SAN FRANCISCO -- A group affiliated with the Russian government created phony versions of five websites - including some related to public policy and to the U.S. Senate - with the apparent goal of hacking into the computers of people who were tricked into visiting, according to Microsoft, which said Monday night that it discovered and disabled the fake sites.
The effort by the notorious APT28 hacking group, which has been publicly linked to a Russian intelligence agency and actively interfered in the 2016 presidential election, underscores the aggressive role Russian operatives are playing ahead of the midterm congressional elections in the United States. U.S. officials have repeatedly warned that the November vote is a major focus for interference efforts. Microsoft said the sites were created over the past several months but did not go into more specifics.
Microsoft's Digital Crimes Unit took the lead role in finding and disabling the sites, and the company is launching an effort to provide expanded cybersecurity protection for campaigns and election agencies that use Microsoft products.
Among those targeted were the Hudson Institute, a conservative Washington, D.C., think tank active in investigations of corruption in Russia, and the International Republican Institute (IRI), a nonprofit group that promotes democracy worldwide. Three other fake sites were crafted to appear as though they were affiliated with the Senate, and one nonpolitical site spoofed Microsoft's own online products.
The Senate did not immediately respond to requests for comment late Monday.
Microsoft said Monday that it had found no evidence that the fake sites it recently discovered were used in attacks, but fake sites can carry malware that automatically loads onto the computers of unsuspecting visitors. Hackers often send out deceptive "spear-phishing" emails to trick people into visiting sites that appear to be authentic but in fact allow the attackers to penetrate and gain control of computers that log on, allowing the theft of emails, documents, contact lists and other information.
"This apparent spear-phishing attempt against the International Republican Institute and other organizations is consistent with the campaign of meddling that the Kremlin has waged against organizations that support democracy and human rights," said Daniel Twining, IRI's president, who put blame on Russian President Vladimir Putin. "It is clearly designed to sow confusion, conflict and fear among those who criticize Mr. Putin's authoritarian regime."
The move by Microsoft is the latest effort by Silicon Valley to address Russian threats to the coming election more aggressively than the technology industry did in 2016, when many woke up to the seriousness and sophistication of disinformation efforts only after Americans had voted. Companies and U.S. officials have vowed to work together more closely this year. Facebook recently disclosed that the company had taken down 32 fake accounts and pages that were tied to the Internet Research Agency, a Russian disinformation operation active before and after the 2016 election.
After discovering the sites recently, Microsoft said, it sought to obtain a court order to transfer the domain names to its own servers, a legal tactic that the company's security division has used a dozen times since 2016 to disable 84 websites created by APT28, which also is sometimes called Strontium or Fancy Bear. APT28, a unit under the Russian military intelligence agency GRU, specializes in information warfare or hacking and disinformation operations. "APT" refers to "advanced persistent threat" in cybersecurity circles.
The court order, executed last week, effectively allowed Microsoft to shut down the sites and to research them more fully. Microsoft has used the legal tactic to go after botnets, or malicious networks of automated accounts, since at least 2010.
Microsoft President Brad Smith said in an interview that the company had been tracking the Russian-government-backed group for two years but had decided to speak publicly about the company's efforts for the first time because of a growing sense of urgency and an uptick in Russian activity ahead of the midterms.
"You can't really bring people together in a democratic society unless we share information about what's going on," Smith told The Washington Post. "When there are facts that are clear as day, for those of us who operate inside companies, increasingly we feel it's an imperative for us to share this more broadly with the public."
He said that the technology industry was seeking to become more transparent with the public. The company previously had announced that two political candidates had been subjected to spear-phishing attacks.
Installing malicious software on phony websites is a popular method for hacking into computers and resembles the tactic used in the attack on John Podesta, the campaign chairman for Hillary Clinton, who received a fake security-warning email that linked to a phony site created by Russians. His stolen emails were released publicly in the final weeks of the presidential election and caused embarrassment for their blunt assessments of various matters. Cybersecurity researchers have blamed the hack of Podesta's email on APT28.
Special Counsel Robert Mueller in July indicted 12 Russian intelligence officers, accusing them of hacking the Democratic National Committee, also in 2016.
Microsoft did not explicitly blame the Russian intelligence agency for the attack announced Monday but it did cite Russia's government and named APT28 and its pseudonyms, Strontium and Fancy Bear.
The Hudson Institute said that it, like many Washington institutions, had been the subject of previous cyberattacks. David Tell, the group's director of public affairs, said that the Hudson Institute's Kleptocracy Initiative, which frequently reports on corruption in Russia, may have made the conservative think tank a target. Tell also noted that Director of National Intelligence Daniel Coats, speaking at the Hudson Institute in July, called Russia "the most aggressive foreign" actor in seeking to divide Americans, which could have drawn the attention of APT28. "This kind of stuff does happen. It's happened to us before," Tell said. "It doesn't surprise me that bad actors in nondemocratic states would want to mess with us."
