(Not) hacked Macron

In the case of Kiberatak for the election headquarters of France President Emmanuel Macron, two directly opposite news appeared in recent days. On the one hand, the French authorities said that Russian hackers, apparently, were not involved in the hacking e -mail of the macron headquarters. On the other hand, two Russian publications immediately published materials, at least indirectly confirming the possibility of communication between hackers who attacked the election headquarters and Russian special services.

Recall that on the night of May 6, on the eve of the second round of the presidential election in France, WikiLeaks published an array of documents of the election headquarters of Emmanuel Macron. The headquarters then stated that they became victims of a "coordinated hacker operation." The data made no special sensations or the murderous compromising evidence of WikiLeaks did not contain data, and it was not easy to understand them due to a huge volume. This story practically did not affect the outcome of the elections: Macron defeated his rival, the leader of the National Front and the favorite of the Kremlin Marin Le Pen, with a margin of more than 30% of the vote. Nevertheless, in Paris they started talking about the “Russian trace” in this hacker attack, which looked quite likely, given that in the USA the involvement of Russian hackers in cyber attacks during the election campaign became the subject of a thorough investigation .

Presidents of France and Russia Emmanuel Macron and Vladimir Putin during negotiations in Versailles, May 29, 2017

However, on June 2, the head of the National Safety Agency of French Information Systems Guillaume Pupar said that, apparently, hackers from Russia are not involved in the leakage of materials from the macron headquarters. According to Pipap, the attack was "so simple" that "anyone could commit it and from nowhere." Pupar confirmed that his department also did not find traces of another hacker group, which is suspected of hacks during a presidential campaign in the United States.

This statement conflicts with the results of investigations conducted by two Russian publications - the project "Municipal Scanner" and The Insider . Both claim that at least one citizen of Russia is involved in the hacking of Macron's Posts, who cooperated - and, possibly, cooperating now - with the main reconnaissance management (GRU). In the metadata of some letters in WikiLeaks, as noted immediately after the cyber attack, The Insider, traces of an editorship made by a user named Georgy Petrovich Roshka were discovered. These are financial documents of the macron headquarters. It turned out that a person with that name worked in the St. Petersburg CJSC Eureka. During the further investigation, it was possible to establish curious details about this company and its owners.

Details of Radio Liberty were reported by the activist of the project "Municipal Scanner" Mikhail Maglov .

A lot of state contracts of this company surfaced with enterprises of the military-industrial complex

-Back in May, when these metadata surfaced, it was established that the only case on the Internet, when the name of George Petrovich Roshka pops up somewhere-this is the annual conference on parallel computing technologies in which he took part. There is a reference book with a listing of all participants where he was indicated as an employee of Eureka CJSC. We began to study what kind of company it is. A lot of state contracts of this company surfaced with enterprises of the military-industrial complex. But the bulk and main profile of this company is still the supply of printed equipment and advanced training courses for IT employees and the issuance of certificates. We decided to see who Eureka CJSC belongs. They saw in the register of legal entities that 80% of this company belongs to a certain Mr. Alexei Nikolaev, who has been working there for a long time. But our greater attention to this story was attracted by the second co -owner - Alexander Kinal, also such a person without a biography, who graduated from two universities at once in 1998 - economic and military . We found that this person at one time was an adviser to the president of the Almaz-Antei concern , this is a manufacturer of Bukov (a Russian anti-aircraft missile system ; according to the international investigative group, it was with the help of Buk in the summer of 2014 that the Malaysian passenger plane of the MN17 flight was shot down over Donbass) . But one of his key jobs is Lomo , which was successfully privatized in the early 90s, now the former Poles of Putin in the North-Western District Ilya Klebanov . Lomo is completely controlled by his family.

The same Roshka. Metadata of one of the files from "Macron Post"

And then we began to watch other intersections. It is interesting, in addition to Roshka, the employees of the two military units took part in this conference, who relate to the 16th Center of the FSB, as experts write who are engaged in obtaining intelligence information using the Internet outside of Russia. We also found a license that was issued by the Eureka CJSC FSB - to work using the information that constituted GOSTain. Several companies controlled by the Councilor of Euryk, Alexei Nikolaev, also had a similar license, and delivered for the military-industrial complex. Here we must understand that the state procurement scheme of the military-industrial complex is such a system for their own. Very few strangers supply anything to the Ministry of Defense, so it develops. The main suppliers are either directly related to the key functionaries of the military-industrial complex or the Ministry of Defense, or these are some of their friends, acquaintances.

- That is, " Eureka " is clearly a company, relatively speaking, " close to the body " ?

