Replies

Anon Post this evening that caught my attention...

Why FBI Relied on Crowdstrike Examination of DNC Server after Alleged Russian Hack

by anon
part 1 of 2

“The FBI never requested access to the DNC’s computer servers,” wrote DNC deputy communications director Eric Walker. According to an unnamed intelligence official, no U.S. intelligence agency ever did its own forensic analysis on the hacked servers. FBI and Homeland Security relied on analysis by third-party security firm CrowdStrike, which investigated the breach for the DNC. [1]

Even that narrative is questionable. “[Former] FBI Director James Comey and [former] Homeland Security chief Jeh Johnson both testified to Congress about the DNC’s reluctance to cooperate in a case the Democrats nonetheless relentlessly hyped as tantamount to an act of war.” A week before Comey’s testimony, the DNC even blamed the FBI for having never requested access. Yet an unnamed senior FBI official contradicted the DNC the very next day, telling The Hill that “The FBI repeatedly stressed to DNC officials the necessity of obtaining direct access to servers and data, only to be rebuffed… This left the FBI no choice but to rely upon a third party for information.” [2]

In hindsight, isn’t it obvious that the whole procedure was highly irregular, especially in light of the extreme sensitivity of the “Russian election interference” allegation? Who directed the FBI to disregard procedure and not insist on doing a proper forensic exam of the DNC server—especially if the alleged “Russian hacking” was going to serve as a pretext to derail Donald Trump’s legitimate presidency?

The hacking of the DNC server is what initiated the entire Trump/Russia hoax. How can we trust the DNC or Obama administration officials—contradicting each other’s statements—on such a significant matter? Let’s review the events. [4]

In testimony to the House Intelligence Committee, the DNC IT Director, Yared Tamene Wolde-Yohannes, stated that in September 2015, a [name-redacted] FBI agent first alerted him to potential nefarious activity on the DNC network. [6, p.7] However the DNC technology team could not detect the nefarious activity. That FBI agent contacted the DNC numerous times between then and December 2015 to report continued signs of suspicious activity. The agent said his information came from other operatives in the Intelligence Community. [6, p.12]

The FBI eventually asked the DNC for 15 GB of metadata from the DNC servers, which was to be turned over on 4/29/16. [6, p.24] But on 4/28/16, the DNC’s information technology team discovered a cyberattack on their servers.

On 5/1/16 the DNC, through their law firm Perkins-Coie, hired CrowdStrike, a private contractor, to examine the server. From that time onward, CrowdStrike took over all communications with the FBI on behalf of the DNC. [6, p.32]

In response to questioning over Seth Rich, Tamene stated that the DNC found no unusual or unauthorized access by DNC personnel, but admitted that CrowdStrike was involved in the process of analysis [6, p.35] (Under contract to the DNC, did Crowdstrike in effect serve as a paid advocate to exonerate DNC personnel or advance a predetermined outcome?)

Predictably, CrowdStrike concluded that the Russians were responsible.

In mid-June, WikiLeaks announced they were in possession of emails damaging to Clinton. They did not say how they obtained the emails, but denied that Russia provided them.

In a perplexing “coincidence”, Shawn Henry admitted that Crowdstrike had provided some “intelligence services to the FBI as part of a contract” in the past. [5, - p.74]. A search for CrowdStrike’s government contracts reveals a contract with the FBI from 7/8/2015 to 7/7/2016. [7] So while remediating the DNC network and advocating for the DNC in contacts with the FBI, CrowdStrike simultaneously had a contract with the FBI. The period

when the FBI agent originally advised Director Tamene of ‘potential nefarious activity’ on the DNC network was concurrent with CrowdStrike providing intelligence to the FBI. Which unnamed Intelligence Community source was notifying the FBI agent of nefarious activity on the DNC servers—could it have been CrowdStrike itself? Shouldn’t the [name-redacted] FBI Agent be called to testify?

