# Hack-and-Leak Operation An influence operation that joins two distinct moves: a **cyber intrusion** ("the hack") to steal private documents or communications, and a **strategic, selectively-timed release** of that material ("the leak") engineered to damage a target and steer a political outcome. The hack supplies the ammunition; the leak is where the political effect is manufactured. Its defining trick is that the leaked material is usually *authentic* — which is precisely what makes it potent: targets cannot dismiss it as fabricated, and the press, following normal news values, amplifies it. ## The 2016 canonical case The archetype is the Russian operation against the 2016 U.S. election, the single most-studied hack-and-leak in history and a centerpiece of this knowledge base's [[Active Measures]] coverage. Two GRU/SVR-linked intrusion sets — popularly **Fancy Bear** and **Cozy Bear** — breached the DNC and ran a [[Spearphishing]] operation against Clinton campaign chairman John Podesta. The stolen emails were then laundered to the public through a chain of cut-outs designed to obscure attribution: the [[Guccifer 2.0]] persona, the [[DCLeaks]] site, and ultimately [[WikiLeaks]], which dumped DNC emails on July 22, 2016, days before the Democratic convention, and rolled out the Podesta emails in daily tranches through October to maximize sustained coverage. The cadence was the message: a slow drip keeps a story alive far longer than a single dump. ## What makes it work — and why it's dangerous A hack-and-leak exploits the *journalistic and partisan reflex to report on "the documents."* As the War on the Rocks "simulation of scandal" framing puts it, the operation manufactures the *appearance* of a scandal whether or not the contents warrant one — the mere existence of leaked private material reads as incriminating. Several features amplify the effect: - **Authenticity-as-credibility** — real documents resist the "fake news" defense, so the target is forced into damage control rather than denial. - **Laundering through cut-outs** — personas and "hacktivist" fronts ([[Guccifer 2.0]], DCLeaks) and a publisher with First Amendment cover ([[WikiLeaks]]) put distance between the state sponsor and the release. - **Selective curation and timing** — what is withheld matters as much as what is released; drip-feeding sustains the news cycle. - **Tainted-leak risk** — a documented variant (Citizen Lab's "tainted leaks") salts genuine stolen material with forged additions, so the credibility of the real documents vouches for the planted falsehoods. The technique migrated quickly: the 2017 "Macron Leaks" attempted (and largely failed, due to French media restraint and pre-election blackout rules) to replicate it against Emmanuel Macron's campaign, and Gulf-state rivalries have produced their own hack-and-leak exchanges. ## Right-wing-KB relevance Hack-and-leak is the cleanest illustration of how a cyber technique becomes a *political* weapon, and it sits at the seam between this vault's cybersecurity, disinformation, and foreign-influence coverage. The 2016 operation reshaped American politics, was relentlessly amplified by domestic partisan actors (see [[Roger Stone]]'s contacts with the [[WikiLeaks]] release), and established a template that any sufficiently-resourced state or actor can now reuse. It also demonstrates the *liar's-dividend* dynamic in reverse: once hack-and-leaks are a known tactic, even authentic future leaks can be pre-emptively dismissed as foreign operations, corroding trust in genuine accountability journalism. ## Distinct from neighbors - **[[Kompromat]]** — compromising material held for *leverage*; a hack-and-leak is kompromat *deployed publicly* rather than used to coerce privately. - **Whistleblowing / classic leak** — an insider releases material on conscience; a hack-and-leak is an *external intrusion* dressed up as a leak. - **Doxxing** — publishing identifying data to enable harassment; hack-and-leak targets documents for political scandal, at scale. - **Disinformation (fabrication)** — invents false content; hack-and-leak weaponizes *true* content (with the tainted-leak hybrid as the dangerous middle ground). ## See Also - [[Cybersecurity Lexicon]] - [[DNC Hack]] - [[Guccifer 2.0]] - [[WikiLeaks]] - [[Kompromat]] - [[Active Measures]] - [[Firehose of Falsehood]] - [[Disinformation Hub]]