Securing Democracy Dispatch

Mueller indicts 12 Russian intelligence officers for 2016 election hacks: Special Counsel Robert Mueller indicted 12 Russian GRU (military intelligence) officers on July 13 for “gain[ing] unauthorized access (to ‘hack’) into the computers of U.S. persons and entities involved in the 2016 U.S. presidential election, steal[ing] documents from those computers, and stag[ing] releases of stolen documents to interfere with the 2016 U.S. presidential election.” For the first time, the alleged hackers were identified as GRU officers, the same Russian intelligence agency implicated in the Skripal assassination attempt and the downing of Malaysian Airlines Flight 17 over eastern Ukraine. The Justice Department also confirmed that DCLeaks and Guccifer 2.0 were “fictitious online personas” created and used by the GRU officers to disseminate both leaked and fake information. The indictment described the technical tools — such as URL-shorteners, fake websites, and spearphishing emails — and the myriad of online aliases the officers used in the attacks. It also provided new details about GRU officers’ contacts with third parties in the United States under the Guccifer 2.0 moniker. In mid-August 2016, an unnamed candidate for Congress requested documents on their opponent, and the Russian spies obliged. The same month, the GRU officers provided a state lobbyist and news source with stolen documents, and sent a reporter hacked material on the Black Lives Matter movement. The indictment included communications between WikiLeaks and the GRU that revealed both parties’ intentions to use timely releases of stolen documents to damage Hillary Clinton’s candidacy. The indictment also exposed how the Russians conspired to launder $95,000 through cryptocurrencies and used bitcoin to purchase hardware and domain names which were then used to facilitate cyber operations on both the DCCC and DNC. Concurrent with the indictment’s release, Director of National Intelligence Dan Coats cautioned about the continued threat of Russian cyber operations, stating, “The warning lights are blinking red again … Today, the digital infrastructure that serves this country is literally under attack.” (Department of Justice, RFE/RL, The New York Times)

Reporters Press Trump and Putin on Election Interference: President Trump met with Russian President Vladimir Putin on Monday to discuss Syria, Ukraine, and election interference, among other issues. Following the meeting, the two held a joint press conference in Helsinki, Finland. During the conference, Trump declined to denounce Russian interference in the 2016 election, telling reporters that Putin was “extremely strong and powerful in his denial” of election interference. Putin confirmed that he wanted Trump to win in 2016, but vehemently denied any interference, despite the recent indictment of 12 Russian intelligence officers for exactly that. Reporters also asked Trump about his stance on the Nord Stream 2 pipeline, which Trump previously criticized during last week’s NATO Summit. Trump responded that the United States is the “largest in the oil and gas world” and will “compete successfully” with Russia. In the lead-up to the meeting, lawmakers on both sides of the aisle promised to “demonstrate to the world that the community of democratic nations does not intend to accede to Putin’s or any other authoritarian’s view of the world,” stating that they will continue to investigate Russian election interference. Democrats from the House Foreign Affairs Committee even sent a letter to President Trump asking that he cancel the summit in light of the recent Mueller indictments. (The Guardian, USA Today, House Committee on Foreign Affairs.)

NATO addresses hybrid threats but more needs to be done to improve resilience: Last week in Brussels, NATO leaders met to address the major challenges the Alliance is facing, including hybrid threats from Russia. The summit’s declaration denounced Russia’s hybrid actions against NATO, “including attempted interference in the election processes … widespread disinformation campaigns, and malicious cyber activities,” asserting “in cases of hybrid warfare, the [North Atlantic] Council could decide to invoke Article 5 of the Washington Treaty, as in the case of armed attack.” NATO also asserted its readiness “to assist an Ally at any stage of a hybrid campaign” and announced the establishment of “Counter Hybrid Support Teams,” which will assist member states “in preparing for and responding to hybrid activities.” However, the declaration also underscored that the “primary responsibility for responding to hybrid threats rests with the targeted nation.” (NATO)

