4

Russian social media campaign
Vladimir Putin

A Russian politician and a former officer of the KGB who has served as President of Russia since 2012, previously holding the position from 1999 until 2008.

The Internet Research Agency (IRA) carried out the earliest Russian interference operations identified by the investigation a social media campaign designed to provoke and amplify political and social discord in the United States. The IRA was based in St. Petersburg, Russia, and received funding from Russian oligarch Yevgeniy Prigozhin and companies he controlled. Prigozhin is widely reported to have ties to Russian President Vladimir Putin, Harm to Ongoing Matter                                                                                                                                                                                                           

Yevgeniy Prigozhin

Head of Russian companies Concord Catering and Concord Management and Consulting; supported and financed the Internet Research Agency, which engaged in an “active measures” social media campaign to interfere in the 2016 U.S. presidential election.

In mid-2014, the IRA sent employees to the United States on an intelligence mission with instructions Harm to Ongoing Matter                                                                                                                

The IRA later used social media accounts and interest groups to sow discord in the U.S. political system through what it termed “information warfare.” The campaign evolved from a generalized program designed in 2014 and 2015 to undermine the U.S electoral system, to a targeted operation that by early 2016 favored candidate Trump and disparaged candidate Clinton. The IRA’ s operation also included the purchase of political advertisements on social media in the names of U.S. persons and entities, as well as the staging of political rallies inside the United States. To organize those rallies, IRA employees posed as U.S. grassroots entities and persons and made contact with Trump supporters and Trump Campaign officials in the United States. The investigation did not identify evidence that any U.S. persons conspired or coordinated with the IRA. Section II of this report details the Office’s investigation of the Russian social media campaign.

John Podesta

Clinton campaign chairman whose email account was hacked by the GRU. WikiLeaks released his stolen emails during the 2016 campaign.

Russian Hacking Operations

In March 2016, the GRU began hacking the email accounts of Clinton Campaign volunteers and employees, including campaign chairman John Podesta. In April 2016, the GRU hacked into the computer networks of the Democratic Congressional Campaign Committee and the Democratic National Committee (DNC). The GRU stole hundreds of thousands of documents from the compromised email accounts and networks. Around the time that the DNC announced in mid-June 2016 the Russian government's role in hacking its network, the GRU began disseminating stolen materials through the suspicious online personas DCLeaks and Guccifer. The GRU later released additional materials through the organization WikiLeaks.

At the same time that the IRA operation began to focus on supporting candidate Trump in early 2016, the Russian government employed a second form of interference: cyber intrusions (hacking) and releases of hacked materials damaging to the Clinton Campaign. The Russian intelligence service known as the Main Intelligence Directorate of the General Staff of the Russian Army (GRU) carried out these operations.

14

II. RUSSIAN "ACTIVE MEASURES" SOCIAL MEDIA CAMPAIGN

Yevgeniy Prigozhin

Head of Russian companies Concord Catering and Concord Management and Consulting; supported and financed the Internet Research Agency, which engaged in an “active measures” social media campaign to interfere in the 2016 U.S. presidential election.

The first form of Russian election influence came principally from the Internet Research Agency, LLC (IRA), a Russian organization funded by Yevgeniy Viktorovich Prigozhin and companies he controlled, including Concord Management and Consulting LLC and Concord Catering (collectively "Concord").2 The IRA conducted social media operations targeted at large U.S. audiences with the goal of sowing discord in the U.S. political system.3 These operations constituted "active measures", a term that typically refers to operations conducted by Russian security services aimed at influencing the course of international affairs.4

3 Harm to Ongoing Matter                                                             
see also SM-2230634, serial 44 (analysis). The FBI case number cited here, and other FBI case numbers identified in the report, should be treated as law enforcement sensitive given the context. The report contains additional law enforcement sensitive information.

2 The Office is aware of reports that other Russian entities engaged in similar active measures operations targeting the United States. Some evidence collected by the Office corroborates these reports, and the Office has shared that evidence with other offices in the Department of Justice and FBI.

The IRA and its employees began operations targeting the United States as early as 2014. Using fictitious U.S. personas, IRA employees operated social media accounts and group pages designed to attract U.S. audiences. These groups and accounts, which addressed divisive U.S. political and social issues, falsely claimed to be controlled by U.S. activists. Over time, these social media accounts became a means to reach large U.S. audiences. IRA employees travelled to the United States in mid-2014 on an intelligence-gathering mission to obtain information and photographs for use in their social media posts.

4 As discussed in Prut V below, the active measures investigation has resulted in criminal charges against 13 individual Russian nationals and three Russian entities, principally for conspiracy to defraud the United States, in violation of 18 U.S.C. § 371. See Volume I, Section V.A, infra; Indictment, United States v. Internet Research Agency, et al. , 1:18-cr-32 (D.D.C. Feb. 16, 2018), Doc. 1 ("Internet Research Agency Indictment").

IRA employees posted derogatory information about a number of candidates in the 2016 U.S. presidential election. By early to mid-2016, IRA operations included supporting the Trump Campaign and disparaging candidate Hillary Clinton. The IRA made various expenditures to carry out those activities, including buying political advertisements on social media in the names of U.S. persons and entities. Some IRA employees, posing as U.S. persons and without revealing their Russian association, communicated electronically with individuals associated with the Trump Campaign and with other political activists to seek to coordinate political activities, including the staging of political rallies.5 The investigation did not identify evidence that any U.S. persons knowingly or intentionally coordinated with the IRA's interference operation.

