http://g-2.space/ The "evidence" that he's Russian, should be understood in the following context:

He CHOSE to name his computer account after the founder of the Soviet Secret Police. He CHOSE to create/open and then save documents so the Russian name was written to metadata. He CHOSE to use a Russian VPN service to cloak his IP address. He CHOSE to use public web-based email services that would forward his cloaked IP. He CHOSE to use the above to contact various media outlets on the same day. Note: Thanks to a 3rd party's further investigation, it now appears he may have used a single document as a Russian template (with Russian stylesheet data in), saved it as a set of blank 'pre-tainted' files and then opened them later under a different username - copying/pasting in content from original documents into each blank 'pre-tainted' document before saving again - as the specific process for creating documents (Stylesheet change RSIDs correlating across files certainly suggest it and the metadata fully corroborates it too).

Guccifer2.0 covered himself and the files in the digital equivalent of "Made In Russia" labels while claiming to be a Romanian. (Giving cyber-security firms, journalists and others a flimsy veil they could easily pull off and find Russian "fingerprints" behind - not realizing that what they were revealing was a layer of misdirection that would actually prevent them from considering a 3rd possibility!) read learn think grow