Sources: FBI investigation continues into 'odd' computer link between Russian bank and Trump Organization
By Pamela Brown and Jose Pagliery, CNN
Updated 5:44 PM ET, Thu March 9, 2017
Sources: FBI investigates 'odd' computer link 08:27
(CNN)Federal investigators and computer scientists continue to examine whether there was a computer server connection between the Trump Organization and a Russian bank, sources close to the investigation tell CNN.
Questions about the possible connection were widely dismissed four months ago. But the FBI's investigation remains open, the sources said, and is in the hands of the FBI's counterintelligence team -- the same one looking into Russia's suspected interference in the 2016 election.
One U.S. official said investigators find the server relationship "odd" and are not ignoring it. But the official said there is still more work for the FBI to do. Investigators have not yet determined whether a connection would be significant.
The server issue surfaced again this weekend, mentioned in a Breitbart article that, according to a White House official, sparked President Trump's series of tweets accusing investigators of tapping his phone.
CNN is told there was no Foreign Intelligence Surveillance Act warrant on the server.
The FBI declined to comment. The White House did not respond to a request for comment.
In addition, companies involved have provided CNN with new explanations that at times conflict with each other and still don't fully explain what happened.
The story -- of a possible connection between computer servers -- is a strange tale because there are no specific allegations of wrongdoing and only vague technical evidence.
Internet data shows that last summer, a computer server owned by Russia-based Alfa Bank repeatedly looked up the contact information for a computer server being used by the Trump Organization -- far more than other companies did, representing 80% of all lookups to the Trump server.
It's unclear if the Trump Organization server itself did anything in return. No one has produced evidence that the servers actually communicated.
Slate and The New York Times were first to report the unusual server activity.
The Times said the FBI had concluded there could be an "innocuous explanation." And cybersecurity experts told CNN this isn't how two entities would communicate if they wanted to keep things secret.
But for those who have studied the data, the activity could suggest an intent to communicate by email during a period of time when ties between the Trump Organization and Russia are being closely scrutinized because of Russia's alleged involvement in hacking the emails of the Democratic National Committee and Hillary Clinton campaign chief John Podesta.
This issue intrigued a dozen computer researchers at a recent business conference in Washington, D.C. that pulled together the world's top network operators, the ones who help run the internet. To them, it's a strange coincidence that merits further scrutiny.
Another computer researcher, Richard Clayton of Cambridge University, said it's just plain weird.
"It's not so much a smoking gun as a faint whiff of smoke a long way away. Maybe there's something else going on. It's hard to tell," said Clayton, who has independently examined the scant evidence available.
What is known:
Last year, a small group of computer scientists obtained internet traffic records from the complex system that serves as the internet's phone book. Access to these records is reserved for highly trusted cybersecurity firms and companies that provide this lookup service.
These signals were captured as they traveled along the internet's Domain Name System (DNS).
These leaked records show that Alfa Bank servers repeatedly looked up the unique internet address of a particular Trump Organization computer server in the United States.
In the computer world, it's the equivalent of looking up someone's phone number -- over and over again. While there isn't necessarily a phone call, it usually indicates an intention to communicate, according to several computer scientists.
What puzzled them was why a Russian bank was repeatedly looking up the contact information for mail1.trump-email.com.
Publicly available internet records show that address, which was registered to the Trump Organization, points to an IP address that lives on an otherwise dull machine operated by a company in the tiny rural town of Lititz, Pennsylvania.
From May 4 until September 23, the Russian bank looked up the address to this Trump corporate server 2,820 times -- more lookups than the Trump server received from any other source.
As noted, Alfa Bank alone represents 80% of the lookups, according to these leaked internet records.
Far back in second place, with 714 such lookups, was a company called Spectrum Health.
Spectrum is a medical facility chain led by Dick DeVos, the husband of Betsy DeVos, who was appointed by Trump as U.S. education secretary.
Together, Alfa and Spectrum accounted for 99% of the lookups.
This server behavior alarmed one computer expert who had privileged access to this technical information last year. That person, who remains anonymous and goes by the moniker "Tea Leaves," obtained this information from internet traffic meant to remain private. It is unclear where Tea Leaves worked or how Tea Leaves obtained access to the information.
Tea Leaves gave that data to a small band of computer scientists who joined forces to examine it, several members of that group told CNN, which has also reviewed the data.
more:
http://www.cnn.com/2017/03/09/politics/fbi-investigation-continues-into-odd-computer-link-between-russian-bank-and-trump-organization/index.html
DO SOMETHING!
| 
