Messing with the Enemy

by Clint Watts

  Twitter’s revelations of Russian meddling have been slow and concerning, and they continue to grow with each month. As Facebook and Google returned their findings to the Senate Select Intelligence Committee, Twitter seemed unaware of any Russian influence connections on its platform. In early October 2016, Twitter initially knew of a couple hundred accounts connected to the Kremlin. That number had grown by ten times by the end of that month.12 On January 31, 2018, Twitter upped the count to 3,814 Internet Research Agency–backed accounts, along with 50,258 automated accounts that were “Russia-linked and Tweeting election-related content during the election period.” I estimate this to be only a fraction of the Kremlin’s accounts. Twitter has since notified more than 1.4 million users it believes might have interacted with Russian government-linked accounts. John Cornyn of Texas, the second-highest-ranking Senate Republican, received one of the notifications.

  Thousands of Russian-backed Twitter accounts influenced the presidential election cycle, but an example of how a single account can influence debate comes from @TEN_GOP. This Russian-operated account posed as a Tennessee Republican Party account and gathered 136,000 followers, many multiples greater than the account of the actual Tennessee Republican Party, which tried to have the impostor account closed. This single Russia influence account received retweets from Brad Parscale, the Trump campaign’s digital director, Donald Trump Jr., who repeated its bogus voter fraud claims, Michael Flynn, Michael Flynn Jr. (more than thirty times), and conservative pundit Ann Coulter (fifteen times).13 The Kremlin’s @TEN_GOP account received citations from nearly every conservative outlet heading into the election. Kevin Collier at BuzzFeed noted, “Fox News quoted an @TEN_GOP tweet in at least three stories . . . The Daily Caller itself quoted it in six stories, . . . Breitbart mentioned it in seven; Infowars in four; RedState in eight. . . . The Gateway Pundit . . . cited the Russian account in 19 different stories.”14 I’ll say it again: this was just one of thousands of accounts operated by Russia in the lead-up to the election pushing for Trump and hating on Clinton.

  But even so, did Trump directly collude with the Kremlin? President Trump’s opponents have advanced the conspiracy that the commander in chief worked with the Russians to gain the nation’s top spot and that he now does Putin’s bidding. Tales of Kremlin operatives compromising Trump family members, perpetuated by the Christopher Steele dossier and left-wing conspiracy theorists, have littered the internet. Investigative journalists continue to trace the connections between Trump Tower and Moscow. Trump’s own behavior—his public support for Russian foreign policy positions, his adoration of Putin and failure to articulate a Russia policy to counter the Kremlin, despite its well-documented meddling, and the abrupt firing of FBI director Comey, among other bizarre behaviors—strengthens claims of collusion.

  Trump’s supporters offer several counterarguments. One says that Trump naturally allies with the Kremlin; their views and policy positions converge. A separate argument posits that Trump is a political opportunist, his behavior consistent with his deal-making strategy in the business world. A more recent argument comes directly from the White House. Jared Kushner appeared behind closed doors with the Senate Select Intelligence Committee and released a public statement discussing all of his contacts with Russian diplomats, bankers, and envoys during the campaign. The statement, in sum, points to inexperience, disorganization, and chaos—in essence, it blames the Trump campaign’s incompetence for the way it stumbled into Russian influence.

  The debate over whether the Trump team colluded with Russia ultimately is a debate about the word collusion—secret or illegal cooperation or conspiracy that seeks to cheat or deceive others. Collusion comes in degrees, however, and ultimately the Kremlin would prefer not to engage in direct collusion. Enlisting the Trump team as direct agents infiltrating the highest ranks of government would be an immediate provocation for war between the United States and Russia.

  When Vladimir Putin sat down at a table during an RT dinner in Moscow in December 2015, he enjoyed the company of two Americans: Michael Flynn, who would later join the Trump campaign, and Jill Stein, a presidential candidate for the Green Party,15 a subset of liberal America with a penchant for U.S. government conspiracies. In Flynn, Russia saw an ally in the fight against terrorism and a man amenable to taking financial payment. Flynn compromised himself by appearing at that dinner at all, providing the Kremlin with information it could use against the retired general should he go against its wishes. Flynn later appeared at meetings in the United States with Ambassador Sergey Kislyak and, in his zealous and aggressive pre-election plotting, made a phone call to the ambassador in advance of President Obama’s sanctions against the Russian government. Flynn’s obfuscation about this monitored phone call led to his firing only weeks into his new job as national security adviser. The Russians didn’t direct Flynn; Flynn did their bidding for them.

