草莓传媒

Anatomy of a Russian attack: First signs of the Kremlin’s attempt to influence the 2016 election

Anatomy of a Russian attack: The U.S. intelligence community has concluded an attempt to interfere in the 2016 Presidential election was ordered by Russian President Vladimir Putin.  A 草莓传媒 investigation that began in November 2016 examined how the attack happened, when it started, who was involved, and what鈥檚 next. We conducted dozens of interviews with current and former U.S. intelligence officials, members of Congress, cyber security and intelligence experts, foreign government officials, Russian nationals and American victims.  Here is what we learned. (Alexei Druzhinin, Sputnik, Kremlin Pool Photo via AP)
Anatomy of a Russian attack: The U.S. intelligence community has concluded an attempt to interfere in the 2016 Presidential election was ordered by Russian President Vladimir Putin. A 草莓传媒 investigation that began in November 2016 examined how the attack happened, when it started, who was involved, and what鈥檚 next. We conducted dozens of interviews with current and former U.S. intelligence officials, members of Congress, cyber security and intelligence experts, foreign government officials, Russian nationals and American victims. Here is what we learned. (Alexei Druzhinin, Sputnik, Kremlin Pool Photo via AP)
In this Jan. 5, 2017, photo, Director of National Intelligence James Clapper testifies on Capitol Hill in Washington. Clapper will be quizzed again on Jan. 10, on a declassified report that fingered the Kremlin in hacking during the presidential campaign, just one day after the U.S. sanctioned five Russians. (AP Photo/Evan Vucci)
FILE – In this July 7, 2017, file photo, President Donald Trump meets with Russian President Vladimir Putin at the G20 Summit in Hamburg, Germany. Trump had a second, previously undisclosed conversation with Putin at the summit it Germany. (AP Photo/Evan Vucci)
A part of the declassified version Intelligence Community Assessment on Russia’s efforts to interfere with the U.S. political process is photographed in Washington, Friday, Jan. 6, 2017. Russian President Vladimir Putin ordered a campaign to influence the American presidential election in favor of electing Donald Trump, according to the report issued by U.S. intelligence agencies. The unclassified version was the most detailed public account to date of Russian efforts to interfere with the U.S. political process, with actions that included hacking into the email accounts of the Democratic National Committee and individual Democrats like Hillary Clinton’s campaign chairman John Podesta. (AP Photo/Jon Elswick)
A part of the declassified version Intelligence Community Assessment on Russia's efforts to interfere with the U.S. political process is photographed in Washington, Friday, Jan. 6, 2017. Russian President Vladimir Putin ordered a campaign to influence the American presidential election in favor of electing Donald Trump, according to the report issued by U.S. intelligence agencies. The unclassified version was the most detailed public account to date of Russian efforts to interfere with the U.S. political process, with actions that included hacking into the email accounts of the Democratic National Committee and individual Democrats like Hillary Clinton's campaign chairman John Podesta. (AP Photo/Jon Elswick)
A part of the declassified version Intelligence Community Assessment on Russia’s efforts to interfere with the U.S. political process is photographed in Washington, Friday, Jan. 6, 2017. Russian President Vladimir Putin ordered a campaign to influence the American presidential election in favor of electing Donald Trump, according to the report issued by U.S. intelligence agencies. The unclassified version was the most detailed public account to date of Russian efforts to interfere with the U.S. political process, with actions that included hacking into the email accounts of the Democratic National Committee and individual Democrats like Hillary Clinton’s campaign chairman John Podesta. (AP Photo/Jon Elswick)
During a news conference in December, Russian President Vladimir Putin mocked allegations of hacking, saying that Democrats are "looking elsewhere for things to blame." (AP Photo/Pavel Golovkin)
During a news conference last week, Russian President Vladimir Putin mocked allegations of hacking, saying that Democrats are “looking elsewhere for things to blame.” (AP Photo/Pavel Golovkin)
Russian President Vladimir Putin is seen in Nagato, western Japan, Thursday, Dec. 15, 2016. The Obama administration suggested Thursday that Putin personally authorized the hacking of Democratic officials鈥 email accounts in the run-up to the presidential election, which intelligence agencies believe was designed to help Donald Trump prevail. The White House also leveled an astounding attack on Trump himself, saying he must have known of Russia鈥檚 interference. (Toru Hanai/Pool Photo via AP)
FILE – In this Monday, Sept. 28, 2015 file photo, U.S. President Barack Obama, right, and Russia’s President President Vladimir Putin pose for members of the media before a bilateral meeting at the United Nations headquarters. President Barack Obama is promising that the U.S. will retaliate against Russia for its suspected meddling in America’s election process, an accusation the Kremlin has vehemently denied. (AP Photo/Andrew Harnik)
(1/8)
Anatomy of a Russian attack: The U.S. intelligence community has concluded an attempt to interfere in the 2016 Presidential election was ordered by Russian President Vladimir Putin.  A 草莓传媒 investigation that began in November 2016 examined how the attack happened, when it started, who was involved, and what鈥檚 next. We conducted dozens of interviews with current and former U.S. intelligence officials, members of Congress, cyber security and intelligence experts, foreign government officials, Russian nationals and American victims.  Here is what we learned. (Alexei Druzhinin, Sputnik, Kremlin Pool Photo via AP)
A part of the declassified version Intelligence Community Assessment on Russia's efforts to interfere with the U.S. political process is photographed in Washington, Friday, Jan. 6, 2017. Russian President Vladimir Putin ordered a campaign to influence the American presidential election in favor of electing Donald Trump, according to the report issued by U.S. intelligence agencies. The unclassified version was the most detailed public account to date of Russian efforts to interfere with the U.S. political process, with actions that included hacking into the email accounts of the Democratic National Committee and individual Democrats like Hillary Clinton's campaign chairman John Podesta. (AP Photo/Jon Elswick)
During a news conference in December, Russian President Vladimir Putin mocked allegations of hacking, saying that Democrats are "looking elsewhere for things to blame." (AP Photo/Pavel Golovkin)

