Russia comes knocking
By June, Trump and Democratic candidate Hillary Clinton had emerged as the de facto nominees of their parties and were gearing up for what would be a bruising general election. The campaign took a historic turn on June 14, when the Democratic National Committee announced that it had been hacked and blamed Russia -- which Trump
dismissed as a farce.
Assange was busy back at the embassy. That month, members of the security team worked overtime to handle at least 75 visits to Assange, nearly double the monthly average of visits logged by the security company that year. He met Russian citizens and a hacker later flagged in the Mueller report as a potential courier for emails stolen from the Democrats.
Also in June, WikiLeaks secretly communicated with Russian hackers and Assange
publicly announced plans to release new material about Clinton. The Mueller report says the Russian hackers obscured their identities by using online personas for all their communications with WikiLeaks, which included emails and direct messages to WikiLeaks' account on Twitter.
Assange took at least seven meetings that month with Russians and others with Kremlin ties, according to the visitor logs.
Two encounters were with a Russian national named Yana Maximova, who could not be reached for comment. Almost nothing is known about Maximova, making it difficult to discern why she visited the embassy at key moments in June 2016. During her two visits that month, she met with Assange in the middle of the day in the embassy's conference room.
Assange also had five meetings that month with senior staffers from RT, the Kremlin-controlled news organization.
US intelligence agencies have
concluded that RT had "actively collaborated with WikiLeaks" in the past and played a significant role in Russia's effort to influence the 2016 election and help Trump win. For several months in 2012, Assange hosted a television show on RT.
In June 2016, RT's London bureau chief, Nikolay Bogachikhin, visited Assange twice, and gave him a USB drive on one occasion, according to the surveillance reports. That five-minute visit was hastily arranged and required last-minute approval from the Ecuadorian ambassador.
In an email to CNN, Bogachikhin said, "RT has produced multiple programming featuring Mr. Assange. Within that process, everything that is intrinsically involved in the production of content took place."
The RT bureau chief previously mocked
reports about his visits with Assange, jokingly
tweeting that he gave the WikiLeaks founder "a whole bag of Novichok," the chemical weapon used last year to poison a traitorous ex-Russian spy who lives in the UK. Since Bogachikhin's post last year, he has remained silent on Twitter.
Shortly after WikiLeaks established contact with the Russian
online personas, Assange asked his hosts to beef up his internet connection. The embassy granted his request on June 19, providing him with technical support "for data transmission" and helping install new equipment, the documents said.
This was the same day Assange and his lawyers met with then-Ecuadorian Foreign Minister Guillaume Long, according to the surveillance reports. Long declined to comment for this story.
It's unclear whether Assange told the Ecuadorians that WikiLeaks was working behind the scenes to acquire documents related to the US election. The US government has never publicly accused Ecuador of knowingly helping Assange or the Kremlin.
Creating chaos from the embassy
As the election approached, security officials at the embassy noted that Assange released some of the hacked emails "directly from the embassy," according to the surveillance documents. The Mueller report
explicitly referenced that "Assange had access to the internet from the Ecuadorian Embassy in London, England." The rest of that paragraph is heavily redacted.
It's unclear whether Mueller ever obtained these surveillance reports as part of his investigation.
Mueller concluded that hackers from Russia's military intelligence agency,
known as the GRU, attacked Democratic targets in spring 2016 and removed hundreds of gigabytes of information. They created
online personas -- Guccifer 2.0 and DCLeaks -- to transfer some of the files to WikiLeaks and publicly claim responsibility for the hacks, falsely disavowing any Russian ties.
Mueller's team noted that it "cannot rule out that stolen documents were transferred to WikiLeaks through intermediaries who visited during the summer of 2016." Assange has said a
small group of associates helped him from the outside, but only to sift through the emails.
The special counsel named one of those associates, German hacker Andrew Müller-Maguhn, and said he "may have assisted with the transfer of these stolen documents to WikiLeaks." The Mueller report appears to contain additional details about this possibility, but those portions were redacted because they contain classified information about sensitive investigative techniques.
Assange has known Müller-Maguhn for years. The hacker even showed up as a
featured guest on Assange's short-lived television show on RT in 2012, discussing the future of the internet and digital privacy. Müller-Maguhn is also involved in mainstream technology groups, and served on the board of ICANN, the international organization that governs internet domains.
When contacted by CNN, Müller-Maguhn declined to comment about his meetings with Assange. He
previously told The Washington Post that he was never in possession of the hacked materials before they were posted online.
According to the surveillance reports, Müller-Maguhn visited Assange at the London embassy at least 12 times before the 2016 election. During a few of those meetings, Müller-Maguhn was accompanied by another well-known German hacker, Bernd Fix, the reports said. CNN was unable to reach Fix for comment.
The Mueller report says that on July 6, WikiLeaks reached out to the Russian online personas with a request to send anything "hillary related" as soon as possible, "because the (Democratic National Convention) is approaching and she will solidify bernie supporters behind her after," referring to her opponent in the Democratic primaries, Sen. Bernie Sanders of Vermont.
