Russian Trolling 2.0: How the Kremlin changed its tactics from the 2016 election strategy

CNN
—

The recent indictment in the US of two employees of the Russian state media network RT underscores a significant shift in the Kremlin's tactics to influence US elections since 2016, current and former US officials told CNN.

Rather than relying on fake accounts and false online personas, the current modus operandi, alleged in this week's indictment, involves engaging real American influencers to push Russian narratives on U.S. audiences, specifically aimed at undermining support for Ukraine.

The indictment says the RT employees secretly pumped nearly $10 million into a Tennessee company that hired prominent right-wing commentators who produced content on volatile political issues, including Russia's war on Ukraine. The influencers say they had no idea of ​​Russian involvement in the activities of the media company, which CNN has identified as Tenet Media, and they controlled their own content.

“Buying authentic influencers is a far better use of funds than creating fake personas because they bring their own trusted audience and are actually, you know, real,” said Renee DiResta, an online influencer operations expert, in a social media post.

After its US offices were forced to close following the Russian invasion of Ukraine in 2022, RT is now resorting to increased covert operations to spread its message, according to prosecutors.

The shift shows that Russia's best chance to undermine US support for Ukraine may be to exploit influential American voices that bypass the mainstream media and criticize aid to Kyiv, the sources said.

“The Russians have diversified well beyond the 2016 model,” said Chris Krebs, former head of the Federal Cybersecurity and Infrastructure Security Agency. “At least from a tactical perspective, it's unclear what the true impact is. My sense is that they're not successful in changing specific behaviors or decisions, like the outcome of a single election,” Krebs said. “But it's much more likely that the Russians' efforts have been going on for some time and we don't yet fully understand the true damage.”

“It’s a difference like day and night”

The shift in Russian tactics also shows a keen understanding of the fragmented media landscape in the United States. Whereas in 2016 Russian intelligence primarily leaked hacked information to reach the mainstream media, today it is directly targeting a remote corner of the conservative media, where individual podcasters reach audiences that rival those of traditional newspapers.

As a result, Russia no longer needs to orchestrate the kind of hack-and-leak operation it carried out with great success in 2016, when Russian intelligence operatives stole a trove of emails from Democratic officials and leaked them to Wikileaks.

The Russians thought the American media would view Wikileaks as a relatively credible source of information, says Michael van Landingham, a former CIA official who assessed Russian activities in 2016.

“But in the absence of a hack-and-leak campaign at present, Russia has resorted to the age-old tactic of supporting public voices that express views consistent with the Russian message,” van Landingham said.

Artificial intelligence has also made it much easier for Russian (or other) intelligence agencies to pose as Americans online using fake photos and biographies.

“It's a night and day difference,” said Emerson Brooking, senior fellow at the Atlantic Council's Digital Forensic Research Lab. Compared to 2016, Russian actors have “demonstrated a far better understanding of the US information landscape” this time, said Brooking.

It's also unclear how useful hack-and-leak operations will be in 2024. Journalists are more aware of foreign influence attempts, and at least one known operation to influence this year's election had questionable effects.

As CNN previously reported, Iran itself conducted a hack-and-leak attack over the summer, stealing documents from the Trump campaign and sending them to several major news outlets. However, the contents of the stolen documents were barely reported, in part because they were low-profile.

The Justice Department on Wednesday also seized dozens of fake news sites used by other Russian companies to closely mimic the look and feel of Fox News and the Washington Post. According to an FBI affidavit, the Russian companies used the popular AI tool ChatGPT to compose some of their content.

Internal project documents from one of the Russian companies propose targeting US voters in six swing states with disinformation on topics such as the “risk of job loss for white Americans” and the alleged threat of crime posed by “Ukrainian immigrants,” the affidavit states.

“They were obsessed with impact and set clear goals,” Brooking said.

But the impact and effectiveness of Russian interference is difficult to measure. The influencers hired by Tenet Media, including Benny Johnson and Tim Pool, say they were victims of the alleged Russian plot. They had millions of followers to whom they had shared their views long before RT employees invested in Tenet Media, the indictment says.

“I'm skeptical that this operation would have resulted in preaching to anyone who wasn't already converted,” Gavin Wilde, a former National Security Council official focused on Russia, told CNN.

“It's largely a vicious cycle of fraud,” says Jason Kikta, a former U.S. Cyber ​​Command official who now works at security firm Automox. “With the Russian money, they can expand their operations within the ideologically like-minded population to run more scams, while the Russians can claim some imaginative success within their government to improve budget and career opportunities.”