conference in 2016. Instead, they sent a PowerPoint deck. One slide, which Duncan reveals in a photo from the conference, pointed participants toward what Guccifer 2.0 claimed was new and useful information from the DNC.
Duncan surmises that the Russian officers knew that the Guccifer 2.0 persona was quickly losing its credibility. They needed to keep attention on the stolen documents and broader influence campaign rather than who or what was behind it. They needed to create a new, plausible explanation for the documents falling into the hands of Wikileaks.
They soon identified a person they could plausibly frame: a former Democratic National Committee staffer named Seth Rich, who had been murdered in Washington, D.C., on July 10, 2016. A victim in the wrong place at the wrong time, Rich wouldn’t be able to defend himself. Conspiracies about his death were already growing like mushrooms in the darker corners of Internet chat rooms, easily observable to foreign intelligence. But the GRU needed some way to point to Seth Rich as the data thief.
So they manipulated the metadata — that is, they changed the dates — in some of their stolen files to indicate that they were copied by an insider, not hacked by a foreign nation, and then sent to Wikileaks. The date they encoded into the files was July 5, less than a week before Rich’s murder. That fact is viewable to anyone who downloads the zip file and uses the password to do it.
Duncan explains: “Some 13 groups had then been compressed using WinRAR 4.2. Nine additional files were compressed using 7zip. The archive, called 7dc58-ngp-van.7z, was published in this format, as a single file of 680MB…The files released in London, we found, had first been processed in this way to show timestamps for 5 July 2016.
“This dual compression method was unique to the London documents. It was not used in other file dumps released by Guccifer 2.0, WikiLeaks or other publishers of stolen DNC material. The special method used two different file compression systems, 7zip and WinRAR, and required using a four-year-old, superseded version of WinRAR to obtain the required result. The way the Russians did it, the two compression operations appeared to overlap within a single 20-minute period. The tampering may have been done on 1 September, a week before the London conference.”
But no one noticed the timestamps in the documents that Guccifer 2.0 gave to the conference. The conspiracy crowd, it seemed, would require some additional breadcrumbs if they were going to behave in the way the Kremlin needed them to.
Jump to June 2017, when a British IT manager and conspiracy theorist named Tim Leonard was running a site called G2.space and operating under the Twitter alias “Adam Carter.” Leonard received “a tip” from a mysterious anonymous source allowing him to unlock hidden metadata in the docs from the London conference. He discovered the timestamps within the documents showing that they were copied from one computer to another on July 5 from the northeastern United States. It was all —conveniently — consistent with the Seth Rich “inside job” theory.
From there, a group called Forensicator — Duncan does not elaborate on Leonard’s association with this group — produces an “analysis” purporting to prove that Wikileaks documents were copied in the United States rather than exfiltrated from abroad. The “evidence” was compelling enough to catch the attention of Binney and a few of his former intelligence colleagues, including in the CIA. Binney wagered his credibility on the faulty analysis without fully checking the files. Binney backtracked on much of what he said publicly and admits his previous statements were factually inaccurate in Duncan’s article. But in 2017, the endorsement from a top former NSA official was enough to get the att