Here’s a look at hacking incidents during the 2016 presidential campaign and Russian meddling in the election. For details about investigations into hacking and efforts to interfere with the election, see 2016 Presidential Election Investigation Fast Facts.
Timeline:
September 2015 – The FBI contacts the Democratic National Committee’s help desk, cautioning the IT department that at least one computer has been compromised by Russian hackers. A technician scans the system and does not find anything suspicious.
November 2015 – The FBI reaches out to the DNC again, warning them that one of their computers is transmitting information back to Russia. DNC management later says that IT technicians failed to pass along the message that the system had been breached.
March 19, 2016 – Clinton campaign chairman John Podesta receives a phishing email masked as an alert from Google that another user had tried to access his account. It contains a link to a page where Podesta can change his password. He shares the email with a staffer from the campaign’s help desk. The staffer replies with a typo – instead of typing “This is an illegitimate email,” the staffer types “This is a legitimate email.” Podesta follows the instructions and types a new password, allowing hackers to access his emails.
June 12, 2016 – During an interview on British television, WikiLeaks founder Julian Assange says that the website has obtained and will publish a batch of Clinton emails.
June 14, 2016 – The Washington Post reports hackers working for the Russian government accessed the DNC’s computer system, stealing oppositional research on Donald Trump and viewing staffers’ emails and chat exchanges. The Kremlin, however, denies that the government was linked to the hack, and a US official tells CNN that investigators have not yet concluded that the cyberattack was directed by the Russian government.
June 15, 2016 – A cybersecurity firm hired by the DNC posts a public notice on its website describing an attack on the political committee’s computer network by two groups associated with Russian intelligence. According to the post, two Russian-backed groups called “Cozy Bear” and “Fancy Bear” tunneled into the committee’s computer system. In response, a blogger called Guccifer 2.0 claims that he alone conducted the hack, not the Russians. As proof, he posts internal DNC memos and opposition research on Trump. Furthermore, Guccifer 2.0 claims to have passed along thousands of files to WikiLeaks. Trump offers his own theory on the origins of the attack: suggesting in a statement that the DNC hacked itself to distract from Clinton’s email scandal.
July 22, 2016 – Days before the Democratic National Convention, WikiLeaks publishes nearly 20,000 emails hacked from the DNC server. The documents include notes in which DNC chair Debbie Wasserman Schultz insults staffers from the Bernie Sanders campaign and messages that suggest the organization was favoring Clinton rather than remaining neutral. Wasserman Schultz resigns in the aftermath of the leak.
July 25, 2016 – The FBI announces it has launched an investigation into the DNC hack. Although the statement doesn’t indicate that the agency has a particular suspect or suspects in mind, US officials tell CNN they think the cyberattack is linked to Russia.
July 27, 2016 – During a press conference, Trump talks about Clinton’s use of a private email server while she was secretary of state and calls on hackers to find deleted emails. “Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing,” says Trump. Newt Gingrich, a Trump surrogate, defends Trump in a Tweet, dismissing the comment as a “joke.”
August 12, 2016 – Hackers publish cell phone numbers and personal email addresses for Nancy Pelosi and other members of the Democratic Congressional Campaign Committee. Pelosi says she has received “obscene and sick calls” from strangers. She advises targeted colleagues not to allow children or family members to answer the phone or read text messages.
September 1, 2016 – During an interview with Bloomberg News, President Vladimir Putin says that he and the Russian government have no ties to the hackers. He says that the identity of the culprit or culprits is not as important as the content of the leaks, and ultimately the hackers revealed important information for voters.
September 22, 2016 – Democrats Dianne Feinstein and Adam Schiff, ranking members of the Senate and House Intelligence Committees, issue a joint statement declaring that based on information they received during congressional briefings, they believe that Russian intelligence agencies are carrying out a plan to interfere with the election. They call on Putin to order a halt to the activities.
September 26, 2016 – During a presidential debate with Clinton, Trump questions whether the DNC cyberattack was carried out by a state-sponsored group or a lone hacker. “It could be Russia, but it could also be China. It could also be lots of other people. It also could be somebody sitting on their bed that weighs 400 pounds.”
