Russia accused of hacking sports world over doping scandal
U.S. indictment alleges attacks were in response to anti-doping penalties imposed on country's athletes
In Russia, sports and the government are closely intertwined.
Top athletes hold military ranks, Olympic medals are a matter of national pride, and champions receive luxury cars in Kremlin ceremonies.
So when Russia was accused of doping its way to the top, the Russian state hit the sports world with a wave of hacker attacks, says an indictment unsealed Thursday by the U.S. Department of Justice and the FBI.
More than 250 athletes' medical records were published and confidential data from some of the world's biggest sports organizations — the Olympics, world track and field, FIFA — was published as Russia prepared to host this year's soccer World Cup.
Scott Brady, U.S. attorney for the Western District of Pennsylvania, said Russia was seeking revenge for some of its team being barred from the 2016 Summer Olympics over widespread drug use and coverups.
"This began with a disclosure of Russian state-sponsored doping programs for its athletes. In other words, Russia cheated," Brady said. "They cheated, they got caught, they were banned from the Olympics, they were mad, and they retaliated. And in retaliating, they broke the law, so they are criminals."
The hacks were allegedly perpetrated by serving officers of the GRU, Russia's military intelligence body.
Wiggins and records
The biggest impact of the hacks arguably was felt by cyclist Bradley Wiggins, a five-time Olympic champion and first British winner of the Tour de France.
Wiggins' reputation and popularity took a hit when his medical records were published in September 2016 by Fancy Bear, a name allegedly used as an alias by the GRU posing as anti-drugs crusaders. The leaked documents revealed that Wiggins sought therapeutic use exemptions (TUEs) — permission to take a banned drug for medical reasons — for injections of triamcinolone acetate before key races in 2011, 2012 and 2013, including the 2012 Tour. He denied wrongdoing and said it was to prevent hay fever.
The story was aggressively pursued by British media and a parliamentary committee, and focused on a mystery package hand delivered from England to France. It produced denials and shifting explanations from Wiggins' former bosses at Team Sky.
Sky's reputation for precise management of fine details fell apart. As a result, Sky's Chris Froome got little benefit of the doubt in Britain when a potential doping case arose after he won the 2017 Spanish Vuelta.
Wiggins was among dozens of international athletes whose medical privacy was breached. Most files contained nothing suspicious at all, but without context, medicine taken to recover from already well-known injuries or illness could look suspect.
One athlete's use of fertility medication was presented as evidence of doping, as was another's emergency hospital treatment after a sudden collapse. No Russian TUEs were published, though Russian athletes like swimmer Yulia Efimova have said they too used the TUE system.
Suspects at the Olympics
Throughout its doping scandals, Russia has tried to stay close to the International Olympic Committee, but the indictment alleges the IOC wasn't immune from attack.
Two hackers allegedly travelled to the Olympics in Rio de Janeiro in 2016 to steal information from sports officials via their Wi-Fi networks. The Dutch Ministry of Defence even released a photo showing one of the accused posing for a picture at an Olympic arena.
The indictment says hackers targeted the beachfront hotel where Olympic doping cases were heard, including some involving leading Russian athletes, and intercepted an IOC anti-doping official's username and password to break into WADA's files.
Eventually, the IOC banned Russia from the 2018 Winter Olympics in Pyeongchang — its athletes were allowed to apply to participate as neutrals — as punishment for doping offences in Sochi four years earlier.
A wave of other Olympic-related organizations were also hit by hackers: the IAAF, which suspended Russia from world track and field in 2015 over widespread doping; Canada's anti-doping agency, a trenchant critic of Russia; the Court of Arbitration for Sport, which ruled against some Russian athletes.
The U.S. impact
The impact on the U.S. included athletes — some world-famous — whose medical data was released even where there was no evidence they'd done anything wrong.
The U.S. Anti-Doping Agency was a prime target. As USADA's CEO Travis Tygart issued stinging attacks on Russian athletes' drug use, science director Matthew Fedoruk's email was hacked at the 2016 Olympics. The Fancy Bear website then posted medical data of dozens of U.S.-based athletes who'd asked permission to use otherwise-banned substances for medical reasons.
"A system that was abusing its own athletes with an institutionalized doping program has now been indicted for perpetrating cyber-attacks on innocent athletes from around the world while yet again trying to win by any means," Tygart said Thursday.
World Cup records
While Russia built lavish new stadiums to host this year's World Cup, soccer's world governing body was allegedly targeted by Russian hackers.
In December 2016, FIFA was investigating allegations that Russian soccer players had benefited from a coverup, though none have since been banned as a result. At that time, the indictment says, "the conspirators compromised a computer" with evidence from anti-doping investigations and lab results, and retained access to the device for almost a month.
Last year, some FIFA data was published by the Fancy Bear group, including a list of players who had TUEs at the 2010 World Cup. There was no evidence any of those players had cheated.
FIFA has not commented on the indictment.
Russia hits back
The Russian Foreign Ministry fired back with its own accusations Thursday, accusing USADA of going easy on U.S. dopers and seeking to sideline their Russian rivals.
"American pretentions to leading the fight for clean sport are no more than unfair competition," ministry spokeswoman Maria Zakharova said, speaking after British and Dutch officials outlined the hacking accusations, but before the full U.S. indictment was published.
Zakharova accused Britain of turning stories about the GRU into a "hellish perfume mix," a reference to the perfume bottle which two Russians are accused of using to poison ex-spy Sergei Skripal in Britain in March. She added: "The rich imagination of our colleagues from Britain truly knows no bounds."