Efforts by social media companies to counter disinformation bring mixed results: Amid efforts to secure users’ personal data and crack down on disinformation, Facebook is facing both criticism and legal action. The British Information Commissioner’s Office fined Facebook £500,000 (around $660,000) for allowing Cambridge Analytica, a political consulting firm, to access the personal information of millions of users without their consent. The fine is the maximum possible fine in the U.K. and is the first financial penalty issued to Facebook related to the data leak. In addition, reports last week revealed that even after Facebook made changes to address the flaw that allowed this exploitation, many apps, including Russian Internet giant Mail.ru, were granted special extensions to continue to access data about users’ friends. In a separate effort to better understand disinformation on its platform and its role in the democratic process, Facebook made a landmark decision to share a massive data set, comprised of approximately a petabyte of data, with Social Science One, an independent research commission of academics. However, as it works toward countering disinformation, Facebook has also come under fire for allowing InfoWars, an organization well-known for spreading conspiracy theories, to maintain a Facebook page with nearly one million followers. John Hegeman, who runs Facebook’s News Feed team, responded to the criticism by stating that false information does not inherently violate Facebook’s community standards and therefore is not always taken down. Facebook received substantial backlash for its comments, with Buzzfeed reporting, “The result is a near-pathological resistance toward taking a stand against actors that brazenly flaunt Facebook’s rules. And by doing so, Facebook plays into the hands of those who seek to wage information war.” Twitter moved to eliminate fake and automated accounts, announcing that it would lock and begin to remove suspicious accounts from the site, noting the removals could significantly affect the follower numbers of popular accounts. Prominent politicians’ Twitter followings were impacted by the move, with President Trump losing about 340,000 of his 53 million followers and President Obama losing 3 million of his 104 million followers in a single day. (The New York Times, Wired, Axios, Social Science One, Buzzfeed, CNN, Twitter)

Congress sheds more light on election vulnerabilities as midterms draw near: Congress held two hearings on election security last week. In the House Committee on Homeland Security hearing, DHS Under Secretary Chris Krebs, Director of the National Protection and Programs Directorate (NPPD), testified that he had “confidence in the resiliency of the system.” He reported a significant increase in trust and information-sharing between state governments and DHS. Krebs also told the Committee that he had found no evidence of a robust cyber operation to sabotage America’s midterm elections, but there was nevertheless evidence of Russian information operations against the elections on social media and news outlets. Additionally, the House passed the FY18 and FY19 Intelligence Authorization Act, which includes provisions that require the Director of National Intelligence to report on “foreign counterintelligence and cybersecurity threats to [federal] election campaigns.” Despite these positive developments, a Congressional Briefing hosted by Senator James Lankford (R-OK) and the Brennan Center for Justice highlighted that many states still lack necessary election security measures, mainly voter-verified paper ballots and mandatory post-election audits. This was confirmed by a report released by Democrats on the House Administration Committee identifying “18 states with the most vulnerable election infrastructure.” In addition, Senators on both sides of the aisle expressed concern about voting systems’ age and significant security. (The Washington Post, House Committee on Homeland Security, House Intelligence Committee, Brennan Center, Committee on House Administration – Democrats, Washington Times)

Greece expels Russian diplomats for alleged political interference: Greece expelled two Russian diplomats on July 6 and barred the entry of two others, accusing them of “acting to obtain and distribute sensitive information that could then be used to bribe Greek state officials.” The Russian diplomats apparently sought to bribe opponents of a June 17 agreement with Macedonia to change the latter’s name and “encourag[ed] rallies to oppose” it. The Greece-Macedonia name dispute has long impeded Macedonia’s accession to NATO and the EU; both countries will hold referendums on the agreement in the fall. Russian officials promised to expel two Greek diplomats in response and suspended preparations for an official visit from FM Sergei Lavrov to Greece. Russia has reportedly sought influence in Greece through the Greek Orthodox Church and organizations such as the Imperial Orthodox Palestinian Society. The Financial Times reported that the expelled Russian diplomats targeted “local government officials, Orthodox clergymen, and members of cultural associations and far-right groups” across northern Greece to help inflame tensions against the resolution. In response to the news, U.S. State Department Spokeswoman Heather Nauert tweeted, “We support Greece defending its sovereignty. #Russia must end its destabilizing behavior.” (BBC News, The Guardian, CBC, Ekathimerini, Financial Times, Twitter)