October-November 2016 – Over the course of a month, WikiLeaks publishes more than 58,000 messages hacked from the account of John Podesta, Clinton’s campaign chairman.
October 6, 2016 – DCLeaks, a self-described collective of “hacktivists” seeking to expose the influence of special interests on elected officials, publishes a batch of documents stolen from Clinton ally Capricia Marshall. DCLeaks is later identified as a front for Russian military intelligence.
October 7, 2016 – The Department of Homeland Security and the Office of National Intelligence on Election Security issues a statement declaring that the intelligence community is “confident that the Russian Government directed the recent compromises of emails from US persons and institutions.” According to the statement, document releases on websites WikiLeaks and DCLeaks mirror the methods and motivations of past Russian-directed cyberattacks.
November 29, 2016 – A group of Democratic senators sends a letter to President Barack Obama calling on intelligence agencies to declassify information about “the Russian Government and the US election.” Sources later tell CNN that new intelligence has been shared with lawmakers suggesting that Russia’s purpose for meddling in the election was to sway voters towards Trump, rather than broadly undermining confidence in the system.
December 9, 2016 – The Washington Post reports the CIA has determined that Russian hacking was conducted to boost Trump and hurt Clinton during the presidential campaign. The Trump transition team dismisses the CIA’s findings, releasing a statement, “These are the same people that said Saddam Hussein had weapons of mass destruction.” President Obama asks intelligence agencies to review the hacking incidents in 2016 and other cyberattacks on political campaigns dating back to 2008. The agencies are asked to deliver their findings before Obama leaves office on January 20. A Russian foreign ministry spokesman expresses skepticism about the review and asks US investigators to share their evidence of government-sponsored cyber espionage. Meanwhile, media critics question the Post’s reliance on anonymous sources for the CIA report and advise readers to be wary of claims in the article due to the lack of publicly available evidence to support the spy agency’s conclusions.
December 10, 2016 – John McCain, Chuck Schumer, Lindsey Graham and Jack Reed issue a joint statement calling on Congressional Republicans and Democrats to work cooperatively on securing future elections and stopping cyber attacks.
December 11, 2016 – Sources tell CNN that although US intelligence agencies share the belief that Russia played a role in the computer hacks, there is disagreement between the CIA and the FBI about the intent of the meddling. While the CIA assessment shows that the Russians may have sought to damage Clinton and help Trump, the FBI has yet to find proof that the attacks were orchestrated to elect the Republican candidate, according to unnamed officials. Furthermore, some sources say the hackers also infiltrated the Republican National Committee’s computers.
December 12, 2016 – CNN reports that Russian hackers accessed computer accounts of Republican lawmakers and GOP organizations. A source with knowledge of the investigation says that even though hackers breached the GOP computers, they opted not to release documents en masse.
December 13, 2016 – The New York Times publishes a detailed account of the DNC’s delayed response to initial warnings in September of 2015 that its network had been infiltrated by hackers. The report outlines how phishing emails and communication failures led to a sweeping cyberattack. The story also lays out evidence that Guccifer 2.0 and DCLeaks were linked to Russia. A second article in the Times chronicles the hacking of Democratic Congressional Campaign Committee, housed in the same building as the DNC. According to the report, Guccifer 2.0 stole tens of thousands of documents and offered them to reporters in districts where Democratic candidates were engaged in competitive races for House seats.
December 29, 2016 – President Obama issues an executive order with sanctions against Russia. The order names six Russian individuals who allegedly took part in the presidential campaign hacking. Additionally, 35 Russian diplomats are ordered to leave the US within 72 hours.
January 3, 2017 – Julian Assange of WikiLeaks says that the Russian government did not provide him with the hacked DNC emails during an interview with Sean Hannity on the Fox News Channel.
