Anatomy of a Russian attack: First signs of the Kremlin’s attempt to influence the 2016 election

Anatomy of a Russian attack: The U.S. intelligence community has concluded an attempt to interfere in the 2016 Presidential election was ordered by Russian President Vladimir Putin.  A WTOP investigation that began in November 2016 examined how the attack happened, when it started, who was involved, and what’s next. We conducted dozens of interviews with current and former U.S. intelligence officials, members of Congress, cyber security and intelligence experts, foreign government officials, Russian nationals and American victims.  Here is what we learned. (Alexei Druzhinin, Sputnik, Kremlin Pool Photo via AP)
Anatomy of a Russian attack: The U.S. intelligence community has concluded an attempt to interfere in the 2016 Presidential election was ordered by Russian President Vladimir Putin. A WTOP investigation that began in November 2016 examined how the attack happened, when it started, who was involved, and what’s next. We conducted dozens of interviews with current and former U.S. intelligence officials, members of Congress, cyber security and intelligence experts, foreign government officials, Russian nationals and American victims. Here is what we learned. (Alexei Druzhinin, Sputnik, Kremlin Pool Photo via AP)
In this Jan. 5, 2017, photo, Director of National Intelligence James Clapper testifies on Capitol Hill in Washington. Clapper will be quizzed again on Jan. 10, on a declassified report that fingered the Kremlin in hacking during the presidential campaign, just one day after the U.S. sanctioned five Russians. (AP Photo/Evan Vucci)
FILE – In this July 7, 2017, file photo, President Donald Trump meets with Russian President Vladimir Putin at the G20 Summit in Hamburg, Germany. Trump had a second, previously undisclosed conversation with Putin at the summit it Germany. (AP Photo/Evan Vucci)
A part of the declassified version Intelligence Community Assessment on Russia’s efforts to interfere with the U.S. political process is photographed in Washington, Friday, Jan. 6, 2017. Russian President Vladimir Putin ordered a campaign to influence the American presidential election in favor of electing Donald Trump, according to the report issued by U.S. intelligence agencies. The unclassified version was the most detailed public account to date of Russian efforts to interfere with the U.S. political process, with actions that included hacking into the email accounts of the Democratic National Committee and individual Democrats like Hillary Clinton’s campaign chairman John Podesta. (AP Photo/Jon Elswick)
A part of the declassified version Intelligence Community Assessment on Russia's efforts to interfere with the U.S. political process is photographed in Washington, Friday, Jan. 6, 2017. Russian President Vladimir Putin ordered a campaign to influence the American presidential election in favor of electing Donald Trump, according to the report issued by U.S. intelligence agencies. The unclassified version was the most detailed public account to date of Russian efforts to interfere with the U.S. political process, with actions that included hacking into the email accounts of the Democratic National Committee and individual Democrats like Hillary Clinton's campaign chairman John Podesta. (AP Photo/Jon Elswick)
A part of the declassified version Intelligence Community Assessment on Russia’s efforts to interfere with the U.S. political process is photographed in Washington, Friday, Jan. 6, 2017. Russian President Vladimir Putin ordered a campaign to influence the American presidential election in favor of electing Donald Trump, according to the report issued by U.S. intelligence agencies. The unclassified version was the most detailed public account to date of Russian efforts to interfere with the U.S. political process, with actions that included hacking into the email accounts of the Democratic National Committee and individual Democrats like Hillary Clinton’s campaign chairman John Podesta. (AP Photo/Jon Elswick)
During a news conference in December, Russian President Vladimir Putin mocked allegations of hacking, saying that Democrats are "looking elsewhere for things to blame." (AP Photo/Pavel Golovkin)
During a news conference last week, Russian President Vladimir Putin mocked allegations of hacking, saying that Democrats are “looking elsewhere for things to blame.” (AP Photo/Pavel Golovkin)
Russian President Vladimir Putin is seen in Nagato, western Japan, Thursday, Dec. 15, 2016. The Obama administration suggested Thursday that Putin personally authorized the hacking of Democratic officials’ email accounts in the run-up to the presidential election, which intelligence agencies believe was designed to help Donald Trump prevail. The White House also leveled an astounding attack on Trump himself, saying he must have known of Russia’s interference. (Toru Hanai/Pool Photo via AP)
FILE – In this Monday, Sept. 28, 2015 file photo, U.S. President Barack Obama, right, and Russia’s President President Vladimir Putin pose for members of the media before a bilateral meeting at the United Nations headquarters. President Barack Obama is promising that the U.S. will retaliate against Russia for its suspected meddling in America’s election process, an accusation the Kremlin has vehemently denied. (AP Photo/Andrew Harnik)
(1/8)
Anatomy of a Russian attack: The U.S. intelligence community has concluded an attempt to interfere in the 2016 Presidential election was ordered by Russian President Vladimir Putin.  A WTOP investigation that began in November 2016 examined how the attack happened, when it started, who was involved, and what’s next. We conducted dozens of interviews with current and former U.S. intelligence officials, members of Congress, cyber security and intelligence experts, foreign government officials, Russian nationals and American victims.  Here is what we learned. (Alexei Druzhinin, Sputnik, Kremlin Pool Photo via AP)
A part of the declassified version Intelligence Community Assessment on Russia's efforts to interfere with the U.S. political process is photographed in Washington, Friday, Jan. 6, 2017. Russian President Vladimir Putin ordered a campaign to influence the American presidential election in favor of electing Donald Trump, according to the report issued by U.S. intelligence agencies. The unclassified version was the most detailed public account to date of Russian efforts to interfere with the U.S. political process, with actions that included hacking into the email accounts of the Democratic National Committee and individual Democrats like Hillary Clinton's campaign chairman John Podesta. (AP Photo/Jon Elswick)
During a news conference in December, Russian President Vladimir Putin mocked allegations of hacking, saying that Democrats are "looking elsewhere for things to blame." (AP Photo/Pavel Golovkin)