In a further “coincidence”, IT Director Tamene’s legal counsel for the House Intelligence Committee testimony was Marc Elias of Perkins-Coie—the same law firm that technically hired CrowdStrike to work for the DNC. (Doesn’t Perkins-Coie’s representation of the DNC and CrowdStrike appear to be a conflict of interest?) But back to the timeline…

The DNC refused to allow the FBI or Homeland Security anywhere near their server. In violation of every investigative norm, the FBI accepted CrowdStrike’s unverified redacted report, and passed it on to Mueller’s special counsel. In fact, the FBI never even saw the full report, but used it as a primary source to blame Russia anyway! [3]

The New York Times wrote an article supporting the DNC version of the story. Then Comey’s FBI leaked information to bolster this narrative, and the Times ran a second story. The DNC version of events got repeated so frequently and passionately that it became accepted as true.

In this way, through the knowing collusion of many individuals, criticism regarding the content of Hillary’s emails was deflected, and the seeds were sown for a false narrative that Russians wanted to bolster Trump’s election changes.

part 2 of 2

In Congressional testimony, CrowdStrike’s CEO Shaun Henry could not state unequivocally that Russians hacked the DNC server or exfiltrated data from it. “There are times when we can see data exfiltrated, and we can say conclusively. But in this case it appears it was set up to be exfiltrated, but we just don’t have the evidence that says it actually left.” [5] Yet upon this thinnest of predicates was based a circa-$32-million special counsel that failed to find wrongdoing by the President, an impeachment proceeding that concluded no wrongdoing by the President, and a relentless media narrative that for 3.5 years has attempted to unseat a duly-elected President.

Bottom line: While we do know that the 2016 Clinton Campaign and DNC paid for the discredited Steele Dossier, we still don’t know what data the DNC server held that the DNC hoped to hide from the FBI—data which remains hidden to this day. We don’t know exactly what acts of wrongdoing the Obama administration hoped to conceal from their employers, the American people. However, we do know that everyone in Mr. Obama’s cabinet used private Gmail addresses for surreptitious email communication, to knowingly evade federal records retention laws. We do know that the Steele dossier (which the FBI certified to the Foreign Intelligence Surveillance Court (FISC) as reliable, and upon which the Court relied in granting warrants that legitimized spying on candidate and President Donald Trump) contained nothing more than rumors and innuendo, and had been discredited by the FBI itself. After the FBI’s stunning malfeasance was revealed, FISC Chief Judge Boasberg censured the FBI, suggesting that prior cases might be overturned due to the FBI’s pattern of lacking candor. We do know that when the Crossfire Razor investigation regarding Lt. Gen. Michael Flynn was about to be closed for lack of evidence, the FBI’s Peter Strzok overrode agency decisions and insisted it remain open so they could frame Trump’s incoming National Security Advisor, Flynn.

Four years later, unanswered questions still abound. We must continue pressing for answers to unravel the bizarre and inexplicable behavior of the DNC, the FBI, and the Obama administration.

Sources

[1] https://thehill.com/policy/national-security/312767-fbi-never-examined-hacked-dnc-servers-report (01/04/17)

[2] https://amgreatness.com/2020/02/14/impeachment-was-cover-for-crowdstrike-and-democrats-got-what-they-wanted/ (2/14/20)

[3] https://lidblog.com/crowdstrike-dnc/ (6/16/19)

[4] https://redstate.com/elizabeth-vaughn/2020/05/08/huge-crowdstrike-ceo-has-no-direct-evidence-russia-stoleexfiltrated-dnc-emails/ (5/8/20)

[5] Testimony of Shaun Henry (CrowdStrike CEO) to House Intelligence Committee (12/5/17), https://intelligence.house.gov/UploadedFiles/SH21.pdf

[6] Testimony of Yared Tamene Wolde-Yohannes (DNC IT Director) to House Intelligence Committee (08/30/17), https://dni.gov/files/HPSCI_Transcripts/Yareda_Tamene-MTR_Redacted.pdf

[7] CrowdStrike contract with the FBI
https://www.usaspending.gov/#/award/CONT_AWD_DJF151200P0007649_1549_-NONE-_-NONE- .