January 3-4, 2017 – In a series of tweets, Trump questions the US intelligence community’s claims that the Russian government interfered with the election. He alleges that intelligence officials have delayed a scheduled meeting with him but sources tell CNN that there has been no change to the schedule. Trump also cites Assange’s interview to back his assertion that a rogue hacker, not the Russian government, may have meddled in the election.
January 5-6, 2017 – Intelligence officials meet separately with Obama and Trump to present the results of their probe into cyber espionage during the presidential campaign. After the president and the president-elect are briefed, the Office of the Director of National Intelligence releases a declassified version of its classified report on Russian meddling. According to the report, hackers did not breach voting machines or computers that tallied election results but Russians meddled in other ways. Putin ordered a multifaceted influence campaign that included spreading pro-Trump propaganda online and hacking the DNC and Podesta. Bracing for a possible Clinton win, Russian bloggers were prepared to promote a hashtag #DemocracyRIP on election night. Paid social media users, aka “trolls,” shared stories about Clinton controversies to create a cloud of scandal around her campaign.
January 6-7, 2017 – Trump issues a statement after his meeting with intelligence officials. In the statement, he acknowledges that the Russian government may have been linked to the DNC hacking but declares that cyberattacks did not impact the outcome of the election because voting machines were not breached. In a series of tweets, he repeats that hacking did not affect election results and says that he wants to improve relations with Russia.
March 10, 2017 – In an interview with the Washington Times, Trump ally Roger Stone says that he had limited interactions via Twitter with Guccifer 2.0 during the campaign. He says the exchanges were “completely innocuous.” The following day, the New York Times publishes its own interview with Stone, in which he says that his communication with Guccifer 2.0 took place after the DNC hack, proving there was no collusion with the Trump campaign to arrange the cyber attack.
June 1, 2017 – In public remarks, Putin says that hacking during the presidential election campaign may have been carried out by patriotic Russian citizens who felt compelled to respond to perceived slights against Russia from America. Putin says, however, that the Russian government played no role in the cyber attacks. During an interview days later, Putin says that a child could have easily hacked the American presidential campaign.
June 5, 2017 – An investigative website, the Intercept posts a report that the Russian government coordinated a spear-phishing attack on computers at an American voting machine company and compromised at least one email account. The article is based on an NSA memo that was leaked to the Intercept. Hours after the story is published, the source of the leak is identified as a government contractor named Reality Leigh Winner, 25. She is charged with transmitting classified information.
June 21, 2017 – During a Senate hearing, a Department of Homeland Security official says that hackers linked to the Russian government targeted voting systems in up to 21 states.
July 25, 2017- A bipartisan bill limiting Trump’s power to ease sanctions against Russia passes in the House by a 419-3 vote. The measure also imposes new sanctions on North Korea and Iran.
July 27, 2017 – The Russia sanctions bill passes in the Senate 98-2. White House communications director Anthony Scaramucci tells CNN that the president may veto the bill and negotiate a tougher deal.
July 28, 2017 – In a reversal, the White House announces that Trump intends to sign the sanctions bill into law.
July 30, 2017 – Putin announces that 755 employees at US diplomatic missions in Russia will be ousted from their posts in response to sanctions.
August 2, 2017 – Trump says the Russia sanctions bill is “seriously flawed” but he signs it anyway.
September 6, 2017 – In a blog post, Facebook announces that more than 3,000 advertisements posted on the social network between June 2015 and May 2017 were linked to a Russia. The Washington Post reports that the ads came from a Russian company called the Internet Research Agency.
September 22, 2017 – The DHS notifies select states that hackers targeted their election infrastructure before the vote on November 8, 2016. Although vote-counting systems were not impacted, computer networks containing voter info may have been scanned by Russian hackers. Some states reported attempts to infiltrate their computer systems.
October 3, 2017 – CNN reports that a number of the Russia-linked Facebook ads were geographically targeted to reach residents of Michigan and Wisconsin. Trump defeated Clinton by a narrow margin in both battleground states.
October 12, 2017 – CNN publishes an investigation of Russian trolls who posed as a group of Black Lives Matter activists during the presidential campaign. They used a variety of platforms including Tumblr and Pokemon Go to reach voters.