Tor at the Heart: The Tor Project

It turns out that very similar conclusions were independently drawn by other (and more authoritative) sources:

https://theintercept.com/2017/01/04/the-u-s-government-thinks-thousands…
The U.S. Government Thinks Thousands of Russian Hackers May Be Reading My Blog. They Aren’t.
Micah Lee
4 Jan 2017

> After the U.S. government published a report on Russia’s cyber attacks against the U.S. election system, and included a list of computers that were allegedly used by Russian hackers, I became curious if any of these hackers had visited my personal blog. The U.S. report, which boasted of including “technical details regarding the tools and infrastructure used by Russian civilian and military intelligence services,” came with a list of 876 suspicious IP addresses used by the hackers, and these addresses were the clues I needed to, in the end, understand a gaping weakness in the report.

medium.com
Russian Hackers, Elections, and Data-Driven Analytics
darkcubed

> Two days before New Years, something interesting happened in the world of cyber security. The Department of Homeland Security released a report on hacking activities by Russian Intelligence Services related to activities against the U.S. Government. The report was somewhat interesting, however DHS also released a set of indicators in a .csv file with 956 lines of data. As the CEO of a new cyber security startup focused on using data in smarter, more interesting ways, this data tugged and pulled at me in a way that I did not expect. Over the next two days, in between (and through) family events, football games, dogs grabbing food off of the counters, I sat on a stool in my in-law’s kitchen and tuned out the world. There was something about this analysis that I could not ignore.

Among the 876 IPs listed in the faulty JAR (Joint Activity Report): various entities found

DarkCubed: 211 Tor nodes
Post above: 219 Tor nodes
Micah Lee: 211 Tor nodes

The minor discrepancies probably come from the fact that there are several distinct lists of all currently active Tor nodes, but the best procedure would be to use a list of all IPs used by Tor nodes during the past year straight from TP.

Again, just to be clear: I don't doubt that RU intelligence has planted APTs deep inside all manner of US networks, including those used by politicians, or that FSB/GRU frequently leaks damaging information about government officials in hopes of influencing elections or destabilizing "adversary nations". They would only be following the lead of USIC: the very first CIA mission involved bribing Italian politicians and rigging elections to prevent the election of Communists (this happened even before CIA was officially created). By the 1980s, CIA had spent hundreds of millions influencing elections in that one country (Italy) alone. Its other election influencing exploits including founding the leading political party in Japan, and preventing certain candidates from winning popular landslides in countries from Malaysia to Chile over much of the past six decades. So Putin is not wrong to wryly declare that USG is in no position to complain about another country successfully altering the outcome of US elections.

More links to experts who dismiss the amateurish JAR "evidence", which casts more doubt upon the ability of USIC to provide useful intelligence analysis:

https://krebsonsecurity.com/2017/01/the-download-on-the-dnc-hack/#more-…
The Download on the DNC Hack
Brian Krebs
3 Jan 2017

> ...the only remarkable thing about the hacking of the DNC is that the people responsible for protecting those systems somehow didn’t expect to be constantly targeted with email-based malware attacks. Lest anyone think perhaps the Republicans were better at anticipating such attacks, the FBI notified the Illinois Republican Party in June 2016 that some of its email accounts may have been hacked by the same group. The New York Times has reported that Russian hackers also broke into the DNC’s GOP counterpart — the Republican National Committee — but chose to release documents only on the Democrats.

http://arstechnica.com/security/2016/12/did-russia-tamper-with-the-2016…
White House fails to make case that Russian hackers tampered with election
US issued JAR billed itself as an indictment that would prove Russian involvement.
Dan Goodin
30 Dec 2016

> Talk about disappointments. The US government's much-anticipated analysis of Russian-sponsored hacking operations provides almost none of the promised evidence linking them to breaches that the Obama administration claims were orchestrated in an attempt to interfere with the 2016 presidential election.

http://www.politico.com/story/2017/01/russia-hacking-cyberattacks-fake-…
Shaky accusations hamper cyber case against Russia
The Obama administration’s efforts to press its election-hacking accusations against Russia could be undermined by a flurry of unfounded cyber charges against Moscow.
Cory Bennett and Eric Geller
4 Jan 2017

> The hyped — and quickly deflated — news reports alleging Kremlin-backed hacking of the U.S. electric grid via a Vermont power company have stoked fears among cyber specialists that a flurry of false accusations against Russia will follow, as U.S. companies respond to the administration's request that they search for possible Russian-linked cyberattacks on their systems. And those easily debunked tales could sow doubts about all hacking allegations against Russia — undermining the administration's arguments that it has solid evidence Vladimir Putin's regime used digital mischief to interfere in the 2016 presidential election.

Another widely reported story which turns out to have been very misleading was the claim that "known RU malware" had been found to be infecting Burlington Electric's power delivery grid; in fact, someone who works there found probably not-state-sponsored malware on a work laptop (not a SCADA device) and panicked:

http://thehill.com/policy/cybersecurity/312466-russia-did-not-hack-verm…
Russia did not hack Vermont electric utility: report
Joe Uchill
3 Jan 2017

> Russian hackers do not appear to be behind an attack on a Vermont electric utility, reports the Washington Post, citing officials close to the investigation of a potential activity first reported by the Post last week. The report at least temporarily puts to bed a news story that rankled many in the security community — including the most fervent believers that the Democratic National Committee was hacked by the Russians — and underlines problems many have with a joint Homeland Security, Director of National Intelligence and FBI report released last week.

One intriguing story late last year which had a similar flavor: the Secretary of State of one US state notice a port scan of her networks from a purported DHS address and immediately publicly accused the USG of trying to hack the state election system. This is intriguing because it shows how close the USA is of doing a USSR and simply dissolving itself in mutual fear and loathing, and also because it shows just how clueless most government officials really are.

Another important point about the debunking of the Burlington Electric story: in contrast to the Vermont power grid, it is a well documented fact that RU state-sponsored hackers have indeed hacked into the Ukraine power grid and actually turned off power to large areas of cities such as Kiev. The RU hackers no doubt exploited the fact that major Russian cities (such as Moscow) have bought "smart meter" systems from Landis+Gyr, which also built the Kiev system. So they have access to the same infrastructure and to the user manuals. Many large US cities have also bought "smart meter" systems from Landis+Gyr, so it would be foolish to doubt that RU state-sponsored hackers have the capability to damage the US power delivery grid, because they have already demonstrated that capability in very similar systems overseas.

We can expect that many more explosive allegations about alleged RU (or CN or IR or KP) hacking into US networks--- heavily slanted to suit various political agendas--- will appear in the coming year. Wary Tor users will need to interpret these carefully, because many of them will no doubt be mangled and misleading, yet may contain a kernel of truth which we would ignore at our peril. Further, we will need to stand together and firmly oppose attempts by our political enemies inside the USG to promote the view that "Tor is used only by enemies of the USA", which is patently absurd. Quite the contrary: no entity needs to adopt onion services on a massive scale more than the USG, in order to better protect the security/privacy of data in motion and data at rest. Making this case to someone like John McCain might be difficult, but we need to try.