Wednesday, March 15, 2017

Hybrid Warfare: NATO Investigates Putin's Troll War against the West 2/3

 by Nomad

In Part One of this series, we took a look at the basic principles of Russia's hybrid warfare campaign on social media based on a 2015 NATO report. In this segment, let's take a look at how these techniques have been used in practice. In addition, we will look at the role that Russian hybrid warfare played in the 2016 campaign.
That's a puzzle that's still missing quite a few pieces.

Early Warnings

I don’t think anybody knows that it was Russia that broke into the DNC. She’s saying Russia, Russia, Russia—I don't, maybe it was. I mean, it could be Russia, but it could also be China. It could also be lots of other people. It also could be somebody sitting on their bed that weighs 400 pounds, okay?Donald Trump, September 26, 2016
This remark by candidate Trump in last months of the campaign must have struck many informed observers as extremely peculiar. His denial of Russian hacking didn't fit into the established timeline.
Only a few months earlier, on July 27, in the heat of the campaign, Trump had invited Russian hackers to find the 30,000 Hillary Clinton's emails. 
And a month before that, June 15, 2016, a hacker calling himself Guccifer 2.0 explain he had given the hacked emails to WikiLeaks. The emails reportedly came complete with telltale Russian-language formatting errors. Yet, Trump was still inexplicably denying what was already obvious.

Hillary Clinton's allegations of Russian hacking were not based on her imagination. Nor were they based on any secret intelligence from the CIA or from NATO. In fact, news about Russian cyber-warfare capabilities, including hacking, had been well established in the press for years.
For example, in the spring of 2012, the Guardian began reporting of Russian attempts to manipulate the media in the West.
“A pro-Kremlin group runs a network of internet trolls, seeks to buy flattering coverage of Vladimir Putin and hatches plans to discredit opposition activists and media, according to private emails allegedly hacked by a group calling itself the Russian arm of Anonymous”.

A full four years before Trump's denials. And there were other, more recent, reports in the press about Russian trolling.

In December 2014, Paul Roderick Gregory, a professor of economics at the University of Houston, Texas, and a research fellow at the Hoover Institution wrote a piece for Forbes magazine which lead with:
The internet troll army’s selling of the Kremlin’s parallel universe to the Russian people and to a skeptical Western audience is a matter of life and death for the Putin regime. If the Russian people do not buy their story, Putin loses the high “ratings” on which his regime rests. .. Trolling is a high-stakes business that Putin takes seriously and the West must not underestimate.
According to Gregory, throughout his Putin's time in office, the Russian leader has never hesitated to launch his troll army when it offered him an advantage. The Ukrainian crisis was the moment that Putin truly ramped up the use of this type of campaign.
Said one policy analyst,
“Information warfare in Russia is a systemic phenomenon; no other country deals with this issue on such a scale; no-one invests so much organizational and financial effort in it. Information warfare, as it has been conducted for decades, reveals enduring, long-term qualities based on Russian strategic culture.”
By April 2015, the cat was out of the bag. At least, among the experts.
In that month, the Guardian published an article by Shaun Walker which included an interview of two former employee of  an alleged headquarters of Russia’s ‘troll army’ in which "hundreds of paid bloggers work round the clock in order to flood Russian internet forums, social networks and the comment sections of western publications with remarks praising the president, Vladimir Putin, and raging at the depravity and injustice of the west”.

It's clear that the employees were in the pay of the Kremlin and were being assigned tasks by the FSB (Federal Security Service), the intelligence agency Putin once headed.

Other online media outlets soon followed up on the report of paid troll armies. These included Radio Free Europe, the Guardian, the Wall Street Journal, Business Insider, Forbes, etc. 

The stories consisted of published interviews and investigative journalism articles referring to interviews with former trolls or claim to have proof of the location of one of the headquarters of the purported troll army.
(Nomadic Politics filed a detailed report entitled  "The Hunt For Vladimir Putin's Troll Nest" on March 26, 2014.)

And apparently, all those reports from a variety of sources had somehow managed to hide from Donald Trump. The future president was seemingly clueless and ready to attribute the shenanigans on obese bedfast geeks.

What Trolls are Paid to Do

The NATO report offered a lot of supporting evidence and cited one investigation in particular.
Back in 2013, Yle Kioski, a Finnish online magazine, sent reporters to a company named Internet Research Agency in St. Petersburg. The investigators found that the agency had posted
ten job advertisements for innocent-sounding positions such as “social-media specialists”, “internet operators”, “content managers”, etc. for both day and night shifts.