- Eureka, obviously, is very firmly connected with Ilya Klebanov. In the company of Lomo, he himself worked back in the Soviet years, and he managed to privatize it later. After he left the Permanent, he leads the "Sovcomflot" . Nevertheless, part of the defense complex, including this "eurica", it essentially controls. The second layer became interesting when we began to watch the political component. Because it turned out that Eureka was one of the main protests against the Okhta Center . Before the resignation of Valentina Matvienko from the post of Governor of St. Petersburg, when Ilya Klebanov was as a midday in the North-Western District, it was about the fact that, perhaps, it was he who, after the departure of Matvienko, would become a new governor.

"Eureka" is obviously very firmly connected with Ilya Klebanov

-That is, this company was involved in the subcover political struggle in St. Petersburg, part of which was the story with Okhta Center ?

- Yes. The leadership of Euryk took a direct part in it: they, among other things, hired lawyers, appealed to the courts, including the European Court of Human Rights. It was their claims that stopped the initial construction of the Okhta Center.

-If we return to the person with whom we started, to this Mr. Roshka- at least something else is known about him, except that he was involved in the activities of the Eureka company ? How does Eureka react to these messages if it reacts ? After all, there was a lot of noise around the hacking of the macron headquarters.

-"Eureka" completely denies that ever Roshka worked for them. Unfortunately, it is impossible to reliably check this. But at the same time, in their comments, they indicate that Mr. Roshka took part in conferences in 2016-17. On the one hand, they can know this quite, because the owners of Euryk have another joint business with the organizers of these conferences. But it was not possible to get any documentary evidence, because conferences organizers deleted absolutely all the lists of participants over all years. They disappeared completely. The only thing we managed to initially detect was the list for 2014. And then interesting events take place. It was possible to establish that another person who, in 2014, at least introduced himself as an employee of Euryk, a year later, literally, in 2015, already publishes his mathematical scientific articles, introducing himself as an employee of the Center for Special Development of the Ministry of Defense. Further - more. The INSIDER publication sent requests to all conference participants, they managed to get a conference program for 2016 - and saw that Mr. George Roshka is already there as an employee of the military unit, which belongs to the main intelligence department and is responsible for cryptography.

Vladimir Putin, Valentina Matvienko and Ilya Klebanov. Petersburg, July 2011

“Eureka” rests on the fact that they cannot control, who seems to whom, but, they say, they have nothing to do with these employees. As far as we understand, these are really the same people who, at different conferences in different years, act as representatives of different organizations: somewhere a military unit, somewhere the center of the Ministry of Defense, somewhere "Eureka". We have no doubt that they are interconnected. In this case, "Eureka" is simply such a civil cover. We managed to talk with the St. Petersburg journalist, which was directly in the office of this company, she described us the situation there. It is clear that they have a license for GOSTain, it is forbidden to move independently there. The public part of the work of Euryk is only a small part of the office, in the other part there are employees who at one time Olga Andronova (the wife of one of the co -owners of Eurica, died last year. - RS ) described as “promising talents”. We assume that "Eureka" is such a school of personnel of future cyber explorations.

"Eureka" is such a school

-There was a publication in the Forbes magazine very skeptical regarding the Russian roots of cyber attacks on the headquarters of Macron and, accordingly, attempts to influence the election campaign in France. There, a version of the fact that this could be a provocation: they threw it into the metadata pointer to Russia specifically in order to take attention from those who actually stood behind this.

- Yes, we also read such a version, it is very funny. Because if it were a certain provocation, then, probably, they would use the surname of a person who can be immediately determined with reliability as an employee of the Russian special services so that this was proved even before the voting day. But no, the elections have already passed, and the process of proving that Roshka is related to Russian cyber exploration takes a long time. Such a name, surname, patronymic is quite difficult to come up with. If someone wanted to make a provocation, they would really find an employee of some part of the FSB who is responsible for this activity, they would simply use it to be obvious. To use the surname, name, patronymic of a person about which almost nothing is known is such an absurdity.

-And the version, which President Putin voiced at the forum in St. Petersburg in relation to cyber attacks on the United States, is that it is someone's amateur performances, yes, maybe Russian, but these amateur ones, as he said, “ patriotic hackers ” , are you also awarded?

- We already heard this about three years ago from Putin, when he talked about patriotic amateur people who bought a military uniform in a military commissar and annexed a whole peninsula from a neighboring country.

Three years ago, Putin also talked about patriotic amateur people

- How, in this case, you relate to the newly known statement by the chief of the National Safety Agency of French Information Systems of France Mr. Popar that Russian hackers to the headquarters of Emmanuel Macron are not involved in the headquarters of Emmanuel Macron? What can stand behind this?

- Well, this is partly a question for a political scientist, which I am not, and I can’t judge if there is a political background, and if so, which one, behind the statement of the French authorities, is it related to the recent visit of Vladimir Putin to France, etc. On the other hand, I do not have purely technical data about what exactly and how the French IT specialists were checked in connection with the cyber headquarters for the macron election headquarters. I can only operate on the information that we found and released: in the materials related to hacking, the name of the person related to Eureka and one of the GRU divisions appears, ”says Mikhail Maglov, activist of the municipal scanner.