How Did The US Government Miss A Week Of Activity And Most Of The DNC Emails?

The USIC/DOJ Timeline For DNC Email Exfiltration

In the Summer of 2018, the US Department of Justice released an indictment against a number of Russian nationals, some of whom it accused of hacking the DNC.

The indictment alleged that Russians had used infrastructure in the US to connect to the DNC's Exchange server, and, presumably, grabbed all of the DNC's emails that were later published by WikiLeaks during this incident.

The US DOJ gave a rough timeline citing the date range of May 25, 2016 to June 1, 2016 for the exfiltration.

As supporting evidence, the DOJ mentioned that a suspect called Yermakov had allegedly researched how to access and manage Microsoft Exchange Server using Powershell during this time (in reference to the May 25, 2016 to June 1, 2016 time frame).

However, the majority of the DNC's emails appear to have already been exported and written to disk several days before the DOJ's time frame starts.

The DOJ's use of "on or about", and, elsewhere, "approximately", are instances of imprecision that are baffling considering the access to evidence they would have had.

However, it does seem that May 25, 2016 is the date on which they believe the DNC Exchange server was hacked.

Forensicator Spots May 23, 2016 Export

Following the public disclosure of the indictment referenced above an independent analyst and source I've referenced previously (who writes under the pseudonym "The Forensicator"), decided to take a closer look at the DNC email files hosted by WikiLeaks.

Forensicator found that all of the emails for one DNC staffer, Luis Miranda, (accounting for around a quarter of the emails published by WikiLeaks) were exported to disk no later than May 23, 2016, two days before the alleged Russian access to the Exchange server and at least two days before Yermakov's search.

Readers who downloaded the archive linked to at the beginning of this article, and who view the archive from American time zones will see the date as May 22, 2016. However, the timestamps we see there do not align with what the time was in the Eastern time zone and are offset by several hours.

NOTE: Timestamps above are from the perspective of an observer in the Eastern time zone.

The cause of this shift comes from how files were handled in different time zones. This is an issue that Forensicator had covered in his report in relation to the May 25, 2016 activity (where he also reported on discovery of Pacific time zone indicia).

To see that some activity identified in the screenshot above really extended into May 23 (from the Eastern time zone perspective), we can look at the headers of one of the emails to see what was recorded by the DNC's mail server.

Email #5308 (shown in the screenshot above as last being modified on May 22, 2016) was processed by the DNC's mailserver at 00:06:25 (-0400) on May 23, 2016.

Regardless of which time zone we view this from, what remains clear is that the data indicates there was exporting activity occurring several days prior to the reported hack of the DNC's exchange server on May 25, 2016.

It's worth considering how this was missed and why it shouldn't have been.

We know that the DOJ looked at metadata on WikiLeaks files in relation to Podesta's emails.

Yet, with the DNC emails, they seem to have overlooked exactly the same type of evidence, in this case with over 10,000 emails with last-modified time stamps indicating that they were exported to disk around May 22.

Forensicator published his analysis in early 2019, about a month before the Mueller report was made public.

Sorting The WikiLeaks
DNC Emails

(Forensicator's analysis delves into the emails in stunning detail and also builds on observations that were first highlighted in 2017 by someone using the pseudonym Steemwh1sks/wh1sks, outlined here. It is a far more thorough and detailed analysis of the DNC emails than anything the US government and it's sources ever produced.)

The Mueller report was then made public and we saw that it provided the same May 25 to June 1, 2016 time frame that we saw in the Netyksho indictment, missing out the activity Forensicator had discovered and reported on previously.

Most Of The DNC Emails Already Exported Prior To May 25, 2016

While Miranda's emails only accounted for around a quarter of the overall haul (23.88%), this wasn't the only mailbox from which emails were exported prior to May 25, 2016.

The evidence shows us that over 70% of the emails were exported on or before May 23, 2016.

If you look at the "last modified" timestamps of the DNC email files, you will notice that they form four batches based on distinct dates.

If you then check the email send dates for each batch you will find that three of these batches appear to be batches of emails taken no later than May 23, 2016.

Batch	File Last Modified	Latest Email	Count	%
A	May 23, 2016	May 23, 2016	10520	23.88%
B	May 25, 2016	May 25, 2016	11936	27.09%
C	August 26, 2016	May 22, 2016	13357	30.32%
D	September 21, 2016	May 22, 2016	8240	18.70%

Batches A, C and D all appear to contain a snapshot of emails taken prior to May 24, 2016 (as indicated by the lack of emails sent after May 23, 2016).

Batch A contained emails exclusively from Luis Miranda's mailbox.

Batch B contained emails from Eric Stowe, Zach Allen, Andrew Wright, Jordan Kaplan, Daniel Parrish and Scott comer.

Batches C and D contained emails from Andy Crystal, Jeremy Brinster and Ryan Banfill.

Batches C and D also appear to have had last-modified timestamps coming from post-exfiltration activity, probably caused by WikiLeaks handling of files.

From this we can see that 72.9% of the overall collection published by WikiLeaks appear to have been exported before alleged-Russians connected to the DNC's Exchange server.

Thirty Day Retention Period

A thirty day retention rule was implemented on DNC mailboxes. This was noted by DNC staffers themselves, such as when they spoke with Buzzfeed in 2017.

