A Screen in Rostov

A Hacker in the UK

Eli: Late 2017. Dutch military intelligence learns that a hacker working for Russia's GRU is about to travel to Britain. When he lands in England, the Dutch put a choice to him, as Matthew Cole tells it in Vanity Fair. Work for them against the GRU, or be arrested by the British and face years in prison. He switches sides. He gives the Dutch access to a remote GRU server in Rostov, in Russia. And on that server sit screenshots of Jared Kushner's iPhone X.

Mara: The GRU being Russia's military intelligence. Not freelancers. The Russian state's own spies.

Eli: Right, and spies who hack abroad. Their server was holding the phone screens of the president's son-in-law and senior adviser.

Mara: The listener who wrote in wants to know about the influence of the Dutch intelligence service in this case. Why them, and why not the US intelligence services. And what their interest was in getting involved at all. It's Friday, October 23rd, and today's angle is how hunting Russian hackers put Dutch spies onto an American adviser's screen.

Eli: Getting there runs through a hacking team in Moscow, a bank account in the Gulf and an American law. The deal in England was aimed at the GRU. Counterespionage against Russia, not a probe into American politicians. Still, Mara, Dutch spies now had a White House adviser's phone data in hand.

Hunting the Bear

Mara: That counterespionage had a long backstory. In 2018 the AIVD, the Dutch general intelligence service, reported that China, Iran and Russia ran offensive cyber programmes aimed at the Netherlands. On Russia it was blunt: "The Netherlands has been in the Russian eye for much longer, because of our membership of NATO and the EU. Russia would like to learn what our position is in these international cooperative frameworks."

Eli: And after MH17 was downed, one analyst wrote, relations sank "well below freezing."

Mara: By April 2018 it was on Dutch soil. Four Russians with diplomatic passports land at Schiphol. A man from the Russian embassy meets them. They load a car with technical equipment and spend days circling the OPCW's headquarters in The Hague, taking photos. Dutch counterintelligence intercepts them and sends them back to Moscow. The US Justice Department later tied two of them to GRU Unit 26165, better known as Fancy Bear.

Eli: The chemical weapons watchdog. So the man flipped in England was one catch in a much wider hunt.

Mara: A hunt that had taken the Dutch inside Russian networks before. Long before Rostov.

Eli: Summer 2014. A Dutch hacking team gets into the network of Cozy Bear, a Russian cyber-spying crew working out of an office near Red Square. They even take over a hallway security camera. Now they can watch roughly ten hackers come and go, and see that many visitors work for Russia's foreign intelligence service. That November, the Dutch watch those hackers break into the US State Department, gathering senior officials' email addresses and log-in details. Then they alert the Americans.

Mara: Chris Painter called that blindside "one of the reasons why the Dutch access was so appreciated."

Eli: Painter spent six years as the State Department's top cyber diplomat. And that access didn't last. In spring 2017, American intelligence sources praised the access of a Western ally to US media. Dutch broadcaster NOS reported great anger in The Hague and Zoetermeer. The Dutch services feared the remarks had woken the hackers up, and their way in was gone.

Mara: That's Painter's reading: the Dutch had access nobody else had. Years of hunting Russian hackers built it, and one loose remark in Washington could cost it.

The Screen and the Statute

Eli: Which brings it back to Jared Kushner's phone. By 2018, the Daily Beast reports from Cole's account, the Dutch had figured out how the Russians got into it. And they stayed on the device to track what he did. Watching his screen, Dutch personnel saw him log into a bank account in the United Arab Emirates. One that had received hundreds of millions of dollars from a bank in Azerbaijan.

Mara: So the Dutch went from studying a Russian hack to watching through it.

Eli: And the account has a name. Alpha, at First Abu Dhabi Bank, nominally run by a UAE-funded charity, the Watani Al Emarat Foundation. Kushner was allegedly a signatory, able to use it, not its owner.

Mara: Which lands on a man whose clearance was already under scrutiny.