Not unexpectedly, former employees were tight-lipped when it came to the actual details of their work. They undoubtedly had good reasons.
While Yle Kioski journalists were photographing the IRA building, they were stopped by security guards who claimed it was a government building. In Russia, the NATO report points out, that description is typically applied to FSB buildings, military, and administrative buildings, etc.

Some of the details, especially those provided by Buzzfeed journalist Max Seddon, are eye-opening and impressive in a certain way.
In a June 2014 article, Seddon described what it was like to work at a Kremlin-funded troll agency, Internet Research Agency (IRA) where employees are engaged in continually posting online comments and Twitter feeds.
“On an average working day, the Russians are to post on news articles 50 times. Each blogger is to maintain six Facebook accounts publishing at least three posts a day and discussing the news in groups at least twice a day. By the end of the first month, they are expected to have won 500 subscribers and get at least five posts on each item a day. On Twitter, the bloggers are expected to manage 10 accounts with up to 2 000 followers and tweet 50 times a day.”
It's important to note too that not all comments are aimed at persuading people. Some are designed to "complicate informed journalism by polluting the public domain with false or useless information." Fake news, inaccurate data, fake experts making unsubstantiated claims, for example.

Another investigator gave this picture of how a day begins in troll-town. As their shifts commence, they begin by hiding their true identities and their true location.
The first thing employees did upon arriving at their desks was to switch on an Internet proxy service, which hid their I.P. addresses from the places they posted; those digital addresses can sometimes be used to reveal the real identity of the poster.
The trolls would then be provided a list of the opinions to promulgating that day. Workers received a constant stream of “technical tasks” — point-by-point talking points and themes they were to address, all pegged to the latest news.
It doesn't require Sherlock Holmes to know where exactly those talking points come from.

Ukraine, Poland, Finland

When you look over the evidence, it immediately becomes clear that  Putin was more than willing to use social media to control his own people. It was all part of his tools to maintain power.
Yet, where's the evidence that the same techniques were used against the West?

Outside of the Russia, according to the NATO report, pro-Kremlin trolling has been identified in countries including Ukraine, the US, Great Britain, Germany, Poland and the Baltic States.

The full scale of the propaganda efforts against Ukraine, for example, only became clear in March 2015 when Ukrainian Security Service officially announced that the FSB was responsible for all kinds of mischief. FSB-controlled trolls, according to this announcement, had conducted an overwhelming disinformation campaign.   

This involved fake news postings from ostensibly Ukrainian news portals, which were actually controlled by Russia.
The announcement points out that pro-Russian trolls did not succeed in turning everybody pro-Russian but that they were  "definitely succeeded in creating a completely unreliable information space at all levels of society."
A very dangerous trend, which proves the success of the trolling strategy in Ukraine, is the very low credibility of any attempts to portray the situation in the country. Not only Ukrainian and Russian, but even credible western media outlets are at risk of reporting false information.
Only a month later, April 2015, the Poland  Security Agency (PSA) released a similar report which noted a sharp increase in the number of cyber attacks.
These attacks did not appear to be random. The level of sophistication and coordination suggested the involvement of state actors. Russia was not directly accused but its involvement was pretty clearly implied.That PSA report, for instance, stresses the abundance of pro-Russian trolling comments in Poland’s online information space, especially following the annexation of Crimea.

In addition to cyber attacks, the report mentioned the threat that information warfare via the internet posed to Polish security. It noted examples of such efforts include the dissemination of foreign ‘propaganda disinformation’ by bloggers and contributors to online discussion forums or website comment sections.
Many such individuals, the report states, are on the payroll of a foreign state; while others may simply be naïve, misinformed or ideologically driven ‘useful idiots’ whose viewpoints or standing can be exploited.
An investigative journalist in Finland also uncovered evidence of sophisticated trolling in their country. With the help of various experts, lists of Finnish websites and individuals who had been targeted by alleged pro-Russian trolls were compiled. This included the activities of several secret profiles used for conducting pro-Russian information warfare.

