Thread by @nimkef

What's Shawn Henry's core competency?

(Note: A hash value is definitely not an algorithm. It's a value.)

Does Henry have any formal technical education?

"Hash values are algorithms of the documents" ~ Shawn Henry

Tamene ("the contractor") contradicts Shawn Henry's testimony about Henry not having contact with him.

Henry, oddly, never mentions the 4/30/2016 call w/ Tamene, Sussmann, Chris Scott, Dacey, Reynolds and Brown, only a call w/ Sussmann and a Crowdstrike employee (Scott?) on 5/1

Here's some odd testimony. An FBI Agent sent Tamene a script to run on the DNC servers in April 2016. He doesn't run the script until May 2016. Tamene testifies that this is lucky because Cozy Bear and Fancy Bear would have been alerted by running it.

So Fancy Bear consists of the world's greatest hackers who then proceed to set off all kinds of alarm bells by going after password files on the DNC servers...

Doesn't add up

Sussmann testified that in Summer 2016 FBI was aware of exfiltration of files from DNC servers.

Crowdstrike believed files had been removed but was unable to prove it

I wonder if that corresponds to the "two files" that were reported as being exfiltrated from the DNC servers.

Shame Sussmann didn't recall any further details on the substance of the exfiltration noted by the FBI

https://twitter.com/nimkef/status/1289686271686713344?s=20

US Government (FBI, USAF, State, HHS, etc.) contracts for Crowdstrike services and software licenses

Note: listed companies other than Crowdstrike seem to be providing licenses for Crowdstrike Falcon at around $200k+ / year

usaspending.gov/#/search/c112f…

July 8 2015 - July 7 2016 Crowdstrike has $150 000 contract to provide "D306: IT AND TELECOM- SYSTEMS ANALYSIS" to the FBI

usaspending.gov/#/award/CONT_A…

"Mr. Henry has earned a Bachelor of Business Administration from Hofstra University in New York, and a Master of Science in Criminal Justice Administration from Virginia Commonwealth University."

fbi.gov/news/pressrel/…

March 3 2016
The BfV, Germany's FBI, releases a briefing warning of possible Fancy Bear cyber attacks that includes a list of domain names they've associated with APT-28

verfassungsschutz.de/download/brosc…

Apr 20 2015
Pricewaterhouse Coopers Threat Intelligence Bulletin for Fancy Bear

Report includes many references and a list of domains

pwc.blogs.com/files/cto-tib-…