The phony websites, which were registered with major web-hosting companies, were at my-iri.org, hudsonorg-my-sharepoint.com, senate.group, adfs- senate.services, adfs-senate.email and office365-onedrive.com, according to Microsoft. Their discovery underscores the central role that American tech companies, which frequently have been criticized for hosting Russian disinformation on their platforms, can play in ferreting it out.
Eric Rosenbach, former Pentagon chief of staff and now co- director of Harvard University's Belfer Center for Science and International Affairs, applauded Microsoft for quickly announcing its discoveries. He said that companies sometimes can act in ways that governmental agencies cannot because of legal and ethical restrictions.
"The tech sector needs to play a role in protecting elections and protecting campaigns," Rosenbach said. "The tech sector will have visibility on some of these things that the [National Security Agency] never could and never should."
Microsoft also said Monday it was launching an initiative to provide enhanced cybersecurity protections free to candidates and campaign offices at the federal, state and local level that use its Office 365 software, as well as think tanks and political organizations the company believes are under attack.
"For many decades, people in democratic societies saw these as fundamentally tools that were more likely to bring information to people living in authoritarian countries, and we didn't really worry about these kinds of technologies causing risks to a democratic society," Smith said. "What we're seeing now, with email and voting systems and social media, is [the technologies] creating an asymmetric risk for democratic societies."
The Washington Post's Ellen Nakashima contributed to this report.
CHARLESTON, S.C. -- Elizabeth Boineau's 1939 Colonial sits a block and a half from the Ashley River in a sought-after neighborhood of ancient live oaks, charming gardens and historic homes. A year ago, she thought she could sell it for nearly $1 million. But after dropping the price 11 times, Boineau has decided to tear it down.
In March, the city's Board of Architectural Review approved the demolition - a decision not taken lightly in Charleston's historic district.
"Each time that I was just finishing up paying off the bills, another flood would hit," Boineau said.
Boineau is one of many homeowners on the front lines of society's confrontation with climate change, living in houses where rising sea levels have worsened flooding not just in extreme events like hurricanes, but also heavy rains and even high tides. Now, three studies have found evidence that the threat of higher seas is also undermining coastal property values, as home buyers - particularly investors - begin the retreat to higher ground.
On a broad scale, the effect is subtle, the studies show. The sea has risen about eight inches since 1900, and the pace is accelerating, with three inches accumulating since 1993, according to a comprehensive federal climate report released last year. Scientists predict the oceans will rise another three to seven inches by 2030, and as much as 4.3 feet by 2100.
Meanwhile, mapping has become increasingly precise, providing near-exact elevations that let researchers predict when individual properties could be underwater.
By comparing properties that are virtually the same but for their exposure to the seas, researchers at the University of Colorado at Boulder and Pennsylvania State University found that vulnerable homes sold for 6.6 percent less than unexposed homes. The most vulnerable properties - those that stand to be flooded after seas rise by just one foot - were selling at a 14.7 percent discount, according to the study, which is set to be published in the Journal of Financial Economics.
The study found the drop in prices appears to be driven primarily by investors buying multiple properties or second homes. Such buyers tend to be wealthier and better educated than owners who occupy their coastal homes, said Ryan Lewis, an assistant professor of finance at the University of Colorado and a co-author of the study.
"Sophisticated buyers . . . demand a discount to bear the risk of future sea level rise," Lewis said in an email.
The most-studied market has been Miami-Dade County, parts of which have for years been experiencing regular sunny-day flooding. In a separate paper published in April, researchers at Harvard University found that properties at higher elevations were appreciating faster than properties at lower elevations, a phenomenon they dubbed "climate gentrification."
Last month, the nonprofit First Street Foundation released the first analysis to single out Charleston, a gracious port city founded in 1670. The analysis suggests that exposed homes in Charleston have lost $266 million in value since 2005 due to coastal flooding and expectations of still higher seas. (Using the same method, the First Street researchers found a $465 million loss in Miami-Dade County.)
Harvard's Jesse Keenan, who worked on the climate gentrification study, said the research is "an emerging area" that so far has produced uneven results. For instance, the Colorado-Penn State study found lower property values along the U.S. coast as a whole and in several states, including New York, New Jersey, Florida and Massachusetts. But it did not detect a change in South Carolina.
