The following is the first in a series of articles that will summarize the “Report on the Investigation into Russian Interference in the 2016 Presidential Election” (aka The Mueller Report). In this article, we look at the ways in which the Russians used social media to influence the 2016 presidential election. 

According to the report, “The Russian government interfered in the 2016 presidential election in sweeping and systematic fashion.”

The initial FBI investigation into Russian interference in the 2016 election began in late July 2016, under the presidency of Barack Obama. Upon realizing the extent and scope of the Russian attacks, in late December 2016, the Obama administration imposed sanctions on Russia for having interfered in the election. By early 2017, several congressional committees were examining Russia’s interference in the election.

In May 2017 Special Counsel Robert S. Mueller was appointed to investigate “the Russian government’s efforts to interfere in the 2016 presidential election,” including any links or coordination between the Russian government and individuals associated with the Trump Campaign.

When assessing links between the Russian government and the Trump campaign, the report notes that the relevant legal term would be “conspiracy” not “collusion.” Mueller notes that “collusion is not a specific offense or theory of liability found in the United States Code.”

During its investigation the Office issued more than 2,800 subpoenas, executed nearly 500 search-and-seizure warrants, obtained more than 230 orders for communications, made 13 requests to foreign governments pursuant to Mutual Legal Assistance Treaties, and interviewed approximately 500 witnesses, including almost 80 before a grand jury.

Russian Election Interference

Mueller’s investigation revealed that the Russian government and its affiliates interfered in the 2016 election in two main ways:

1) First, a Russian entity called the Internet Research Agency (IRA) carried out a social media campaign that favored presidential candidate Donald J. Trump and disparaged presidential candidate Hillary Clinton.

2) Second, a Russian intelligence service conducted computer-intrusion operations against entities, employees, and volunteers working on the Clinton Campaign and then released stolen documents.

The Internet Research Agency: Fake Social Media Accounts, Bots, and Trolls

The Internet Research Agency (IRA) carried out the earliest Russian interference operations identified by the Mueller investigation—a social media campaign designed to provoke and amplify political and social discord in the United States.

The IRA was based in St. Petersburg, Russia, and received funding from Russian oligarch Yevgeny Prigozhin, who is widely reported to have ties to Russian President Vladimir Putin.

Yevgeny Prigozhin aka “Putin’s Chef” (left) serving food to Russian President Vladimir Putin (center). Prigozhin was the official funder of the Internet Research Agency (IRA).

The IRA used social media accounts and interest groups to sow discord in the U.S. political system through what it termed “information warfare.”

The social media campaign evolved from a generalized program designed in 2014 and 2015 to undermine the U.S. electoral system, to a targeted operation that by early 2016 favored candidate Trump and disparaged candidate Clinton.

The IRA’ s operation also included the purchase of political advertisements on social media in the names of U.S. persons and entities. These social media groups and accounts, which promoted divisive U.S. political and social issues, falsely claimed to be controlled by U.S. activists. Over time, these accounts became a means to reach large U.S. audiences.

By the end of the 2016 U.S. election, the IRA had the ability to reach millions of U.S. persons through their social media accounts. Multiple IRA-controlled Facebook groups and Instagram accounts had hundreds of thousands of U.S. participants.

Facebook Operations

According to the Mueller report, in November 2017, a Facebook representative testified that Facebook had identified 470 IRA-controlled Facebook accounts that collectively made 80,000 posts between January 2015 and August 2017. Facebook estimated the IRA reached as many as 126 million persons through its Facebook accounts.

IRA employees also traveled to the United States on intelligence-gathering missions.

In certain cases, the IRA created accounts that mimicked real U.S. organizations. For example, one IRA-controlled Twitter account, @TEN_GOP, purported to be connected to the Tennessee Republican Party. More commonly, the IRA created accounts in the names of fictitious U.S. organizations and grassroots groups and used these accounts to pose as anti-immigration groups, Tea Party activists, Black Lives Matter protestors, and other U.S. social and political activists.

To reach larger U.S. audiences, the IRA purchased advertisements from Facebook that promoted their groups on the newsfeeds of U.S. persons. According to Facebook, the IRA purchased over 3,500 advertisements, and the expenditures totaled approximately $100,000.

The IRA purchased dozens of advertisements supporting the Trump Campaign, predominantly through the Facebook groups “Being Patriotic,” “Stop All Invaders,” and “Secured Borders.” Here are a few examples of Facebook ads purchased by the IRA. You can find all of the IRA-bought Facebook ads HERE, as they have been released by Congress.

Fake political ad funded by IRA.

IRA-controlled Facebook groups attracted hundreds of thousands of unwitting followers.

One of the more popular Russian-backed Facebook groups was called, ironically, “Being Patriotic”

The IRA social media campaign supported Donald Trump and disparaged Hillary Clinton.

IRA-controlled accounts reached millions of Americans, according to the Mueller Report.

Collectively, the IRA’s social media accounts reached tens of millions of U.S. persons.

Individual IRA social media accounts attracted hundreds of thousands of followers. For example, at the time they were deactivated by Facebook in mid-2017, the IRA’s “United Muslims of America” Facebook group had over 300,000 followers, the “Don’t Shoot Us” Facebook group had over 250,000 followers, the “Being Patriotic” Facebook group had over 200,000 followers, and the “Secured Borders” Facebook group had over 130,000 followers.