  Trump’s inexperience also led him to hire Paul Manafort as his campaign manager. An experienced political hand, Manafort had spent the better part of the previous decade consulting and operating in Ukraine, at times for now-exiled president Viktor Yanukovych, a well-documented, cultivated ally of Russia. Manafort led the planning and operations of the Republican National Convention, where again Ambassador Sergey Kislyak appeared, encountering future attorney general Jeff Sessions. During the same convention, Trump staffers stripped language from the party platform that supported the provision of defensive weapons to Ukraine, directly countering the notoriously hawkish Republican stance against Russia.16 Manafort, an unpaid campaign manager for Donald Trump, departed the campaign shortly after repeating a Kremlin conspiracy on CNN and being tied to a ledger payment from Ukraine’s pro-Russian Party of Regions in the amount of $1.2 million.17 As of this writing, reports from CNN assert that U.S. intelligence agencies intercepted Russian operative communications discussing efforts to work with Manafort and provide information damaging to Hillary Clinton.18 Manafort has been indicted by the special counsel’s investigation and awaits trial on a range of money-laundering charges. Even if Russian connections to Manafort prove to be true, no evidence suggests that Russia colluded directly with Trump as of this publication.

  * * *

  Perestroika and glasnost—economic liberalization and opening up of information—crumbled the Soviet Union, but two decades later they opened the way for Russian active measures far more successful than those of their forefathers. The closed Soviet economy provided no method for openly and legally incentivizing accomplices. KGB agents instead had to recruit operatives and issue payments in the conduct of active measures. Today, Russia’s active measures economically influence America. The Kremlin doesn’t need to pay the Trump team and its envoys when mutually beneficial business arrangements have naturally brought the two camps together. President Trump’s son, Eric Trump, smugly noted that a significant portion of the investments they received were Russian. Donald Trump attempted for years to invest in Russia, even hosting the Miss Universe pageant in Moscow in 2013—an event now shrouded in conspiracy. Even as he began his run for president in 2015, Trump’s businesses were seeking to build a tower in Moscow.19

  Carter Page is the perfect embodiment of Kremlin and Trump economic convergence. Page, an oil-and-gas expert and investor, stumbled into Trump Tower during the campaign and became one of the nominee’s foreign policy advisers. But in the summer of 2016, Page stepped onto a Moscow stage and gave a lecture that sharply criticized the United States and promoted Russian economic and foreign policy positions. Soon after, the Trump team shed Page and distanced itself from him. As with Manafort and Flynn, Kremlin influence connections to Page have surfaced that date back to 2013. An espionage case from New York City in 2013 convicted two Russian spies. Those proceedings illuminated Russia’s intentions to recruit an American businessman amenable to Kremlin policies. The court proceedings anonymized the name, but journalists believe this individual was Carter Page.20 Page claims that he wasn’t aware of this recruitment, and he�
��s likely telling the truth. From Russia’s perspective, why coerce an asset if the target willingly pursues the Kremlin’s interests?

  The most egregious and foolish connection between the Trump campaign and the Kremlin occurred on June 9, 2016, in New York City.21 Rob Goldstone, an English music producer and friend of the Trump family, emailed Donald Trump Jr. about setting up a meeting at Trump Tower with Natalia Veselnitskaya, a Russian lawyer, and Rinat Akhmetshin, a Russian immigrant with ties to a range of Kremlin intelligence. “Russia—Clinton—private and confidential,” the email’s subject line read.22 Donald Trump Jr. took the meeting under the auspices of receiving damaging kompromat on Clinton, but the meeting devolved into a lobbying effort to repeal the Magnitsky Act, a congressional law passed to prevent those responsible for the 2009 death of whistleblower Sergei Magnitsky from gaining access to the United States and utilizing the U.S. banking system. Trump Jr. states that nothing of consequence was discussed. Veselnitskaya claims she was summoned to Trump Tower. Again, Russia created an incident where it could influence the narrative, sow discord in America, and suggest incompetence.

