Messing with the Enemy

by Clint Watts

  The U.S. government wasn’t interested in the research; Americans weren’t interested in the analysis; I could find no way to turn the Russia research from hobby to paid work. What was I going to do with this massive waste of time and research? If WikiLeaks was going to dump stolen information, then I would start dumping research onto the internet. I wouldn’t have the impact of WikiLeaks, but at least I’d try.

  On Saturday night, July 30, just three days after Trump’s call for Russian assistance, two stories were released in short order by RT and Sputnik. The state-sponsored news agencies both published articles about possible protests at the U.S. air base in Incirlik, Turkey, an increase in Turkish security forces, the potential for a second Turkish military coup, and leaving U.S. nuclear weapons in jeopardy. Minutes later, key Twitter accounts that Andrew, J. M., and I had watched for some time began tweeting both stories. “We have a situation in #Turkey #Incirlik” was followed by sparks and bursts of tweets raising alarm bells about a potential attack at the base. One group of accounts panicked about the possibility of nuclear weapons getting lost to hordes storming the base. A separate group compared the impending doom to Benghazi, and then another subset of tweets asked why the mainstream media wasn’t responding to the incident. Amid these groups, bots promoted hashtags amplifying four themes, at distinct time intervals. #Media #Trump #Nuclear #Benghazi—the pumped hashtags painted the intent of the campaign. The media wasn’t reacting to the incident at Incirlik, though, because nothing was happening. The small protest at the gate had been there for some time and seemed not at all threatening. Preparations for the U.S. chairman of the Joint Chiefs landing the next day provided a reasonable explanation for the added security at the base. On the ground in Turkey, nuclear weapons were not falling into the hands of any military coup or protesters, but in the social media world, one might have thought a second Benghazi-style attack was about to occur.

  Analysis of the Twitter accounts showed a familiar pattern. The first ninety minutes of tweets using the #Incirlik hashtag circled around known amplifiers we’d previously observed. The account bios used highly similar words, most commonly “God,” “country,” “family,” “conservative,” “Christian,” “America,” “Constitution,” and “military.” While there certainly might have been real Trump supporters watching and praying for the safety of U.S. service members on that Saturday night, most of those inciting panic about the Incirlik attack weren’t real accounts; they were social bots creating the appearance of being Trump supporters, hoping to propagate strategically placed false narratives among real Trump supporters.

  Weisburd and I published the analysis of the Incirlik social media campaign at the Daily Beast on August 6, 2016,14 and the story received a good number of views and some commentary. But the article’s release quickly succumbed to the endless barrage of Trump–Clinton election coverage. Despite Russia’s efforts, Trump looked to be a long way from victory, his poll numbers sliding as Clinton took what appeared to be a commanding lead. I resumed my day job, but once again, news coverage of the Trump campaign incited fear.

  “You had the NATO base in Turkey being under attack by terrorists,” Paul Manafort exclaimed to Jake Tapper on CNN on August 14, 2016. The Trump campaign again appeared to be relying on Russian information operations to power their narratives. For the second time in a month, I wondered whether the campaign might be actively working with Russia to influence Americans. The Incirlik coup—or attack, or whatever it had been depicted as—had been debunked almost immediately, and now Trump’s campaign manager was using it as a talking point to discredit mainstream media and suggest bias against the Trump campaign. The next day, the New York Times reported that Manafort’s name had appeared on a payment list belonging to Russia-backed Ukrainian president Viktor Yanukovych. On August 19, shortly after the Incirlik claims and the revelations of the Ukrainian ledger, Paul Manafort’s leadership of the Trump campaign ended.

