How Russian hackers played the media

US indictments against 12 Russian agents for hacking the Democratic Party in the 2016 presidential election demonstrates how journalistic practice is being weaponised to manipulate journalists themselves.

The indictments, released Saturday morning AEST, seemingly confirm what was reported at the time: in 2016, Russian agents penetrated the servers of the Clinton campaign, the Democratic National Committee and the Democratic Congressional Campaign Committee. The spearphishing was more behavioural than technical, relying on tricking staff into providing a password then, once inside, following the networks where they led.

Having stolen documents, the agents then turned to working a con on journalists. First, in early June 2016, the Russians set up a fake WikiLeaks-style website called DC Leaks and alerted journalists through Twitter and Facebook to documents posted there.

Then about a week after DC Leaks was activated — and after the DNC’s cyber adviser Crowd Strike accused the Russian government of hacking — the agents got creative. They created a hacker persona with the name Guccifer 2.0, complete with a colourful backstory and digital footprint of a blog, email and Twitter handle.

The persona was claimed to be Romanian, in apparent homage to an earlier Romanian hacker, Marcel Lehel Lazar, who had taken the pseudonym Guccifer, a portmanteau blend of Gucci and Lucifer. Lazar is reported now to be working with US authorities.

Guccifer 2.0 released documents through the blog and a tranche was provided through Washington-based political paper The Hill.

Vice’s tech journal Motherboard established in a June 2016 Twitter interview with the Guccifer 2.0 persona that it was definitely not Romanian and concluded that it was connected with Russian security. Thanks to the indictment, we now know the Russian identities involved.

WikiLeaks — or “the Organisation” as the indictment calls it — through Julian Assange, acted as though the Guccifer 2.0 persona was real. The indictment confirms earlier reports that Assange initiated contact seeking documents that would embarrass Clinton, promising “a much higher impact than what you are doing”. WikiLeaks’ dump came in late July, in the lead-up to the Democratic National Convention.

Of course, there is no evidence that any of the media, including WikiLeaks, definitively knew that they were dealing with Russian security, although by mid-June, it seemed broadly accepted in the mainstream media that the Russians had hacked the DNC and that that hack was the origin of the documents.

In a post-election interview with Fox’s Sean Hannity in December, Assange asserted his belief that the documents were independently hacked, suggesting they were perhaps deliberately shaped to look “too much like the Russians”.

Documents stolen by State security and released through the media as part of a cyber guerrilla war creates a tricky ethical dilemma for journalists. As a member of the MEAA, Assange should have been bound by the Australian code of ethics which, in this context, says:

Aim to attribute information to its source. Where a source seeks anonymity, do not agree without first considering the source’s motives and any alternative attributable source. Where confidences are accepted, respect them in all circumstances.

Few in the media seemed to spend much time considering the source’s motives, nor in thinking through what the obligation to confidentiality may be to a non-existent person. Rather, the reporting was more meta, proving that media interest in a document is more linked to its confidentiality than its contents.

This encouraged faking, with the dump becoming an all-purpose source to justify fake news, such as the widely shared canard that the Clinton Foundation funded Chelsea Clinton’s wedding.

WikiLeaks revolutionised media practice, alerting journalism to new tools that could keep sources confidential in the surveillance age. Most news organisations have now embedded these tools. WikiLeaks assumes transparency benefits from dumping leaked documents en masse, such as these DNC leaks or their earlier diplomatic cables.

The journalistically curated releases of tax evasion documents by the International Consortium of Investigative Journalists (most recently, the Panama Papers) show how this practice has shaped modern journalism.

However, both these WikiLeaks dumps and the tax leaks demonstrate that it’s the journalism that brings value by joining the dots: interrogating, testing and contextualising the otherwise misleadingly raw documents.