Twitter Operations

IRA-controlled Twitter accounts separately had tens of thousands of followers, including multiple U.S. political figures who retweeted IRA-created content.

In January 2018, Twitter announced that it had identified 3,814 IRA-controlled Twitter accounts and notified approximately 1.4 million people Twitter believed may have been in contact with an IRA-controlled account.

IRA specialists operated certain Twitter accounts posing as individual US personas. IRA operated a network of automated Twitter accounts (commonly referred to as a bot network) that enabled the IRA to amplify existing content on Twitter.

Individualized accounts used to influence the U.S. presidential election included @TEN_GOP (described previously); @jenn_abrams (claiming to be a Virginian Trump supporter with 70,000 followers); @Pamela_Moore13 (claiming to be a Texan Trump supporter with 70,000 followers); and @America:__Ist_ (an anti-immigration persona with 24,000 followers). In May 2016, the IRA created the Twitter account @march_for_trump, which promoted IRA-organized rallies in support of the Trump Campaign.

70 U.S. media outlets also quoted tweets from IRA-controlled accounts and attributed them to real U.S. persons. Similarly, numerous high-profile U.S. persons, including former Ambassador Michael McFaul, Roger Stone, Sean Hannity, and Michael Flynn Jr., retweeted or responded to tweets posted to these IRA-controlled accounts. Multiple individuals affiliated with the Trump Campaign also promoted IRA tweets.

Trump Campaign affiliates promoted dozens of tweets, posts, and other political content created by the IRA. Posts from the IRA-controlled Twitter account @TEN_GOP were cited or retweeted by multiple Trump Campaign officials and surrogates, including Donald J. Trump Jr., Eric Trump, Kellyanne Conway, Brad Parscale, and Michael T. Flynn. These posts included allegations of voter fraud, as well as allegations that Secretary Clinton had mishandled classified information.

On September 19, 2017, President Trump’s personal Twitter account @realDonaldTrump responded to a tweet from the IRA-controlled account @ l0_gop (the backup account of @TEN_GOP, which had already been deactivated by Twitter). The tweet read: “We love you, Mr.President!”

In January 2018, Twitter publicly identified 3,814 Twitter accounts associated with the IRA. According to Twitter, in the ten weeks before the 2016 U.S. presidential election , these accounts posted approximately 175,993 tweets.

Fake Political Rallies

The IRA organized and promoted political rallies inside the United States while posing as U.S. grassroots activists. First, the IRA used one of its preexisting social media personas (Facebook groups and Twitter accounts, for example) to announce and promote an event.

The IRA then sent a large number of direct messages to followers of its social media account asking them to attend an event. From those who responded with interest in attending, the IRA then sought a U.S. person to serve as the event’s coordinator. In most cases, the IRA would tell the U.S. person that they personally could not attend the event due to some preexisting conflict or because they were somewhere else in the United States. After the event, the IRA posted videos and photographs of the event to the IRA ‘s social media accounts.

Mueller’s investigation identified dozens of U.S. rallies organized by the IRA. The earliest evidence of a rally was a “confederate rally” in November 2015. The IRA continued to organize rallies even after the 2016 U.S. presidential election. The attendance at rallies varied. Some rallies appear to have drawn few (if any) participants while others drew hundreds. Here are some of the rallies organized by IRA-controlled accounts:

Indictments and Charging of Criminal Activity

On February 16, 2018, a federal grand jury in the District of Columbia returned an indictment charging 13 Russian nationals and three Russian entitiesincluding the IRA with violating U.S. criminal laws in order to interfere with U.S. elections and political processes.

The indictment charges all of the defendants with conspiracy to defraud the United States, three defendants with conspiracy to commit wire fraud and bank fraud, and five defendants with aggravated identity theft. As of this writing, the prosecution of some remains ongoing before the U.S. District Court for the District of Columbia. Other defendants remain at large.

Although members of the IRA had contact with individuals affiliated with the Trump Campaign, the indictment does not charge any Trump Campaign official or any other U.S. person with participating in the conspiracy. That is because the investigation did not identify evidence that any U.S. person who coordinated or communicated with the IRA knew that he or she was speaking with Russian nationals engaged in the criminal conspiracy.

Mueller therefore determined that such persons did not have the knowledge or criminal purpose required to charge them in the conspiracy to defraud the United States or in the separate count alleging a wire- and bank-fraud conspiracy involving the IRA and two individual Russian nationals.

Mueller did, however, charge one U.S. national for his role in supplying false or stolen bank account numbers that allowed the IRA conspirators to access U.S. online payment systems by circumventing those systems’ security features.

On February 12, 2018, Richard Pinedo pleaded guilty to identity fraud. Mueller did not establish that Pinedo was aware of the identity of the IRA members who purchased bank account numbers from him. Pinedo’s sales of account numbers enabled the IRA members to anonymously access a financial network through which they transacted with U.S. persons and companies. On October 10, 2018, Pinedo was sentenced to six months of imprisonment, to be followed by six months of home confinement, and was ordered to complete 100 hours of community service.

Stay tuned for Part 2 of this series, in which we summarize Mueller’s findings on Russian computer hacking operations!