(I notice when going to the last link, it loses the ending dash for me... Add it back into the end of the URL in your browser, and it will find the document. ~Easy)

Mark Elias gave testimony before the Permanent Select Committee on Intelligence ( run by the Repubs ) on 12/13/2017.
Elias also represented many who testified before that same committee - including Andrew Brown.

Andrew Brown was the technology director at the DNC.
He oversaw the information technology team as well as the data team, the software engineering team, and the data and analytics team and the security component at the DNC, who admits he's not a cybersecurity expert.

Here's what he testified to re: the FBI\DNC servers on 08/13/2017. (Starting at the end of page 24 questions by the Repubs)

Q I've only got like 7 or 8 minutes before I turn it over, so I just want to change gears a little bit. So when all this happened, did you, the DNC, contact the FBI or any other law enforcement agency?

A Yeah. So as soon as we discovered the intruders on our network in April, at the same time that we were reaching out to CrowdStrike, who began their engagement the very next day, we were also in contact with the FBI and notifying them of the situation.

Q Now, did the FBI ever receive access to DNC servers to do their own exploitation?

A Yeah. So at every step of the way we fully cooperated with everything the FBI requested of us. And to my knowledge, everything that the FBI requested they received. Once -- you know, with the expertise and the background and experience that CrowdStrike had, they became the main point of contact in dealing with the FBI on behalf of the DNC. So requests that the FBI would have while they were doing their investigation, they would give to CrowdStrike, and we always said, yes, please do that.

Q But do you know, or does the DNC now know if the FBI ever had access to the infrastructure to do their own analysis?

A It's my understanding that, yes. So the servers that were compromised in this attack were imaged. So what that means is most of these servers were not like a physical box --

Q Sure.

A -- running an OS. They were a box that had multiple servers running on them in a virtual environment. So the images of those virtual servers, as well as the physical servers, were taken.

And that is an important distinction because that means that not only were the -- it means that the running state of the server was captured, so not only the information that was on the hard drive and maybe logs that existed but the actual working memory of that server was captured. Those server images were, as far as I know, turned over by CrowdStrike to the FBI, so the FBI could investigate them.

and the end of page 33 starts the questions by the Rats about the DNC servers.

Q I want to ask about the server or the servers at the DNC, and you talked with my colleagues a little bit about that. I just want to clarify, were the actual physical servers turned over to the FBI?br>
A So images of those servers. So the physical hardware itself was not removed from the premise, but a virtual image of the running servers were taken and turned over.
And that was the level of detail, which, again, is greater than what could -- if the servers were turned over, they would have to be unplugged and turned over, and there would be information that was lost when those servers were taken offline.
So based on the recommendation and request of CrowdStrike to create images of those running servers that would contain not only the information stored on disk, but the working information stored in the memory of the computer; that was what CrowdStrike requested for the purpose of their investigation, and is what I believe that they passed along to the FBI for the FBI to conduct its own investigation.

Q That's what I thought. I wasn't sure from your conversation earlier. But the former Director of the FBI, James Comey, actually testified before the Senate Intelligence Committee earlier this year and said that while the FBI did not have access to the servers themselves, they were able to obtain the relevant information they needed to understand the intrusion and that they had obtained that from CrowdStrike. A Yeah.

Q So that was my initial --

A And at every point we fully cooperated with all of the requests that the FBI made. I'm not aware of any request that the FBI made of the DNC for access or information that was not complied with.

and later they get into Seth Rich.

Regarding the servers - a whole bunch of people lied somewhere. We need the Crowdstrike piece of this.

https://intelligence.house.gov/uploadedfiles/ab3.pdf <---- Andrew Brown transcript