4 Big Ideas in the DNC Hacking Indictments

More than 20 months after the 2016 election was marred by a Russian hacking campaign targeting Democratic nominee Hillary Clinton, the Justice Department handed down indictments Friday seeking punishment for 12 Russian military officers who allegedly led the operation.

The move, which comes just days before President Donald Trump is scheduled to meet with Russian President Vladimir Putin, is unlikely to result in jail time for any of the hackers.

The indictments send a message, however, about what’s acceptable for nations to do in the murky world of cyberspace, what’s unacceptable and where that line should be drawn.

Here are four big takeaways:

The Big Number

Russian government cyber spooks “hacked the website of a state election board and stole information about 500,000 voters,” Deputy Attorney General Rod Rosenstein said while stressing that there’s no evidence the hacking operation changed any votes.

Intelligence officials previously acknowledged that Russian hackers penetrated some non-voting systems, but the scope of the breached information is new.

That’s a big number, but it pales in comparison to most high-profile breaches. The 2014 JPMorgan Chase breach affected more than 80 million people, by contrast, and the mother of all breaches at the credit ratings agency Equifax affected about 148 million people.

Voter registration information—mostly names and addresses—is also relatively innocuous compared to the information scooped up in some breaches. The 2015 Office of Personnel Management breach, for example, compromised highly sensitive security clearance information about more than 20 million current and former federal employees.

The hackers also breached a company that supplied software to verify voter registration information, Rosenstein said.

Spear-phishing ain’t pattycake

Criminal hackers often send out pro forma phishing emails to dozens or hundreds of members of an organization and just hope someone’s naïve or careless enough to click on a malicious link. That’s not what happened here.

The indictment goes into extensive detail about the long hours the Russian hackers put in tailoring phishing emails to Democratic targets.

There’s the already well-known ploy in which a Russian hacker spoofed a security email from Google to con Clinton campaign manager John Podesta into revealing his password. But that’s just the beginning.

In one case, the hacker Aleksey Lukashev created an email account that mirrored the name of a Clinton campaign staffer with just one letter changed. His colleagues then used the email account to send spear-phishing emails with malicious links to 30 other campaign staffers.

That malicious link appeared to be the tantalizingly titled spreadsheet: “hillary-clinton-favorable-ratings.xlsx.”

This doesn’t happen every day

Anyone shocked by Friday’s indictments likely wasn’t paying much attention. It was widely expected that Special Counsel Robert Mueller would get around to indicting the Russian military officers responsible for hacking Democratic political targets and the broad outlines of the scheme were already well-known.

It’s worth noting, though, how comparatively rare these sorts of indictments are.

In fact, Friday’s indictments mark only the fourth time the Justice Department has indicted foreign government-linked hackers for breaching U.S. targets.

Nation-state hacking had been common practice for years before the Justice Department handed down its first indictments in 2014—against five members of China’s People’s Liberation Army for hacking U.S. companies.

The charges made major waves and are credited as the first big move in a diplomatic push that led to a 2015 agreement between the U.S. and China that neither would hack the other’s companies for commercial gain.

Since then, the Justice Department indicted Iranian Revolutionary Guard hackers for hacking financial firms and a New York dam in 2016 and indicted hackers with Russia’s FSB intelligence agency for hacking Yahoo in 2017.

The only arrest stemming from those indictments, however, was Karim Baratov, a Canadian who assisted with the Yahoo breach. Baratov in May was sentenced to a five years in prison and $250,000 fine after pleading guilty.

Mueller’s office also indicted officials with Russia’s Internet Research Agency for social media influence operations related to the 2016 election earlier this year.

All this and a dirty House race, too?

It was well-known that the online persona Guccifer 2.0—who claimed to be a lone Romanian hacker, but was a front the Russian agents used to release their breached information—sent information to reporters.

The persona also, however, communicated with a House candidate, according to the indictment. The candidate reached out to Guccifer 2.0 in August 2016, looking for dirt on the candidate’s opponent, the indictment states. The hackers sent it along.