Today New Yorker magazine posted a long article revisiting a semi-obscure detail in the Trump-Russia-Conspiracy story. Late in the 2016 election cycle news broke that Trump Campaign servers had been communicating through an arcane channel with servers owned by Alpha Bank. Alpha Bank is closely connected to Russian President Vladimir Putin and his cronies, and has been tied to Russian Oligarch money laundering activities. This communication is regularly referenced as part of the curious connections between the Trump Campaign and Putin cronies.
A year ago this site ran a story looking into the details, and finding it inconclusive. The story is based on studies of DNS query traffic, and not of actual traffic. A DNS query is made whenever software needs the IP address for a remote computer. The source for the story seemingly had access to query logs for a set of prominent DNS servers, but because they cannot have had query logs for all DNS servers any report they made would be limited. They claimed to have seen a curious pattern of DNS queries between a set of servers owned by Alpha Bank, the Trump Organization, and Spectrum Health (a company connected to the DeVos family).
The new article covers the same territory, and claims to have studied the issue more closely.
The article:
newyorker.com magazine 2018 10 15 was-there-a-connection-between-a-russian-bank-and-the-trump-campaign
The new results are based on hindsights of having 2 years to review the data, answering the critiques of earlier reports.
A spokesperson for Russia's Alpha Bank, Jeffrey Birnbaum, described the allegations as a kind of kompromaut. When the accused person claims it is the accuser who is corrupt, you have to be extra careful in gauging who to believe. Birnbaum suggested several possibilities, the best of which is anti-virus software repeatedly scanning old archived e-mails.
That is - the Trump Organization server in question is not owned by the Trump Organization, but instead is owned by a 3rd party company offering mass e-mail marketing services. The Trump Organization used that company to send emails advertising specials at various Trump properties.
Supposedly some employees of Alpha Bank had received some such emails from the Trump Administration, and those e-mails were in the e-mail archive. Every so often the anti-virus software, Trend Micro Deep Discovery Inspector, would rescan the e-mail archive triggering a new wave of DNS queries. Since the e-mail archive supposedly includes some of the commercial Trump Organization emails this rescan would trigger corresponding DNS queries. According to the New Yorker article experts agree this is somewhat plausible but that it is not consistent with the pattern of activity.
That pattern of DNS query activity is consistent with human activity, not with automated software. The other issue is it does not explain why Spectrum Health servers were making similar queries.
Another curiosity is that queries for the Trump Organization domain, mail1.trump-email.com, had been coming from exactly two sources. One was Alpha Bank, the other Spectrum Health.
One would think a server used to send mass e-mail to thousands of customers would be generating zillions of DNS queries from across the Internet. Indeed, a study was conducted of DNS traffic for Denihan Hospitality Group, a hotel chain similarly sized to the Trump Organization, and which also uses the same mass e-mail service. According to the New Yorker article:
In a sample spanning August and September, 2016, a Denihan domain received more than twenty thousand D.N.S. queries, from more than a thousand I.P. addresses. In the same period, the Trump domain had twenty-five hundred lookups, nearly all of them from Alfa Bank and Spectrum Health.
The server in question is owned by a 3rd party service provider. That service provider says their servers do one thing, and that customers cannot set up specially configured servers. But among the provided services is "Webmail" and "Instant Messaging" services, the latter being normally used by event staff to coordinate an event.
The New Yorker article theorizes the DNS traffic could have been associated with instant messaging traffic among folks collaborating on some project spanning Spectrum Health, the Trump Organization, and a bank in Russia. But what would that project be...??
Researchers looking more closely at the DNS query data discovered a third organization being involved: Heartland Payment Systems, a payments processor in Princeton. That company had been acquired by Global Payments, which had also acquired United Card Services, Russia’s leading credit-card-processing company, which in turn bought Alfa Bank’s credit-card-processing unit. That makes a tenuous connection of financial companies to this story.
Maybe there was some under-handed communication going on. But it does little to explain why a credit card processing company would be communicating through a private instant messaging program on a Trump Organization server.
We have to remember that the evidence here is DNS queries. DNS queries is not sufficient to tell us what communication occurred, only a pattern of queries for the IP address for a given domain name. In other words, software looking up the IP address prior to communicating some data.
It means we have no clue what communication might be happening. Where the New Yorker article starts describing what that communication might be we have to recognize it as pure speculation.
