The Plot to Destroy Democracy

CHAPTER 1

Shots Fired

On November 8, 2016, Vladimir Putin became the first Russian President of the United States. What could arguably be called the greatest intelligence operation in the history of the world had been executed and the result was that the candidate Moscow had supported had won. Putin didn’t care what happened next. He was certain that with Trump in power the American public would be so enmeshed with chaos that they would be completely indifferent on how to respond, if they responded at all. That was the weakness with democracy; it required consensus, process, and time. Putin relied on none of that. He had ordered and executed a daring political mission. His cyber spies, state run news media, and his elite global rich—the oligarchs—had successfully influenced the American public’s mindset so deeply they were in total denial that it had been done at all. As both Baudelaire and Keyser Söze said, “Que la plus belle des ruses du diable est de vous persuader qu’il n’existe pas!… The best trick of the devil was to convince you he didn’t exist.”

The political party controlling the US Congress, the Republican Party, had dedicated itself for eight years to destroying any positive action by President Barack Obama. Hillary Clinton, his Secretary of State, was likely to be the Democratic Party’s frontrunner and even more likely to be the next President of the United States. Putin’s personal hatred of both seemed to be the key motivating factor that caused him to intervene. But luck was on his side in 2016 because all of the actors and stages that the Russian Federation had cultivated over a decade were in place to effect a change bigger than a US President. Russia had taken a modest distrust of Hillary Clinton and had used the Republican Party’s own argument, “But… Hillary’s emails,” and had turned it into a weapon. Russia capitalized on the repeated investigations into Clinton’s emails that were found on a secure server in her Secret Service–protected home. It was an easy target. When the election was done, America had fractured.

Russia had exerted its asymmetric power to elect Donald J. Trump to the highest office in the West and it had succeeded beyond its dreams. With this, they’d get the Magnitsky Act and Crimea sanctions lifted. Russian investments would become highly desired vehicles again, but to sustain Putin’s dream, the real goal must be attained: Put an end to liberal democracy in America and Europe and bring about a worldwide conservative renaissance.

It wasn’t a very difficult job despite the perils of running an integrated intelligence mission against the world’s premier superpower. Like the 9/11 attacks, American politicians and the public just did not have the imagination to believe that Putin would dare do something so intrusive. US Intelligence did have the imagination as well as the information that both Moscow and Beijing could pull off such a stunt, but the military and intelligence leadership was responsive to politicians. One could warn till one is blue in the face, but intelligence produces warnings; politicians must act on them.

In the end, Putin won with the aid of Americans who had turned on their own values. The news media assisted greatly by elevating stolen innocuous emails from an insecure party server to a national crisis in which the victims were treated suspiciously. To Trump supporters it validated everything they ever suspected about Hillary Clinton—she hid emails, which meant she was a liar. No matter that Trump voters elected a man who openly embraced white supremacy, rejected diversity, abhorred global engagement, ignored his own corruption, and enlisted his own family and staff as royalty to be worshipped. Trump voters saw these traits as perks. They viewed nepotism, largess, and excess as virtues of a business and political shark. If he vocally stood against virtually all gains America had made in equality and global economic expansion since 1964 and it got him elected, then all the better that he hold those positions. By all means necessary was Trump’s apparent motto for the 2016 election. Russian intelligence lived by that motto too. The spies of the Red Square were shameless enough but the real scandal was that Team Trump saw nothing wrong with it.

Trump voters had blindly elected him despite knowing that Russia had intervened in the electoral process. They cared not that Trump’s own surprising level of slavish devotion to Putin was suspicious. It. Did. Not. Matter. Trump had created a cult of personality in the white lower class so that they worshipped his every word and challenged the veracity of anything negative said against him. This worked out well for Putin.

For the new Russian President of the United States, the original goal had been to just make America consume itself in partisanship and beat them on the global market to return to economic supremacy. Now with the election of Trump, America would become fundamentally dysfunctional. More importantly, Russia would gain an ally that would release its illicit billions stolen from them by the Obama administration through sanctions. It had taken a decade to earn those hundreds of billions of dollars through the theft of former Soviet assets. Liquidating Russian shipyards and airports, and selling off everything from tanks to chemical factories, had been a tough business where only the toughest could survive. Led by an ex-KGB officer, Russia was about to embark on a path to a new era of global leadership. Yet Americans were fickle and the “Yes, We Can!” of Barack Obama had splintered the nation to the point that just a few subtle strokes of assistance—financial and ideological—would shift the US into Moscow’s orbit. It was a tough shot, and if it failed the damage could become permanent, but Vladimir Putin dared to take it—and in the 2016 American election it paid off.