Yle Kioski, the Finnish online site mentioned earlier, actually discovered the presence of pro-Russian trolls in various social networking platforms, as well as in Finnish discussion forums, and news and video platforms.
Interestingly, the investigation revealed that there is much more propaganda on Russian and English websites than there is on Finnish ones, probably because of the trolls’ linguistic limitations. disruptive trolls were difficult to conclusively identify.
Although it was often difficult to absolutely identify each of the trolls, journalists believed that a large proportion of the comments appeared to be orchestrated.
Identical messages criticizing NATO and the US are often posted over a hundred times. According to one editor of a Finnish news outlet:
“There is a distinct peak whenever a bigger news story about Russia or Ukraine is published: the number of trolling messages multiplies in comparison with the amount of messages prior to the war in Ukraine."
As successful as each of these targeted attacks were, they were just a testing ground for a much more important target: The United States.
For that, we must leave our NATO report and look to other, more recent sources. 

Trolls on the Attack

Max Seddon’s June 2014 report alleges that  Russia recruited and trained online trolls in order to target the comment sections of top US-based websites. He names Fox News, Huffington Post, Politico. It must be assumed that other sites were likewise infiltrated.

Vedomosti, an independent Russian daily business newspaper, quoted an insider close to the Putin’s administration who claimed that this troll army campaign was manufactured by the Russian government. 
Furthermore, the operation involved Russian bloggers not only in Russia, but also in countries such as Germany, India, and Thailand.
The former head of Russia’s state newswire’s media analytics laboratory, Vassily Gatov, observed that the Russian information-warfare strategy is based on the assumption that 
“Western media, which specifically have to align their interests with their audience, won’t be able to ignore saturated pro-Russian campaigns and will have to change the tone of their coverage of Russia to placate their angry readers.”
To put that another way, Russia hoped to nudge the popular opinions in a more pro-Russian direction. However, the NATO report also offers an unexpected ray of hope.
Surprisingly, the study of the influence of pro-Russian trolling on leading US media outlets demonstrated the opposite outcome to that expected. Most users of online media and forums, upon seeing a clearly pro-Russian comment, assumed it was either paid-for or written for ideological reasons.
Yet, the reality was that all of these efforts to manipulate US public opinion using fake news and social media comments were all in preparation for the most egregious offensive to date: the 2016 campaign and Russia's direct interference with the election results.

Those who Praised Putin

After the NATO report was released, investigative journalists began to find even more corroborating evidence.
By June 2015, prior to the election, there were warnings in the air. PBS NewsHour interviewed Adrıan Chen, from The New York Times Magazine about a cover story he had written on that Saint Petersburg troll agency we mentioned earlier, the Internet Research Agency (IRA). 

The article, entitled "The Agency," is a treasure trove of information, detailing the degree to which the IRA was responsible for the spread of propaganda and hoaxes online.

One of their tactics, explained Chen, is to pretend to be average "citizen of the net", sometimes Americans and sometimes Russians, on social media like Facebook and Twitter. Their primary task was to praise Putin as a model leader and slam President Obama in any and every way.

This brings us to another an exceedingly queer thing. It's really the stuff of conspiracy theories.
Around the same time as Russian operatives were promoting Putin over Obama online, many well-known conservatives in the US were also gushing infusive praise for the Russian leader.

In a 2014 LA Times article, Pulitzer Prize-winning columnist David Horsey listed outspoken Obama critics, like Rush Limbaugh, Sarah Palin, and Pat Buchanan who seemed to be reading from the same scripts as trolls in St. Petersburg.  
Horsey could also have added Alex Jones of InfoWars. In 1999, Jones called Putin a demon and "Vladimir The Ruthless" and yet by 2016, Jones was extolling the virtues of Putinism, presenting him as a "Judeo-Christian White Knight who is moving against “Islam and the return of the Nazis."

Horsey did not stop there. He cited other names.
In March 2014, the GOP chairman of the House Intelligence Committee, Mike Rogers of Michigan, claimed that "Putin was playing chess while Obama is playing marbles."
On Fox News, former New York Mayor Rudolph Giuliani- who would later play an important role in Trump's campaign, declared that Putin has shown true leadership by acting boldly and rapidly to assert his nation’s interests in Crimea.  

It was all very discomfiting to hear allegedly patriotic conservatives running down the US president while hailing the former KGB officer, especially coming from the same party of war-hawk Reagan.
At the time, it was written off as sensationalist attention-hogs jumping onto the Obama hate bandwagon. In retrospect, it looks much more suspicious.

The News That Never Happened

Russian trolls did not stop at spicing up comment sections of Huffington Post. They were also reportedly engaged in manufacturing impressive online hoaxes.

