SII Focus 15th September 2016

Analysis: Further ADAMS leaks targets 25 athletes in 8 countries

The Fancy Bears internet site has exposed adverse analytical findings (AAFs) and Therapeutic Use Exemptions (TUEs) relating to 25 athletes from eight countries, after confidential information from the Anti-Doping Administration and Management System (ADAMS) was published this morning. While the World Anti-Doping Agency (WADA) condemned the leaks as a ‘criminal attack’ that ‘recklessly exposed personal data’, the further leaks are bound to raise questions about whether the TUEs exposed are related to a genuine medical need, or are being manipulated to help athletes win. The targeted athletes include ten from the United States, five from Germany, five from Great Britain, one from the Czech Republic, one from Denmark, one from Poland, one from Romania and one from Russia.

The new leak follows exposure of confidential TUEs and AAFs relating to four US Athletes by the same hacking group, a story which The Sports Integrity Initiative broke earlier this week. None of the documents from either leak suggest that any of the athletes have done anything wrong, but their publication does appear to represent a serious privacy breach. As previously stated by The Sports Integrity Initiative, ADAMS is due to be replaced at the end of this year.

Below, in a ‘living document ‘that will be amended as further details emerge, we examine the allegations relating to each athlete in detail. A later leak involved 11 athletes from five countries. A further leak involved 26 athletes from ten countries, involving 12 sports, taking the grand total to 66 athletes from 16 countries as of 19 September.

However, it should be stressed that although this analysis exposes no wrongdoing on the part of any athlete concerned, it is incomplete, as like the hackers, we do not know – or have access to – the athletes’ medical history. However, as Fancy Bears allege that the documents prove that they have abused the TUE process in order to win, it is important to use information that is in the public domain to highlight that this is not the case.

Bethanie Mattek-Sands (US)

Fancy Bears released documents relating to US Open tennis doubles champion, Bethanie Mattek-Sands, which reveal past TUEs for hydrocortisone and prasterone, both of which are medical treatments for adrenal insufficiency. Mattek-Sands is understood to suffer from hypopituitarism and adrenal insufficiency, as well as a number of different allergies. In 2014, she is understood to have unsuccessfully appealed against the World Anti-Doping Agency’s (WADA) decision to reverse a TUE granted by the International Tennis Federation (ITF) giving permission for use of dehydroepiandrosterone (DHEA). As such, the past TUEs appear to be related to a genuine medical need.

Brittney Griner (US)

Documents were also released relating to Pheonix Mercury basketball player Brittney Griner, revealing an existing TUE for lisdexamfetamine, a drug commonly used to treat Attention Deficit Hyperactivity Disorder (ADHD). Again, there is nothing to suggest that this does not constitute a genuine medical need.

John Conger (US)

John ‘Jack’ Conger won a gold medal in the 4x200m freestyle relay at the Rio 2016 Olympics. Documents exposed by Fancy Bears exposed an existing TUE for Dextroamphetamine, commonly known as Adderall in the US and used to treat ADHD. Again, this appears to be a genuine medical need. Conger was recently sanctioned with a four-month ban by the US Olympic Committee (USOC) and USA Swimming for misbehaviour at a petrol station.

Dagmara Wozniak (US)

Wozniak won a bronze medal in fencing at the Rio 2016 Olympics. Documents exposed by Fancy Bears exposed expired TUEs for triamcinolone and prednisone. They are the same substances revealed in an expired TUE for Venus Williams, who yesterday argued that its use was for legitimate medical reasons. Both drugs are corticosteroids used to treat a number of medical conditions including asthma, so appear to be related to a genuine medical need.

Deanna Price (US)

Deanna Price is a hammer thrower who competed at the Rio 2016 Olympics. Documents released by Fancy Bears expose a recent TUE for prednisone during the Olympics. Prednisone is a corticosteroid used to threat asthma and other medical conditions, and therefore appears to relate to a genuine medical need.