Fresh Bear Tracks

The plot to hack America, given the FBI code name Operation GRIZZLEY STEPPE, was executed early in the of summer 2015. Russian Military Intelligence hackers executed a long-term plan to penetrate the servers of the Democratic National Committee (DNC). It was technically simple. The GRU, an acronym for Glavnoye Razvedyvatel’noye Upravleniye, or Main Intelligence Directorate, used the lax computer security of the Americans, which allowed their spies to gain access to the servers. The Russian army spies ran rampant for as long as 7 to 10 months before the threat was detected. They copied what they wanted and left no part of the DNC untouched. Someone in the US Intelligence community must have noticed the attempts. In September 2015, the FBI sent the DNC a notice that their computer systems were being probed by an undesignated foreign actor. The DNC did perfunctory checks and detected nothing out of the ordinary. They would already be too late. The Russian army spies were well into the system and operating almost invisibly. They were using a suite of cyberware known as Advanced Persistent Threat-29 (ATP-29). It was a well known hacking suite that had been nicknamed by many companies but the one that stuck was coined by the cybersecurity company Crowdstrike: COZY BEAR. The people behind the software were a cell of Russian army intelligence soldiers using a highly sophisticated suite of malware in their attacks. This wasn’t the first time the GRU deployed COZY BEAR. It had been used many times around the world and had been used to penetrate the White House and Pentagon servers in 2014 and 2015. It was the GRU’s go-to penetration system. To get into a civilian agency such as the DNC, it was child’s play. In the past, they could get into White House staffers’ log-ins, so an American political party was cake.

Yet while the GRU was successful in owning the DNC, a very specific attack was carried out by another spy entity known as APT-28 and nicknamed FANCY BEAR. This malware belonged to the cyber spies of the Russian intelligence agency, the FSB. The State Security Directorate—the FSB—was the heir to the entire legacy and corporate knowledge of the villainous Soviet spy agency KGB. They changed their acronym when the USSR fell. In fact, once Russia lost its Communist ideology, the former KGB became far more powerful in computing power. In the cybersecurity world FANCY BEAR was well known to be controlled by the Russia State Security agency, the FSB. The only difference between the modern-day FSB (and its overseas clandestine service branch, the SVR) and the ruthless KGB is that the FSB has a much bigger budget and more latitude for overseas operations.

THE FSB IGNORED the GRU team in the DNC hack and stole a single yet specific folder of opposition research in their FANCY BEAR software. An opposition research folder is all the dirt a political party collects on another party’s opponent. The Republicans had 17 candidates and the Democrats had folders on each but the FSB stole the folder for one specific person: Donald J. Trump.

In June 2016, the CEO of Crowdstrike, Dmitri Alperovitch, published the findings of the DNC hack. The paper is titled Bears in the Midst: Intrusion into the Democratic National Committee and it publicly accused Russian spies of conducting the DNC hacking. It was well received in the cybersecurity community but detractors in the Republican Party, particularly those of the now frontrunner Donald Trump, did not agree with the Russian findings.

A few days after the Crowdstrike report, a Wordpress blog written by someone using the name “Guccifer 2.0” appeared on the internet. The entity claimed that he penetrated the DNC by himself, a “lone hacker.” Cybersecurity experts were immediately suspicious because that name was apparently a homage to “Guccifer,” a prolific Romanian hacker who repeatedly read and published the emails of Colin Powell and other luminaries. Since the real Guccifer was sitting in a US prison and cooperating with the FBI, who was this guy? Journalists and cybersecurity experts quickly surmised that the person on the blog was likely a Russian citizen due to a poor understanding of Romanian language and was using a Russian language keyboard. No matter, Guccifer 2.0 started to publicly release data stolen by the COZY BEAR/FANCY BEAR hacks. He started first by releasing DNC financial reports, a “dossier on Hillary Clinton,” and other materials that could only have come from DNC computer servers. However, the Guccifer persona was met with skepticism and derision. Apart from the cybersecurity world its story was not making headway. That changed immediately when Julian Assange’s WikiLeaks organization announced it had the DNC emails. The effect was galvanizing. The entire global media stood up and paid attention.