Chen cites, as one example, a totally imaginary Ebola outbreak in Atlanta, involving 145 people. The story was disseminated from different sources at the same time over the Net. Twitter hashtags materialized a bit too quickly.
The December 2014 hoax included images of doctors in Hazmat suits. The attention to detail was remarkable, suggesting a tremendous amount of effort. 
The official Twitter account of Yahoo News was hacked and a breaking news alert was sent out 816,000 followers. In reality, there was no such outbreak. The Yahoo twitter account was cleared of the fake news but not before the hoax had spread to other news sites.

Besides the fun of watching relatively sane people freaking out. What was the point of this spoofing?
It's important too to look at the timeline. Only a month before,
House Republicans were heavily criticizing Obama's reaction to public fears of an Ebola outbreak. They were loudly renewing calls for travel bans and quarantines. Yet, polls showed that the public was losing interest. 
If the aim of the hoax was to create a panic and to embarrass the White House, the timing could hardly have been better.

A few months earlier there had been another much more audacious fabricated event.
Chen's article cites another incident on September 11, 2014. According to a breaking news report, a chemical plant in St. Mary Parish, Louisiana was on fire. Hundreds of Twitter accounts were giving minute-by-minute accounts of "powerful explosions" at industrial parks in Centerville, Louisiana. Residents were sent a disturbing text messages warning of toxic fumes and were advised to take shelter immediately.
Breaking news accounts filled the Net, from images of flames erupting from the plant, eyewitness accounts and to videos of thick black smoke filmed by citizen journalists.The first Google search result, returned a fake Wikipedia page (now deleted) tied to this supposed explosion.
Another researcher noted how expertly social media was used:
On Twitter, a full-blown tweet storm emerged, reaching peak velocity of one tweet per second, using a number of hashtags — #DeadHorse, #ColumbianChemicalsInNewOrleans, #ChemicalAccidentLouisiana, #LouisianaExplosion — eventually converging into a single hashtag: #ColumbianChemicals.
A screenshot of CNN’s home page was posted online, showing that the story had already made national news. ISIS had already claimed credit for the attack.
Officials at the local Department of Homeland Security were totally baffled. Their offices were just down the road from where all this was taking place and they saw nothing.

Incredibly, the whole thing was an elaborate and well-orchestrated hoax.
Anyone who took the trouble to check would have found no news of a spectacular Sept. 11 attack by ISIS. It was all fake: the screenshot, the videos, the photographs.
As Chen notes, this wasn't the work of a 400-lb sadistic hacker in his mom's basement.
It was a highly coordinated disinformation campaign, involving dozens of fake accounts that posted hundreds of tweets for hours, targeting a list of figures precisely chosen to generate maximum attention. The perpetrators didn’t just doctor screenshots from CNN; they also created fully functional clones of the websites of Louisiana TV stations and newspapers.
Later, Betaworks data scientist Gilad Lotan concluded that the effort likely originated inside Russia. (Lotan's analysis is fascinating and worth reading.)

If true, if Russia was behind the fake ISIS attack, then it was meant to create a panicky overreaction. If nothing else, it was a spectacular display of the power to hijack social media.

Assist from Within

In January of this year, the Atlantic Monthly made an attempt to answer some of the basic questions.

One of their source materials was a "declassified version of a highly classified assessment" from three different US intelligence agencies. The bombshell document was released just weeks before the new president was to be sworn in. It confirmed what a lot of people already believed.  

According to their own research, "Vladimir Putin ordered an influence campaign in 2016 aimed at the US presidential election.” 
The goal of that campaign was to damage the chances Hillary Clinton’s “electability and potential presidency.”  The intelligence analysts also concluded that Putin and the Russian Government developed a clear preference for President-elect Trump.”
The intelligence-community assessment provides official backing to media reports from mid-December stating that that Russian President Vladimir Putin was “personally involved” in cyberattacks aimed at interfering with the United States presidential election.
The assessment goes on to say:
Moscow’s influence campaign followed a Russian messaging strategy that blends covert intelligence operations—such as cyber activity—with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or “trolls.”
Another conclusion points to a grand conspiracy against the United States, hitherto unseen in its scope and threat against any sovereign nation.
Moscow’s campaign aimed at the US election reflected years of investment in its capabilities, which Moscow has honed in the former Soviet states.
The most unbelievable aspect of all this information is the fact that the Republican president- even today- refuses to believe any of it. Equally perplexing (or revealing, depending on how you look at it) is the fact that Republicans in Congress seem to have no great interest in investigating the matter. No interest in preventing it from happening again.

