“We have something in American politics. It’s legitimate; both sides do it. It’s called opposition research … Now imagine being able to do that with the power of a nation state, illegally acquiring things like emails and being able to weaponize by leaking.”
Senator Marco Rubio (R-FL)

Overview

Amid the substantial and ever-growing evidence of the Trump campaign’s collusion with Russia, the clearest example of coordination—the hacking and release of thousands of emails stolen from Trump’s political opponents—remains relatively overlooked. As the investigations have proceeded, it has become increasingly clear that the Trump campaign was not simply a passive beneficiary of the stolen emails but were instead active participants, helping ensure that the leaked information would reach its intended audience and have the most significant possible effect. Examining the hack and release of stolen emails during the 2016 is key to understanding collusion and its impact.

As this report documents, the full context and series of events surrounding the theft and release of emails from Trump’s opponents clearly shows that Trump’s associates and Russian operatives secretly collaborated so that releasing the stolen emails would maximally benefit Trump and help him win the presidency. In other words: They colluded.

This report for the first time puts together the series of known facts derived from criminal indictments, congressional testimony and documents, and press reporting. While each of these facts and revelations has been previously revealed—Cambridge Analytica’s emails with WikiLeaks, Roger Stone’s communication with Guccifer 2.0, the June 9 meeting in Trump Tower—they have too often been treated as discrete revelations rather than placed in the context of a broader influence campaign centered on the hacked emails. The Moscow Project has outlined the full series of events, which paint a clear picture of collusion.

As Senator Marco Rubio explained at one of the few public hearings on Russian interference, “We have something in American politics. It’s legitimate, both sides do it. It’s called opposition research … Now imagine being able to do that with the power of a nation state, illegally acquiring things like emails and being able to weaponize by leaking.” That’s exactly what happened.

The five steps of collusion around the hacking and release of the stolen emails are simple:

1. Russia’s military intelligence unit hacked the emails of Trump’s Democratic opponents.
2. Russia alerted the Trump Campaign that they are in possession of the stolen emails.
3. The two sides met to coordinate.
4. Russia released emails through its trusted intermediary WikiLeaks, timed to benefit the Trump campaign.
5. Trump made the emails central to his message in the final weeks of the campaign.

Step 1: Russia’s military intelligence unit hacked the emails of Trump’s Democratic opponents. (March-April 2016)

In March 2016, hackers linked to Russia’s military intelligence directorate (GRU) launched a six-week campaign to gain access to email accounts belonging to Democratic National Committee employees and Clinton campaign staff. Reporting has since identified Fancy Bear, a hacking group run out of the GRU, and Guccifer 2.0, who has been identified as a GRU officer, as the culprits in these hacks and the subsequent email distribution and release.

According to the Associated Press, “It wasn’t just a few aides that the hackers went after; it was an all-out blitz across the Democratic Party. They tried to compromise Clinton’s inner circle and more than 130 party employees, supporters and contractors,” with a specific focus on officials involved in voter-registration issues. The attacks came in waves, ramping up on March 10, 11, 19, 22, 23, and 24, and again on April 6 and April 20.

Key Events:

• March 19: Podesta was successfully hacked. As part of their broad campaign targeting Democratic and Clinton campaign operatives, Russian hackers breached John Podesta’s email account, stealing at least 50,000 messages.
• Late April: DNC was breached. By the end of April, Russian operatives completed their hacking campaign, successfully breaching not only Podesta’s inbox but also the servers of the Democratic National Committee. Around the same time, Democratic operatives began to become aware that their servers had been breached.

Step 2: The Kremlin alerted the Trump Campaign that they had the stolen emails. (April-May 2016)

After Russian intelligence successfully stole emails from Trump’s opponents, they informed the Trump campaign. Joseph Mifsud, a Maltese professor and suspected Russian intelligence agent, developed a relationship with Trump foreign policy advisor George Papadopoulos and told him that Russia had “dirt” on Clinton in the form of “thousands of emails.” Papadopoulos informed the leadership of the Trump campaign about his conversations with Russian agents. He remained in touch with not only Mifsud but also Mifsud’s contacts with closer connections to the Kremlin, who continued extending offers of assistance.

According to a publicly-released memo from Democrats on the House Intelligence Committee, Papadopoulos knew not only that the Kremlin had the hacked emails but also that Russia planned to disseminate the emails anonymously. Representative Adam Schiff (D-CA), the ranking member of the committee who prepared the memo, has since confirmed to MSNBC’s Chris Hayes that “the Russians previewed to Papadopoulos that they could help with disseminating these stolen emails” (emphasis added).

