Timeline:September 2015 - The FBI contacts the Democratic National Committee's help desk,
cautioning the IT department that at least one computer has been compromised by Russian
hackers. A technician scans the system and does not find anything suspicious.
April 2016 - Hackers create a fake email account
and use it to send spear-phishing emails to more than thirty Clinton staffers, according to investigators. In the emails, the hackers embed a link purporting to direct the recipient to a document titled "hillaryclinton-favorable-rating.xlsx." The link directs the recipients' computers to a website operated by the hackers. That same month, hackers use stolen credentials to access the Democratic Congressional Campaign Committee computer network, stealing data with malware. They ultimately access 33 DNC computers and anonymously register a website called DC Leaks to publicize the release of documents.
May-June 2016 - The hackers steal thousands of emails from the DNC server and begin to conceal their efforts.
June 12, 2016 -
During an interview on British television, WikiLeaks founder Julian Assange
says that the website has obtained and will publish a batch of campaign emails.
June 14, 2016 - The Washington Post reports
hackers working for the Russian government accessed the DNC's computer system, stealing oppositional research on Trump and viewing staffers' emails and chat exchanges. The Kremlin, however, denies that the government was linked to the hack and a US official tells CNN that investigators have not yet concluded that the cyberattack was directed by the Russian government.
June 15, 2016 -
Crowdstrike, a cybersecurity firm hired by the DNC, posts a public notice on its website
describing an attack on the political committee's computer network by two groups associated with Russian intelligence. According to the post, two groups called "Cozy Bear" and "Fancy Bear" tunneled into the committee's computer system. In response, the hackers create a persona called Guccifer 2.0, a self-described Romanian blogger who claims that he alone conducted the theft.
July 22, 2016 -
Days before the Democratic National Convention, WikiLeaks
publishes nearly 20,000 emails hacked from the DNC server.
The documents include notes in which DNC chair Debbie Wasserman Schultz insults staffers from the Bernie Sanders
campaign as well as messages that suggest the organization was favoring Clinton rather than remaining neutral. Wasserman Schultz resigns as DNC chair in the aftermath of the leak.
July 25, 2016 - The FBI announces it has launched an investigation into the hack.
Officials tell CNN they think the cyberattack is linked to Russia.
July 27, 2016 - During a press conference,
Trump talks about Clinton's use of a private email server while she was secretary of state and calls on hackers to find deleted emails.
"Russia, if you're listening, I hope you're able to find the 30,000 emails that are missing," says Trump. Newt Gingrich,
a Trump surrogate, defends Trump in a Tweet, dismissing the comment as a "joke."
August 12, 2016 - Hackers publish cell phone numbers and personal email addresses
for Nancy Pelosi
and members of the Democratic Congressional Campaign Committee.
September 1, 2016 -
During an interview with Bloomberg News, Russian President Vladimir Putin
says that he and the Russian government have no ties to the hackers.
He says that the identity of the culprit or culprits is not as important as the content of the leaks and ultimately the hackers have revealed important information for voters.
September 22, 2016 -
Democrats Dianne Feinstein and Adam Schiff, ranking members of the Senate and House Intelligence Committees, issue a joint statement
declaring that based on information they received during congressional briefings, they believe Russian intelligence agencies are carrying out a plan to interfere with the election. They call on Putin to order a halt to the activities.
September 26, 2016 - During a presidential debate,
Trump questions whether the DNC cyberattack was carried out by a state-sponsored group or a lone hacker. "It could be Russia, but it could also be China. It could also be lots of other people. It also could be somebody sitting on their bed that weighs 400 pounds."
October-November 2016 -
Over the course of a month, WikiLeaks publishes more than 58,000 messages
hacked from Podesta's account.
October 6, 2016 - DC Leaks publishes a batch of documents stolen from Clinton ally Capricia Marshall.
October 7, 2016 -
The Department of Homeland Security and the Office of National Intelligence on Election Security issue a statement
declaring that the intelligence community is "confident that the Russian Government directed the recent compromises of emails from US persons and institutions." According to the statement, document releases on websites WikiLeaks and DCLeaks mirror the methods and motivations of past Russian-directed cyberattacks.
November 29, 2016 - Democratic senators send a letter
to President Barack Obama
calling on intelligence agencies to declassify information about "the Russian Government and the US election." Sources later tell CNN
that new intelligence has been shared with lawmakers suggesting that Russia's purpose for meddling in the election was to sway voters towards Trump, rather than broadly undermining confidence in the system.
December 9, 2016 - The Washington Post reports
the CIA has determined that Russian hacking was conducted to boost Trump and hurt Clinton. The Trump transition team dismisses the report and criticizes the CIA.
Obama asks intelligence agencies to review the hacking incidents and other cyberattacks on political campaigns
dating back to 2008. The agencies are asked to deliver their findings before Obama leaves office on January 20. A Russian foreign ministry spokesman expresses skepticism about the review and asks US investigators to share their evidence of government-sponsored cyber espionage.
December 10, 2016 - John McCain, Chuck Schumer, Lindsey Graham
and Jack Reed issue a joint statement
calling on Congress to work on securing future elections and stopping cyberattacks.
December 11, 2016 - Sources tell CNN
that although US intelligence agencies share the belief that Russia played a role in the computer hacks, there is disagreement between the CIA and the FBI about the intent of the meddling. While the CIA assessment shows that the Russians may have sought to damage Clinton and help Trump, the FBI has yet to find proof that the attacks were orchestrated to elect the Republican candidate, according to unnamed officials. Furthermore, some sources say the hackers also infiltrated the Republican National Committee's computers.
December 12, 2016 - CNN reports that Russian hackers accessed computer accounts of Republican lawmakers and GOP organizations.