Eli: Kushner says that two days before the inauguration he found the foreign-contacts section of his clearance form blank. After a four-month delay he disclosed more than a hundred foreign contacts, the Russian ambassador among them. In 2018 his clearance was downgraded.

Mara: The Dutch haven't said who authorized that watching, or whether Washington was told.

Eli: Cole's reading is that the Dutch were watching Kushner on purpose. In late spring 2020 a source he trusted called him: "The Dutch government had hacked into Jared Kushner's phone and monitored him as he accessed a Dubai-based bank account." Six months later Cole asked someone else about Kushner and UAE transfers. That person went quiet, then said, "Yes."

Mara: The easy guess is that American spies just missed all this. The law points somewhere else. FISA Section 702, the statute that lets US agencies collect on foreigners abroad, "may be used only to target non-U.S. persons reasonably believed to be located outside the United States." Kushner was an American in the White House. Under FISA and Executive Order 12333, the directive governing foreign intelligence collection, targeting a US person takes a warrant or specific approval.

Eli: Americans still get swept up, though, when foreign targets call them or discuss them.

Mara: They do. That's where minimization procedures come in, the rules that keep American identities masked and limit what's kept. The NSA's John DeLong said in 2013 that they contemplate "from day one" a foreign target talking with, or about, an American. And FBI Director Christopher Wray has warned that a strict warrant requirement would amount to a de facto ban on the tool.

Eli: Mara, the American agencies were barred by their own law from watching an American adviser's screen. A Dutch team was already watching it.

The Silent Channel

Mara: And here's what turns the story. According to Gizmodo, the Dutch presumably had to leave Washington in the dark to keep their access. In its words: "Neither the GRU nor Dutch intelligence seems to have been looking at Kushner as a friend." But reporting and intelligence history suggest the Dutch kept quiet to preserve their penetration, after American public remarks had already burned their access to Cozy Bear.

Eli: Meanwhile American agencies, barred from targeting a U.S. person without a warrant, couldn't look themselves.

Mara: And it stayed secret until Thursday.

Eli: Thursday, Vanity Fair ran an excerpt from Cole's book, Princes and Thieves. Kushner's response: "The allegations made by this author are completely insane and never happened." And: "No bank statements, wire transfer records, account numbers, transaction dates, or other verifiable details were provided to support these extraordinary accusations." He points to more than thirty hours of voluntary testimony to Congress and the special counsel. His lawyer says he had no connection to the Watani charity or any UAE bank account, and made no arrangements without the president's consent.

Mara: A former US ambassador denied it too, calling claims about his own role false.

Eli: Against the lawyer's word, four senior officials from Trump's first term, two national security advisers and a former CIA director among them, told Cole they were unaware of any presidential authorization for Kushner to tap a foreign government's bank account.

Mara: What has changed is the sharing. The ally that once tipped off Washington about Cozy Bear limited its intelligence ties with US counterparts last year, over human rights concerns. Cooperation now runs case by case: each exchange weighed on its own, instead of flowing automatically.

Eli: And no government has confirmed the Kushner claims, nor are they findings of wrongdoing.

Mara: So the answer to the listener comes back to that man in England. The Dutch were hunting the GRU under their own counterespionage mandate, and flipping him put them on Kushner's phone. And by Gizmodo's reading, the Dutch presumably kept Washington uninformed to preserve their access to his phone.

Eli: Three things stay open. Whether Dutch ministers authorized the surveillance, which a parliamentary inquiry or a CTIVD oversight report, from the Dutch intelligence watchdog, could show. Whether anything was quietly passed to Washington, which declassified records or congressional hearings could settle. And whether verified bank records ever surface, proving or disproving the Alpha account.

Mara: For background on foreign surveillance limits, read into FISA Section 702.

Eli: Follow security with Angle for more stories as allied intelligence sharing faces new tests.

Mara: Thanks for spending this time with us. I'm Mara.

Eli: And I'm Eli. Until next time, this has been Angle.