Key Events:

• April 26: Papadopoulos learned the Russians had Clinton emails. According to Papadopoulos’s plea agreement, on April 26, he learned from a Maltese professor Joseph Mifsud that “the Russians had emails of Clinton; they have thousands of emails.”
• April 27: Papadopoulos informed senior campaign officials about his conversations with Russian operatives. On April 27, the day after he learned of the stolen emails, Papadopoulos updated his chain of command on his conversations with Russian operatives, emailing a “Senior Policy Advisor” (reported to be Stephen Miller) and a “high-ranking campaign official” (reported to be Corey Lewandowski).
• May 4: Russians told Papadopoulos they’re “open for cooperation.” On May 4, one such contact, who worked in the Russian Ministry of Foreign Affairs, emailed both Papadopoulos and Mifsud, saying he had just spoken to colleagues who “are open for cooperation.”
• May 5: Papadopoulos passed the information to his superiors. He forwarded the email to Lewandowski and a “campaign supervisor” (reported to be Sam Clovis, whom Lewandowski later described as “running point” on Russia), adding “Russia updates” to the top of the email; he also called the “campaign supervisor.”

Step 3: The Russians and the Trump campaign met to coordinate. (April-October 2016)

By early May, the Trump team knew that the Kremlin was conducting an espionage campaign against American citizens. The Trump campaign not only did not contact the FBI but also actively maintained contacts with Kremlin-linked figures who they believed had “dirt” that could be helpful to their political campaign.

Prior to the Democratic National Convention in July, there were at least 16 meetings between representatives of the Trump campaign and Kremlin-linked figures. Between April and October, when the Kremlin began releasing the contents of Podesta’s inbox, at least 12 representatives of the Trump campaign met or conversed with Russian assets, agents, or officials.

Key Meetings and Contacts

The June 9 Meeting: In perhaps the most pivotal moment in the known collusion timeline, three of the Trump campaign’s most senior officials met with Kremlin-linked operatives specifically to discuss the “dirt” the Russian government had on Hillary Clinton.

• The Offer: On June 3, Rob Goldstone, an intermediary for a Russian oligarch, sent Donald Trump Jr. an email with the subject line “Russia – Clinton – private and confidential.” In the email, Goldstone offered to set up a meeting regarding “official documents and information that would incriminate Hillary [Clinton] and her dealings with Russia and would be very useful to” Trump as “part of Russia and its government’s support for Mr. Trump.”
• The Acceptance: Less than 20 minutes later, Trump Jr. responded, agreeing to the meeting and saying, “if it’s what you say I love it especially later in the summer” (emphasis added). While much of the focus has been on the first part of the sentence, in which Trump Jr. seems to both know of Russia’s support for his father’s campaign and enthusiastically accept Goldstone’s offer, the second part is also important: Not only did Trump Jr. suggest coordinating dropping the dirt, he suggested a time roughly coinciding with the first WikiLeaks dump.
• The Meeting: After several more emails, and multiple calls between Donald Trump Jr. and the Russian pop star on whose behalf Goldstone sent the email, the pair set up the meeting for June 9 at 4 p.m. in Trump Tower. Attending on behalf of the Trump campaign were Trump Jr., Trump’s son-in-law and director of digital operations Jared Kushner, and the campaign’s chairman Paul Manafort; representing Russian interests were Goldstone, the lawyer and Magnitsky Act opponent Natalia Veselnitskaya, the real-estate executive and suspected money launderer Irakly Kaveladze, and the lobbyist and former counterintelligence officer Rinat Akhmetshin, along with a translator.

The Trump campaign’s backchannels to WikiLeaks. After learning of the stolen emails and Russia’s plans to release them anonymously, the Trump campaign established at least three backchannel lines of communications to Russia’s cut-out WikiLeaks.

