Russia is back, wilier than ever — and it’s not alone

Tactics aim to sow division and undermine Joe Biden’s candidacy.

Russian operatives are using a sneakier, more sophisticated version of their 2016 playbook to undermine the November U.S. election — and this time, groups inside and outside the U.S. are furthering their goal of sowing chaos.

Kremlin-backed operatives are flooding social media with fake accounts and stoking racial divisions around topics like Black Lives Matter. Articles in state-owned Russian media with millions of U.S. readers online seek to dampen Joe Biden’s appeal among progressives and echo President Donald Trump’s unsupported claims about voting fraud.

At the same time, Russian state-backed hackers are waging cyberattacks against political parties, campaigns, consultants and others tied to the U.S. elections — using more elaborate deceptions than in 2016, Microsoft said last week.

So far, the 2020 race hasn’t featured any obvious repeats of the mass hacking and dumping of confidential documents that undermined Hillary Clinton at key moments during the 2016 campaign. U.S. intelligence agencies later blamed that breach on a covert Kremlin effort to torpedo the Democratic nominee and help Trump win.

But security researchers, former intelligence officials and lawmakers now worry that the Russians may still have a hand they haven’t played.

“One thing we know that happened in 2016 was Russia, particularly with misinformation and disinformation, tried to exacerbate those divisions that we see play out in real time in America,” Senate Intelligence Vice Chair Mark Warner (D-Va.) told an audience at a cybersecurity conference last week. “I’m very, very concerned in these last 50-plus days whether Russia could try to exacerbate those kinds of racial divisions again.”

In some ways, Russia’s job is easier than it was in 2016. American, Chinese and Iranian copycats are now pumping out falsehoods likely to seed the same divisions and doubts about the legitimacy of the election, often mimicking tactics first deployed by the Kremlin.

And the biggest threat this year may be Americans themselves. Many have embraced a deluge of fringe ideas and misinformation to a degree that may dwarf those foreign efforts. Extremists in the U.S. have adopted much of Moscow’s online strategy, including creating fake online personas to pump out falsehoods. Case in point: The QAnon conspiracy theory, which alleges a plot by elite pedophiles and the “deepstate” to overthrow Trump, has gone so mainstream it’s poised to send adherents to Congress.

“The scale, scope and, most importantly, the impact of domestic disinformation is far greater than any foreign government could do to the United States,” said Graham Brookie, director of the Atlantic Council’s Digital Forensic Research Lab, which tracks online influence campaigns — and was itself the victim of recent Russian cyberattacks.

“Russia is continuing to evolve its tactics,” he added. “But the playing field has shifted since 2016.”

Worst-case scenarios

The question of what exactly Russia is up to has spawned a political brawl in Washington, where congressional Democrats have accused the Trump administration of failing to disclose all it knows about the Kremlin’s activities. They also say the president is pushing a false narrative that this year’s most potent election threat comes from China, which Trump contends favors Biden. Intelligence officials have told POLITICO that no evidence backs up those claims.

Still, Trump’s top counterintelligence official, William Evanina, has agreed that Moscow is seeking to attack the election. He told lawmakers last month that Russia aims to “denigrate” Biden “and what it sees as an anti-Russia ‘establishment.” Those efforts — plus influence campaigns by China and Iran — are "a direct threat to the fabric of our democracy," he said in an earlier statement.

Last week, the Treasury Department imposed sanctions on four individuals, including Andrii Derkach, a Ukrainian lawyer with ties to Trump, accusing them of being active Russian agents. In particular, the U.S. accused Derkach of leaking doctored audiotapes aimed at discrediting Biden.

“The United States will continue to use all the tools at its disposal to counter these Russian disinformation campaigns,” said Treasury Secretary Steven Mnuchin. Still, social media posts about those recordings have drawn millions of views among mostly Trump supporters after the president and his allies promoted them, the Associated Press reported Saturday.

Ten U.S. and international national security officials, misinformation experts and tech executives who spoke to POLITICO said their major concerns include a hack of either campaign coming to light only days before November 3. Most spoke on the condition of anonymity because they were not authorized to discuss national security matters.

That would mirror not only the months of anti-Clinton leaks from 2016, but also the run-up to France’s 2017 presidential election, when Russian hackers released reams of internal documents from Emmanuel Macron’s campaign.

No such leaks have yet been made public in this election. Senior U.S. national security and intelligence officials say they also have seen no new Russian efforts to hack the nation’s election infrastructure, such as voting machines, election device vendors and state voter databases.

But officials warned that Moscow is engaging in information warfare through a combination of attempted social media manipulation, old school propaganda and other dirty tricks.

Conspiracy theories like QAnon and racial divisions stoked by right-wing extremists online appear to be making it more difficult for Russia’s direct campaigns to gain massive followings, with recently exposed Kremlin efforts garnering limited traction with social media users.

But if Moscow still intends to try to weaken the U.S. by generating doubt around the election itself, such homegrown falsehoods would help achieve that goal, according to misinformation experts.

Moscow forced to evolve

Another change from 2016: Tougher oversight by social media companies and increased awareness from U.S. security agencies about Russia’s tactics have forced the Kremlin’s operatives to step up their game.

Before the 2016 election, the Internet Research Agency — a St. Petersburg-based propaganda outfit with ties to the Russian government — was able to buy political ads on Facebook, some of them in rubles, and create fake social media profiles that drew widespread followings around posts on both sides of issues like America’s racial divisions and the country’s treatment of immigrants.

But some of those doors have closed.

