An American journalist who runs an independent newsletter published a document Thursday that appears to have been stolen from Donald Trump’s presidential campaign — the first public posting of a file that is believed to be part of a dossier that federal officials say is part of an Iranian effort to manipulate the U.S. election.
The PDF document is a 271-page opposition research file on former President Donald Trump’s running mate, Sen. JD Vance, R-Ohio.
For more than two months, hackers who the U.S. says are tied to Iran have tried to persuade the American media to cover files they stole. No outlets took the bait.
But on Thursday, reporter Ken Klippenstein, who self-publishes on Substack after he left The Intercept this year, published one of the files.
“If the document had been hacked by some ‘anonymous’ like hacker group, the news media would be all over it. I’m just not a believer of the news media as an arm of the government, doing its work combating foreign influence. Nor should it be a gatekeeper of what the public should know,” he wrote.
Publication of the document reflects how a shifting media ecosystem featuring more high-profile independent journalists on platforms like Substack can influence the ability of state-sponsored hackers to carry out election influence operations.
In an interview, Klippenstein said: “It’s been a vibes election. They are so vague on policy. There’s so few specifics, and something like this can give you some sense of what the campaign thinks.”
At least three major news outlets and two independent journalists previously received a document described as a JD Vance dossier but did not publish it, citing what they have described as a lack of newsworthy information in it.
The dissemination of the Vance file appears to be a hack-and-leak operation akin to how Russian intelligence leaked files from Hillary Clinton’s presidential campaign in 2016. Those emails got significant media attention at the time, a decision that prompted much media criticism.
Politico, which says it began receiving unpublished Trump documents on July 22, was the first news outlet to report that it had received them. The Trump campaign acknowledged last month that it had been hacked and accused Iran, but it has not shared details, and it did not immediately respond to a request for comment Thursday. Research published by Google and Microsoft indicates the hack occurred in June.
Three U.S. agencies have publicly attributed the hack and the subsequent distribution of the files to Iran.
Iranian officials have denied involvement with the hack. Mohammad Javad Zarif, Iran’s vice president for strategic affairs, told NBC News on Tuesday that the country has “no interest in changing the results or affecting the results of this election” and that “the government and official agencies of Iran have not hacked anybody. People working for us haven’t, either.”
The Office of the Director of National Intelligence has repeatedly said since July that Iran seeks to damage Trump’s candidacy. As president, Trump authorized the assassination of military leader Qassem Soleimani. Intelligence officials have also briefed Trump on what they say are ongoing Iranian attempts to assassinate him. The Trump campaign did not respond to a request for comment.
Reporters who have received the documents describe the same pattern: An AOL account emails them files, signed by a person using the name “Robert,” who is reluctant to speak to their identity or reasons for wanting the documents to receive coverage.
NBC News was not part of the Robert persona’s direct outreach, but it has viewed its correspondence with a reporter at another publication.
One of the emails from the Robert persona previously viewed by NBC News included three large PDF files, each corresponding to Trump’s three reported finalists for vice president. The Vance file appears to be the one Klippenstein hosts on his site.
X, formerly known as Twitter, appears to have taken the strongest initial stance against Klippenstein following his Substack post, blocking accounts that share links to his post and suspending his account. Elon Musk, who owns the site, was a staunch critic of how Twitter’s previous leadership limited access to an “October surprise” story in the New York Post about scandalous material found on a laptop belonging to President Joe Biden’s son Hunter.
Former intelligence officials at the time cautioned that the laptop was consistent with the work of Russian intelligence, though no direct connection has been publicly substantiated.
An X spokesperson told NBC News that Klippenstein “was temporarily suspended for violating our rules on posting unredacted private personal information” pertaining to Vance.
Klippenstein wrote an additional post on Substack on Thursday defending his decision to post the file while acknowledging that it did appear to violate X’s rules.
“Did I make a mistake in not redacting the ‘private’ information on J.D. Vance? If I wanted a Twitter account, apparently so. But on principle? I stand by it absolutely,” he said.
Representatives for Substack did not immediately respond to a request for comment.
Kevin Collier is a reporter covering cybersecurity, privacy and technology policy for NBC News.