1. Roger Stone knew Podesta was hacked before Podesta did: Stone, a long-time Republican operative and informal adviser to Trump, publicly discussed his backchannels to both Guccifer 2.0 and WikiLeaks founder Julian Assange multiple times during the campaign. (Stone and WikiLeaks have both since denied communicating, only for subsequent reporting to reveal direct messages between the two on Twitter.) Stone also publicly revealed his knowledge of the upcoming publication of emails from John Podesta on August 21, tweeting, “Trust me, it will soon [be] Podesta’s time in the barrel.” The tweet was especially revealing because at that point nobody else, including Podesta himself, knew that the emails had been stolen.
2. Cambridge Analytica asked WikiLeaks to get the stolen emails: Cambridge Analytica, the disgraced data firm the Trump Campaign hired to essentially serve as the data “brain” of the campaign, also reached out to Assange during the summer of 2016 asking to get the hacked Clinton emails in order to “to turn them into a searchable database for the campaign or a pro-Trump political action committee.” (Assange has confirmed he received Cambridge Analytica’s offer, which he claims he declined.)
3. Donald Trump Jr. messages with WikiLeaks: In September, Trump Jr. communicated with WikiLeaks through private messages via Twitter. WikiLeaks began the conversation on September 20 by providing Trump Jr. with a link to and login information for an anti-Trump website, and subsequently suggested potential campaign strategy, including boosting WikiLeaks material and contesting the results of the election, on multiple occasions. In one instance, Trump tweeted a link to the latest batch of Podesta emails just 15 minutes after WikiLeaks suggested to Trump Jr. that his father do so.

Step 4: Russia strategically released emails through its trusted intermediary WikiLeaks, timed to benefit the Trump campaign. (July/October 2016)

At some point between March and July, Russian intelligence began sharing the emails with the self-proclaimed transparency organization WikiLeaks. The ties between WikiLeaks and Russia are so deep that Trump’s Secretary of State Mike Pompeo has called the organization a “non-state hostile intelligence service often abetted by state actors like Russia,” effectively branding the website a tool of Russian intelligence. The description comports with the January 2017 Intelligence Community report, which assessed “with high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release US victim data obtained in cyber operations publicly and in exclusives to media outlets.”

Though WikiLeaks’ founder Julian Assange has repeatedly denied that it received any documents from the Russian government, the connection between the organization and the Kremlin was already evident during the campaign; for example, Assange at one point hosted a show on the Russian state-owned propaganda network RT. Guccifer 2.0, at the time unsuccessfully masquerading as a Romanian hacktivist, even announced it had given the emails it had stolen from the DNC to WikiLeaks, writing “that the DNC’s stolen documents were in WikiLeaks’ hands.”

The DNC email release divided Democrats before the convention: On July 22, WikiLeaks began publishing the emails Russia stole from the Democratic National Committee. The first publication occurred just three days ahead of the Democratic National Convention in Philadelphia in an apparent effort to create internal divisions within the Democratic Party and disrupt what was intended to be a unifying event following a divisive primary. Most infamously, the leak included emails in which the committee’s chairwoman, Florida congresswoman Debbie Wasserman Schultz, and other operatives seemed dismissive or even antagonistic toward Senator Bernie Sanders’s candidacy. The subsequent outrage among Sanders supporters, who felt the national Democratic party had unduly influenced the primary process toward Clinton, fueled protests during the convention and ultimately led to Wasserman Schultz’s resignation.

The Podesta email release distracted from the “Access Hollywood” tape: The clearest example of WikiLeaks timing an email dump to benefit Trump’s candidacy occurred when the website began publishing emails from Podesta’s inbox at 4:32 p.m. on Friday, October 7.

• The timing didn’t make sense for WikiLeaks: In a vacuum, WikiLeaks’s release strategy made little sense. Friday afternoon releases are typically reserved for information an organization is seeking to bury, not promote. This was WikiLeaks’s biggest release of the election, a chance to drive the conversation and increase traffic to their website. So why would WikiLeaks begin releasing the Podesta emails late on a Friday afternoon?
• But it made sense for the Trump campaign: While timing its release for a Friday afternoon would not be in WikiLeaks’s interests, it would certainly be in the interests of the Trump campaign. At 4:03 p.m. on October 7, The Washington Post published the “Access Hollywood” tape, in which Trump bragged about his penchant for sexually assaulting women. The release looked likely to end his already-embattled candidacy. Fortunately for Trump, just 29 minutes later, WikiLeaks released its bombshell, enabling Trump to change the conversation and attack Clinton at a difficult moment for his campaign. By the next presidential debate on October 10, Clinton, too, was on the defensive, having to answer questions about excerpts from speeches she had given to Goldman Sachs in 2013 included in WikiLeaks’ latest dump.

Step 5: Trump made the emails central to his message in the final weeks of the campaign. (October-November 2016)

WikiLeaks formed a cornerstone of both Trump’s campaign and the Russian campaign to support him during the final run-up to the election. Trump built his closing campaign message around amplifying the emails, publicly mentioning WikiLeaks 164 times—more than five times per day—during the last month of the campaign and often citing specific conversations contained within the leaks. As the former FBI agent Clint Watts told the Senate, “part of the reason active measures have worked in this U.S. election is because the Commander-in-Chief [Trump] has used Russian active measures at times, against his opponents.” Each time new emails came out from WikiLeaks, RT published articles hyping the latest batch; on at least two occasions, the propaganda service even appeared to tweet about a new dump before WikiLeaks posted it.