After receiving widespread criticism for their 2016 failings, Facebook, Twitter and Google’s YouTube have spent the past two years removing millions of misleading posts and so-called bot networks of fake accounts controlled by Russian operatives. They have also limited the ways Kremlin-owned media outlets can spread their messages online.

On September 1, Facebook and Twitter announced their latest attempts at curbing Russia’s influence by removing a handful of accounts and social media pages linked to an Internet Research Agency campaign to target progressive voters with a fake news website that pumped out left-leaning articles.

Seeking to evade the hunt for fake accounts, the IRA used artificial intelligence to create photos of non-existent people, then built social media personas with those images to push news articles to left-minded online groups, the two companies said. Most strikingly, the IRA also hired freelance journalists to write for a bogus online news outlet called PeaceData that promoted causes favored by Russia, such as attacks on Belarus’ opposition leader, Svetlana Tikhanovskaya, and U.S. foreign policy toward Venezuela.

The elaborate tactics highlight how much harder it has become for Russia’s misinformation campaigns to reach Americans on social media, said Ben Nimmo, director of investigations at Graphika, an analytics firm that worked with Facebook on the recent takedown.

But even the new methods did not guarantee success. PeaceData’s English-language social media presence, for instance, failed to gain traction in the U.S. before it was outed as a Kremlin front, garnering just 200 followers after creating its Facebook page in mid-May.

“If you’re running a fake operation, trying to achieve success when you don’t have any real friends is tough,” said Nimmo, who has tracked the IRA’s activities for years. “The underlying reality is that it’s harder to conduct a successful campaign than you may think.”

Russia’s U.S. targets

Still, misinformation experts and national security officials say Moscow is again targeting the same voters as in both the 2016 presidential race and 2018 midterm elections.

The goal: to suppress turnout among disaffected Democratic voters and galvanize Trump supporters to head to the polls.

Last October, for instance, Facebook removed 50 IRA-linked Instagram accounts that had posed as Republican voters and progressive Democrats, according to a review by the social media company and Graphika.

Under usernames like “Confederate Virginia” and “Stop.Trump2020,” Russian operatives — often pretending to be voters in crucial swing states — copied viral memes like images of liberal Reps. Ilhan Omar (D-Minn.) and Rashida Tlaib (D-Mich.) allegedly promoting anti-Israeli causes from other accounts. They also posted incendiary slogans and calls-for-action on both sides of issues like Black Lives Matter and garnered almost 250,000 followers collectively before the accounts were shut down.

In March, Facebook and Twitter also took down a similar Russian-backed campaign that tricked unsuspecting social media users in Ghana to target African Americans in the U.S. with viral posts depicting police brutality against minorities, including an image of officers allegedly arresting a 6-year-old boy, and calling Trump a racist.

Most of that content was not linked to the 2020 election, according to a review of the fake online content by Graphika. But tech executives and misinformation experts said the campaign had been aimed at building an online following that could then switch to more explicit political content closer to November.

“These types of operations are getting caught earlier and before they have an impact compared to what happened in the past,” said Nathaniel Gleicher, Facebook’s head of cybersecurity policy. Then again, he added, “The threat actors will keep on innovating.”

'Russia doesn’t need to be successful in everything'

With weeks left before November’s vote, Russia is not limiting itself to covert tactics.

Over the past two months, the Kremlin has used its extensive state media operations like RT and Sputnik to pump out political messages to both progressive voters and Trump supporters, according to a POLITICO review of these outlets' social media activities.

Since the beginning of the Democratic National Convention in mid-August, for instance, the Kremlin-backed outlets published articles and op-eds attacking Biden for policies like his support for the Iraq War, and claimed that Barack Obama expressed doubt that his former running mate could win the presidency.

Those stories collectively reached thousands of online users, according to a review of activity on CrowdTangle, a Facebook-owned tool that analyzes people’s engagement on social media. That represents a fraction of the reach of traditional news outlets’ coverage of the convention, but still allowed Russia to get its message to social media users across the U.S.

The Kremlin’s aim was to sow doubts in the minds of progressive voters, particularly those who had initially backed Bernie Sanders, about whether Biden was worth supporting, said Bret Schafer, a media and digital disinformation fellow at the German Marshall Fund of the United States' Alliance for Securing Democracy, a think tank in Washington.

The Marshall Fund was one of more than 200 organizations, businesses and people targeted by Russia’s recent hacking efforts, Microsoft said last week.

“It’s a quintessential voter suppression campaign,” Schafer added.

A week later, just as the Republican convention was getting underway, the same Russian media outlets began peddling articles to promote Trump’s unsubstantiated claims that mail-in voter fraud was a widespread problem. Kremlin operatives have been pushing similar pro-Trump messages about voter fraud since at least March, according to an intelligence bulletin from the Department of Homeland Security obtained by ABC News.

That message has continued into September, with articles from RT and Sputnik promoting mail-in fraud accusations garnering, collectively, thousands of comments and shares across social media, according to POLITICO’s analysis of CrowdTangle data.

“What we’re seeing in the U.S. is what Russia has done elsewhere,” said a veteran European national security official, who has tracked the Kremlin’s disinformation activities across multiple elections worldwide since 2016. The person spoke on the condition of anonymity because the individual was not authorized to speak publicly on security matters linked to Russia.

“The key is that Russia doesn’t need to be successful in everything that it does,” the official added. “Just the fact that it’s pushing these falsehoods can be enough to muddy the waters before an election.”

Natasha Bertrand and Martin Matishak contributed to this report.