Updated Mar 6, 2018

Exclusive: The Illinois Republican who catfished Guccifer 2.0

Russian President Vladimir Putin is seen through a Twitter logo in this photo illustration. (Photo: Jaap Arriens / NurPhoto via Getty Images)

In August 2016, John Bambenek, a former Republican state senate candidate in Illinois, launched his own clandestine investigation of Guccifer 2.0, the public face of the Russian cyber break-in at the Democratic National Committee. What Bambenek found was that the Guccifer 2.0 persona — believed to be a cover for Russia's military intelligence arm — reflected a more slapdash chapter in the operation to sow U.S. election chaos than usually presented.

Why it matters: In transcripts of Twitter messages that Bambenek shared with Axios, Guccifer 2.0 seemed to be either careless or indiscriminate, apparently failing to do even a cursory check on Bambenek, and with only a vague understanding of what he was sharing.

How it happened: In June 2016, the DNC told the Washington Post that hackers apparently working for the Russian government had penetrated its computer networks. The day after, Guccifer 2.0 surfaced with the first of a trove of stolen DNC documents, including a 231-page dossier on Donald Trump, the start of a drumbeat of leaks that would dog Hillary Clinton's presidential campaign until she ultimately lost in November.

Not long after, Bambenek approached Guccifer 2.0, asking for documents to help the Republican cause. "I knew I had a good chance of passing the Google test for being a Republican, and it came at a time when Guccifer was probably receiving many inquiries from the press," he told Axios.

  • The two agreed that leaking documents on Illinois state races to arrange "for maximum impact" might aid Guccifer 2.0's efforts.
BAMBENEK: Among other things I am a Republican operative.

GUCCIFER 2.0: what r u gonna do with the docs?

BAMBENEK: Well it depends on the document. Emails about meeting for lunch, who cares. Emails that can affect an election, well, they'd be used for maximum impact.

GUCCIFER 2.0: i'll let u know if i find any
— From the introductory DM conversation on Aug. 12, 2016
  • So began what would become a two-month correspondence with Guccifer 2.0 over Twitter direct message, ultimately netting leaks of apparent DCCC files profiling Illinois districts (he named himself 2.0, apparently attempting to piggy-back on a Romanian hacker who called himself Guccifer.).

The catch: Bambenek wasn't wearing a GOP hat while conducting the conversation. Instead, he was an executive at Fidelis, a Bethesda, MD, cybersecurity firm that, along with CrowdStrike, had quickly attributed the attack to Russia. Bambenek was more or less just continuing the investigation out of curiosity.

The FBI was in the loop: "Every [direct message] I sent, every [one] I received was turned over to the FBI immediately. I assumed they would have been monitoring the account to begin with," Bambenek said.

  • Though Guccifer 2.0 provided him exclusive documents, they focused on almost comedically non-competitive races.

Bambenek's interactions show Guccifer 2.0 was not a precision operation:

  • With any vetting — even just a glance at Bambenek's Twitter bio, which mentioned his role at Fidelis — Guccifer 2.0 could have easily discovered that Bambenek was not who he said he was.
  • The documents Guccifer 2.0 funneled to Bambenek concerned races in Illinois House districts 01 and 08, neither of them competitive. Illinois 01, the south side Chicago district represented by Democrat Bobby Rush, hasn’t elected a Republican since the Roosevelt administration. Illinois 08, Sen. Tammy Duckworth's old district, wasn't a much safer bet.
  • "They were dumping documents in places there were no real Republicans. Even if there was a there there, it’d have to be something extreme — Roy Moore extreme," Bambenek told Axios.

Though an issue in the Mueller investigation, the Guccifer 2.0 campaign appeared to lack the US political savvy that would have suggested coordination with a domestic expert.