About this series: The U.S. intelligence community has concluded an attempt to interfere in the 2016 presidential election was ordered by Russian President Vladimir Putin. A 草莓传媒 investigation that began in November 2016 examined how the attack happened, when it started, who was involved and what鈥檚 next. Dozens of interviews with current and former U.S. intelligence officials, members of Congress, cyber security and intelligence experts, foreign government officials, Russian nationals and American victims were conducted. Here is what 草莓传媒 learned.

Part 1: Anatomy of a Russian attack
Part 2: Anatomy of a Russian attack
Part 3: Anatomy of a Russian attack
Part 4: Anatomy of a Russian attack
Part 5: Anatomy of a Russian attack

WASHINGTON 鈥 In April 2014, former FBI special agent Clint Watts and two colleagues noticed a bizarre petition on the Whitehouse.gov website.

鈥淎laska back to Russia appeared as a public campaign to give America’s largest state back to the nation from which it was purchased,鈥 Watts said during testimony before the Senate Select Committee on Intelligence on March 30, 2017.

Watts told the committee that upon closer examination he, Andrew Weisburd and J.M. Berger observed a strange occurrence.

The petition had gained 鈥渕ore than 39,000 signatures in a very short period of time,鈥 Watts said.

Watts, currently a senior fellow at the Center for Cyber and Homeland Security at George Washington University and a Foreign Policy Research Institute fellow, said he and his team detected something even more peculiar.

鈥淥ur examination of those signing and posting on this petition revealed an odd pattern. The accounts varied considerably from other petitions and appeared to be the work of bots.鈥

Their investigation into the accounts associated with the petition revealed that the bots were directly related to other social media campaigns and networks that had been aggressively promoting Russian propaganda in previous months.

Hackers connected to the accounts had multiplied on the networks and could be spotted among recent data-breaches and website defacements.

鈥淐losely circling those hackers were honey pot accounts, attractive looking women and political partisans trying to social engineer other users,” Watts said. “Above all we observed hecklers 鈥 those synchronized trolling accounts you see on Twitter 鈥 that would attack political targets using similar talking patterns and points.鈥

That activity turned out to be the makings of a sophisticated Russian influence operation.

In 2015, U.S. intelligence agencies began to notice that bots like those Watts described had selected some very specific targets 鈥 the U.S. elections system and individuals and organizations associated with it.

According to U.S. intelligence sources, the activity intensified as time passed and there was little doubt that it was a Russian intelligence-linked operation that reached to the very top of the Russian government.

By late 2016, President Barack Obama was notified. And at a Dec. 16, 2016 news conference, he told reporters that he warned Russian President Vladimir Putin not to interfere in the election process.

鈥淚n early September when I saw President Putin in China, I felt that the most effective way to ensure that didn’t happen was to talk to him directly and tell him to cut out and there would be some consequences if he didn鈥檛. And in fact we did not see further tampering of the election process,鈥 Obama said.

