On 26 October 2015, I authored a post at the Foreign Policy Research Institute (FPRI) entitled “Russia Returns as al Qaeda and the Islamic State’s Far Enemy” noting:
“The Russians have used social media-driven information campaigns to discredit the U.S. for years. Facebook and Twitter remain littered with pro-Russian, Western-looking accounts and supporting automated bots designed to undermine the credibility of the U.S. government.”
Just a few weeks later in November 2015, the FBI visited FPRI, notifying their leadership that I had been targeted by a cyberattack. The FBI didn’t say who exactly had targeted me, but I had a good idea who it might be.
ADVERTISEMENT
In the 18 months prior to the above quote and in the three years leading up to today, two colleagues and I watched and tracked the rise of Russia’s social-media influence operations witnessing their update of an old Soviet playbook known as Active Measures.
For me, I began watching these influence operations in January 2014 after I co-authored an article in Foreign Affairs entitled “The Good and The Bad of Ahrar al Sham.” Hecklers appearing to be English-speaking Europeans and Americans trolled me for my stance on Syrian President Bashar Assad. But these social-media accounts, they didn’t look right—their aggression, persistence, biographies, speech patterns and synchronization were unnatural. I wasn’t the only one who noticed this pattern. Andrew Weisburd and J.M. Berger, the two best social-media analysts I’d worked with in counterterrorism, noticed similar patterns around the troll discussions of Syria, Assad, al Qaeda, and the Islamic State.
Shortly after, in April 2014, we noticed a petition on the WhiteHouse.gov website. “Alaska Back to Russia” appeared as a public campaign to give America’s largest state back to the nation from which it was purchased. Satirical or nonsensical petitions appearing on the White House website are not out of the norm. This petition was different though, having gained more than 39,000 online signatures in a short time period. Our examination of those signing and posting on this petition revealed an odd pattern—the accounts varied considerably from other petitions and appeared to be the work of automated bots. These bots tied in closely with other social-media campaigns we had observed pushing Russian propaganda.
Through the summer and fall of 2014, we studied these pro-Russia accounts and automated bots. Hackers proliferated the networks and could be spotted amongst recent data breaches and website defacements. Closely circling them were honeypot accounts, attractive-looking women or passionate political partisans, which appeared to be befriending certain audience members through social engineering. Above all, we observed hecklers, synchronized trolling accounts that would attack political targets using similar talking points and follower patterns. These accounts, some of which overtly supported the Kremlin, promoted Russian foreign-policy positions targeting key English-speaking audiences throughout Europe and North America. From this pattern, we realized we were observing a deliberate, well-organized, well-resourced, well-funded, wide-ranging effort commanded by only one possible adversary—Russia.
Active Measures: Everything Old Is New Again
Soviet Active Measures strategy and tactics have been reborn and updated for the modern Russian regime and the digital age. Today, Russia seeks to win the second Cold War through “the force of politics as opposed to the politics of force.” As compared to the analog information wars of the first Cold War, the Internet and social media provide Russia cheap, efficient, and highly effective access to foreign audiences with plausible deniability of their influence.
Russia’s new and improved online Active Measures shifted aggressively toward U.S. audiences in late 2014 and throughout 2015. They launched divisive messages on nearly any disaffected U.S. audience. Whether it be claims of the U.S. military declaring martial law during the Jade Helm exercise, chaos amongst Black Lives matter protests, or tensions in the Bundy Ranch standoff in Oregon, Russia’s state-sponsored outlets of RT and Sputnik News, characterized as “white” influence efforts in information warfare, churned out manipulated truths, false news stories, and conspiracies. Four general themes outlined these propaganda messages:
· Political Messages—Designed to tarnish democratic leaders and undermine democratic institutions· Financial Propaganda—Created to weaken confidence in financial markets, capitalist economies and Western companies· Social Unrest—Crafted to amplify divisions amongst democratic populaces to undermine citizen trust and the fabric of society· Global Calamity—Pushed to incite fear of global demise such as nuclear war or catastrophic climate change
From these overt Russian propaganda outlets, a wide range of English-language conspiratorial websites (“gray” outlets), some of which mysteriously operate from Eastern Europe and are curiously led by pro-Russian editors of unknown financing, sensationalize conspiracies and fake news published by white outlets further amplifying their reach in U.S. audiences. American-looking social-media accounts, the hecklers, honeypots, and hackers described above, working alongside automated bots further amplify and disseminate Russian propaganda amongst unwitting Westerners. These covert, “black” operations influence target-audience opinions with regards to Russia and undermine confidence in Western elected leaders, public officials, mainstream-media personalities, academic experts, and democracy itself.