5 Internet Research Agency Indictment 52, 54, 55(a), 56, 74;Harm to Ongoing Matter                                                             

By the end of the 2016 U.S. election, the IRA had the ability to reach millions of U.S. persons through their social media accounts. Multiple IRA-controlled Facebook groups and

29

29

80 Twitter, "Update on Twitter's Review of the 2016 US Election" (updated Jan. 31, 2018). Twitter also reported identifying 50,258 automated accounts connected to the Russian government, which tweeted.

related."80 Twitter also announced that it had notified approximately 1.4 million people who Twitter believed may have been in contact with an IRA-controlled account.81

81 Twitter, "Update on Twitter's Review of the 2016 US Election" (updated Jan. 31, 2018).

82 8/20/16 Facebook Message, ID 100009922908461 (Matt Skiber) to IDHarm to Ongoing Matter                                                   

83 See, e.g., 7/21/16 Email, joshmilton024 gmail.com toHarm to Ongoing Matter  7/21/16 Email, joshmilton024@gmail.com toHarm to Ongoing Matter 

5. U.S. Operations Involving Political Rallies

The IRA organized and promoted political rallies inside the United States while posing as U.S. grassroots activists. First, the IRA used one of its preexisting social media personas (Facebook groups and Twitter accounts, for example) to announce and promote the event. The IRA then sent a large number of direct messages to followers of its social media account asking them to attend the event. From those who responded with interest in attending, the IRA then sought a U.S. person to serve as the event's coordinator. In most cases, the IRA account operator would tell the U.S. person that they personally could not attend the event due to some preexisting conflict or because they were somewhere else in the United States. 82 The IRA then further promoted the event by contacting U.S. media about the event and directing them to speak with the coordinator.83 After the event, the IRA posted videos and photographs of the event to the IRA's social media accounts.84

84 @march_for_trump 6/25/16 Tweet (posting photos from rally outside Trump Tower).

85 Instagram ID 2228012168 (Stand For Freedom) 11/3/ 15 Post ("Good evening buds! Well I am planning to organize a confederate rally[ ... ] in Houston on the 14 of November and I want more people to attend.").

The Office identified dozens of U.S. rallies organized by the IRA. The earliest evidence of a rally was a "confederate rally" in November 2015.85 The IRA continued to organize rallies even after the 2016 U.S. presidential election. The attendance at rallies varied. Some rallies appear to have drawn few (if any) participants while others drew hundreds. The reach and success of these rallies was closely monitored Harm to Ongoing Matter                                                                                                                                                                                                    

31

From June 2016 until the end of the presidential campaign, almost all of the U.S. rallies organized by the IRA focused on the U.S. election, often promoting the Trump Campaign and opposing the Clinton Campaign. Pro-Trump rallies included three in New York; a series of Trump rallies in Florida in August 2016; and a series of pro-Trump rallies in October 2016 in Pennsylvania. The Florida rallies drew the attention of the Trump Campaign, which posted about the Miami rally on candidate Trump's Facebook account (as discussed below).86

86 The pro-Trump rallies were organized through multiple Facebook, Twitter, and email accounts. See, e.g., Facebook ID 100009922908461 (Matt Skiber); Facebook ID 1601685693432389 (Being Patriotic); Twitter Account @march_for_trump; beingpatriotic@gmail.com. (Rallies were organized in New York on June 25, 2016; Flo1ida on August 20, 2016; and Pennsylvania on October 2, 2016.)

Many of the same IRA employees who oversaw the IRA's social media accounts also conducted the day-to-day recruiting for political rallies inside the United States. Harm to Ongoing Matter                                                                                                                                                                            7

6. Targeting and Recruitment of U.S. Persons
As early as 2014, the IRA instructed its employees to target U.S. persons who could be used to advance its operational goals. Initially, recruitment focused on U.S. persons who could amplify the content posted by the IRA.Harm to Ongoing Matter                                                                                                                                                                            

IRA employees frequently used Harm to Ongoing Matter                  Twitter, Facebook, and Instagram to contact and recruit U.S. persons who followed the group. The IRA recruited U.S. persons from across the political spectrum. For example, the IRA targeted the family of Harm to Ongoing Matter                                                                          and a number of black social justice activists

At the same time that the IRA operation began to focus on supporting candidate Trump in early 2016, the Russian government employed a second form of interference: cyber intrusions (hacking) and releases of hacked materials damaging to the Clinton Campaign. The Russian intelligence service known as the Main Intelligence Directorate of the General Staff of the Russian Army (GRU) carried out these operations.

32

32

89 3/11/16 Facebook Adve1tisement ID 6045078289928, 5/6/16 Facebook Advertisement ID 6051652423528, 10/26/16 Facebook Adve1tisement ID 6055238604687; 10/27/16 Facebook Message, IDHarm to Ongoing Matter 
& ID 100011698576461 (Taylor Brooks).

while posing as a grassroots group called "Black Matters US."89 In February 2017, the persona "Black Fist" (purporting to want to teach African-Americans to protect themselves when contacted by law enforcement) hired a self-defense instructor in New York to offer classes sponsored by Black Fist. The IRA also recruited moderators of conservative social media groups to promote IRA-generated content,90 as well as recruited individuals to perform political acts (such as walking around New York City dressed up as Santa Claus with a Trump mask).91

90 8/ 19/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID Harm to
Ongoing Matter       

91 12/8/16 Email, robot@craigslist.org to beingpatriotic@gmail.com (confirming Craigslist advertisement).

Harm to Ongoing Matter          as the IRA's online audience became larger, the IRA tracked U.S. persons with whom they communicated and had successfully tasked (with tasks ranging from organizing rallies to taking pictures with certain political messages).Harm to Ongoing Matter                                                                                                                                                                                                                                                                                   93

93 See, e.g.11/11-27/16 Facebook Messages, ID 100011698576461 (Taylor Brooks) & Harm to
Ongoing Matter
(arranging to pay for plane tickets and for a bull horn).