Russian military intelligence targeted the Colorado Springs-based U.S. Anti-Doping Agency with a four-year hacking and smear campaign, according to a federal indictment unsealed Thursday.
The indictment, handed down by a grand jury in Pennsylvania, charges seven Russian military intelligence agents with “computer hacking, wire fraud, aggravated identity theft, and money laundering.” Federal prosecutors say the goal was to discredit the Anti-Doping Agency after it “exposed a Russian state-sponsored athlete doping program.” The hackers targeted anti-doping agencies in Canada and Europe, too.
“These illegal and malicious acts were a desperate attempt to divert attention away from Russia’s state-sponsored doping program and were part of a broader scheme of corrupt and unethical behavior by the Russian government to manipulate international Olympic sport,” the Anti-Doping Agency said in a Thursday statement.
The hacking program kicked off as investigators with the World Anti-Doping Association probed reports of state-sponsored use of illegal performance-enhancing drugs by Russian athletes at the 2014 Winter Games in Sochi, Russia. That investigation led to Russian athletes being banned from the 2016 games.
The Justice Department says Russian hackers targeted the Colorado Springs agency and other athletes and entities with attempts to hack email systems, obtain medical and other records and invade social media accounts. The Anti-Doping Agency, which monitors U.S. athletes for drug use, partners with the U.S. Olympic Committee, also in Colorado Springs, to keep drugs out of the games.
If this hacking scheme sounds familiar, it should. Hackers in the anti-doping case are tied to “Fancy Bear,” a Russian hacking operation that U.S. intelligence officials say worked to sway the 2016 U.S. presidential election. Two of the seven intelligence agents charged in the sports-hacking scheme also were charged in the investigation by special counsel Robert Mueller.
As part of the sports hacking, the Justice Department says, Russian agents worked in Brazil during the 2016 summer games, using systems including hotel Wi-Fi networks to gather dirt.
In Brazil, the Russian agents tailed U.S. Anti-Doping officials in attempts to crack their computers. The scheme included a full set of hacking equipment mounted in the trunk of a rental car. Eventually, through hacks a “spear-fishing” emails, they gained access to a anti-doping agency account, the indictment says.
They gained access to a treasure trove of data from the Colorado Springs agency including “90,000 messages and an estimated 10 gigabytes of data, which included summaries of athlete test results and prescribed medications.”
Hacked information and altered documents naming athletes and linking them to various ailments and addictions were shared selectively with media outlets in a bid to discredit doping allegations against the Russian Olympic squad.
Attorney General Jeff Sessions said the hackers targeted several U.S. entities, from the Colorado Springs agency to the Pennsylvania-based Westinghouse Electric Corp.
“State-sponsored hacking and disinformation campaigns pose serious threats to our security and to our open society, but the Department of Justice is defending against them,” Sessions said.
The same hackers, federal prosecutors allege, are tied to an data-stealing operation in April targeting the Dutch-based Organization for the Prevention of Chemical Weapons. In that case, police seized hacking equipment found in the trunk of a rental car. Information obtained in that case helped investigators nail down the Colorado Springs hacking.
The sports hacking also has ties to other Russian military intelligence operations. The hack attempts at Westinghouse included work to uncover the firm’s nuclear power secrets.
U.S. intelligence officials have maintained in the past that most large hacking operations by Russian military intelligence are approved by Vladimir Putin.
Vance Brown, who heads the Colorado Springs-based National Cybersecurity Center, said the hacking in Colorado Springs should be a wake-up call to area businesses and nonprofits.
“Everybody needs to up their game and take this very seriously,” Brown said.
But Fancy Bear’s involvement in targeting Colorado Springs “is certainly not surprising,” he said. “Russian interference is a real thing.”
The Russian hacking revelation comes after the International Olympic Committee lifted its ban on Moscow-sponsored teams and last month dropped a suspension of the Russian anti-doping program.
In February, the IOC ruled that Russian teams will compete in the 2020 Tokyo games. The decision sparked ire among American officials, with the outgoing chairman of the U.S. Olympic Committee’s board slamming the decision.
“Suggesting that Russia has lived up to its obligations is disingenuous,” Larry Probst said last month at the Olympic Assembly in Colorado Springs.
It remained unclear Wednesday whether Russia could face more Olympic sanctions over the hacking scheme.
The U.S. Anti-Doping Agency said the indictments alone could slow sporting shenanigans.
“Those who attempt to violate the rights of clean athletes and corrupt the integrity of sport will be held accountable for their actions,” the agency said in a news release.
Contact Tom Roeder: 636-0240 Twitter: @xroederx