ON JULY 22, 2016, WikiLeaks flooded the global media with 19,252 stolen DNC emails from senior DNC staff, including the communications director and the senior finance team. The materials appeared to focus on discussions designed to split the Democratic Party by revealing then chairperson Debbie Wasserman Schultz’s views on Bernie Sanders and Hillary Clinton. Schultz was a close personal friend of Clinton, so it was no surprise she supported her, and the release of the emails was timed to occur just before the Democratic National Convention in Philadelphia. The intent of the leak was clear—split the Bernie Sanders faction from the Democrats and damage Hillary Clinton among independent and progressive voters. It worked like a charm. The first morning of the convention, Bernie Sanders supporters walked out, staged loud protests, and even publicly shouted Donald Trump’s schoolyard nickname for the nominee: “Crooked Hillary.”

The Friday before the Democratic Party’s convention in Philadelphia, I was in New York City to provide analysis and commentary related to possible terrorist and security threats to the convention. As the counterterrorism analyst for MSNBC, I was kept hanging around their makeshift studio. The temporary studio had an elevated and breathtaking view of Independence Hall. I felt the pride of Jefferson, Franklin, and the others who had come to that spot to tirelessly create history. In the air was a feeling of jubilation and inevitability that America would overwhelmingly reject the hatred, bigotry, and mean-spiritedness of the previous week displayed at the Republican convention.

The Republican convention in Cleveland, and its process to nominate self-described billionaire Donald J. Trump as their candidate for President, was a visceral parade of grievance, rejection, and near open appeals to racism. It became apparent to everyone watching, even a lifelong Republican myself, that the party would show a willingness to fight as dirty as possible and go as deep into the mud as one could go—and maybe a step lower. The convention was reported accurately as a massive grievance festival.

While the Republican convention unfolded, numerous shenanigans to get rid of Trump were floated and shot down among the party establishment. In the end, the Republicans nominated arguably the most divisive person to run for President since Abraham Lincoln—and we all know how that ended.

Consequently, the Democratic Party was poised to stand on an air of cooperation, strength through diversity, compassion, and love. First Lady Michelle Obama’s slogan “When they go low, we go high” would resonate with Hillary Clinton’s supporters. It would allow Bernie Sanders’s following to come together with Clinton’s and close ranks the way she’d done with Barack Obama’s nomination in 2008. Everyone looked forward to a rousing party.

At my Independence Hall standby location, I kept watch just in case a terrorist group or individual would attempt to break up the Hillary lovefest with guns, bombs, or worse. There were no indications of a terrorist threat but for almost four months I had been aware of a different kind of threat. As part of my continuing counterterrorism study, I had been drafting a manuscript for a new book titled Hacking ISIS. I was writing it with my chief researcher and coauthor Chris Sampson. We had been working on the manuscript for more than a year to provide the deepest dive on the terrorist group’s success at hijacking social media. While researching ISIS’s tactics, we came across two efforts that seemed at odds with the terrorist’s capabilities: the hacking of TV5 in Paris, a major television network that broadcasts internationally to the entire francophone world, and the Warsaw Stock Exchange. On the surface, both of these efforts were carried out by hackers of the Islamic State terrorist group, but forensic analysis showed that the entity used in conducting the attack was confirmed to be FANCY BEAR. I watched with interest when news of the WikiLeaks trove came out. One glance at the data revealed to me that they had the stolen DNC information that had been taken by COZY and FANCY BEAR. WikiLeaks was clearly acting as a Russian laundromat for stolen material.