  Amid the leaks and campaign battles, an online persona named Guccifer 2.0 emerged in June 2016, claiming credit for delivering hacked DNC emails to WikiLeaks. Analysis from multiple cybersecurity research companies, however, pointed to APT28 and APT29 connections to the DNC hack, not this new persona Guccifer. Guccifer 2.0 claimed to be a Romanian hacker, but technical signatures from Guccifer emails pointed to a predominantly Russian-used VPN and limited Romanian language ability. All signs suggested that Guccifer 2.0 was a cutout for the Russian government, providing the Kremlin with plausible deniability of any involvement and a conduit for future releases. Guccifer did just that on August 15, releasing hacked materials from the Democratic Congressional Campaign Committee that discussed congressional campaigns and candidates’ strengths and weaknesses.

  Roger Stone, a Trump adviser who’d appeared months before on RT accusing President Clinton of sexual abuse, spoke to a crowd in Florida on August 10, claiming that he’d communicated with Julian Assange of WikiLeaks. Stone publicly promoted Guccifer 2.0 as the hacker behind the DNC breach, calling Guccifer a “HERO” and privately sending direct messages via Twitter to the @GUCCIFER_2 Twitter account between August 14 and September 9, 2016.15 On August 21, he tweeted, “It will soon the [sic] Podesta’s time in the barrel #CrookedHillary,” foreshadowing an upcoming round of hacked emails.16 Again I watched with concern, trying to assess the linkages between Russian hacking and influence alongside the peculiar connections, actions, and words of the Trump campaign.

  Donald Trump’s chances of being elected appeared to have been dashed when the Washington Post published the transcript of a previously unknown video in which he bragged about his dominance over women, commenting that he could “grab ’em by the pussy.” Less than an hour after this video surfaced, though, WikiLeaks published thousands of the emails stolen from Hillary Clinton campaign chairman John Podesta in March. The emails showcased paid speeches Clinton gave on Wall Street, and their release could further the rift between her and the working-class voters she hoped to court. In a second release, on October 11, 2016, WikiLeaks disclosed that Donna Brazile, a CNN spokesperson, had sent messages regarding debate questions to the Clinton campaign. CNN parted ways with Brazile shortly after, chalking up another casualty of Russian active measures. From July through the opening of the polls, WikiLeaks dropped dribs and drabs of stolen information to continue powering the social media storm against Clinton.

  Russia’s pushing of the Trump train continued all the way up to Election Day, but by October the Kremlin’s messaging turned a bit, suggesting that they, too, had read the polls and were possibly anticipating a Clinton victory. Beyond tearing down Clinton, pumping Trump, and noting that Bernie Sanders had gotten a raw deal from the Democratic Party, Russian state-sponsored outlets and their troll army gave increasing coverage to two allegations echoed by candidate Trump. Claims of voter fraud took on a new intensity, despite no evidence of false voter enrollments. Second, the Kremlin pushed that the U.S. election was rigged for a Hillary Clinton victory, suggesting that the vote count wouldn’t be true. Ominously, Trump took to the stage repeatedly in October and November voicing the same conspiracies, each time offering no evidence to support his claims.

  Most Americans probably saw Trump’s claims as a sign of a sore loser preparing for defeat, but Russia’s backup plan to undermine American democracy through active measures benefited from his allegations. The first wave of Russian hacking, starting back in the fall of 2015, had sought compromising information on those tied to the Clinton campaign and the presidential election in general. The second Russian hacker wave, in 2016, aimed to sow chaos on Election Day. The Department of Homeland Security began receiving calls from state election bodies complaining of hacks on their systems. In total, Russia-connected cyber actors attacked some part of the voting infrastructure in twenty-one states. The goal wasn’t to change votes, necessarily, but instead to tamper with state and local voter rolls.17 Previously registered voters might show up to the polls and their names would be missing from the list, or false names woul
d be added to the rolls, which would then provide ammunition to myths of voter fraud. Should Hillary Clinton be elected, it would be much easier for Russia to use an influence campaign to undermine her mandate to govern as conspiracy questioned the legitimacy of her victory.