There was also mention of the 30 day retention rule within the DNC's emails, such as this example sent to Ryan Banfill by Tracie Pough on May 17, 2016.

As well as this email, we can also see from observation of email send dates that it appears that four mailboxes (in the aforementioned batches A, C and D) were affected by a cut-off of approximately 30 days.

Forensicator produced a handy table with the details for this (showing earliest and latest sent dates and the duration between them).

Banfill's emails fall short of 30 days but this is due to Banfill not starting work at the DNC until the end of April. (DNC email #41574 sent on April 28, 2016, welcomes Banfill to Exchange Unified Messaging.)

Brinster's emails exceeded the 30 day limit by four days. We'll come back to this and the reason for it shortly (in the next section of this article).

Regarding batch B, which contained the emails exported on May 25, 2016, these also generally followed a 30 day retention rule (applicable to ~97% of the emails in this batch), however, they appear to have included a small number of emails that went further back in time (resulting in far higher "days" counts in the table above).

The email date frequencies were originally highlighted back in 2017 by Stephen McIntyre and the chart he produced (see below) shows the distribution of email dates.

While some in the media had argued that the emails generally started in January 2015, or, suggested that the emails had been collected over a long period of time, McIntyre showed that only a tiny fraction of the emails were sent on dates prior to April 18, 2016, noting:

There are only a couple of emails per month (~1/day) through 2015 and up to April 18, 2016.

The reason for this small number of emails (around 3% of the batch exported on May 25, 2016) exceeding the 30 day retention rule is most likely due to the emails being stored in personal folders rather than inboxes.

Files Prepared For Exfiltration On April 22 Unrelated To DNC Emails

Some have inferred testimony from CrowdStrike's CSO Shawn Henry (regarding seeing files prepared for exfiltration at the DNC on April 22) as being related to the DNC emails or suggestive of email collection starting around that time.

However, if this was the case, we would expect the uptick in email frequency to be a month earlier (going back 30 days into late March).

Earliest Send Date On Brinster Emails Indicates Initial Export Activity Around May 19, 2016

Brinster's emails don't cut off exactly thirty days prior to the latest email send date for his batch of emails (May 22, 2016) which would be April 22, 2016. Instead, Brinster's earliest send date is April 18, 2016 and his emails span a thirty-four day period instead of thirty days.

The possibility that there could be a distortion due to emails held in personal folders (bypassing the thirty day retention) has been considered here, however, we can see that daily tallies on the earliest days (outside the thirty day range) are congruent with the rest of the data for Brinster.

If the thirty-four day period was a distortion caused by moving some emails to personal folders, we would expect the daily volume of emails from days outside the range (the first 3-4 days in this case) to be considerably lower, but that's not the case.

As such, the evidence here indicates that Brinster's emails were first being exported around May 19, 2016, almost a week before the DOJ's time frame starts.

Unscheduled Maintenance On May 23-24, 2016

On May 23, 2016, following the export of Brinster, Banfill, Crystal and Miranda emails, an email was sent by Yared Tamene Yohannes-Wolde (the DNC's Director of Information Technology) to DNC staff informing them of unscheduled "required maintenance".

At around 10pm, the email server was taken offline. The email server became available again at approximately 4am on May 24, 2016.

On May 25, 2016, emails from the six other mailboxes (Stowe, Allen, Wright, Kaplan, Parrish and comer) were exported.

No Updates From The DNC, CrowdStrike, FBI or DOJ In Five Years

The fact that at least 23.8% of the emails, encompassing all emails from Luis Miranda, were exported several days prior to May 25, 2016, ought to have been obvious to SCO Mueller. However, this crucial information seems to have been missed.

Upon closer scrutiny, we see that 72.9% of the DNC's emails appear to have been exported before the Exchange server was reportedly hacked.

Most of the emails were exported in an initial five day period that we were told nothing about.

Several inquiries arise:

Why did the comprehensive investigation fail to acknowledge the specifics of the activities of WikiLeaks source(s) between May 19 and May 23, 2016?
Who bears responsibility for this conduct, especially if the search attributed to Yermakov occurred several days after the email exportation?
What was the reason for the unscheduled maintenance between May 23-24, 2016?
When exactly was Yermakov's search? (Because if it wasn't in the early hours of May 25, 2016, then it will have been after all of the emails were already exported!)
Is it conceivable that the DNC, CrowdStrike, FBI and DOJ, with access to the crime scene, Exchange logs, Falcon logs, signals intelligence, many analysts and a budget of $32 million seemingly failed to identify the activities brought to light by open source researchers?

The events unfolding at the DNC from May 19 to May 23, 2016, have dwelled in the shadows for years, with their true nature potentially destined to remain obscured for the foreseeable future.

If SCO Mueller had disclosed full details of this, the timing of the May 25 hack event might have raised suspicions and the attribution to Yermakov would have faced far more scrutiny.

Despite the discovery and exposition of the earlier exfiltration activity by independent researchers, those officially responsible for probing the exfiltration do not appear to have produced any further insights or evidence.

How Did The US Government Miss A Week Of Activity And Most Of The DNC's Emails?