The Leaked NSA Report Is Being Read Backward

(Bloomberg View) -- The publication that revealed a classified National Security Agency report on alleged Russian attempts to hack U.S. election-related systems, treats the report  as possible evidence that Russia tried to rig the vote. More likely, however, the Kremlin expected the vote to be rigged in favor of Hillary Clinton.

According to the leaked report, the Russian military intelligence, GRU, ran a spear-phishing campaign targeting the employees of VR Systems, a voting hardware and software producer. At least one of its employee accounts was apparently compromised. Then, the hackers used the harvested credentials to trap local government officials in charge of organizing elections. Emails, coming credibly from a VR Systems employee, contained malware that would have allowed the GRU (although the report provides no clues as to how the attribution was made) to control the computers of these local officials. The NSA doesn't seem to have determined whether the hackers managed that with any of their targets.

QuickTake The Russian Hacking Probe

Reality Winner, the 25-year-old NSA contractor accused of leaking the report to The Intercept, had an apparent motive: Her Twitter feed (under the name Sara Winners) shows she was disappointed when Trump won. So far, Russia's alleged help to Trump in the 2016 election has amounted to Russian sources stealing and publishing some emails and documents related to the campaign of Trump's rival, Hillary Clinton. That's not particularly dangerous to Trump unless it can be shown that his campaign colluded with the hackers -- or that Russia tried to influence the actual vote count. The report appears to imply just that.

In reality, even if the allegedly GRU-affiliated hackers got into the computers of local officials in the states where VR Systems technology was used, they couldn't have changed the election outcome.

VR doesn't actually make voting machines. It makes electronic poll books that make paper voter rolls unnecessary. They allow an election worker to check a voter's personal data against the rolls and issue a ballot. By messing with such a system, hackers could produce confusion, making it difficult for voter names to be verified. They could even enable ineligible people to vote -- but for such a ploy to work, there would need to be large numbers of such ineligible people available for a massive fraud operation on voting day.

The Intercept story suggests that the same local officials who handle the electronic voter rolls also manually install updates on the voting machines. If so, they could inadvertently infect the voting equipment with malware. But even if that happened, it didn't swing any states Trump's way.

There is reason to suspect that the U.S. intelligence community knew about the VR Systems hack in December, 2016; the company isn't mentioned by name in news stories from that time, though the geography and nature of reported breaches suggested it was the target. But results in the states that use VR equipment and software -- Florida, Illinois, Indiana, New York, North Carolina, Virginia and West Virginia -- were not challenged. They yielded no surprises compared with polling data.

Clinton carried Illinois, New York, California and Virginia. She was so far behind in Indiana and West Virginia that it's difficult to suspect the results were tweaked. Trump won the too-close-to-call races in North Carolina and Florida, but the big surprises -- the ones that clinched the Electoral College -- came in Pennsylvania, Michigan and Wisconsin, where VR Systems isn't present.

In any case, even in the states where VR Systems equipment was used, it would have been extremely difficult to infect the voting machines. A great variety of equipment is used by the different counties. In Florida, where I was on election day to watch the results come in, Trump won in counties that use touchscreens and in those that stick to paper ballots. There was no clear pattern to suggest a hack or a rigging operation.

I have written before that it's not impossible to rig a U.S. presidential election (and was ridiculed for saying so). The rigging, however, would require a vast conspiracy spanning the entire country and involving local election officials -- the kind that exists in Russia. Trump, with his cheap, hastily thrown together campaign infrastructure could have achieved nothing of the kind, but, as the election campaign drew to a close, he appeared to fear such an effort from Barack Obama's Democratic administration.

Experts pooh-poohed this conspiracy talk, pointing out how disparate the U.S. election system was and what a massive clandestine effort would be required to subvert it. In Moscow, there were people telling President Vladimir Putin that Clinton had all the levers (financial and intelligence service contacts) to falsify a vote. Whether or not Putin agreed, he would have had a lively interest in checking whether Clinton, whom he has long hated, won the election fraudulently. One way to find evidence of fraud would be to watch electoral rolls -- for example, for the sudden inclusion of large numbers of additional voters. Reading the emails and computer files of local election officials for signs of a rigging conspiracy would have been helpful, too.

In other words, hacking VR Systems and the local officials would have been much more useful to the GRU if it had been conducting an intelligence operation to detect pro-Clinton fraud than if it had been planning to rig the election.

That, of course, doesn't rule out collusion between the Kremlin and the Trump campaign when it came to releasing damaging information about Clinton. That is still for U.S. authorities to investigate. But the NSA report, which is likely to land Reality Winner in prison, at best provides additional evidence of Putin's skepticism of Trump's ability to beat the U.S. establishment, not of his meddling with vote results.

Russia doesn't run the U.S. -- American voters do, even if they have excellent reasons today to regret their decision of November 8.

This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.

Leonid Bershidsky is a Bloomberg View columnist. He was the founding editor of the Russian business daily Vedomosti and founded the opinion website Slon.ru.

To contact the author of this story: Leonid Bershidsky at lbershidsky@bloomberg.net.

To contact the editor responsible for this story: Therese Raphael at traphael4@bloomberg.net.

For more columns from Bloomberg View, visit http://www.bloomberg.com/view.