What the NSA report reveals about Russian hacking,

NSA papers indicate attacks hit deeper than thought.

WASHINGTON — Russian hackers attacked at least one U.S. voting software supplier days before last year’s presidential election, according to a government intelligence report leaked Monday that suggests election-related hacking penetrated further into U.S. voting systems than previously known.

The classified National Security Agency report, which was published online by The Intercept, does not say whether the hacking had any effect on election results. But it says Russian military intelligence attacked a U.S. voting software company and sent spear-phishing emails to more than 100 local election officials at the end of October or beginning of November.

U.S. intelligence agencies declined to comment.

However, the Justice Department announced Monday it had charged Reality Leigh Winner, a government contractor in Georgia, with leaking a classified report containing “top secret level” information to an online news organization. The report the contractor allegedly leaked is dated May 5, the same date as the document The Intercept posted online.

The document said Russian military intelligence “executed cyber espionage operations against a named U.S. company in August 2016, evidently to obtain information on elections-related software and hardware solutions, according to information that became available in April 2017.”

The hackers are believed to have then used data from that operation to create a new email account to launch a spear-phishing campaign targeting U.S. local government organizations, the document said. “Lastly, the actors send test emails to two non-existent accounts ostensibly associated with absentee balloting, presumably with the purpose of creating those accounts to mimic legitimate services.”

The document did not name any state.

The information in the leaked document seems to go further than the U.S. intelligence agencies’ January assessment of the hacking that occurred.

“Russian intelligence obtained and maintained access to elements of multiple U.S. state or local electoral boards,” the assessment said. The Department of Homeland Security “assesses that the types of systems Russian actors targeted or compromised were not involved in vote tallying.”

The American intelligence community has concluded that Russia conducted a broad influence campaign for the purpose of undermining Hillary Clinton’s candidacy.

In October, when the Obama administration accused Russian of stealing and releasing Democratic emails, it also said there was a pattern of probing of voter registration-related systems that were traceable to Russian servers, but stopped short of saying the Russian government was behind them. The intelligence report, citing unspecified information the NSA obtained in April, suggests the government is now satisfied that Moscow was the culprit.

Both attacks described in the report relied on so-called spear-phishing, a tactic that uses spoof emails to trick users into clicking links or opening attachments that then install malicious software on their computers.

Russia’s president, Vladimir V. Putin, shifted last week from his blanket denials of meddling in the election and suggested that “patriotically minded” private Russian hackers could have been involved in the cyberattacks last year.

Once rare, leak cases like the one being brought against Winner have become far more common in the 21st century, in part because of electronic trails that make it easier for investigators to determine who both had access to a leaked document and was in contact with a reporter. Depending on how they are counted, the Obama administration brought nine or 10 leak-related prosecutions — about twice as many as were brought under all previous presidencies combined.

Deputy Attorney General Rod Rosenstein helped prosecute one of them, a case against James E. Cartwright, a retired four-star Marine general and a former vice chairman of the Joint Chiefs of Staff accused of disclosing classified information to reporters. Cartwright pleaded guilty to lying to investigators about his conversations with journalists but was later pardoned by President Barack Obama.

Trump called for a crackdown in the context of leaks about what surveillance has shown about his own associates’ contacts with Russian officials. The report Winner is accused of leaking, by contrast, focuses on pre-election hacking operations targeting voter registration databases and does not mention the Trump campaign.