How Russian Hackers Amplified the Seth Rich Conspiracy Until it Reached Donald Trump and the CIA

#HisNameWasSethRich and, no, he did not leak stolen DNC info to Wikileaks. A new report shows how Russian military intelligence fueled a conspiracy around the unsolved 2016 murder of the Democratic National Committee staffer, fooling right-wing talk show hosts, journalists, former NSA and CIA officials — to the point that Donald Trump ordered the head of CIA to investigate it.

The report, by investigative British journalist Duncan Campbell, was published on Monday by Computer Weekly, a professional IT online magazine. Campbell asserts that Russian military intelligence, the GRU, manipulated metadata in DNC files that it stole and then released to the public. The GRU’s goal in doing so: to give the false impression that the files were not hacked but copied from one computer to another by a DNC insider — Seth Rich — and then given to Wikileaks. The con job was good enough to persuade William Binney, a former technical director at the NSA, to conclude last year that the DNC files weren’t hacked at all, just stolen from the inside. Binney’s name and credibility helped to propel the conspiracy onto Sean Hannity’s show and then to the President and the head of the CIA.

To understand how the Seth Rich conspiracy made its way from the backwaters of 4Chan to Langley, you have to go back to June 2016. Cybersecurity company Crowdstrike had just reported that the DNC had been hacked and the culprit was likely Russian intelligence.

In order to throw dust over their trail, the Russians created a fake persona, a supposed lone Romanian going by “Guccifer 2.0.” It wasn’t long before a cybersecurity event organizer in London contacted Guccifer 2.0 through Twitter and invited him to a major conference in September.

The U.S. intelligence and cybersecurity communities have concluded that Guccifer 2.0 was actually the GRU. Obviously, the Russian military officers skipped that fun London conference in 2016. Instead, they sent a PowerPoint deck. One slide, which Duncan reveals in a photo from the conference, pointed participants toward what Guccifer 2.0 claimed was new and useful information from the DNC.

Duncan surmises that the Russian officers knew that the Guccifer 2.0 persona was quickly losing its credibility. They needed to keep attention on the stolen documents and broader influence campaign rather than who or what was behind it. They needed to create a new, plausible explanation for the documents falling into the hands of Wikileaks.

They soon identified a person they could frame: a former Democratic National Committee staffer named Seth Rich, who had been murdered in Washington, D.C., on July 10, 2016. A victim in the wrong place at the wrong time, Rich wouldn’t be able to defend himself. Conspiracies about his death were already growing like mushrooms in the darker corners of Internet chat rooms, easily observable to foreign intelligence. But the GRU needed some way to point to Seth Rich as the data thief.

So they manipulated the metadata — that is, they changed the dates — in some of their stolen files to indicate that they were copied by an insider, not hacked by a foreign nation, and then sent to Wikileaks. The date they encoded into the files was July 5, less than a week before Rich’s murder. That fact is viewable to anyone who downloads the zip file and uses the password to do it.

Duncan explains: “Some 13 groups had then been compressed using WinRAR 4.2. Nine additional files were compressed using 7zip. The archive, called 7dc58-ngp-van.7z, was published in this format, as a single file of 680MB...The files released in London, we found, had first been processed in this way to show timestamps for 5 July 2016.

“This dual compression method was unique to the London documents. It was not used in other file dumps released by Guccifer 2.0, WikiLeaks or other publishers of stolen DNC material. The special method used two different file compression systems, 7zip and WinRAR, and required using a four-year-old, superseded version of WinRAR to obtain the required result. The way the Russians did it, the two compression operations appeared to overlap within a single 20-minute period. The tampering may have been done on 1 September, a week before the London conference.”

But no one noticed the timestamps in the documents that Guccifer 2.0 gave to the conference. The conspiracy crowd, it seemed, would require some additional breadcrumbs if they were going to behave in the way the Kremlin needed them to.

Jump to June 2017, when a British IT manager and conspiracy theorist named Tim Leonard was running a site called G2.space and operating under the Twitter alias “Adam Carter.” Leonard received “a tip” from a mysterious anonymous source allowing him to unlock hidden metadata in the docs from the London conference. He discovered the timestamps within the documents showing that they were copied from one computer to another on July 5 from the northeastern United States. It was all —conveniently — consistent with the Seth Rich “inside job” theory.

From there, a group called Forensicator — Duncan does not elaborate on Leonard’s association with this group — produces an “analysis” purporting to prove that Wikileaks documents were copied in the United States rather than exfiltrated from abroad. The “evidence” was compelling enough to catch the attention of Binney and a few of his former intelligence colleagues, including in the CIA. Binney wagered his credibility on the faulty analysis without fully checking the files. Binney backtracked on much of what he said publicly and admits his previous statements were factually inaccurate in Duncan’s article. But in 2017, the endorsement from a top former NSA official was enough to get the attention of right-wing talk show host Sean Hannity, and, from there, the President.

Last November, CNN reported that Pompeo, at Trump’s urging, had recently met with Binney to discuss the theory.

Duncan elaborated further in a Wednesday interview with Defense One. He said the GRU ultimately revealed their own ruse in their efforts to encode the timestamps and make sure they were seen. “You would find great difficulty in preserving those timestamps when you sent them through the Internet. Normal compression methods would not preserve those July five dates. In order to make the dates work, they had to use two different operating systems,” he said. “They needed to go to an out-of-date version of WinRAR to get what they wanted. That is written into the file...The method of putting them in two containers was chosen so that the 5 July date would come through.”

Cyber security researchers who spoke with Defense One, and who asked not to be named, verified that the theory was probable. One pointed out that duel compression serves no purpose in terms of efficiency. It isn’t quite a smoking gun, but it is a highly coincidental series of correlative facts from which any reasonable person could interpret the high likelihood of a causative relationship. There is smoke in the room. There is a gun. There is a person prone to shooting guns with gunpowder on his sleeve.

Special Counsel Robert Mueller's July indictments of 12 Russian intelligence operatives who carried out the operation also discuss the timestamp phenomenon, also in an effort, it seems, to lay to rest the faulty “inside job” theory. The indictments specifically state the date that the DNC files were compressed was “on or about April 22”  and even points out that the files were later moved via a GRU malware program called X-Tunnel to a server that the Russians were renting in Illinois.

Bottom line: the Mueller indictments disprove the theory that Seth Rich leaked DNC data to Wikileaks in July 2016. It’s a theory that was spurred to new heights of perceived credibility because of metadata that was in files that the GRU stole. An anonymous tipster then sent a group of conspiracy theorists a map to find precisely the information that the GRU wanted them to find. From there, it went to Sean Hannity and eventually to the president and then to the CIA.