  Russia can influence its intended targets through emissaries, envoys, and oligarchs. Should a target shun Russian advances or even rebuff the Kremlin’s overtures in private, a public meeting with a target provides a real world encounter Russian propagandists can reframe to discredit an opponent through conflicting stories or allegations. For example, in the case of Donald Trump Jr., Natalia Veselnitskaya claimed during an NBC interview that it was the Trump team, not her, who sought damaging information on Hillary Clinton. Jared Kushner suffered similar challenges after accepting a pre-inauguration meeting with Ambassador Kislyak. The media later reported that Kushner sought to establish secret back-channel communications from the Trump team. In both cases, accepting these Russian meetings resulted in the media running with a narrative that was damaging to the Trump presidency.

  As with all of Russia’s active measures, the essential element is plausible deniability: the actions and outcomes of Russian influence should appear as natural occurrences. Guccifer 2.0, the slipping of hacked DNC and Podesta emails to WikiLeaks, a Trump Tower meeting regarding the Magnitsky Act, multiple chance encounters with Ambassador Kislyak, an RT dinner with a retired U.S. general and intelligence chief—each can be explained away. Putin, when asked about Russian meddling in the U.S. election, said the Russian government had nothing to do with such interference but that it’s possible that “patriotic hackers” in Russia may have undertaken actions independently.23 By muddying the waters, Putin indirectly admitted that some Russians may have been involved but also offered plausible deniability of his state’s direct involvement.

  Ensuring plausible deniability requires a sustained campaign far beyond any single active measures action or achievement. The Kremlin counters attribution claims using three techniques: alternative perceptions, parsing and refuting facts, and counteraccusations. It implements this methodology through a full-spectrum approach employing diplomats, selective information, and proxies to challenge attribution claims. The best example of this approach is the story of Seth Rich, a DNC staffer murdered on July 10, 2016, who became a tragic conspiracy scapegoat among Russia meddling investigations. D.C. police believe that Rich’s murder was the result of a robbery gone wrong. WikiLeaks’ Julian Assange, however, issued a reward for details regarding the murder, suggesting that he may have been the source of the DNC email leak. Alt-right websites and conspiracy theorists on 4chan and Reddit posited the same explanation: Rich knew of DNC corruption, they said, and was a closet Bernie Sanders supporter seeking to air the truth.24 RT and Sputnik continued stirring up these allegations through public news stories, amplifying WikiLeaks’ conspiracies,25 and Russian diplomats joined in this counternarrative as well. On May 19, 2017, the Russian embassy in London tweeted, “#WikiLeaks informer Seth Rich murdered in US but MSM [mainstream media] was so busy accusing Russian hackers to take notice.”26 The Russian troll army amplified this conspiracy even further, retweeting claims of a U.S. government cover-up. A Fox News story repeating the claim that Rich may have been the source of DNC leaks has since been retracted, and the news outlet has come under suit by a private detective wrongly cited in an article. A year after Seth Rich’s murder, no evidence has emerged to support the conspiracy about his being the source of the DNC email leak, but the challenge to U.S. government explanations of DNC hacking lives on.27

  Russia’s vast cybercrime underworld adds to the Kremlin’s plausible deniability and provides Putin’s minions with a strategic edge against his adversaries. The National Security Agency (NSA) and, more recently, the new U.S. Cyber Command (CYBERCOM) struggle mightily to recruit, train, and retain hacking specialists in their ranks. Vast differences in pay and culture make government work unpalatable for the highly skilled hackers of America. Even if interested in serving their country, most top potential recruits to America’s cyber ranks have either committed a crime by breaching networks and databases or used a controlled substance, which bars them from government employment. Both of these stipulations routinely disqualify patriotic Americans willing to serve the country’s intelligence services.

  Russia and its Eastern European neighbors maintain highly educated citizenry who—when finally exposed to the world of information technology after the end of the Soviet Union—took to computer science in droves. Computer application coding became a burgeoning industry after the fall of the Iron Curtain, and Western countries outsourced their technological needs to the former Soviet republics, valuing their skill and low prices. At the same time, Putin’s Russia, struggling economically and moving toward kleptocracy, allowed organized crime to run wild, and these groups drifted toward a nearly infinite new enterprise of cybercrime and scooped up a rising pool of talented young programmers.

