COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
|
DHS reported GRU scanning activity on the Secretary of State domain.[1] | |
| State 12 | (U) Cyber actors using infrastructure identified in the August FLASH conducted scanning activity that "lasted less than a second and no security breach occurred," according to State 12 officials.[2] State 12 became aware of this malicious activity after being alerted to it.[3]
DHS reported that because of a lack of sensor data related to this incident, they relied on NetFlow data, which provided less granular information.[4] DHS's only clear indication of GRU scanning on State 12's Secretary of State website came from State 12 self-reporting information to MS-ISAC after the issuance of the August FLASH notification.[5] |
| State 13 | (U) According to State 13 officials, they have seen no evidence of scanning or attack attempts related to state-wide election infrastructure in 2016.[6] |
| State 14 | MS-ISAC passed DHS reports of communications between a suspect IP address used by the GRU at the time and the State 14 election commission webpage, but no indication of a compromise.[9] In addition, DHS was informed of activity relating to separate IP addresses in the August FLASH, |
- ↑ (U) DHS briefing for Committee staff on March 5, 2018.
- ↑ (U) Memorandum for the Record, SSCI Staff, Conference Call with [State 12], December 1, 2017.
- ↑ (U) Ibid.
- ↑ (U) DHS briefing for Committee staff on March 5, 2018.
- ↑ (U) Ibid.
- ↑ (U) Memorandum for the Record, SSCI Staff, Conference Call with [State 13], December 1, 2017.
- ↑ (U) FBI IIR DHS briefing for Committee staff on March 5, 2018.
- ↑ ; DHS briefing for Committee staff on March 5, 2018. For more information on decisions by DHS to exclude certain activity in its count of 21 states, see text box, infra, "DHS Methodology for Identifying States Touched by Russian Cyber Actors."
- ↑ DHS/FBI Homeland Intelligence Brief, ; DHS briefing for Committee staff on March 5, 2018.
18
COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
