The FBI failed to notify scores of US officials that Russian hackers were trying to break into their personal Gmail accounts despite having evidence for at least a year, an investigation found.
The Associated Press dedicated two months and a small team of reporters to go through a hit list of targets of Fancy Bear, a Russian government-aligned cyberespionage group, that was provided by the cybersecurity firm Secureworks.
Previous investigations based on the list had shown how Fancy Bear worked in close alignment with the Kremlin’s interests to steal tens of thousands of emails from the Democratic party. The hacking campaign disrupted the 2016 US election and cast a shadow over the presidency of Donald Trump, whom US intelligence agencies say the hackers were trying to help. The Russian government has denied interfering in the American election. The special counsel Robert Mueller is leading an investigation into alleged collusion between Trump aides and Russia. Indictments have been made.
Nearly 80 interviews with Americans targeted by Fancy Bear turned up only two cases in which the FBI provided a heads-up. Even senior policymakers discovered they were targets only when the AP told them.
“It’s utterly confounding,” said Philip Reiner, a former senior director at the National Security Council, who was notified by the AP that he was targeted in 2015. “You’ve got to tell your people. You’ve got to protect your people.” The FBI declined to answer most questions from the AP about how it had responded to the spying campaign. The bureau provided a statement that said in part: “The FBI routinely notifies individuals and organizations of potential threat information.”
Three people familiar with the matter – including a current and a former government official – said the FBI had known for more than a year the details of Fancy Bear’s attempts to break into Gmail inboxes. A senior FBI official, not authorized to publicly discuss the operation, declined to comment on timing but said the bureau was overwhelmed by the sheer number of attempted hacks.
“It’s a matter of triaging to the best of our ability the volume of the targets who are out there,” he said. The AP identified more than 500 US-based people or groups and reached out to more than 190, interviewing nearly 80. Many were long retired but about a quarter were still in government or held security clearances at the time they were targeted.
Only two told the AP they learned of the hacking attempts on their personal Gmail accounts from the FBI. A few more were contacted by the FBI after their emails were published in the torrent of leaks that coursed through the 2016 election. To this day, some leak victims have not heard from the bureau at all.
Questions over the FBI’s handling of Fancy Bear date to March 2016, when agents arrived unannounced at Hillary Clinton’s headquarters in Brooklyn to warn her campaign about a surge of rogue, password-stealing emails. The agents offered little more than generic security tips the campaign had already put into practice and refused to say who they thought was behind the attempted intrusions, according to a person who was there and spoke on condition of anonymity because the conversation was meant to be confidential.
Questions emerged again after it was revealed that the FBI never took custody of the Democratic National Committee’s computer server after it was penetrated by Fancy Bear in April 2016. The former FBI director James Comey testified this year that the FBI worked off a copy of the server, which he described as an “appropriate substitute”.
Some of those contacted by the AP brushed off the idea that they were taken in by a foreign power’s intelligence service. “I don’t open anything I don’t recognize,” said Joseph Barnard, who headed the personnel recovery branch of the air force’s air combat command.
That may well be true of Barnard; Secureworks’ data suggests he never clicked the malicious link sent to him in June 2015. But it isn’t true of everyone. An AP analysis suggests that out of 312 US military and government figures targeted by Fancy Bear, 131 clicked links sent to them. That could mean that as many as two in five came perilously close to handing over their passwords.
A former US ambassador to Russia, Michael McFaul, who like many others was repeatedly targeted by Fancy Bear but has yet to receive any warning from the FBI, said the lackluster response risked something worse than last year’s parade of leaks.
“Our government needs to be taking greater responsibility to defend its citizens in both the physical and cyber worlds, now, before a cyberattack produces an even more catastrophic outcome than we have already experienced,” McFaul said. Charles Sowell, who worked as a senior administrator in the Office of the Director of National Intelligence and was targeted by Fancy Bear two years ago, said there was no reason the FBI couldn’t do the same work the AP had done.
“It’s absolutely not OK for them to use an excuse that there’s too much data,” Sowell said. “Would that hold water if there were a serial killer investigation, and people were calling in tips left and right, and they were holding up their hands and saying: ‘It’s too much’? That’s ridiculous.”
Download SafeUM — communicate privately, without advertising and spam.
110 Reykjavik, Iceland