A group of Russian hackers is believed to be behind the release of a cache of emails obtained from a former director of MI6 and other Brexiters unhappy with Theresa May’s failure to negotiate a “clean” EU exit deal.
Google said the “clumsy campaign” bore the hallmarks of a Russian group it called Coldriver – and the hackers published the correspondence under the title “Very English Coop d’Etat”, claiming it revealed the existence of shadowy group of pro-Brexit plotters.
But the principal cluster of emails – dated from August 2018 to July 2019 – instead appears to show a group of Brexiters frustrated with May’s willingness to seek compromises with the EU and their attempts to campaign against it.
Shane Huntley, who directs Google’s threat analysis group, said the Russian Coldriver hackers had previously tried to steal people’s login credentials. “This is the first time we’ve seen them step into the disinformation / hack-and-leak space,” he added.
Hack-and-leak operations are part of the standard modus operandi of Russian hackers, who are often linked to one of the country’s spy agencies – and the attack is one of the first detected during the now three-month-long Ukraine war.
A key figure targeted was Sir Richard Dearlove, a former director of MI6 between 1999 and 2004, including the period leading up to the Iraq war. The former spymaster told Reuters, which first reported the story: “I am well aware of a Russian operation against a Proton [email] account which contained emails to and from me.”
The emails describe a short-lived plan to create a hard Brexit campaign group in the summer of 2018 amid growing opposition to May’s proposed Chequers deal, which had already prompted the resignation of Boris Johnson from government.
Using the codename “Operation Surprise” the group was to be chaired by leave-supporting former Labour MP and peer Gisela Stuart with Dearlove among a group of public figures who would sit on its advisory board.
Its goals, the leaked document says, were to “block any deal” to leave the EU arising from the Chequers white paper, to “ensure that we leave on clean WTO terms” and “if necessary remove this prime minister and replace with one fit for purpose”. Later it adds: “May has now been shown to be incapable of office” and lists a group of well known rightwing journalists as part of its “media circle”.
But the group never got going, after Stuart told others on the would be advisory board in August 2018 that she did not believe it was necessary, because other anti-Chequers campaigns were developing rapidly.
Many of the other emails consist of ongoing complaints about civil servants, the drift of May’s policy, and even tittle tattle about anti-Brexiter George Soros, consisting largely of political remarks he had supposedly made to family members over dinner.
Dearlove said that the emails had captured a “legitimate lobbying exercise” which, when seen through “this antagonistic optic” of a Russian hack-and-leak operation “is now subject to distortion”.
The website containing the emails is called “sneaky strawhead” – a reference to Johnson’s often chaotic hairstyle. It was registered on 19 April by individuals using a commercial domain name provider.
Democratic party emails were hacked by members of Russia’s GRU military intelligence in the run-up to the 2016 presidential election and passed to WikiLeaks, where their publication helped pave the way for the election of Republican candidate Donald Trump.
Confidential documents relating to US-UK trade talks were stolen from a personal email account belonging to former trade minister Liam Fox. The 451-page cache was dumped on Reddit and eventually ended up in the hands of then Labour leader, Jeremy Corbyn, during the 2019 election campaign.
