The Rest Is Classified
The Rest Is Classified

133. How Russia Made Trump: Romanian Hackers, WikiLeaks, and Hillary’s Emails (Ep 3)

March 03, 2026 • 43m

Summary

⏱️ 8 min read

Overview

Gordon Carrera and David McCluskey examine the 'leak' phase of Russia's 2016 election interference operation, tracing how GRU hackers moved from stealing DNC emails to weaponizing them through WikiLeaks. The episode reveals how Russian intelligence created digital fronts like DCLeaks and Guccifer 2.0, eventually partnering with Julian Assange to release damaging emails that exposed DNC bias against Bernie Sanders and undermined Hillary Clinton's campaign just before the Democratic Convention.

The Challenge of Distribution: From Hack to Leak

After successfully infiltrating the DNC and Clinton campaign networks, Russian GRU hackers faced a critical problem: how to distribute the stolen information to maximize political impact. They created DCLeaks.com as their first front, attempting to pose as American hacktivists promoting transparency. Despite uploading stolen emails and documents, including attachments from John Podesta's inbox, the site initially gained little traction, prompting the hackers to seek more effective distribution channels.

  • GRU registered DCLeaks.com using $37 worth of Bitcoin, one day after compromising the DNC
  • The site featured a sleek logo with DC in blue and a white Capitol silhouette, branding themselves as American hacktivists
  • Initial uploads included 72 random attachments from John Podesta's inbox, published without reference to him
  • GRU attempted amplification through fake Facebook persona 'Melvin Reddick' but nobody noticed
  • The hackers were extracting gigabytes of data through a command and control machine leased in Illinois
" You just dump the stuff and then you let journalists sift through it and find what they want and find their stories within it. It's a slightly different model from the active measures of the past. "

Active Measures in the Digital Age

The episode reveals how traditional Soviet-era 'active measures' evolved for the internet age. Instead of carefully placing disinformation in obscure publications and waiting for it to spread, modern operations involve massive data dumps that allow journalists and the public to find their own narratives. This approach is more efficient but also more chaotic, as the GRU discovered when their initial distribution attempts failed and they needed WikiLeaks' established platform to achieve their goals.

  • Modern active measures involve dumping raw data and letting journalists sift through it, unlike Cold War methods
  • This approach was pioneered with North Korean hack of Sony Pictures, where embarrassing executive emails were released
  • Journalists face ethical dilemmas about using leaked material when they may be manipulated by foreign intelligence
  • GRU posed as 'American hacktivists' supporting 'freedom of speech and transparency'
" It's a slightly different model from the active measures of the past. And it's one that relies on journalists, often Western journalists, to be picking through this material. "

📚 7 more sections below

Sign up to unlock the complete summary with all insights, key points, and quotes