Through the end of 2015 and start of 2016, the Russian influence system outlined above began pushing themes and messages seeking to influence the outcome of the U.S. presidential election. Russia’s overt media outlets and covert trolls sought to sideline opponents on both sides of the political spectrum with adversarial views toward the Kremlin. The final months leading up to the election have been the predominate focus of Russian-influence discussions to date. However, Russian Active Measures were in full swing during both the Republican and Democratic primary season and may have helped sink the hopes of candidates more hostile to Russian interests long before the field narrowed.
The final piece of Russia’s modern Active Measures surfaced in the summer of 2016 as hacked materials from previous months were strategically leaked. On July 22, WikiLeaks released troves of stolen communications from the Democratic National Committee and later batches of campaign emails. Guccifer 2.0 and DC Leaks revealed hacked information from a host of former U.S. government officials throughout July and August 2016. For the remainder of the campaign season, this compromising material powered the influence system Russia successfully constructed in the previous two years.
On the evening of July 30, my colleagues and I watched as RT and Sputnik News simultaneously launched false stories of the U.S. airbase at Incirlik being overrun by terrorists. Within minutes, pro-Russian social-media aggregators and automated bots amplified this false news story and expanded conspiracies asserting American nuclear missiles at the base would be lost to extremists. More than 4,000 tweets in the first 78 minutes after launching of this false story linked back to the Active Measures accounts we’d tracked in the previous two years. These previously identified accounts, almost simultaneously appearing from different geographic locations and communities, amplified this fake news story in unison. The hashtags incrementally pushed by these automated accounts were #Nuclear, #Media, #Trump and #Benghazi. The most common words found in English-speaking Twitter user profiles were: God, Military, Trump, Family, Country, Conservative, Christian, America, and Constitution. These accounts and their messages clearly sought to convince Americans a U.S. military base was being overrun in a terrorist attack like the 2012 assault on the U.S. consulate in Libya. In reality, a small protest gathered outside the Incirlik gate and the increased security at the airbase sought to secure the arrival of the U.S. Chairman of the Joint Chiefs of Staff the following day.
This pattern of Russian falsehoods and social-media manipulation of the American electorate continued through Election Day and persists today. Many of the accounts we watched push the false Incirlik story in July now focus their efforts on shaping the upcoming European elections, promoting fears of immigration or false claims of refugee criminality. They’ve not forgotten about the United States either. This past week, we observed social-media campaigns targeting Speaker of the House Paul Ryan, hoping to foment further unrest amongst U.S. democratic institutions, their leaders and their constituents.
As we noted two days before the presidential election in our article describing Russian influence operations, Russia certainly seeks to promote Western candidates sympathetic to their worldview and foreign-policy objectives. But winning a single election is not their end goal. Russian Active Measures hope to topple democracies through the pursuit of five complementary objectives:
· Undermine citizen confidence in democratic governance· Foment and exacerbate divisive political fractures· Erode trust between citizens and elected officials and democratic institutions· Popularize Russian policy agendas within foreign populations· Create general distrust or confusion over information sources by blurring the lines between fact and fiction
From these objectives, the Kremlin can crumble democracies from the inside out creating political divisions resulting in two key milestones: 1) the dissolution of the European Union and 2) the breakup of the North American Treaty Organization (NATO). Achieving these two victories against the West will allow Russia to reassert its power globally and pursue its foreign-policy objectives bilaterally through military, diplomatic, and economic aggression. Russia’s undeterred annexation of Crimea, conflict in Ukraine, and military deployment in Syria provide recent examples.