  As active measures pushed Putin’s preferred agenda in America and at home, the troll army grew in size and intensity. Each WikiLeaks release of stolen emails not only powered Kremlin state-sponsored outlets but also armed conspiracies from fringe media sites and political opportunists. Clickbait websites in Macedonia and Canada emerged from thin air, pushing false election-related news stories that lured viewers and advertising revenues. Political parties and the super PACs supporting them launched sustained media campaigns, using social media to amplify their message. Members of the Trump campaign, in particular retired lieutenant general Michael Flynn, cheered “Lock her up!” on campaign stages and amplified WikiLeaks’ links on social media. Russian state-sponsored news promoted Trump conspiracy theories of voter fraud and election rigging while WikiLeaks disclosures of hacked material powered wide-ranging smears of Clinton. With the DNC fractured and in disarray, Russia hoped that Bernie Sanders supporters would stay home on Election Day.

  The cacophony of social media rage grew in the final two months of the campaign as Trump and Clinton met for three debates. Political social bots picked up steam. The first debate witnessed massive surges of Twitter activity. By the second debate, researchers at Oxford University determined that nearly a fifth of pro-Clinton and a third of pro-Trump tweets originated from automated accounts. The third debate, on October 19, showed pro-Trump bots outnumbering pro-Clinton bots by a margin of seven to one.18 Trump supporters joined in, proclaiming victory and outshouting Clinton supporters online, while in reality, commentators mostly called the outcome a toss-up or gave a slight edge to Clinton.

  It appeared that Putin’s active measures and open support for Trump wouldn’t be enough to overcome the nearly endless string of Trump gaffes and less than stellar debate performances. Like many, I nervously watched the polls going into the final weeks. While I found little that excited me about the Clinton campaign, Trump’s overt love for authoritarians like Putin and parroting of Kremlin propaganda made me incredibly uneasy. Pundits seemed convinced after the final presidential debate that Clinton would win easily. I became more convinced that if Clinton won, the Kremlin would only intensify its influence efforts on the American public, which made me wonder whether, after the election, I’d finally be able to gain interest from the U.S. government for studying Russian online active measures.

  My thinking changed quickly on the afternoon of October 28, 2016, when FBI director James Comey sent a letter to Congress reopening the investigation into candidate Clinton’s emails from the State Department. Former congressman Anthony Weiner, embroiled in an investigation regarding his explicit conversations with an underage girl, had surrendered a computer to investigators that contained communications between his wife, Huma Abedin, and then–Secretary of State Hillary Clinton. All of Trump’s gaffes, bad debates, and lack of policy expertise quickly evaporated, and the election changed overnight.

  The single biggest issue for pro-Trump online propagandists, Russian or otherwise, was missing emails, and Director Comey’s letter ignited a firestorm on Twitter. The following weekend saw nonstop coverage of the Clinton email controversy—an American couldn’t engage with any media without hearing of the renewed investigation. Almost immediately, polls swung in the opposite direction and states marked solid blue on campaign tracking maps swooped back into play. Having conducted opinion polling during the war on terror, I watched FiveThirtyEight’s tracker cautiously, and the volatility in the previous months convinced me that no one had any idea how people would actually vote on Election Day. The monthly polling swings—Clinton up by five and then neck and neck with Trump—made it clear to me that the election was impossible to call. On Halloween night, one week before Election Day, I checked FiveThirtyEight’s polls one more time—they were basically showing 50–50, an even split, a complete toss-up.

  I had a decision to make. If Trump won, there would be no future Russian active measures research by the U.S. government; I felt certain of that. Although almost anything seemed plausible at this point, Trump seemed more of a “useful idiot,” opportunistically taking the Kremlin’s help, than a “Manchurian candidate” infiltrating the U.S. political system under Russia’s direction. Either way, his overtly pro-Russian foreign policy stances and adoration of Putin convinced me that a future Trump administration wouldn’t be working aggressively to counter the foreign meddling in this election. I’d also learned on my Facebook and Twitter feeds that my questioning of Trump’s Russia ties led conservatives to label me a liberal shill for Hillary Clinton. Despite my upbringing in red-leaning Missouri and my reputation as a pro-drone war hawk during the Obama years, Republican friends suddenly saw me as a Democratic operative seeking to tear down Trump. If I waited to publish research pointing to Russian interference and influence on behalf of Trump until after he won the election, I felt it would be seen as some liberal snowflake conspiracy theory. The more I pondered a potential Trump win, the more certain I became that our findings on Russia’s renewed active measures in cyberspace must be published right then, before the election.