Kathleen Baker (US)

Kathleen Baker took gold in the women’s 4x100m medley swimming relay at the Rio 2016 Olympic Games and silver in the 100m backstroke. Documents released by Fancy Bears expose a 9 August Adverse Analytical Finding (AAF) for prednisone and presnisolone, as well as an expired TUE for prednisone, methylprednisolone, budesonide and intravenous infusions of remicade. They also show an existing TUE for dextran, prednisone and budesonide, which would negate the AAF for prednisone. However, Baker is a known sufferer of Chron’s disease, so would appear to have a medical need for the substances listed.

McQuin Baron (US) 

Baron is a member of the US water polo team. Documents leaked by Fancy Bears expose an existing TUE relating to his use of Adderall, which as explained previously, is used to treat ADHD. Again, there is no reason to suggest this is anything other than a genuine medical need.

Michelle Carter (US)

Carter won the gold medal in the shot put at the Rio 2016 Olympics, breaking the US record in that event. Documents released by Fancy Bears show that a February 2015 application for a TUE for Medrol Dosepak (methylprednisolone) and Breo Ellpita (beta-2 agonist) was rejected. Both are drugs commonly used to treat asthma. A TUE application for Depo-Medrol, a glucocorticoid used to treat joint pain was also rejected at the same time.

However, a further document appears to indicate that she received approval for a TUE for all three drugs during the Rio 2016 Olympic Games. The documentation does not indicate the reasons why the TUEs were granted for Rio after they were rejected a year earlier. However, there is no suggestion that in reapplying for them, the athlete has done anything wrong.

Sam Dorman (US)

Dorman won a silver in the men’s synchronised 3m springboard diving at the Rio 2016 Olympics and documents released by Fancy Bears appear to show an AAF for amphetamine during the Games. However, the documents also reveal that Dorman had a valid TUE for ADHD medication Adderall, so the AAF is irrelevant.

Tervel Dlagnev (US)

Dlagnev reached the semi-final in his category at Rio 2016 Olympics, but missed out on the bronze medal. Documents leaked by Fancy Bears reveal a TUE for prednisone during the Rio Olympics. Prednisone is a corticosteroid used to treat a number of medical conditions including asthma. There is nothing to suggest this is anything other than a genuine medical need.

Bradley Wiggins (UK)

Wiggins took gold in the team pursuit at the Rio 2016 Olympics, and also won gold in the time trial at the London 2012 Olympics, the same year in which he won the Tour de France. Documents leaked by Fancy Bears show a TUE for salbutamol, formoterol and budesonide that expired in 2009. All three drugs are used to treat asthmatic-type conditions.

Three later TUEs for triamcinolone acetonide, the last of which expired in 2013, are accompanied with the following note: ‘life long history of upper respiratory and ocular allergy’, including numerous details of tests performed that confirm this diagnosis. There is therefore nothing to suggest that this is anything other than a genuine medical need.

However, Wiggins was forced to defend himself against a claim made in his autobiography that he had never used needles. “Brad’s passing comment regarding needles in the 2012 book referred to the historic and illegal practice of intravenous injections of performance-enhancing substances, which was the subject of a law change by the UCI in 2011″, a spokesperson told The Guardian. “The triamcinolone injection that is referred to in the WADA leaks is an intramuscular treatment for asthma and is fully approved by the sport’s governing bodies. Brad stands by his comment concerning the use of illegal intravenous needle injections.”

Charley Hull (UK)

Documents released by Fancy Bears expose that British golfer Charley Hull holds a valid TUE for asthma medication salbutamol. This does not indicate any wrongdoing of any sort, as the TUE relates to a genuine medical need.

Chris Froome (UK)

Froome won bronze in the men’s time trial at the Rio 2016 Olympics, the same year in which he won the Tour de France for a third time. Documents released by Fancy Bears expose four expired TUEs for prednisolone, a glucocorticoid often used to treat inflammations such as saddle sores. The Union Cycliste Internationale’s (UCI) approval of TUEs for Froome has come under scrutiny before, however there is no suggestion that rules have been broken. Froome has gone to extraordinary lengths to prove that he is clean. Again, there is nothing to suggest that any of the TUEs were anything other than a genuine medical need for the substances concerned.