About this series: The U.S. intelligence community has concluded an attempt to interfere in the 2016 presidential election was ordered by Russian President Vladimir Putin. A WTOP investigation that began in November 2016 examined how the attack happened, when it started, who was involved and what’s next. Dozens of interviews with current and former U.S. intelligence officials, members of Congress, cyber security and intelligence experts, foreign government officials, Russian nationals and American victims were conducted. Here is what WTOP learned.

Part 1: Anatomy of a Russian attack
Part 2: Anatomy of a Russian attack
Part 3: Anatomy of a Russian attack
Part 4: Anatomy of a Russian attack
Part 5: Anatomy of a Russian attack

WASHINGTON — In April 2014, former FBI special agent Clint Watts and two colleagues noticed a bizarre petition on the Whitehouse.gov website.

“Alaska back to Russia appeared as a public campaign to give America’s largest state back to the nation from which it was purchased,” Watts said during testimony before the Senate Select Committee on Intelligence on March 30, 2017.

Watts told the committee that upon closer examination he, Andrew Weisburd and J.M. Berger observed a strange occurrence.

The petition had gained “more than 39,000 signatures in a very short period of time,” Watts said.

Watts, currently a senior fellow at the Center for Cyber and Homeland Security at George Washington University and a Foreign Policy Research Institute fellow, said he and his team detected something even more peculiar.

“Our examination of those signing and posting on this petition revealed an odd pattern. The accounts varied considerably from other petitions and appeared to be the work of bots.”

Their investigation into the accounts associated with the petition revealed that the bots were directly related to other social media campaigns and networks that had been aggressively promoting Russian propaganda in previous months.

Hackers connected to the accounts had multiplied on the networks and could be spotted among recent data-breaches and website defacements.

“Closely circling those hackers were honey pot accounts, attractive looking women and political partisans trying to social engineer other users,” Watts said. “Above all we observed hecklers — those synchronized trolling accounts you see on Twitter — that would attack political targets using similar talking patterns and points.”

That activity turned out to be the makings of a sophisticated Russian influence operation.

In 2015, U.S. intelligence agencies began to notice that bots like those Watts described had selected some very specific targets — the U.S. elections system and individuals and organizations associated with it.

According to U.S. intelligence sources, the activity intensified as time passed and there was little doubt that it was a Russian intelligence-linked operation that reached to the very top of the Russian government.

By late 2016, President Barack Obama was notified. And at a Dec. 16, 2016 news conference, he told reporters that he warned Russian President Vladimir Putin not to interfere in the election process.

“In early September when I saw President Putin in China, I felt that the most effective way to ensure that didn’t happen was to talk to him directly and tell him to cut out and there would be some consequences if he didn’t. And in fact we did not see further tampering of the election process,” Obama said.