  I called Berger and Weisburd. I urged them to join in writing up our findings, explaining why I thought we had to get our work out before the election. Again, we all felt some reluctance about penning another unfunded article for which we’d likely suffer renewed cyberattacks.

  I started writing with less than a week till Election Day, and Weisburd and Berger joined me. For three days, we put together our final accounting of what we’d observed in the nearly two and a half years since we stumbled onto the Kremlin’s trolls. We edited and deliberated late into Friday night before the election, and I sent the final copy to War on the Rocks, a rising national security blog we’d written for in the past. I offered it to them first, under the stipulation that they release it at least two days before the election, before any of the late-breaking drama likely to come in the final hours of the two campaigns. On Sunday, November 6, 2016, “Trolling for Trump: How Russia Is Trying to Destroy Our Democracy” posted at the War on the Rocks website, and we braced for future cyberattacks. My colleagues and I sent the article around, and in foreign policy circles we received a good number of reads and feedback, but the cacophony of the election buildup quickly buried our analysis and the three of us returned to our day jobs. And, like most everyone else, all we could do was watch election coverage.

  By Election Day, allegations of voter fraud and the election being rigged created such anxiety that I worried that some antigovernment and domestic extremist groups might undertake violence if Trump didn’t win. Pundits continued their prognostications of an easy Clinton victory, and calls for Trump supporters to go to the polls and monitor for fraud echoed far and wide on social media. Russian social media influence networks prepared for a Trump loss and promoted stories about the election being rigged as much as they pumped candidate Trump.

  Worn out from the unending election cycle and years of Russia analysis, I cast my vote in upstate New York and headed to an election-watching show at the Comedy Cellar, in New York City, my favorite place to hang and a spot I hoped might provide some needed relief after so many stressful months.

  The polls and the pundits who read them seemed convinced that Hillary Clinton had survived the ten days of turmoil created by the Comey letter, since the FBI director had announced that the newly discovered emails had yielded no further evidence in the Clinton investigation and the case was again closed. I kept a close eye on my Twitter feed throughout the day, looking for signs of conflicts or violence at polling places, praying no armed individuals would surface and do damage based on fake news. Russia’s trolls promoted the #voterfraud conspiracy at a steady pace throughout the day, hoping to sow chaos and create doubt.

  The first round of resu
lts came in as expected: Pennsylvania and Florida looked too close to call. Then came the 8 p.m. results, and the comedians all but trumpeting a Clinton victory fell quiet. I looked at the real-time election board: Michigan was showing for Trump.

  Around the room, the results weren’t yet sinking in. I walked outside to get a better signal on my phone, and sure enough, Trump was winning. I went back inside and the comedians were struggling to keep the laughs going. The audience was confused, distraught, but, while I was surprised Trump was winning, I could believe it. The polls had been haywire for months, and only the actual, real vote showed voters’ true sympathies. I checked in with my colleagues, and the themes of voter fraud and election rigging were waning on Twitter. The Russians were just as surprised as we were, I imagined. And now they had their own problem: in hoping to undermine Clinton through conspiracies of election rigging, they now risked undermining their preferred man, Trump.

  By 11 p.m., Trump and Clinton supporters were both in disbelief. Trump was going to win. It was only a matter of time before the results were finalized. I smoked a cigarette on the street in front of the Comedy Cellar, something I’ve rarely done in my life, probably not since I partied on Bleecker Street during my college years. I watched distressed New Yorkers make their way home. I wondered: Are they popping champagne bottles and clinking vodka shots in the Kremlin right now? Putin’s plan had worked: an American reality show star spouting Russian propaganda lines would soon be the president of the United States.