The Catholic email altered the trajectory of the campaign: On October 11, one email in particular became a key part of Trump’s campaign and his efforts to win over Catholic voters in the upper-Midwest. The email made it from WikiLeaks to RT to a Trump rally within 12 hours.

• 8:30 a.m.: WikiLeaks released its third tranche of Podesta emails. On October 11 at 8:30 a.m., WikiLeaks published its third tranche of Podesta’s emails. Among the 1,190 emails released was a 2011 conversation between Podesta associates John Halpin and Jennifer Palmieri, both Catholics themselves. This email chain, which cc’ed Podesta, contains a thread “accusing Republicans of cherry-picking aspects of their religion [Catholicism] for political gain.” On its face, “nothing about the email exchange was particularly remarkable,” especially as it was just one of more than a thousand WikiLeaks published that morning, which itself was only a fraction of those it released during the 2016 election.
• 12:31 p.m.: RT “discovered” the email in a haystack: RT became one of the first outlets to post an article highlighting the exchange. This means that, without prior warning, they would have had to comb through the leak, found a single email from Halpin and Palmieri’s conversation, and recognized its potential, all within a few hours.
• At a rally that night, Trump used the email to attack Clinton: At a rally that very night, at 7:30 p.m. on October 11, Trump cited the email, misrepresenting it as an example of “the Clinton team attacking Catholics.”
• A key campaign line of attack: The next day, the email exchange was the centerpiece of both a conference call with Newt Gingrich (another noted Catholic whose wife, Callista, Trump appointed to be ambassador to the Vatican) and at a rally, where Trump said the conversation “could be election changing.” He even cited it as proof that “Clinton hates Catholics” at the Al Smith Dinner, a fundraiser for Catholic charities where candidates traditionally set aside harsh campaign rhetoric.

The impact of this email may have been significant. Catholics comprise a sizeable portion of the three states that were ultimately key to Trump’s victory, making up more than 29 percent of voters in Pennsylvania, 32 percent of voters in Wisconsin, and 22 percent of voters in Michigan. Even before the “Access Hollywood” tape, Trump was struggling to win over Catholic voters; the tape only further diminished his standing. But after the October 11 leak, Trump repeatedly decried the Clinton campaign’s perceived attacks on Catholics—as did the political action committee Catholic Vote, which went from calling for Trump to step down to running an ad falsely claiming that Clinton’s campaign had “dismiss[ed] the entire Catholic belief system” in a matter of weeks. Trump ultimately won the demographic by 7 percent, more than enough to account for his slim margins in those three states.

Although it has since become conventional wisdom that Clinton’s failure to campaign in the upper Midwest handed Trump the election, at the time, many experts were befuddled that Trump was campaigning in Michigan and Wisconsin. The only high-profile political analysts publicly predicting a Trump victory in the states were Trump’s own team. Nevertheless, the Russian campaign was able to quickly sift through the emails and pick out the specific bit of information that would best support a strategy that only Trump thought would succeed.

Conclusion

The hacking and coordinated release of stolen emails is what collusion looks like. The sequence of events offers a clear case study in how the two campaigns to elect Donald Trump—one based in Trump Tower and one based in Russia—colluded.

• Russia wanted to help Trump and used its intelligence and espionage tools to illegally hack the DNC and the Clinton campaign.
• The Trump campaign also wanted Russia’s help to get the “dirt” on Hillary Clinton. They were willing to work with a foreign intelligence service hostile to the United States to defeat their political opponent.
• These two campaigns then met and coordinated. And when Russia chose to use WikiLeaks to anonymously release the stolen emails, the Trump campaign sought to communicate with WikiLeaks as well.
• The email releases were timed to provide maximum benefit to Trump.
• Trump then made the email releases central to his campaign strategy in the final month.

Combining Russia’s espionage capabilities with the Trump campaign’s unique and granular understanding of the American political landscape, especially its data-targeting expertise, would have greatly aided both campaigns. The two campaigns met and conversed repeatedly for months, providing ample opportunity to hammer out a strategy to amplify each others’ messages to increase Trump’s chances in the election. The question now is no longer whether there was collusion; it is how deep the collusion went.