Heather Fisher (UK)

Fisher is a member of the Great Britain rugby sevens team that lost out on a bronze medal after losing to Canada at Rio 2016. Documents released by Fancy Bears show expired TUEs for methylprednisolone, beclomethasone (becotide), salbutamol, terbutaline, salmeterol, fluticasone propionate, prednisolone, triamcinolone and dexamethasone.

Fisher suffers from alopecia and has reportedly overcome anorexia. Many of the drugs listed above are used to overcome asthma, and others are steroid medications used to overcome skin or lung disease, as well as rheumatic-type conditions. Given the athlete’s apparent history of medical issues, it would appear that the TUEs are related to a genuine medical need.

Sam Townsend (UK)

Townsend was a member of the men’s quadruple sculls that finished fifth at the Rio 2016 Olympics. Documents released by Fancy Bears revealed he was given a past TUE for budesonide and a Rio 2016 TUE for prednisolone. Both are drugs that can be used to treat asthma.

Pernille Blume (Denmark)

Blume won a gold in the 50m freestyle and was a member of the Danish team that won a bronze medal in the 4x100m medley relay in the Rio 2016 swimming pool. Documents released by Fancy Bears reveal an AAF for terbutaline, however she holds a TUE for the substance from the Fédération Internationale de Natation (FINA), which negates the AAF. There can therefore be no suggestion that any wrongdoing has occurred.

“I think it is appalling that some people have managed to hack into a system that is full of very personal information”, said Blume in a statement released by Anti-Doping Denmark. “There are, of course, many headlines being written right now. Some of them will mention just my name and something about doping. And I know very well that what we typically remember from media coverage, is just headlines, and not the rest of the story. Of course it makes me both worried and upset. I distance myself from doping and I really hope nobody is in doubt about that.”

Misha Aloyan (Russia)

Russian boxer Mikhail ‘Misha’ Aloyan won a bronze medal in the flyweight division at the London 2012 Olympics. Documents released by Fancy Bears reveal an AAF for tuaminoheptane at the Rio 2016 Olympics. However, as the date on the AAF is recent (21 August), it is not yet known if the bodies involved have had time to determine if it constitutes an anti-doping rule violation (ADRV).

Natalia Madaj (Poland)

Madaj won gold in the women’s double sculls at the Rio 2016 Olympics. Documents released by Fancy Bears show she held a TUE for diuretics related to a hospital admission back in 2014. Mannitol, the substance that appears to have been administered intravenously, is used to treat cranial pressure, common in head injuries. As such, this would appear to indicate a medical need.

Petra Kvitová (Czech Republic)

Kvitová won a bronze in tennis at the Rio 2016 Olympics. Documents released by Fancy Bears show she held a TUE for salbuterol which expired in 2009 and a TUE for formoterol, which expired in 2013. Both are drugs used in the management of asthma. As both were approved TUEs and both have expired, there is no suggestion that the athlete has done anything wrong.

Roxana Cogianu (Romania)

Cogianu won a bronze medal in the women’s coxed eight at the Rio 2016 Olympics. Documents released by Fancy Bears show she held a TUE for dexamethasone during the Rio 2016 Olympics. Dexamethasone is a steroid-based medication used to treat a number of conditions, including asthma. There is nothing to suggest that the TUE has not been correctly applied for within the rules.

Robert Harting (Germany)

Documents released by Fancy Bears show that London 2012 discus gold medal winner Robert Harting reported an AAF for dexamethasone and triamcinolone acetonide during the Rio 2016 Olympics. However, other documents published by Fancy Bears reveal he held a past TUE for dexamethasone, which had expired in 2008.

‘Me and the medical staff are fine with the leaked content’, Harting posted on twitter. ‘We don’t hide anything’. Dexamethasone is a steroid treatment for a number of medical conditions including skin conditions, as is triamcinolone acetonide.

Franziska Hentke (Germany)

Hentke completed in the butterfly and the women’s 400m individual medley at the Rio 2016 Olympic Games. Documents released by Fancy Bears show expired TUEs for salbutamol, salmeterol and ‘assorted glucocorticoids’. As such, there is not suggestion that the athlete has done anything wrong.

