US-Russia tensions rise as malware found at Vermont electric utility

Extract from The Guardian

• Burlington electric department says it found code
• New York compound allegedly linked to Russian intelligence is evacuated

On Thursday, Barack Obama ordered the expulsion of 35 Russian diplomatic personnel. Photograph: Pablo Martinez Monsivais/AP

Lauren Gambino in Washington and Edward Helmore in New York

Sunday 1 January 2017 03.34 AEDT 

A day after Barack Obama announced tough new sanctions over what intelligence agencies believe to be Russian attempts to influence the presidential election in favour of Donald Trump, US officials said computer code linked to Russian-sponsored hackers had been detected in a computer at a Vermont electric utility.

The municipally run Burlington electric department confirmed on Friday that it had found, in a laptop not connected to grid systems, malware code used in Grizzly Steppe, the name the Department of Homeland Security (DHS) and FBI have applied to a Russian campaign linked to cyber-attacks on the Democratic National Committee and other political organizations.
The Washington Post first reported the discovery.
On Thursday, the day on which Obama announced the new sanctions, the DHS and the FBI published a report detailing what they called Russia’s “ongoing campaign of cyber-enabled operations directed at the US government and its citizens”.
After the discovery in Vermont, however, officials said they did not know when the code was placed in the laptop computer or what the intentions behind it may have been. Russian malware is regularly found inside computers used by US utilities.
Vermont Democrats reacted strongly. The state’s governor, Peter Shumlin, said in a statement: “Vermonters and all Americans should be both alarmed and outraged that one of the world’s leading thugs, Vladimir Putin, has been attempting to hack our electric grid, which we rely upon to support our quality of life, economy, health, and safety.”
Peter Welch, a US representative, said Russian hacking was “rampant… systemic, relentless, predatory” and added: “They will hack everywhere, even Vermont, in pursuit of opportunities to disrupt our country.”
The FBI and DHS report appeared to confirm one aspect of the Russian hacking programme: the gaining of access to Democratic party emails through the use of fraudulent emails that tricked recipients into revealing passwords. Such emails were released by WikiLeaks during the election, to the perceived disadvantage of the Democratic candidate, Hillary Clinton.

‘They fly under the radar’

The gates at Killenworth remained firmly closed on Friday. Photograph: THE GUARDIAN

The reports from Vermont came at the end of a tense week in US-Russian relations that also placed the Obama White House and the incoming Trump administration further at odds with each other.

On Thursday, Obama ordered the expulsion of 35 Russian diplomatic personnel and the closure of country estates in Maryland and New York used by embassy staff.
By midday on Friday, the New York compound Elmcroft in Upper Brookville, on Long Island’s Gold Coast, had been evacuated. The gates were chained shut and US state department personnel were posted outside, in a black SUV.
The Obama administration claimed the compound had been “used by Russian personnel for intelligence-related purposes”. Russia’s ambassador to the United Nations, Vitaly Churkin, disagreed, accusing the White House of targeting children by closing compounds he said were used by families over the Christmas and New Year vacation.
“It’s quite scandalous that they chose to go after our kids, you know?” Churkin told reporters. “They know full well that those two facilities ... they’re vacation facilities for our kids.”
The Elmcroft compound is five miles from another cold war-era Russian compound, Killenworth, in Glen Cove, an area known for its Gatsby-esque estates and golf courses. There, the gates were closed and the intercom went unanswered.
The last time diplomatic hostilities broke out in Glen Cove, mayor Reginald A Spinello told the Guardian, was more than 50 years ago, when Nikita Khrushchev visited and locals threw food at his limousine.
“What happens behind those doors is anyone’s guess, but it’s our understanding it’s mostly caretakers there now,” said Spinello. “They fly under the radar. They pay their bills. The most we ever see is a diplomatic licence plate or two.”

‘All Americans should be alarmed’

With the Trump inauguration three weeks away, the latest US-Russian dispute could yet prove to be short-lived. Despite Obama’s assertion on Thursday that “all Americans should be alarmed by Russia’s actions”, Trump has repeatedly questioned claims of Russian responsibility for hacking.
He has also lavished praise on Putin and called for better relations with Russia, putting himself at odds with the Republican congressional leadership, key members of which welcomed Obama’s sanctions and called for tougher measures to follow.
The Arizona senator John McCain, the chair of the Senate armed forces committee, who has scheduled a hearing on Russian cyber-intrusions for next week, told Ukrainian TV on Friday he saw such activity as “an act of war”.
On Thursday, however, Trump’s incoming White House press secretary, Sean Spicer, said claims of Russian meddling in the election were part of an effort to undercut Trump’s mandate to govern.
“You have a lot of folks on the left who continue to undermine the legitimacy of his win,” he said in a call with reporters. Trump defeated Clinton by 304 votes to 227 in the electoral college; Clinton won the popular vote by close to 3m ballots.
After the announcement of the US sanctions, the Russian foreign minister, Sergey Lavrov, recommended a proportional response. Putin, however, declined to engage, signalling instead that he would wait to see how relations formed with the incoming administration.
Trump, who said it was “time for our country to move on to bigger and better things”, did agree to meet intelligence officials next week. On Friday, he used Twitter to say Putin was “very smart”.

The tweet was pinned to the top of his timeline, so anyone who visited his feed would see it. It seemed as much an attempt to shock the political establishment as a way to disparage Obama.
Trump continues to ridicule the president in public, even as he admits to having “productive” and frequent phone conversations with him. The two men spoke by phone on Wednesday and the White House informed Trump of the sanctions before they were announced the next day, the Trump transition team told reporters.
Later on Friday, Trump turned his attention to the US media, complimenting Fox News for its coverage of Russia but criticising that of NBC and CNN – and in doing so, once again implicitly praising Putin.
On Long Island, meanwhile, the expulsions were being treated largely as a passing dispute. Many local residents said they were only dimly aware of the Russians’ presence.
“They’re not unfriendly,” said one Locust Valley contractor, who declined to give his name. “The spying is no big deal. It’s no more than what we do to them. Obama’s just getting back at them.”