  By the end of the first decade of the twenty-first century, a large portion of global cybercrime came from Russia. The Kremlin largely turned a blind eye to the cybercriminals within its borders, rarely arresting international perpetrators unless they provided a bargaining chip in other state-to-state negotiations. Putin’s cronies and criminals instead implemented a selective black-market tax on the cyber underworld, taking bribes from Russian syndicates, which allows them to continue their hacking as long as they avoid targeting domestically and inflict no damage on the Russian regime. Russian intelligence services today use this cybercriminal underworld as a means of hiding their activities.

  Sometimes the Russian military advertises jobs for coders in the same way that U.S. military contractors seek out new employees: by posting job ads on social media and hosting recruiting sessions at colleges. Mandatory conscription provides a separate vector for the Russian military: those wanting to avoid the tougher challenges of standard military units could join a “science squadron,” where they might employ existing cyber skills or learn new ones. But the best in Russia, much as in America, have found greater incentive to stay outside the Kremlin’s grasp—profits and notoriety abound in the Wild West of Russia’s cyber underworld. The Russian military and intelligence agencies further bolster their ranks through coercion and contracting.

  When the Obama administration announced Russian sanctions at the end of December 2016, a curious mix of criminal hackers and cyber companies appeared on the list, alongside known Kremlin intelligence outfits previously connected to election meddling. Evgeniy M. Bogachev is the most wanted cybercriminal in the world. He controls the GameOver ZeuS botnet, which has drained millions upon millions of dollars from bank accounts around the globe. Conveniently, the same botnet provides access to every infected computer, and in March 2014 Bogachev’s botnet began searching for politically sensitive information, helping look for intelligence in support of Russia’s invasion of Crimea. It’s believed that sometime during this era, Bogachev received free passage to conduct cybercrime around the world, in exchange for Russia’s internal security service, the FSB, being allowed to lean on his services and his botnet to con
duct espionage when needed. Today, Bogachev lives openly in Anapa, Russia, sailing on the Black Sea, and Russian authorities claim no grounds for arresting him, since he’s never robbed a Russian citizen.28

  Alisa Shevchenko, a former employee of Kaspersky Lab, founded the company Zor Security (formerly known as Esage Lab), a business that she openly advertised as an offensive security research firm focused on finding vulnerabilities rather than fixing them. She has even received credit from the U.S. government for identifying critical weaknesses in code. Shevchenko and Zor Security’s connections to election meddling remain unclear, but an examination of YouTube videos places her as a founding member of a white-hat hacker collective known as Neuron Hackspace, in Moscow. A fellow cofounder is none other than Dmytro Oleksiuk, once a technician for Esage Lab in 2012, who authored the base code for a multipurpose hacking Trojan known as BlackEnergy—computer coding later used to black out western Ukraine just before Christmas 2015. Dmytro claims no knowledge of or participation in the later employment of his base code, and Alisa claims no connection to the Russian government, despite curious contracting relationships with the Kremlin.29

  The Kremlin’s chef, Evgeniy Prigozhin, found his catering company on a separate sanction list fought by President Trump in the summer of 2017. Concord Catering supplies Moscow’s public schools, but Prigozhin allegedly also provides the funding for the Internet Research Agency, Russia’s social media troll farm in St. Petersburg. The summer 2017 sanctions list also named two administrators, two organizations, and the Moscow bike center tied to Kremlin-funded motorcycle gang the Night Wolves, who play a prominent role in the theatrics of Russian active measures.30 The Night Wolves act as a visible proxy for Putin, who sometimes appears at their rallies. The biker gang stormed into Ukraine as the Russian annexation of Crimea began. Flying Russian flags, they fought alongside Russian separatists, and they act at times as a civil affairs arm for winning over local support among the insurgency. Their antics inspire alt-right audiences and advance anti-Western sentiments.31 Bogachev’s botnet, Esage Lab contracting, Prigozhin’s troll army, and a ground force called the Night Wolves—criminals, hackers, harassers, and bikers—combine to create the Kremlin’s active measures proxy army, doing Putin’s business with a veil of plausible deniability.