Christina Obergföll (Germany)

Obergföll competed in the javelin at the Rio 2016 Olympics, and a document released by Fancy Bears show she held a TUE for dexamethasone which expired in 2008. As such, there cannot be any suggestion that she has done anything wrong.

‘The document is a medical exemption from the year 2008, due to a joint inflammation that at the request of WADA has been tested and approved’, wrote Obergföll on her Facebook page. ‘The publication of this document is no problem for me, since I am a transparent athlete and have nothing to hide’.

Christian vom Lehn (Germany)

Tom Lehn competed in the men’s 100m breaststroke and the 4x100m relay team at the Rio 2016 Olympics. Fancy Bears published an expired TUE granted by FINA for formoterol and ‘assorted glucocorticoids’. However, as the TUE has expired, there cannot be any suggestion that he has done anything wrong.

Christian Reichert (Germany)

Reichert finished ninth in the 10km marathon swim at the Rio 2016 Olympics. Documents published by Fancy Bears show he FINA TUE for salbutamol that expired in 2010. As such, there cannot be any suggestion that he has done anything wrong.

Reaction

The second leak from Fancy Bears has prompted NADOs to warn athletes that their ADAMS data may be at risk. “Yesterday, as a precaution, we wrote to all members of Team GB to let them know that their information may be at risk”, said UKAD CEO Nicole Sapstead in a statement. “This morning we spoke to all those already affected, and are in the process of contacting others who we believe are most likely to be at risk, to provide them with additional support”.

Germany’s National Anti-Doping Agency (NADA) went further. ‘We have asked WADA for a direct explanation of the scope and extent of the hacker attack and specific instructions on how to proceed in dealing with athlete information on ADAMS’, it said in a statement. ‘We are already in contact with state investigating authorities to clarify any criminal relevance’.

Given the nature of the leaks, which all appear to involve sensitive personal information, athletes could potentially take legal action against WADA for failing to protect their medical information. The data constitutes personal data responsible for being protected under the European Union’s current Data Protection Directive, however WADA is based in Montreal, Canada. However, apparently it could still be on the hook. “I can tell you we are aware of this incident”, said a spokesperson for the Office of the Privacy Commissioner in Canada. “We have reached out to WADA for more information and are awaiting a response. We have not received any formal complaints about this incident to date. Given we have not had an opportunity to formally investigate all the facts, I am not in a position at this time to comment on the organisation’s computer systems, what safeguards may have been in place and what, if any, vulnerabilities might have contributed to the incident. Under Canada’s Personal Information Protection and Electronic Documents Act, which applies to WADA, the sensitivity of information is a specific factor to consider in looking at the adequacy of an organization’s safeguards.”

In its statement today, WADA repeated a line from its initial statement issued after the first leak earlier this week: ‘We still believe that access to ADAMS was obtained through spear phishing of email accounts; whereby, ADAMS passwords were obtained enabling access to ADAMS account information confined to the Rio 2016 Games. We have no reason to believe that other ADAMS data has been compromised.’

Today’s statement repeated its earlier assertion that Russia was behind the attacks. Olivier Niggli, Director General, said that WADA is “receiving intelligence and advice from the highest level law enforcement and IT security agencies that we are putting into action. Given this intelligence and advice, WADA has no doubt that these ongoing attacks are being carried out in retaliation against the Agency, and the global anti-doping system, because of our independent Pound and McLaren investigations that exposed state-sponsored doping in Russia. We condemn this criminal activity and have asked the Russian Government to do everything in their power to make it stop. Continued cyber-attacks emanating from Russia seriously undermine the work that is being carried out to rebuild a compliant anti-doping program in Russia.”

However, the Kremlin has denied that the Russian state is behind the attacks. “It can be stated with certainty that there is no involvement of the official Moscow government or any special services in such actions”, Russian President Vladimir Putin’s spokesperson, Dmitry Peskov told reporters in Russia. “This is completely ruled out”. It is interesting to note that the only potential ADRV that could arise from the documents released today relates to a Russian athlete, boxer Misha Aloyan. If Russia were behind the attacks, would it sacrifice one of its own as a cover?