It immediately became clear to me, and my brothers and sisters in US Intelligence, that a massive cyber warfare operation was afoot. I had been the first to publicly declare on national television that the United States had been subjected to a wide-ranging cyber and political warfare attack. My breathless warning was in reality an intelligence estimate. My call to alarm was based on my background as a career cryptologic collections operative in Naval Intelligence. I was an heir to the legacy of the codebreakers and analysts who had seen the bread crumbs that led to numerous victories, such as the Battle of Midway and Operation Desert Storm, and failures including Pearl Harbor and 9/11. Although my career background was in Middle Eastern state sponsors of terrorism and warfare from Libya to Syria to Afghanistan, I was a child of the Cold War spy world. When I was first read into the Top Secret code word world, the first briefings were not about Libyan spies, Saddam’s assassins, or Iranian Vevak agents—it was a massive counterintelligence indoctrination on the activities and operations of the former Russian intelligence agency, the Komitet Gosudarstvennoy Bezopasnosti (the KGB). The KGB was a worldwide threat during the Cold War that enveloped every intelligence operative and analyst in the West. Their ability to identify, seduce, and turn intelligence professionals into spies who betray their own nation was legendary. The counterintelligence motto was “Beware of the Bears. The Bears are Everywhere!” Their military forces were our primary targets but their spies were far less visible and insidious. The motto was true. Throughout most of my career, the KGB (and its successors the FSB and SVR) was literally everywhere our missions took us. A souk in Marrakech, a café in the Casbah in Algiers, a men’s room in Naples, or a bar in Port Said: There they were. The KGB knew where Americans were and had assets or agents looking to surveill, engage, and recruit. KGB officers and propagandists routinely criticized our military activities, funded terrorists from the Irish Republican Army (via one of my targets, Libya), and ran Palestinian insurgency training camps in the deserts of Syria and the refugee camps of Southern Lebanon. They facilitated dictators and despots across the Eastern Hemisphere. Annually we were briefed on Russian intelligence operations which were enmeshed with our targets everywhere from Iraq to Spain.

When I added one and one together with the DNC hack, the Guccifer 2.0 blog, and the WikiLeaks data dump, it was an obvious large scale old-school KGB-style Russian information warfare operation. It could have but one goal—elect Donald Trump president. It was bold. It was daring and it could only have been directed by Vladimir Putin. I said this loudly and repeatedly throughout the campaign. However, there was much skepticism. I was not alone in my analysis of the bread crumbs. But the news media were interested in the emails and not the source. The more stolen data that were released, the more voraciously the media covered the story. Television and internet news consumed with reports of “emails” had little critical analysis. The actual emails revealed nothing. But the word was in the air. After a month’s hiatus (to turn the data over to WikiLeaks), Guccifer 2.0 popped back up to work in concert with WikiLeaks. They released freshly stolen documents that revealed another Democratic Party institution was hacked. This time it was the Democratic Congressional Campaign Committee (DCCC). In addition, a disturbing pattern was emerging: When Donald Trump would give speeches complaining about a certain subject, within days entire dumps of DNC and DCCC emails on that subject would hit the news media from both Guccifer 2.0 and WikiLeaks. For example, emails on Pennsylvania and Florida primaries were released soon after Trump mentioned them. When he disparaged Nancy Pelosi, a huge tranche of documents on her was released. The flood continued with the entire DNC databases for New Hampshire, Ohio, Illinois, and North Carolina hitting the streets—all Democratic battleground states that Trump eventually won. I spent days on television warning that there was a cyber war designed to destroy the Democratic Party and tilt the election in favor of Donald Trump. Aside from MSNBC, the news media largely ignored the spy story unfolding before their eyes and breathlessly awaited the new stolen tranches.

On August 21, Roger Stone, the Nixonian Republican dirty trickster, hinted that he had advanced information about the WikiLeaks releases on John Podesta, the campaign chairman of the Clinton team. He tweeted that “Podesta’s time in the barrel will come.”¹ A statement such as this was perplexing at the time, but it appeared to be Stone’s classic foreshadowing of a political dirty trick. A few weeks later it would become one of the first of many signs of possible collusion between Trump supporters and Russia via their laundromat, WikiLeaks.

Like clockwork, in mid-September 2016 a new website “DC Leaks” suspected of being another Russian front published email chains from John Podesta. Some of which included messages to Hillary Clinton but did not expose anything more sinister than a risotto recipe. That was the least of it. September and October brought an endless flood of leaks. DC Leaks released the schedules of key Clinton staff and a copy of Michelle Obama’s passport.² Each of them appeared to be timed to whatever bad news the Trump team was facilitating at the time.