Former CIA director John Brennan revealed later that he spoke to Alexander Bortnikov, his counterpart in Russia鈥檚 intelligence services, on Aug. 4, 2016.

鈥淚 said American voters would be outraged by any Russian attempt to interfere in the election,鈥 Brennan said.

He told Bortnikov that if Russia continued to pursue the activity, 鈥渋t would destroy any near term prospects for improvement in relations between Washington and Moscow and would undermine constructive engagement even on matters of mutual interest.鈥

But Brennan said Bortnikov did exactly what he anticipated he would do.

鈥淎s I expected, Mister Bortnikov denied that Russia was doing anything to influence a presidential election,” Brennan said. “Claiming that Moscow is a traditional target to blame by Washington for such activities.鈥

But on Jan. 10, 2017, then-Director of National Intelligence James Clapper revealed that the damage had already been done.

鈥淲e have high confidence that President Putin ordered an influence campaign the 2016 aimed at U. S. presidential election,鈥 he told the Senate Intelligence committee.

At President Obama鈥檚 direction, the intelligence community had conducted a deep, probing investigation into suspicions that Russia had deliberately interfered in the election.

Its report, “,” revealed 鈥淩ussian efforts to influence the 2016 US presidential election represent the most recent expression of Moscow鈥檚 long-standing desire to undermine the US-led liberal democratic order, but these activities demonstrated a significant escalation in directness, level of activity, and scope of effort compared to previous operations.鈥

鈥淩ussia鈥檚 goals were to undermine public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency,” Clapper told the committee. “We further assess Putin and the Russian Government developed a clear preference for President-elect Trump.鈥

The intelligence community’s finding lined up with what Watts and his colleagues suspected.

After the release of the report, another absurd occurrence they had noticed in the summer of 2016 made perfect sense.

鈥淥n the evening of 30 July 2016, my colleagues and I watched as RT and Sputnik news simultaneously launched false stories about the U.S. air base in Incirlik, Turkey being overrun by terrorists,鈥 he told the committee.

鈥淲ithin minutes pro-Russian social media aggregators and automated bots amplified this false news story,” Watts said. “There were more than 4,000 tweets in the first 75 to 78 minutes after launching this false story.鈥

Perhaps the most stunning development for Watt and his companions was that the rapid proliferation of that story was linked back to the active measures accounts (Russian bots) they had tracked for the preceding two years.

鈥淭hese previously identified accounts almost simultaneously appearing from different geographic locations and communities amplified the big news story in unison,鈥 Watts said.

The hashtags promoted by the bots, according to Watts, were 鈥渘uclear, media, Trump and Benghazi.鈥

The most common words, he said found in English speaking Twitter user profiles were 鈥淕od, military Trump, family, country, conservative, Christian, America and constitution.鈥

The objective of the messages, Watts said, 鈥渃learly sought to convince Americans that U.S. military bases being overrun in a terrorist attack.”

In reality, only a small protest gathered outside the gates at the Incirlik base and increased security at the air base had only been deployed to secure the arrival of the Chairman of the U.S. Joint Chiefs of Staff.

According to Watts, similar Russian-driven fake news operations were organized around the Jade Helm exercise, Black Lives Matter protests and the Bundy Ranch standoff in Oregon.

They were partly successful in sowing chaos in some of those cases.

Duping U.S. social media consumers into believing fake news stories emboldened those running Russia鈥檚 active measures campaign to more aggressively seek to influence voter鈥檚 decisions in the 2016 presidential election, according to intelligence sources who spoke with 草莓传媒.

鈥淚t is a very, very [sic] persuasive demonstration of the fact that the Russians interfered in our election process, with the purpose of helping one of the two candidates,” said Robert Litt, former General Counsel of the Office of the Director of National Intelligence, in an interview with 草莓传媒 on Sept. 13, 2017.

Litt, now an attorney with the Washington firm Morrison Foerster, left the U.S. government on Jan. 20, 2017, with a clear view of how the Russian influence operation worked.

鈥淭hey have an extremely capable intelligence service with exceptional cyber capabilities that they have repeated demonstrated, not only against the United States, but against Estonia and Georgia.鈥

NOTE: In our next article, we look at the .

J.J. Green

JJ Green is 草莓传媒's National Security Correspondent. He reports daily on security, intelligence, foreign policy, terrorism and cyber developments, and provides regular on-air and online analysis. He is also the host of two podcasts: Target USA and Colors: A Dialogue on Race in America.

Federal 草莓传媒 Network Logo
Log in to your 草莓传媒 account for notifications and alerts customized for you.