In late July, one of these scientistswho asked to be referred to as Tea Leaves, a pseudonym that would protect his relationship with the networks and banks that employ him to sift their datafound what looked like malware emanating from Russia. The destination domain had Trump in its name, which of course attracted Tea Leaves attention. But his discovery of the data was pure happenstancea surprising needle in a large haystack of DNS lookups on his screen. I have an outlier here that connects to Russia in a strange way, he wrote in his notes. He couldnt quite figure it out at first. But what he saw was a bank in Moscow that kept irregularly pinging a server registered to the Trump Organization on Fifth Avenue.
More data was needed, so he began carefully keeping logs of the Trump servers DNS activity. As he collected the logs, he would circulate them in periodic batches to colleagues in the cybersecurity world. Six of them began scrutinizing them for clues.
(I communicated extensively with Tea Leaves and two of his closest collaborators, who also spoke with me on the condition of anonymity, since they work for firms trusted by corporations and law enforcement to analyze sensitive data. They persuasively demonstrated some of their analytical methods to meand showed me two white papers, which they had circulated so that colleagues could check their analysis. I also spoke with academics who vouched for Tea Leaves integrity and his unusual access to information. This is someone I know well and is very well-known in the networking community, said Jean Camp. When they say something about DNS, you believe them. This person has technical authority and access to data.)
The researchers quickly dismissed their initial fear that the logs represented a malware attack. The communication wasnt the work of bots. The irregular pattern of server lookups actually resembled the pattern of human conversationconversations that began during office hours in New York and continued during office hours in Moscow. It dawned on the researchers that this wasnt an attack, but a sustained relationship between a server registered to the Trump organization and two servers registered to an entity called Alfa Bank.