ASD’s Laura Rosenberger participated in a conversation with Julia Ioffe as part of NATO Engages: The Brussels Summit Dialogue, a two-day event hosted by the Atlantic Council, The German Marshall Fund of the United States, Munich Security Conference, and Women in International Security on the sidelines of the NATO Brussels Summit. Rosenberger highlighted the need for NATO members to prepare their citizenry for the evolving threat of authoritarian interference, stating, “We need to be sure that we’re better at having the tools in place and have the right priorities to analyze what is happening on our platforms, in our countries, and beyond.”

ASD’s Bret Schafer was quoted in a piece by NPR’s Tim Mak drawing on ASD’s investigation into the Internet Research Agency’s impersonation of local news outlets on Twitter. As Schafer describes, “They [the Internet Research Agency] set them up for a reason. And if at any given moment, they wanted to operationalize this network of what seemed to be local American news handles, they can significantly influence the narrative on a breaking news story.”

ASD’s Laura Rosenberger published an op-ed in the Washington Post explaining how the Trump administration’s corrosive rhetoric on NATO could have lasting damage for public opinion and ultimately jeopardize the transatlantic alliance.

Accounts tracked by the dashboard continued to amplify the “walkaway” movement, a campaign highlighting alleged discord among the U.S. political left, with #walkaway remaining in the top hashtags used on the dashboard for the duration of the week. The continued focus on #walkaway illustrates the ongoing effort by Kremlin-oriented accounts to seize control of the narrative and generate wider coverage of the movement. Outside of #walkaway, accounts tracked on Hamilton also promoted an array of false conspiracy theories covering subjects from the Amesbury Novichok poisoning in the U.K. to inaccurate speculation on a women’s death in New York City (see Worst of the Week below). These theories retained a familiar obsession with Hillary Clinton, slandering her former advisors and pushing theories surrounding her emails. The spread of these narratives indicates the willingness of Kremlin-oriented accounts to seize on conspiracies and promote false information to validate their beliefs.

“When we confront foreign interference in American elections, it is important for us to avoid thinking politically as Republicans or Democrats and instead to think patriotically as Americans. Our response must not depend on who was victimized.

“The Internet allows foreign adversaries to attack America in new and unexpected ways. Free and fair elections are hard-fought and contentious. There will always be adversaries who work to exacerbate domestic differences and try to confuse, divide, and conquer us. So long as we are united in our commitment to the values enshrined in the Constitution, they will not succeed.”

– Deputy Attorney General Rod Rosenstein, Remarks Announcing the Indictment of Twelve Russian Intelligence Officers, July 13, 2018

Even 20 months after the 2016 presidential election, fringe news sites continue to spread inflammatory and false stories about Hillary Clinton and her associates. On July 11, fringe conspiracy website The Gateway Pundit ran a breathless headline: “BREAKING: Dead Woman Found In Huma Abedin’s Dumpster at New York Building,” complete with groundless speculation that the death was somehow linked to Abedin and her estranged husband, Anthony Weiner. Police reports indicate that the drunken victim evidently fell down a trash chute with no sign of foul play; the dumpster was not “Abedin’s”; the apartment building in question hosts 670 units; and Abedin and Weiner no longer live there. The article featured among the top URLs shared on the Hamilton 68 dashboard on July 12, indicating the susceptibility of Kremlin-oriented accounts to propagate easily debunked conspiracy narratives through viral clickbait content.

The views expressed in GMF publications and commentary are the views of the author alone.