Incident
"Guccifer 2.0" was the online persona that claimed sole credit for the 2016 Democratic National Committee intrusion, presenting as a lone Romanian hacktivist. US investigators concluded the persona was operated by Russian military intelligence (GRU) officers.
What happened
The persona's operators consistently connected to Twitter and WordPress through a Russian VPN service (Elite VPN) exiting in France, researchers who traced the persona's email metadata dead-ended at that exit for months. On at least one occasion, per reporting by The Daily Beast later reflected in the public record, the operator failed to activate the VPN before logging in, leaving a real Moscow IP address in an American social media company's server logs. Investigators reportedly resolved that address to a GRU officer working from the agency's headquarters on Grizodubovoy Street.
The OPSEC mistake
A fail-open architecture. The VPN was a manual step in front of accounts that would accept logins with or without it. One ordinary lapse, the kind any human makes under deadline, wrote the persona's true origin into logs the operators didn't control and couldn't delete.
Why it mattered
The persona wasn't defeated by cryptanalysis or informants but by a single log line, retrieved later through legal process. Server-side logs are the adversary's memory: they record the network reality of every connection, persist on someone else's infrastructure, and are immune to your after-the-fact regret. Even a professional intelligence service, running tradecraft as a day job, produced the one bare login that mattered.
How it could have been avoided
Making the unprotected path impossible rather than discouraged: a kill switch or a gateway that refuses to route the persona's traffic outside the tunnel, and full separation of environments so the sensitive identity has no way to reach the internet natively. Anything that relies on a human remembering a manual step, before every session, forever, will eventually record exactly one failure, and one is enough.
Defensive lesson
If a protection matters, make it structural. Use the kill switch your VPN client offers; better, confine sensitive contexts to an environment that fails closed (a Tor-only workstation, a VM whose only route is the tunnel). The same logic applies defensively at every stakes level, the setting that "is usually on" protects you exactly as much as its worst day. See OPSEC Fundamentals on consistency.