Former CIA director John Brennan revealed later that he spoke to Alexander Bortnikov, his counterpart in Russia’s intelligence services, on Aug. 4, 2016.

“I said American voters would be outraged by any Russian attempt to interfere in the election,” Brennan said.

He told Bortnikov that if Russia continued to pursue the activity, “it would destroy any near term prospects for improvement in relations between Washington and Moscow and would undermine constructive engagement even on matters of mutual interest.”

But Brennan said Bortnikov did exactly what he anticipated he would do.

“As I expected, Mister Bortnikov denied that Russia was doing anything to influence a presidential election,” Brennan said. “Claiming that Moscow is a traditional target to blame by Washington for such activities.”

But on Jan. 10, 2017, then-Director of National Intelligence James Clapper revealed that the damage had already been done.

“We have high confidence that President Putin ordered an influence campaign the 2016 aimed at U. S. presidential election,” he told the Senate Intelligence committee.

At President Obama’s direction, the intelligence community had conducted a deep, probing investigation into suspicions that Russia had deliberately interfered in the election.

Its report, “Assessing Russian Activities and Intentions in Recent US Elections,” revealed “Russian efforts to influence the 2016 US presidential election represent the most recent expression of Moscow’s long-standing desire to undermine the US-led liberal democratic order, but these activities demonstrated a significant escalation in directness, level of activity, and scope of effort compared to previous operations.”

“Russia’s goals were to undermine public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency,” Clapper told the committee. “We further assess Putin and the Russian Government developed a clear preference for President-elect Trump.”

The intelligence community’s finding lined up with what Watts and his colleagues suspected.

After the release of the report, another absurd occurrence they had noticed in the summer of 2016 made perfect sense.

“On the evening of 30 July 2016, my colleagues and I watched as RT and Sputnik news simultaneously launched false stories about the U.S. air base in Incirlik, Turkey being overrun by terrorists,” he told the committee.

“Within minutes pro-Russian social media aggregators and automated bots amplified this false news story,” Watts said. “There were more than 4,000 tweets in the first 75 to 78 minutes after launching this false story.”

Perhaps the most stunning development for Watt and his companions was that the rapid proliferation of that story was linked back to the active measures accounts (Russian bots) they had tracked for the preceding two years.

“These previously identified accounts almost simultaneously appearing from different geographic locations and communities amplified the big news story in unison,” Watts said.

The hashtags promoted by the bots, according to Watts, were “nuclear, media, Trump and Benghazi.”

The most common words, he said found in English speaking Twitter user profiles were “God, military Trump, family, country, conservative, Christian, America and constitution.”

The objective of the messages, Watts said, “clearly sought to convince Americans that U.S. military bases being overrun in a terrorist attack.”

In reality, only a small protest gathered outside the gates at the Incirlik base and increased security at the air base had only been deployed to secure the arrival of the Chairman of the U.S. Joint Chiefs of Staff.

According to Watts, similar Russian-driven fake news operations were organized around the Jade Helm exercise, Black Lives Matter protests and the Bundy Ranch standoff in Oregon.

They were partly successful in sowing chaos in some of those cases.

Duping U.S. social media consumers into believing fake news stories emboldened those running Russia’s active measures campaign to more aggressively seek to influence voter’s decisions in the 2016 presidential election, according to intelligence sources who spoke with WTOP.

“It is a very, very [sic] persuasive demonstration of the fact that the Russians interfered in our election process, with the purpose of helping one of the two candidates,” said Robert Litt, former General Counsel of the Office of the Director of National Intelligence, in an interview with WTOP on Sept. 13, 2017.

Litt, now an attorney with the Washington firm Morrison Foerster, left the U.S. government on Jan. 20, 2017, with a clear view of how the Russian influence operation worked.

“They have an extremely capable intelligence service with exceptional cyber capabilities that they have repeated demonstrated, not only against the United States, but against Estonia and Georgia.”

NOTE: In our next article, we look at the tactics involved.

J.J. Green

JJ Green is WTOP's National Security Correspondent. He reports daily on security, intelligence, foreign policy, terrorism and cyber developments, and provides regular on-air and online analysis. He is also the host of two podcasts: Target USA and Colors: A Dialogue on Race in America.

Federal News Network Logo
Log in to your WTOP account for notifications and alerts customized for you.

Sign up