Why did Soviet Active Measures fail during the Cold War but succeed for Russia today?
Russia’s Active Measures today work far better than that of their Soviet forefathers. During the Cold War, the KGB had to infiltrate the West, recruit agents, and promote communist parties and their propaganda while under watch by Western counterintelligence efforts. Should they be too aggressive, Soviet spies conducting Active Measures amongst U.S. domestic groups could potentially trigger armed conflict or would be detained and deported.
Social media provides Russia’s new Active Measures access to U.S. audiences without setting foot in the country, and the Kremlin smartly uses these platforms in seven ways to win Western elections. First, Russia chooses close democratic contests where a slight nudge can usher in their preferred candidate or desired outcome. Second, Russia targets specific audiences inside electorates amenable to their messages and resulting influence—in particular, alt-right audiences incensed over immigration, refugees, and economic hardship. Third, Russia plans and implements their strategy long before an election, allowing sufficient time for cultivating an amenable audience ripe for manipulation. Fourth, their early entry into electoral debates allows them to test many messages and then reinforce those messages that resonate and bring about a measurable, preferred shift in public opinion. Fifth, Russia brilliantly uses hacking to compromise adversaries and power their influence messaging—a tactic most countries would not take. Sixth, their employment of social-media automation saturates their intended audience with narratives that drown out opposing viewpoints. Finally, Russia plays either side should the contest change—backing an individual candidate or party so long as they support a Kremlin policy position and then turning against the same party should their position shift against Russia.
The implications of Russia’s new Active Measures model will be twofold. The first is what the world is witnessing today—a Russian challenge to democracies throughout the West. Russian influence surfaced in Eastern Europe elections and the United Kingdom’s Brexit vote before the U.S. presidential election, helped bolster a losing far-right candidate recently in the Netherlands, and right now works diligently to shape the upcoming 2017 elections in France and Germany. Over the horizon, Russia has provided any authoritarian dictator or predatory elite equipped with hackers and disrespectful of civil liberties a playbook to dismantle their enemies through information warfare. Fledgling democracies and countries rife with ethnic and social divisions will be particularly vulnerable to larger authoritarian regimes with the time, resources and patience to foment chaos in smaller republics.
The U.S. Can Counter Russia’s Modern Active Measures
America can defuse Russia’s Active Measures online by undertaking a coordinated and broad range of actions across the U.S. government. Currently, the U.S. ignores, to its own detriment, falsehoods and manipulated truths generated and promoted by Russia’s state-sponsored media and their associated conspiratorial websites. While many Active Measures claims seem ridiculous, a non-response by the U.S. government introduces doubt and fuels social-media conspiracies. The U.S. should generate immediate public refutations to false Russian claims by creating two official government webpages acting as a U.S. government “Snopes” for disarming falsehoods. The U.S. State Department would host a website responding to false claims regarding U.S. policy and operations outside U.S. borders. The U.S. Department of Homeland Security would host a parallel website responding to any and all false claims regarding U.S. policy and operations domestically—a particularly important function in times of emergency where Russian Active Measures have been observed inciting panic.
Criminal investigations bringing hackers to justice will continue to be vital. However, the FBI must take a more proactive role during investigations to analyze what information has been stolen by Russia and then help officials publicly disclose the breach in short order. Anticipating rather than reacting to emerging Russian data dumps through public-affairs messaging will help U.S. officials and other American targets of kompromat prepare themselves for future discrediting campaigns.
