2) This para. V. bad for DNC if those are classification markings (but could be campaign "doc is sensitive" bluster)pic.twitter.com/aaHiQhdaAM
When you tweet with a location, Twitter stores that location. You can switch location on/off before each Tweet and always have the option to delete your location history. Learn more
13) Another #opsec fail. (This happened because they did an Export as PDF, and then later saved, w/ lang set to RU)https://twitter.com/daviottenheimer/status/743199165459529728 …
14) Tldr: this "lone hacker" uses many VMs, speaks Russian; username is founder of USSR secret police & likes laundering docs via Wikileaks.
15) Spot the difference: Left: doc sent to Gawker (page 210). On right, same page in https://guccifer2.wordpress.com/ pic.twitter.com/0Wogj3TXuS
16) Tangentially related: "VantageUploader" is the tool DNC use to share vids. JWT arg leaks author email in base64.pic.twitter.com/05OvNYRjoE
17) Final piece of metadata: Creation date and software used to turn DOC into the Gawker PDF (note: could be journo)pic.twitter.com/y9PoKJqTZ0
19) @_fl01 points out "Grizli777" indicates that pirated Office (2007) was used by the hacker.https://twitter.com/_fl01/status/743226251373060097 …
20) Extra data-point: Author on The Smoking Gun's PDF is different again. (good chance this is TSG's journo)pic.twitter.com/3e0fEkv0zF
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.