In addition, the overall effect on prices appears to be surprisingly small, said Susan Wachter, a professor of real estate at the Wharton School at the University of Pennsylvania.
"You could turn it around, almost," Wachter said. "Despite all the discussion of sea level rise, and despite the tremendous increase in the number of events over the last years and the destructiveness of the events, coastal building continues and coastal property appreciation continues."
Indeed, beachfront property is not necessarily declining in value. Rather, the studies suggest that more-exposed properties - including properties that have not yet experienced direct flooding - simply are not appreciating as rapidly as their inland neighbors.
Home prices on the coast are "going up along with market trends. They're just not going up as fast as other places," said Jeremy Porter, a Columbia University researcher who conducted the First Street study with Steven McAlpine, the group's head of data science.
Charleston, for example, has a hot real estate market characterized by high demand even though the city's historic heart sits at low elevation, is surrounded on three sides by water and has recorded a rise in sea level of roughly a foot over the past century.
A large part of that rise has come in the last 25 years, said Norm Levine, director of the Lowcountry Hazards Center at the College of Charleston. As a result, roughly 1 percent of buildings in the Charleston area are now seeing annual flooding, Levine said. "Our 50-year estimate is that it will be 15 percent of the inventory of buildings."
While homes that have already flooded are clearly losing value, Levine said he is skeptical of the First Street study's findings that other properties in Charleston are also being affected. That there will be an effect on real estate at some point is "a given," Levine said. "The question is how long before it actually starts happening."
Owen Tyler, the managing broker of the Cassina Group, a realty company that sells million-dollar-plus historic homes Charleston, agrees. Home buyers are asking increasingly savvy questions about flooding, Tyler said, "a dramatic change from three years ago or five years ago."
But Tyler said it's mainly homes that have already flooded that are suffering; he said he has seen no "big change" in the market overall.
"Some of the houses that had water in them last year, they're selling a little slower. They're staying on the market a longer time," said Judy Tarleton, the broker in charge at Carriage Properties, another local realty company. "But we are still seeing lots of people come to Charleston."
Boineau lives in Harleston Village, one of the neighborhoods that has been hardest hit. In October 2015, flooding on the Ashley River damaged gardens and homes after an extreme rain event dropped about 20 inches on the city. Not a month later, an 8.7-foot tide flooded the neighborhood again.
In 2016, Hurricane Matthew drove a six-foot storm surge into the city. And in 2017, the remnants of Hurricane Irma again flooded some Harleston Village homes, including Boineau's.
"I definitely feel like something has changed," Boineau said when asked about sea level rise and whether flooding in Charleston is getting worse. "And I think that we all have a lot to be concerned about."
"There was no discussion of flooding when we moved into this house in 2004," said Susan Lyons, 75, a retired journalist who lives two blocks from the river and has had to file insurance claims three times to replace flood-damaged ducts. "We've all been blown away by the amount of water that comes from the river."
Boineau put her house on the market last August priced just shy of $1 million, after repairs from two straight years of flooding that had come up under the house but left the interior largely unaffected. Then in September, the remnants of Hurricane Irma inundated the first floor of the house with eight inches of water.
Even when a property has flooded, local real estate agents said homeowners can reassure buyers by waterproofing electrical systems, moving ductwork and, at the extreme, elevating the entire house - a pricey endeavor.
Boineau made ductwork and other repairs after the first two flooding events, but after the third, she dropped the price down to $599,900 and went through a lengthy process to get permission for demolition.
Now, Boineau says, a new buyer can build a new elevated property on the lot. When that's done, her real estate agent, Robin Reeves, said the property should "go for 1.3 to 1.4 million dollars."
Charleston Mayor John Tecklenburg, I - himself a former real estate agent - said the city is looking for other ways to protect property values. Officials are considering a "comprehensive set of flooding and sea-level-rise strategies," including improving pumping systems and raising Charleston's Battery, a sea wall at the tip of the peninsula.
But those are expensive and complex solutions, Tecklenburg said; even if Charleston had the money, designs are not even in place yet for all of the potential engineering projects.
"Our flooding challenges have been around for hundreds of years, because we filled creeks and marshland, before people figured out that wasn't a particularly wise thing to do," Tecklenburg said. "So we're playing catch-up, no doubt about it, and it will take a little time."
As city officials adjust, so do Charleston residents. Unable to find a buyer willing to purchase and then repair the home, Boineau decided to demolish it and sell the lot in Harleston Village. She is now renting a condo just across the river from the city's central peninsula in West Ashley, where her new neighbors have assured her there has been no flooding. She hopes to buy there after the Harleston lot sells.
"Charleston," she said, "is still an incredible place to live."
Chris Mooney reported from Washington.