Just look at Senate majority leader Mitch McConnell as one example.  
A Washington Post article stated in December 2016 that, prior to the election, the CIA had deduced that Russia was directly involved in the hacking of Democratic accounts. Further, it did so to sabotage the Clinton campaign and assist the Trump campaign.

Since that initial finding, another piece of the puzzle fell into position. Roger Stone, a long-time Trump pal and unofficial campaign aide, just a week ago, admitted contact with the hacking group "Guccifer 2.0."
Cyber-experts have concluded that it is likely that "Guccifer 2.0 is nothing but a disinformation or deception campaign by Russian state-sponsored hackers to cover up their own hack.

But it doesn't end there. Stone had earlier confessed to being in touch with Julian Assange, the man behind Wikileaks which leaked the hacked emails.
Just this week, analysts traced IP addresses of Wikileaks servers to locations in Russia,

One would think this evidence would have been more than enough to spur the authorities in Congress to launch an investigation prior to the election. It could have prevented a constitutional crisis and the mess we have now.

In fact, having looked over the intel, the Obama administration became so convinced that something was very wrong that it directed top intelligence officials "to brief a bipartisan assembly of congressional leaders in September, with the aim of generating support for a bipartisan statement about the intrusion into US politics."
Inexplicably, McConnell blocked the effort. As The Nation notes:
McConnell’s role stands out here as particularly treacherous.
This leads us to another question: How much of Russia's clandestine activity was actually coordinated with domestic political organizations inside American borders?

Collaboration and Conspiracy?

Remarkably, a possible answer isn't all that hard to find. This goal of Russia to assist the Republican candidate nearly parallels the stated goals of Republican SuperPacs well before the election, even before the primaries.  

As Nomadic Politics reported in January 2016 that Steven Law, president of American Crossroads, a  Republican Super PAC, told an interviewer that the Crossroads goal was simply "to erode what should be her natural core of support."
He even admitted that members of his staff at American Crossroads had easily been able to "inhabit the liberal role, despite being fervent Republicans." 
Think about that for a moment.
He said:
“It can diminish enthusiasm for Hillary among the base over time. And if you diminish enthusiasm, lukewarm support can translate into lackluster fund-raising and perhaps diminished turnout down the road.”
Another group, America Rising, which calls itself a "Republican opposition research group" openly explained its own gameplan. This  super PAC aimed to "spread negative stories about congressional Democratic incumbents and candidates through digital channels and earned media."
("Earned media" is a euphemism for social media like Facebook. Twitter or online blogs. It can include comment sections in Youtube and any website.)  

A New York Times article, at that time, quoted Colin Reed, America Rising’s executive director, outlining the group's strategy when it came to Hillary Clinton:
“The idea is to make her life difficult in the primary and challenge her from the left. We don’t want her to enter the general election not having been pushed from the left, so if we have opportunities — creative ways, especially online — to push her from the left, we’ll do it just to show those folks who she needs to turn out that she’s not in line with them.”
The phrase "pushed from the left" suggests infiltration, posing as a disaffected angry liberal, a Bernie bot, for example. The strategy to troll online sites as outlined by these powerful lobbying groups is a carbon copy of what Russian trolls were doing.

In his recent book, The Plot to Hack America: How Putin’s Cyberspies and WikiLeaks Tried to Steal the 2016 Election, Malcolm Nance, a career counterterrorism and intelligence officer for the U.S. government's Special Operations, Homeland Security, and Intelligence agencies, writes:
“The 2016 cyberattack was not just another case of simple Kompromat - meddling in the political affairs of a satellite nation or an individual dissenter. It was a direct attempt to hijack and derail the traditional processes and norms that held the United States together for more than 240 years. The attempt was even more brazen due to the apparent belief that Putin assumed that he and his oligarchy could charm, groom and select a candidate, then with the right amount of cybercrime and enough organized propaganda they could actually choose a president of the United States to do their bidding.”
In reality, Putin had every reason to make such an assumption. the Republican party had already openly demonstrated their willingness to aid and abet this plan.
Amazingly, the Russian troll army and the Republicans were certainly on the same page even before the campaign really got started.
*   *   *  

In the last installment, we will return to the NATO report to examine what lessons were learned from its case study country, Latvia. Those lessons have become particularly important given the events of last year.