A source with knowledge of the investigation says that even though hackers breached the GOP computers, they opted not to release documents.
December 13, 2016 - The New York Times publishes a detailed account
of the DNC's delayed response to initial warnings in September of 2015 that its network had been infiltrated by hackers. The report outlines how phishing emails and communication failures led to a sweeping cyberattack. The story also lays out evidence that Guccifer 2.0 and DCLeaks were linked to Russia. A second article in the Times chronicles the hacking of the DCCC.
According to the report, Guccifer 2.0 stole tens of thousands of documents and offered them to reporters in districts where Democratic candidates were engaged in competitive races for House seats.
December 29, 2016 - Obama issues an executive order with sanctions against Russia.
The order names six Russian individuals who allegedly took part in the hacking. Additionally, 35 Russian diplomats are ordered to leave the US within 72 hours.
January 3, 2017 -
Assange says that the Russian government did not provide him with the hacked DNC emails during an interview with Sean Hannity on the Fox News Channel.
January 3-4, 2017 -
In a series of tweets, Trump questions the US intelligence community's claims that the Russian government interfered with the election.
He alleges that intelligence officials have delayed a scheduled meeting with him but sources tell CNN that there has been no change to the schedule. Trump also cites Assange's interview to back his assertion that a rogue hacker, not the Russian government, may have meddled in the election.
January 5-6, 2017 -
Intelligence officials meet separately with Obama and Trump to present the results of their probe into cyber espionage during the presidential campaign. After the president and the president-elect are briefed, the Office of the Director of National Intelligence releases a declassified version of its classified report on Russian meddling
. According to the report, hackers did not breach voting machines or computers that tallied election results but Russians meddled in other ways.
Putin ordered a multifaceted influence campaign that included spreading pro-Trump propaganda online and hacking the DNC and Podesta, according to the report. Bracing for a possible Clinton win, Russian bloggers were prepared to promote a hashtag #DemocracyRIP on election night. Paid social media users shared stories about Clinton controversies to create a cloud of scandal around her campaign.
January 6-7, 2017 - Trump issues a statement after his meeting with intelligence officials.
In the statement, he acknowledges that the Russian government may have been linked to the DNC hacking
but declares that cyberattacks did not impact the outcome of the election because voting machines were not breached. In a series of tweets, he repeats that hacking did not affect election results and says that he wants to improve relations with Russia.
March 10, 2017 - In an interview with the Washington Times,
Trump ally Roger Stone says that he had limited interactions via Twitter with Guccifer 2.0 during the campaign. He says the exchanges were "completely innocuous." The following day, the New York Times publishes its own interview with Stone,
in which he says that his communication with Guccifer 2.0 took place after the DNC hack, proving there was no collusion with the Trump campaign to arrange the cyberattack.
May 17, 2017 -
Deputy Attorney General Rod Rosenstein appoints former FBI Director Robert Mueller
as special counsel to lead an investigation into Russian interference and related matters that could result in criminal prosecutions.
June 1, 2017 -
In public remarks, Putin says that hacking may have been carried out by patriotic Russian citizens
who felt compelled to respond to perceived slights against Russia from America. Putin says, however, that the Russian government played no role in the cyberattacks. During an interview days later, Putin says that a child could have easily committed the hacking.
June 5, 2017 -
An investigative website, the Intercept posts a report
that the Russian government coordinated a spear-phishing attack on computers at an American voting machine company and compromised at least one email account. The article is based on an NSA memo that was leaked to the Intercept. Hours after the story is published, the source of the leak is identified
as a government contractor named Reality Leigh Winner, 25. She is charged with transmitting classified information.
June 21, 2017 - During a Senate hearing,
a Department of Homeland Security official says that hackers linked to the Russian government targeted voting systems in up to 21 states.
July 30, 2017 - Putin announces that 755 employees at US diplomatic missions in Russia will be ousted from their posts in response to sanctions.
September 6, 2017 -
In a blog post, Facebook
announces that more than 3,000 advertisements
posted on the social network between June 2015 and May 2017 were linked to Russia. The Washington Post reports that the ads came from a Russian company called the Internet Research Agency.
September 22, 2017 - The DHS notifies select states that hackers targeted their election infrastructure before the vote on November 8, 2016.
Although vote-counting systems were not impacted, computer networks containing voter info may have been scanned by Russian hackers. Some states reported attempts to infiltrate their computer systems.
October 12, 2017 - CNN publishes an investigation
of Russian trolls who posed as a group of Black Lives Matter activists during the presidential campaign
. They used a variety of platforms including Tumblr and Pokemon Go to reach voters.
February 16, 2018 -
The Department of Justice announces that Mueller has indicted 13 Russian nationals
and three Russian entities for allegedly meddling in the 2016 election, charging them with conspiracy to defraud the United States.
July 3, 2018 -
The Senate Intelligence Committee releases a report
concluding that the intelligence community's January 2017 assessment of election meddling was accurate. According to the summary, the intelligence agencies were correct in their finding that the goal of the election interference was to help Trump rather than simply create confusion.
July 13, 2018 - The Justice Department announces indictments against 12 members of the Russian intelligence agency, GRU,
as part of Mueller's ongoing investigation. The indictment accuses the Russians of engaging in a "sustained effort" to hack emails and computer networks associated with the Democratic party during the 2016 presidential campaign.
July 16, 2018 - During a joint press conference with Putin in Helsinki,
Trump says that the Russian president was "extremely strong and powerful" in his denial that his country interfered with the 2016 election. Trump says, "I don't see any reason why it would be Russia." One day later, he clarifies his remark.
"The sentence should have been, 'I don't see any reason why it wouldn't be Russia,'" Tru