  • At one point, Guccifer 2.0 lost track of who Bambenek was entirely and appeared unaware he was not currently running for any position.
GUCCIFER 2.0: what's ur interest in these docs? r u gonna get nomination?
BAMBENEK: Will take a look. What do you mean get nomination?
GUCCIFER 2.0: u r a republican, ain't u? may be u gonna become a senator :) i mean why r u interested in these docs?
— DMs on August 23, 2016.
  • At another juncture, Guccifer 2.0 complained that a reporter for the Wall Street Journal quoted him in a story. “[I] didn't think he gonna quote my words, he didn't warn me,” Guccifer 2.0 messaged. “It didn’t seem like he understood how the media worked,” Bambenek told Axios.

This was nothing new — Guccifer 2.0 never seemed to be a precision operation: While I was a reporter for The Hill, I corresponded regularly with Guccifer 2.0, who regularly leaked documents to me.

  • Guccifer 2.0 kept abreast of which articles mentioned him, but rarely appeared to read them. Articles regularly included descriptions of his deceptive cover persona and likely connections to Russia.
  • While the leaks targeted swing states, Guccifer 2.0's understanding seemed to stop there, amplifying publicly available voter data as well as long-resolved scandals.

The end: Guccifer 2.0 cut off contact after figuring out Bambenek's true employment (he has since changed jobs to the firm ThreatStop).

  • Bambenek held off announcing his interactions with Guccifer 2.0 until he was sure they were not a component of the FBI's Russia investigation, he said.
  • He said he will publicly describe his experiences with Guccifer 2.0 on Thursday at Kaspersky Lab's Security Analyst Summit in Cancun, Mexico.
GUCCIFER 2.0: r ur company gonna make a story about me? :)
BAMBENEK: Want me to?
— The last DMs between Bambenek and Guccifer 2.0.

Go deeper

Coronavirus dashboard

Illustration: Sarah Grillo/Axios

  1. Global: Total confirmed cases as of 3 p.m. ET: 1,407,123— Total deaths: 80,759 — Total recoveries: 297,934Map.
  2. U.S.: Total confirmed cases as of 3 p.m. ET: 383,256 — Total deaths: 12,021 — Total recoveries: 20,191Map.
  3. Trump admin latest: Trump removes watchdog overseeing rollout of $2 trillion coronavirus bill.
  4. Federal government latest: Senate looks to increase coronavirus relief for small businesses this week — Testing capacity is still lagging far behind demand.
  5. World update: China reopens Wuhan after 10-week coronavirus lockdown.
  6. Environment latest: Coronavirus patients in more polluted parts of the U.S. are more likely to die from the illness than those in cleaner areas, according to a new Harvard University analysis.
  7. What should I do? Pets, moving and personal health. Answers about the virus from Axios expertsWhat to know about social distancingQ&A: Minimizing your coronavirus risk.
  8. Other resources: CDC on how to avoid the virus, what to do if you get it.

Subscribe to Mike Allen's Axios AM to follow our coronavirus coverage each morning from your inbox.

Pelosi calls for removal of acting Navy secretary

Photo: Chip Somodevilla/Getty Images)

House Speaker Nancy Pelosi on Tuesday called for the firing or resignation of acting Navy Secretary Thomas Modly, following his decision to relieve Capt. Brett Crozier from his command of the USS Theodore Roosevelt last week.

Why it matters: Pelosi said Modly "showed a serious lack of the sound judgment and strong leadership" in firing Crozier, who wrote a letter pleading for help in battling a coronavirus outbreak onboard the ship. The letter was leaked to the press, leading to Crozier's ouster.

Schiff demands that Grenell explain Trump's purge of inspectors general

House Intelligence Chairman Adam Schiff. Photo: Zach Gibson/Getty Images

Rep. Adam Schiff (D-Calif.), the chairman of the House Intelligence Committee, sent a letter to the acting Director of National Intelligence Ric Grenell on Tuesday demanding he turn over documents explaining his management of the intelligence community amid concerns of the politicization of the agency.

Why it matters: The letter, which calls for a response by April 16, comes as President Trump continues his purge of inspectors general across the federal government that he deems disloyal to his administration.