Story highlights
The US believes Putin most likely gave his cyberexperts broad direction
Sources said there is certainly no obvious intelligence linking Putin, such as a signed order
A US official familiar with the US intelligence assessment of the Russia election-related hacking said the understanding is that the operation was carried out with sophisticated hacking tools, the equivalent of those used by the US National Security Agency.
The use of the advanced tools suggests Russian President Vladimir Putin was involved in the hacks, a person familiar with the matter said, adding that it was more than a US intelligence assumption at this point.
But neither of the sources said they knew of specific intelligence that directly ties Putin to the attack. US officials briefed on the investigation say the hacking has continued largely unabated since last month’s election, and President Barack Obama on Thursday vowed to take action against Russia.
“We don’t have Putin’s fingerprints on anything or a piece of paper that shows he signed the order, but the nature of the operation was such that this had to be approved by top levels of the Russian government,” a senior administration official with access to the intelligence on the hacking told CNN.
“The intelligence community has assessed that in order for this operation to have been executed, it could not have been done without the highest levels of the government, including the President himself.”
The US official said there are two entities in Russia capable of doing this kind of work, but would not name either one. The tools the Russians used are understood by the US and have a unique “signature.”
The official said the sophistication of the tools used means that a higher-level Russian government authority would have been required to carry the prolonged effort to steal emails and data from the Democratic National Committee and Hillary Clinton’s campaign chairman, John Podesta, among other targets.
The US believes Putin most likely gave his cyberexperts broad direction to attempt to hack US political institutions. The US believes once the hackers got into the DNC system, they would have instantly reported back to the Russian leader, who would weigh in on what to do with the data.
WikiLeaks, which distributed the hacked information, may well not even know it came from Russia. But under Russian command and control procedures that US intelligence understands, it would be expected that Putin would be the final authority to decide on giving it to WikiLeaks.
The sources did not say when the US came to this analysis of the cybertools used. CNN reported Wednesday that US intelligence believed Putin was involved when they issued their public statement in October.
Putin’s involvement
Multiple national security, intelligence and congressional sources told CNN that the US intelligence assessment continues to be based on the analysis of intelligence, not any evidence directly linking Putin to the effort.
Analysis of the digital footprint and intelligence, including from human sources, has led to the thinking in the intelligence community to conclude that Russians carried out the cyberhack and that it would not have happened without Putin’s consent, according to intelligence, congressional and other administration sources.
That belief was alluded to in the October 7 statement from the Director of National Intelligence and Department of Homeland Security that stated “only Russia’s senior-most officials could have authorized these activities.”
On Thursday, White House Press Secretary Josh Earnest implied that statement was clear in identifying Russian leaders, including Putin, in US election meddling.
“At the risk of editorializing, when I read that statement for first time in early October, I didn’t think it was particularly subtle,” Earnest said. He emphasized he did not have an additional intelligence assessment to share naming Putin specifically as being behind the cyberattacks.
Intelligence exists that could be interpreted as Putin was aware of the hacks beyond just an assumption that the hacking operation could not happen without Putin’s approval, according to two of the sources.
But the sources said there is certainly no obvious intelligence linking Putin, such as a signed order.
One source explained that while the thinking in the US intel community is that Putin was aware of this effort, it doesn’t mean he knew all the details and was personally tracking the program. The source used the analogy that when a drone strike happens, Obama authorizes it but isn’t involved in every step.
Since October, the CIA has refined its analysis based in part on new intelligence, but the government officials said that assessment continues to be based mostly on the reading of circumstantial evidence.
Indeed, a more forward-leaning assessment by the CIA was being produced before the election, but the agency purposely did not brief Congress at the time on that information in an attempt to not get stuck in the middle of politics during the campaign, as the FBI did, according to several of the sources.
That may have backfired, as President-elect Donald Trump is citing the fact that the information is coming out only after the election, timing seen by the Trump transition team as an effort to delegitimize his election victory.
According to an administration official familiar with the matter, the October 7 statement is still the operative bottom line. According to the source, when the Director of National Intelligence James Clapper said the senior most Russian officials had to have authorized the hacking, “who else would that be but Putin? This is an authoritarian regime.”
Hacking continues
Russian cyberhacking activity has continued largely unabated since the election, including against US political organizations, US officials briefed on the investigation told CNN. Among the attempted cyberbreaches are phishing attempts targeting Clinton’s campaign, one official said. The attempt to breach the Clinton campaign was unsuccessful, investigators believe.
The attempts appear to trace back to some of the same Russian hackers behind the breaches of Democratic Party organizations in the past year, one official said. The FBI has expanded its ongoing probe of Russian hacks to include the more recent attempts.
Russians “continue to do all kinds of stuff” against American political organizations, think tanks and thought leaders, another US official said.
“It’s not like the one-and-done deal here. They continue to engage in this operation around the clock,” the official said.
This person said the US is constantly trying to shut down access to different avenues for cyberattacks.
“There’s a lot that gets done with our own security services,” the official said. In terms of retaliation against Russia, this person said a variety of options are on the table, but everything is being carefully considered because “right now, it’s like the old cold cyberwar and the last thing you want to do is turn it into a hot shooting war.”
The continued activity suggests that despite the election won by Trump, who was openly favored by the Russian government, Russian intelligence hasn’t curbed its collection on the US political system. US intelligence and law enforcement officials believe even with a new president considered more friendly to Russia, the Russian intelligence agencies will continue to carry out such hacks.
A senior Clinton campaign official told CNN they received notice “a state actor” was trying to hack private Gmail accounts as recently as December 6. The campaign official said they were informed the US election assistance office also had a cyberhacking attempt.
Obama vows action
Obama on Thursday vowed retaliatory action against Russia.
“I think there is no doubt that when any foreign government tries to impact the integrity of our elections that we need to take action and we will at a time and place of our own choosing,” Obama told National Public Radio.
He said he directly confronted Putin about a potential US response, and said his counterpart acknowledged his stance.
“Mr. Putin is well aware of my feelings about this, because I spoke to him directly about it,” Obama said.
Obama and Putin conferred on the sidelines of the G20 meeting in China in September. Afterwards, Obama told reporters he raised cybersecurity with the Russian leader.
Officials have said US actions against Russia may not be revealed publicly.
CNN’s Shimon Prokupecz, Jeff Zeleny and Kevin Liptak contributed to this report.
