As a graduate student at American University in DC, suspected Russian agent Maria Butina participated in a project focused on discovering cyber vulnerabilities for nonprofits committed to promoting free speech and human rights.
Butina participated in the project under the tutelage of a respected professor who advised the State Department on cybersecurity matters. It was carried out for the nonprofit group Internews, which works extensively with the U.S. government to bolster the free flow of information in dangerous parts of the world and has drawn Russian ire with some of its programs in Russia and neighboring countries. The group also advises other nonprofits on cybersecurity.
(...)
As part of the project, a small group of students led by Butina was given a list of Internews partners working on human rights and press freedom issues for research purposes only, with the understanding that they not be contacted without consultation. But the students contacted some of the groups anyway, according to people involved in the project who spoke on condition of anonymity because they were not authorized to describe the work.
An individual who has worked on U.S. programs in Ukraine told the AP that after Butina's arrest he was briefed by U.S. officials who expressed concern that two Internews programs in Ukraine — dealing with media freedom and cybersecurity, and funded by the State Department — may have been exposed to Russian intelligence and may be at risk due to Butina's student work.
(...)
Kostiantyn Kvurt, who heads a local nonprofit that Internews helped establish, Internews Ukraine, said he was unaware of Butina's project before being informed of it by the AP, but already was wary of potential Russian intelligence interference.
"If they understand how to break our firewalls, they could find our partners," Kvurt said. "People could get detained, tortured, killed."
Internews said the students were never given access to the group's work or systems.
The State Department says AU students only received publicly available materials, and the Department's partnership with Internews is not compromised.
The access that Butina won through her coursework illustrates how academia and the extensive network of entities that often carry out sensitive, but not classified, work for the U.S. government remain national security vulnerabilities.
In this case, all the institutions expected someone else to vet Butina. Internews thought American University stood behind her; the university said it doesn't do background checks and expects the State Department to vet foreign applicants fully before issuing visas.
Prosecutors allege in court documents that attending the university was Butina's "cover" as she cultivated political contacts and ties with the National Rifle Association. They contend she was part of a clandestine political influence campaign directed by a former Russian lawmaker who has been sanctioned by the U.S. Treasury Department for his alleged ties to Russian President Vladimir Putin.
(...)
Butina's student project was led by Eric Novotny, a cybersecurity expert who has a high security clearance as an adviser to the State Department. One of Novotny's AU courses was called "Cyber Warfare, Terrorism, Espionage, and Crime." The project was aimed at helping Internews identify ways that it could help U.S.-based nonprofits improve their cybersecurity.
(...)
Novotny, who was later interviewed by the FBI about Butina, learned his instructions about not reaching out to partners had been ignored when the cybersecurity adviser of one nonprofit called him after becoming suspicious that a Russian student was asking about cyber vulnerabilities. He sternly warned the students not to ignore the protocol.
Research published by Toronto University-based The Citizen Lab analyzing Russian hacking attempts has found that civil society groups ranked behind only governments as the most frequent targets. Most often, it appeared Russian spies were trying to determine who the organizations were working with in places of strategic interest, the research found.
"Russian security services view civil society groups as a threat and treat their local partners with great suspicion." said John Scott-Railton, a cybersecurity researcher at Citizen Lab.
AP found no evidence that Butina passed any information from the university project to Moscow, but the work allowed her to contact likely Russian targets.
Read more: Russian held as agent studied US groups' cyberdefenses (AP)