According to the 50-page indictment by a local US attorney, the Russian soldiers were engaged in a "conspiracy to deploy destructive malware and take other disruptive actions for the strategic benefit of Russia".
Between April 5 and 6, 2018, the soldiers sent emails pretending to be a journalist from a German national weekly newspaper and a British journalist. The emails were sent to official addresses of the Defence Science & Technology Laboratory (DSTL) at Porton Down in England, and to the OPCW in The Netherlands. Regarding the poisoning incidents in Salisbury of March 4, 2018, involving Sergei and Yulia Skripal, the "Conspirators purported to have information to share regarding the poisoning".
No evidence has been presented of what information they, or the Russian military intelligence agency GRU at which the six officers worked, had about the Skripal case because their emails were ignored. Malware alleged to be attached to the emails appears to have caused no damage to the targeted computers, nor allowed effective espionage inside the DSTL and OPCW files.
The attempts to communicate with Porton Down and the OPCW have been charged to be the US criminal offences of wire fraud, damage to computers, identity theft, and abetting a scheme of spearphishing - breaking into the computers of Porton Down and OPCW when those organisations were accusing the Russian Army of an attempted assassination by the chemical agent they called Novichok.
The indictment, released on Monday in a blitz of the US and UK media, is the first to make Russian military operations outside the US a criminal offence inside the US. Four of the accused soldiers are accused of having "developed and deployed destructive malware against victim entities around the world, including in the Western District of Pennsylvania".
Read the full indictment here.
The alleged "cyber-enabled malicious actions aimed at supporting broader Russian government efforts - regardless of the consequences to innocent parties and critical infrastructure worldwide - to undermine, retaliate against, or otherwise destabilise: (1) Ukraine; (2) the country of Georgia; (3) France's elections; (4) efforts to hold Russia accountable for its use of a weapons-grade nerve agent on foreign [British] soil; and (5) the 2018 Winter Olyympics after a Russian government-sponsored doping effort led to Russian athletes being unable to participate under the Russian flag".
The term "retaliate against" implies that the Russian military operations were in response to prior attacks. However, culpability is assumed in the Skripal poisoning case, and in the campaigns to ban Russian participation in international sports. For the book on the Skripal affair, click. For more on the politics of the anti-doping campaign, read this.
The only domestic US case evidence alleged in the indictment claims the Russians launched cyber attacks on a single day, June 27, 2017, against a Pennsylvania health care provider, Heritage Valley Health System; the FedEx Corporation; and Merck & Co., the US pharmaceutical corporation. The damage required a reported $2 million in repairs at Heritage Valley; $400 million at FedEx; $500 million at Merck.
At the time, US press reports indicated the cyber attack was a global one, and that among the targets there was Rosneft, the Russian state oil company. A civil liability lawsuit attempted in the same federal district court in West Pennsylvania by Heritage Valley was dismissed for lack of evidence in August of this year.
Monday's indictment also accuses one of the GRU officers, Anatoly Kovalev, of engaging "in spearphishing campaigns for apparent profit, including campaigns targeting large Russian real estate companies, auto dealers, and cryptocurrency miners, including cryptocurrency exchanges located outside of Russia." No evidence for this allegation has been presented.
Kovalev has also been named in the indictment of July 2018 by Special Counsel Robert Mueller for involvement in US presidential election hacking attempts. The FBI claims Kovalev, a 29-year old native of Vologda, "should be considered armed and dangerous."
Spearphishing is not defined in the indictment. Kaspersky, the Russian internet security company, defines it as "an email or electronic communications scam targeted towards a specific individual, organization or business. Although often intended to steal data for malicious purposes, cybercriminals may also intend to install malware on a targeted user's computer." When conducted as part of military operations against hostile forces employing similar weapons and devices, the concept of criminality ceases to apply across the front between the forces; the laws of war take precedence.
The indictment accuses the GRU officers of conducting "three related spearphishing campaigns that targetd the OPCW and UK agencies involved in the investigation of the poisoning". DSTL at Porton Down is identified as a Ministry of Defence installation. "On or about April 3, 2018, the DSTL announced" - according to the indictment - "that it had identified the poison used against Skripal and others as a military-grade 'Novichok' nerve agent". In point of fact, the only statement from DSTL at the time was carefully qualified so as to rule out the identification of the Russian military as the nerve agent's manufacturer or source.
Two days after this, on April 5, 2018, Kovalev is now charged as having sent spearphishing emails to DSTL "with malware attached". No penetration, hacking, or damage at Porton Down's computers is alleged now, nor the loss of sensitive classified information. A similar GRU operation against the OPCW's computers also failed.
The OPCW had tested the Skripals in Salisbury Hospital two weeks earlier and was preparing to issue its report of April 12. Direct Russian spy operations were also under way at the time at the OPCW headquarters in The Hague, and at one of its associated testing laboratories in Spiez, Switzerland. The intelligence work resulted in Russian government announcements that the British and OPCW testing had failed to identify a Russian source for the nerve agent identified in the Skripal blood samples.