WADA’s insistence that the attacks are emanating from Russia has also been taken up by other NADOs, such as Anti-Doping Denmark and USADA, which both strongly condemned the attacks. Anti-Doping Denmark’s Director, Michael Ask said that Pernille Blume had “become a pawn in a larger international game, where Russian forces seem to try to shift the focus from the documented systematic circumvention of the doping rules that have taken place in Russia”.

As The Sports Integrity Initiative initially reported, analysis revealed that the IP address for the Fancy Bears internet site can be traced to the US and a French physical address is also listed. At this stage, the only thing that appears to link the group to Russia is Fancy Bears’ twitter name @FancyBearsHT. HT relates to the full name of the group, which is Fancy Bears Hack Team, however it could be an acronym for ‘Hat Tip’ – in other words a nod to a Russian hacking group Fancy Bear, which has been targeting organisations since 2008.

None of this, in itself, provides conclusive proof that the Russian state is behind the attacks on ADAMS. To name the hacking group after an existing group that has been shown to be Russian would be a clumsy move by Russia, unless it represents an elaborate double bluff.

Stalemate

In conclusion, WADA has consistently blamed the Russians as being behind the attacks, which Russia has denied. Meanwhile, athletes who have done nothing wrong are having their names besmirched through the implication that they have somehow abused the TUE process in order to cheat – which as we have shown, is a theory the actual documents do not support.

As with the International Association of Athletics Federations (IAAF) database of blood values that was leaked to journalists last year, perhaps the most troubling aspect of the situation is that athlete’s personal information has been compromised. Ultimately, WADA is responsible for the protection of that information and is therefore liable.

That is perhaps why both WADA statements are keen to blame Russia. It is safer to blame somebody else than admit your own culpability, as to admit responsibility opens you up to the threat of legal action. The phrase ‘we have no reason to believe that other ADAMS data has been compromised’ was included in both WADA statements and is supposed to illustrate confidence that only information related to the Rio 2016 Games was accessed. Time will tell. As Fancy Bears ominously states on its internet site: ‘We’ll keep on telling the world about doping in elite sports. Stay tuned for new leaks.’

Follow this story

Read other articles from this story stream...

News 14th September 2016 - 8 days ago

Athletes defend reputations following ADAMS data breach

Athletes have been forced to defend their reputation, after a Russian hacking group illegally published their personal information, claimed that it constituted evidence of doping. As reported by The Sports Integrity Initiative yesterday, the data published comprised adverse analytical findings (AAF) and Therapeutic Use Exemptions (TUE) relating to US athletes, which does not constitute evidence …
Features 15th September 2016 - 7 days ago

Analysis: Further ADAMS leaks targets 25 athletes in 8 countries

The Fancy Bears internet site has exposed adverse analytical findings (AAFs) and Therapeutic Use Exemptions (TUEs) relating to 25 athletes from eight countries, after confidential information from the Anti-Doping Administration and Management System (ADAMS) was published this morning. While the World Anti-Doping Agency (WADA) condemned the leaks as a ‘criminal attack’ that ‘recklessly exposed personal …
News 17th September 2016 - 5 days ago

Additional data leak via Russian cyber hacker Fancy Bear

The World Anti-Doping Agency (WADA) confirms that, once again today, the cyber hacker Group 'Fancy Bear' released a batch of confidential athlete data on their website, which they illegally obtained from a Rio 2016 Olympic Games account of WADA’s Anti-Doping Administration and Management System (ADAMS). This time, they targeted eleven athletes that include three from Australia, one from …
News 19th September 2016 - 3 days ago

Data leak concerning 26 athletes from 10 countries and 12 sports

The World Anti-Doping Agency (WADA) confirms that, again today, the cyber hacker Group 'Fancy Bear' released a batch of confidential athlete data on their website, which they illegally obtained from a Rio 2016 Olympic Games account of WADA’s Anti-Doping Administration and Management System (ADAMS). This time, the group released data concerning 26 athletes from 10 countries, including: …
Features 19th September 2016 - 3 days ago

