Russia experts target of hacks

On Tuesday morning, a hacker going by the name Johnnie Walker sent a group email to an unknown number of recipients claiming to have a trove of emails from the private account of a U.S. intelligence official.

“The U.S. State Department officer’s email has been hacked,” the email announced, and included at least two years’ worth of personal emails from the private Gmail account of a State Department official working in the secretive intelligence arm of the State Department focusing on Russia.

The sender said the archive included exchanges between the official and “CIA officers and other intelligence agencies, mainstream media, NGOs, and international funds” that would “give you evidence of who is responsible for agenda formation in many countries worldwide, especially where the situation is insecure.”

The official involved is in a senior position in the State Department’s Bureau of Intelligence and Research, according to a 2017 department directory. Even though the official’s name is public, Foreign Policy is not identifying him at the department’s request, citing security concerns.

But the official’s expertise in Russian politics and organized crime makes him a significant target.

“He’s probably the top intelligence guy in the entire U.S. government on Russia. He knows more than anybody about what’s going on there,” said one source whose correspondence with the official was revealed in the hack.

While it’s unclear whether the hack is an isolated incident or part of a broader campaign, it comes amid a widening investigation into Russian cyberattacks that included interference in the 2016 U.S. presidential election. Those attacks, according to officials and documents, go beyond high-level political operatives and include experts and think tanks, particularly those working on Russia issues.

A 2016 document from the Department of Homeland Security Office of Intelligence and Analysis, and obtained by FP, warned that there have been more than a dozen recent cases of U.S. think tanks being hacked, including one breach that involved stealing data on Russia-Turkey relations. The document, which is marked “For Official Use Only,” says, “Cyber actors likely will continue to target think tanks and similar organizations, as many maintain significant connections to US government information and personnel, especially foreign policy officials.” The DHS did not respond to a request for comment.