The author of the indictment and of the grand jury investigation leading up to it is Scott Brady, an appointee of the Trump Administration in September 2017. His term runs out next year. Brady describes himself as coming from "a small, blue-collar, steel town in Mercer County, where he learned the value of hard work and the importance of family and public service. Scott worked at an iron foundry to pay his way through Harvard, and upon graduation, worked for faith-based relief and development organizations for seven years, including four in Europe, the Middle East and Central Asia, focusing on post-conflict emergency relief work with refugees."
Brady recruits Russian army for help to win election race
Republican Party sources in Pennsylvania say this week's indictment of six Russian military intelligence officers for cyber-warfare operations in the Ukraine, Georgia, the UK, and South Korea is a highly effective political advertisement for the local US Attorney, Scott Brady, 51. The sources say Brady is running to become the Republican candidate to be the next state governor or senator in 2022.
The timing of Brady's announcement this Monday was driven, the sources say, by the withdrawal of the incumbent Republican senator Pat Toomey, reported on October 4; and by Brady's calculation that, win or lose in Pennsylvania, President Donald Trump will lose the national election on November 3. When that happens, and until Inauguration Day on January 20, Brady will have to resign his post for replacement by the incoming Democratic president.
"The Republican nominations for governor and senator are wide open," a well-known state Republican attorney says. "Brady comes from a Trump county in the west; his reputation in Pittsburgh is that of a Trump loyalist. If he's the only Republican candidate from the west of the state, he stands a good chance of splitting the eastern county votes and winning the party primary. By making this indictment of the Russians public now, he's drawing enormous free advertising of his credentials for the race - if Trump wins next month, and especially if Trump loses."
Brady's case against six officers of the GRU is unique in laying charges against Russian Army soldiers for espionage, computer hacking and cyber disruption operations on battlefields outside the US, where Russia is under attack from US and NATO forces. For details and analysis, read this.
The allegations were filed in Pittsburgh, at the US federal district court for Western Pennsylvania, on October 15, and unsealed for the press on Monday. The region centering on Pittsburgh concentrates leading US computer engineering firms and Carnegie Mellon University, whose consultants have reportedly been advising the prosecutors and FBI investigators.
According to Brady, he had been at work on the case against the Russian Army since 2018. "For more than two years we have worked tirelessly to expose these Russian GRU Officers who engaged in a global campaign of hacking, disruption and destabilization, representing the most destructive and costly cyber-attacks in history. The crimes committed by Russian government officials were against real victims who suffered real harm. We have an obligation to hold accountable those who commit crimes - no matter where they reside and no matter for whom they work - in order to seek justice on behalf of these victims."
Washington lawyers acknowledged that the indictment publicity will be the only result the prosecution will achieve because it's unlikely the Russians accused will ever be caught outside Russia and brought to trial in Pittsburgh. "The government learned from its mistakes in the Concord case where a corporate entity was charged with similar cyber-warfare operations," a US attorney explained. In that case, Concord was able to enter a plea and retain US lawyers without having to expose individuals to arrest and prison. The defence lawyers then pressed for disclosure of the US espionage evidence against the Russians. When that was withheld, the case collapsed. For details of the Concord story, read this.
Republican party sources in the state say that Brady's job has been a political launch platform since Dick Thornburgh, a native of Pittsburgh, was appointed by President Richard Nixon as the US Attorney for Western Pennsylvania in 1969; he was 37 at the time. Thornburgh continued in that office until 1975, when he was promoted to Assistant Attorney-General in Washington, and then returned to the state to win the governorship in 1979. Thornburgh held that post until 1987, and was then promoted by President Ronald Reagan to be the US Attorney-General between 1988 and 1991.
Two of the top state political posts, senator and governor, will be up for election in November 2022. Democratic Governor Tom Wolf, first elected in 2014 with a 10% margin and re-elected in 2018 with 18 points, cannot run again. Republican Senator Pat Toomey first won his Senate seat in 2010 and again in 2016. At the start of this month, Toomey announced that he would not run for a third term and was retiring from politics.
Brady comes from several generations of blue-collar workers in Allegheny and Mercer counties in the west of the state. Mercer is Trump country - in the presidential election of 2016, Mercer voted two to one for Trump. Brady's backing for Trump was rewarded by his nomination as US Attorney for Western District in November 2017. The post is presidential patronage; when the president changes, the attorney is replaced.
Brady had to promote himself quickly, according to a Republican source. "The Russian indictment is his first move. The local politics are the reason for the move. He will be campaigning for the party primary votes as Trump's man, and also the man who's stood up to the Russians."
Pennsylvania polls indicate that the margin for candidate Joe Biden ahead of Trump is far from certain, and the momentum in the last days may be in Trump's favour.
R.C.