Fancy Bears hack now involves 66 athletes from 16 countries

A fourth release of confidential athlete data from the World Anti-Doping Agency’s (WADA) Anti-Doping Administration and Management System (ADAMS) involves 26 athletes from ten countries and 12 sports. The new release is different from earlier releases in that it doesn’t contain any adverse analytical findings (AAFs), just therapeutic use exemptions (TUEs), which are intended to …
Features 17th September 2016 - 5 days ago

Fancy Bears hack now involves 40 athletes from 10 countries

A new leak of confidential medical data taken from the World Anti-Doping Agency’s (WADA) Anti-Doping Administration and Management System (ADAMS) has exposed Therapeutic Use Exemptions (TUEs) and Adverse Analytical Findings (AAFs) relating to 11 athletes from five countries. The data leaked by the Fancy Bears internet site now encompasses the round total of 40 athletes …
Press releases 23rd September 2016 - 30 days ago

Data leak concerning 41 athletes from 13 countries and 17 sports

The World Anti-Doping Agency (WADA) confirms that, again today, the cyber hacker Group “Fancy Bear” released a batch of confidential athlete data on their website, which they illegally obtained from a Rio 2016 Olympic Games account of WADA’s Anti-Doping Administration and Management System (ADAMS). This time, the group released data concerning 41 athletes from 13 countries, including: 4 …
Features 23rd September 2016 - 30 days ago

Fancy Bears hack: 107 athletes; 23 countries; 25 sports

A further publication of data illegally obtained from the World Anti-Doping Agency’s (WADA) Anti-Doping Administration and Management System (ADAMS) has taken the total number of athletes affected to 107 from 23 countries, competing in 25 sports. The latest publication on the Fancy Bears internet site involves Therapeutic Use Exemptions (TUEs) relating to 41 athletes from …
News 7th November 2016 - 15 days ago

Fancy Bears targeting NADOs

The cyber criminals known as Fancy Bears, who hacked into the World Anti-Doping Agency’s (WADA) Anti-Doping Administration and Management System (ADAMS) to expose athletes’ private data such as their use of therapeutic use exemptions (TUEs), are now targeting national anti-doping organisations (NADOS). The Canadian Centre for Ethics in Sport (CCES) confirmed that it was forced …
Features 8th December 2016 - 14 days ago

Fancy Bears email hack: USADA did follow up concerns

On Friday 25 November, The Sports Integrity Initiative received an email from Fancy Bears Hack Team claiming to ‘contain examples of sending WADA tests results to unauthorised persons, instability of ADAMS and subjective-based WADA decisions’, as well as evidence of Ultimate Fighting Championship (UFC) competitors taking prohibited substances. The 189 emails came in three archived …
SII Focus 6th July 2017 - 16 days ago

Athletics stars tagged as ‘likely doping’ in IAAF hack

International Association of Athletics Federations (IAAF) emails illegally accessed by Fancy Bears have indicated that some of track & field’s biggest stars were flagged as ‘likely doping’ under the Athlete Biological Passport (ABP) programme. The cache of documentation also includes details of anti-doping cases and criminal proceedings against other athletes; complaints regarding the anti-doping process …
Press releases 7th November 2016 - 15 days ago

CCES Responding to Cyber Attack

If you’ve tried in recent days to send email to someone at the Canadian Centre for Ethics in Sport, you’ll know that our email system is down, along with our Internet access. We shut these systems down after the Canadian Cyber Incident Response Centre detected a cyber attack. The experts tell us that this is likely …
News 6th July 2017 - 16 days ago

IAAF statement - release of information following cyber attack

The IAAF offers its sincerest apologies to the athletes who believed their personal and medical information was secure with us. We will continue to work with cyber incident response (CIR) firm Context Information Security, who identified the Fancy Bear cyber-attack which we announced in April to create a safe environment. Context believes that the information published yesterday …

You may also like...

Pin It on Pinterest

Share This