The trio of hackers -- Assange, Müller-Maguhn and Fix -- then gathered on July 14 for more than four hours on, according to the security logs. The special counsel's report indicates that on this date, Russian hackers posing as Guccifer 2.0 sent encrypted files to WikiLeaks, with the title "big archive."
Days later, on July 18, while the
Republican National Convention kicked off in Cleveland, an embassy security guard broke protocol by abandoning his post to receive a package outside the embassy from a man in disguise. The man covered his face with a mask and sunglasses and was wearing a backpack, according to surveillance images obtained by CNN.
The security company saw this unfold on surveillance footage and recommended that the guard be replaced. But the Ecuadorian government kept him on the job.
On that same day, according to the Mueller report, WikiLeaks informed the Russian hackers that it had received the files and was preparing to release them soon. It's not clear if these incidents are related, and the contents of the package delivered to the embassy are unknown.
WikiLeaks
released more than 20,000 files from the Democratic National Committee on July 22, and the emails exposed how top officials preferred Clinton and tried to undermine Sanders. The party's convention days later in Philadelphia dissolved into a chaotic mess. A week that had been designed to engineer party unity transformed into a near-mutiny and the DNC chair, Rep. Debbie Wasserman Schultz of Florida, was
forced to resign.
As Democrats tried to manage the fallout, Trump quickly upped the ante.
"Russia, if you're listening, I hope you're able to find the 30,000 emails that are missing," he said on July 27, referring to Clinton's private server. Mueller said
the Russians were listening after all, and tried for the first time to hack Clinton's office within hours of Trump's comment.
'You won't be disappointed'
While Trump and Clinton crisscrossed the country in the final weeks of the campaign, the Russians ramped up their efforts, and Assange was toiling away on another major project.
Russian hackers, posing as DCLeaks, had reached out again to WikiLeaks and offered more materials, writing that "you won't be disappointed, I promise," according to the Mueller report. They later transmitted 50,000 emails stolen from Clinton campaign chairman John Podesta's inbox.
The special counsel report pinpoints a potential date for the data transfer: September 19. On that day, Assange met again with Müller-Maguhn and the security guards observed Assange installing new computer cables in his room, according to the documents obtained by CNN.
WikiLeaks started releasing Podesta's emails on October 7 and released new batches nearly every day before the November election. The media covered all the embarrassing details, including
transcripts of Clinton's closed-door Wall Street speeches,
sniping from staffers about her "terrible" instincts and
frustrationsabout overlap between business and charity, which they dubbed "Bill Clinton Inc."
Trump touted the new leaks at nearly every stop on the campaign trail in the final weeks of the race, sometimes reading directly from emails and seizing on thinly sourced conspiracy theories.
"This just came out -- WikiLeaks! I love WikiLeaks," Trump said at a rally in Pennsylvania, a critical swing state that he carried by less than 1% of the 6.1 million votes cast statewide.
Kremlin-backed outlets, including RT, breathlessly amplified the leaks on social media. On at least two occasions, RT even published articles detailing the new batches of emails before WikiLeaks officially released them, suggesting that they were coordinating behind the scenes, which they deny.
Diplomatic ultimatum
Not long after the Podesta emails began trickling out, with the election fast approaching, the US government raised concerns with Ecuadorian officials that Assange was using their diplomatic mission in London to help the Russians interfere in the 2016 election, a former US official familiar with the matter told CNN.
The US protest came with an implicit warning: Stop Assange or there will be consequences for Ecuador, just like there would eventually be consequences for the Russians for meddling in the election, and for Assange too, according to the US official and documents obtained by CNN.
Facing this ultimatum, Ecuadorian officials in the capital city of Quito decided on October 15 to cut Assange off from the outside world, shutting down his internet access and telephone service. Even this didn't stop the deluge of email releases, which WikiLeaks continued pumping out every day until the election.
Ecuador soon
released a public statement condemning WikiLeaks' involvement in efforts to interfere with the US election but reaffirmed its commitment to protecting Assange. As this geopolitical saga unfolded, the Ecuadorian Embassy received calls from other countries asking about potential US retribution and Assange's physical safety, the security reports said.
The situation intensified three days later. The security documents lay out a critical sequence of events on the night of October 18. Around 10 p.m., Assange got into a heated argument with then-Ecuadorian Ambassador
Carlos Abad Ortiz. Just before midnight, Abad banned any non-diplomatic visitors to the embassy and left the building. Behind the scenes, Assange communicated with the foreign minister in Quito.
Within an hour of Abad's departure, he called the embassy and reversed the ban.
By 1 a.m., two WikiLeaks personnel arrived at the embassy and started removing computer equipment as well as a large box containing "about 100 hard drives," according to the documents.
Security officials on site wanted to examine the hard drives, but their hands were tied. The Assange associates who removed the boxes were on the special list of people who couldn't be searched. The security team sent a memo back to Quito raising red flags about this late-night maneuver and said it heightened their suspicions about Assange's intentions.
