Government Contractor Accused of Leaking Evidence Pointing to Russian Phishing For Votes

Apparently it really was the Russians that at least attempted to meddle in the U.S. elections process in 2016. Despite recent claims by Russian president Vladimir Putin, a leaked document from the National Security Agency (NSA) pointed to the military intelligence arm of the Russian government for conducing a spear-phishing campaign stemming from a specific Gmail address that sent fake Google alerts to a U.S. Company working on U.S. elections systems.

Reality Winner, a 25-year-old contractor was arrested at her home last week and charged with “removing classified material from a government facility and mailing it to a news agency.” The detailed document she was accused of sending to The Intercept included contradictory statements made by Putin that the Russian government didn’t meddle in last year’s election process. Instead, the documents showed, the military intelligence arm of the Russian government (GRU) was the main actor behind a now infamous spear-phishing campaign that continues to be investigated.

The investigation into this incident uncovered that email messages were sent from a fake Gmail address with methods that attempted to collect Google login credentials from those who clicked the included link. In addition, a second campaign was uncovered where another Gmail address was used to send message to local government organizations in the U.S. later in the year offering “election-related products and services.” The 122 messages sent in this one included malicious documents that ultimately resulted in executing an “unknown payload” that the NSA believes was used to establish access or to monitor victims for “items of interest.”

In addition to that, the report states that there was an attempt by GRU to intercept requests by U.S. citizens for absentee ballots. This is a significant finding, as per the Pew Research Center, 23.3 million citizens vote using absentee ballots.

While the leaked document did not explicitly name the connection between Reality Winner and The Intercept, there are plenty of indicators pointing to them indeed being connected. What is certain is that this case will be ongoing for a long time. And at the very least, hopefully, each time we hear about it, we will be reminded about the risk of phishing and think twice before clicking on links and attachments.