Two days before France’s recent presidential election, hackers leaked nine gigabytes of emails from candidate Emmanuel Macron’s campaign onto the web. Since then, the Kremlin has once again emerged as the likeliest culprit. But while public evidence can’t definitively prove Russia’s involvement, NSA director Michael Rogers suggested to Congress today that America’s most powerful cybersecurity agency has pinned at least some electoral interference on Moscow. In a hearing of the Senate’s Armed Forces Committee, Rogers indicated that the NSA had warned French cybersecurity officials ahead of the country’s presidential runoff that Russian hackers had compromised some elements of the election. For skeptics, that statement may help tip the balance towards credibly blaming Russia for the attacks.
“If you take a look at the French election…we had become aware of Russian activity,” Rogers said in response to questions from senator Kirsten Gillibrand about the allegations of Russia hacking the Macron campaign. “We had talked to our French counterparts prior to the public announcements of the events publicly attributed this past weekend and gave them a heads-up: ‘Look, we’re watching the Russians, we’re seeing them penetrate some of your infrastructure.’”
It’s not clear what “infrastructure” means in this context, but it seems likely to refer to the very public email dump. On Friday, Macron’s En Marche political party issued a statement saying that it had “been the victim of a massive, coordinated act of hacking,” but didn’t name Russia or any other culprit behind that attack. Analysts already suspected Russia of at least attempting to breach Macron’s party: Security firm Trend Micro noted in a report late last month that the same Russian group that hacked the US Democratic National Committee and the Clinton Campaign had also created a phishing domain intended to spoof a Microsoft storage website used by Macron. And the trove of Macron’s party emails published as torrent files Friday included metadata in Cyrillic, suggesting that they had been edited on a computer running software with Russian-language configurations. That metadata even included the name Roshka Georgiy Petrovich, reportedly an employee of the Russian intelligence contractor Eureka.