Russian propaganda sometime peddles false financial stories, causing rapid shifts in U.S. company stock prices that hurt consumer and investor confidence and open the way for predatory market manipulation and short selling. At times, U.S. business employees unwittingly engage with Russian social-media hecklers and honeypots putting themselves and their companies at risk. The Departments of Treasury and Commerce should immediately undertake an education campaign for U.S. businesses to help them thwart damaging, false claims and train their employees in spotting nefarious social-media operations that might compromise their information.
The Department of Homeland Security must continue to improve existing public-private partnerships and expand sharing of cybertrends and technical signatures. This information will be critical in helping citizens and companies prevent the hacking techniques propelling Russian kompromat. Finally, U.S. intelligence agencies have a large role to play in countering Russian Active Measures in the future, but my recommendations in this regard are not well suited for open discussion.
The most important actions to diffuse Russia’s modern Active Measures actually come from outside the U.S. government—the private sector and civil society. Russia’s social-media influence campaigns achieve great success because mainstream media outlets amplify the salacious claims coming from stolen information. If forewarned by law enforcement of a Russian compromise (as noted above), the world’s largest newspapers, cable-news channels and social-media companies could join in a pact vowing not to report on stolen information that amplified Russia’s influence campaigns. While they would stand to lose audience in the near term to fringe outlets, Russia’s Active Measures would be far less effective at discrediting their adversaries and shaping polities if they lacked access to mainstream media outlets. Mainstream media outlets unifying and choosing not to be Kremlin pawns would also be a counter to Russia’s suppression of free speech and harsh treatment of journalists and the press.
Social-media companies have played an outsized role in recent elections as they increasingly act as the primary news provider for their users. Tailored news feeds from social-media platforms have created information bubbles where voters see only stories and opinions suiting their preferences and biases—ripe conditions for Russian disinformation campaigns. In the leadup to the 2016 election, fake news stories were consumed at higher rates than true stories. As a result, Facebook initiated a noble effort to tag fake news stories for their readers. But Facebook’s push must be expanded and joined by other social-media companies or they will be overwhelmed by the volume of stories needing evaluation and will find difficulty protecting freedom of speech and the freedom of the press.
Social-media companies should band together in the creation of an Information Consumer Reports. This non-governmental agency would evaluate all media organizations, mainstream and otherwise, across a range of variables producing news ratings representative of the outlet’s accuracy and orientation. The score would appear next to each outlet’s content in web searches and social-media streams providing the equivalent of a nutrition label for information. Consumers would not be restricted from viewing fake news outlets and their erroneous information, but would know the risks of their consumption. The rating, over time, would reduce consumption of Russian disinformation specifically and misinformation collectively, while also placing a check on mainstream media outlets that have all too often regurgitated false stories.
Over the past three years, Russia has implemented and run the most effective and efficient influence campaign in world history. Russian propaganda and social-media manipulation has not stopped since the election in November and continues fomenting chaos amongst the American populace. American allies in Europe today suffer from an onslaught of hacks and manipulation, which threaten alliances that brought U.S. victory in the Cold War. The U.S., in failing to respond to Russia’s Active Measures, will surrender its position as the world’s leader, forgo its role as chief promoter and defender of democracy, and give up on over 70 years of collective action to preserve freedom and civil liberties around the world.
Our nation’s democratic principles and ideals are under attack by a kleptocratic Russian regime sowing divisions amongst the American public and Western society through information warfare. Russia’s strategic motto is “divided we stand, divided we fall”. It’s time the United States remind the world, that despite our day-to-day policy debates and political squabbles, we stand united, alongside our allies, in defending our democratic system of government from the meddling of power-hungry tyrants and repressive authoritarians that prey on their people and suppress humanity.
Clint Watts has been a fellow on national security and the Middle East at the Foreign Policy Research Institute since 2011, and is a senior fellow at the Center For Cyber and Homeland Security at The George Washington University. He is co-author of the recently published, "Trolling for Trump: How Russia Is Trying to Destroy Our Democracy."
