The operation sounds like a normal tech-savvy ad agency.
There’s a graphics team. There is a team devoted to making sure the company’s content shows up near the top of search results. There are IT people and a finance department controlling a budget in the millions.
Employees track their social media posts to see how they’re doing — how many likes, comments and shares they’ve gotten. They do post-mortems on their work to make sure it’s up to the company’s standards.
If you didn’t know that it had just been indicted for trying to interfere with the 2016 U.S. presidential election, you might well want to hire the Internet Research Agency.
A federal indictment against 13 Russian nationals made public on Friday provides new insight into how the Internet Research Agency, a Kremlin-linked Russian troll group, set up a vast network of fake American activist groups and used the stolen identities of real Americans in an attempt to wreak havoc on the U.S. political system.
According to the indictment, the group, which is based in St. Petersburg, Russia, began monitoring the social media pages of real American activist organizations in 2014, before setting up fake pages and personas that became, the indictment says, “leaders of public opinion.”
The pages were designed to look like they were run by real Americans. They focused on a number of divisive issues in American life, including race relations, religion, immigration, and the 2016 presidential election.
On Facebook alone, an estimated 126 million Americans may have been exposed to material the group produced, the social media company told Congress last fall. The indictment provides a fuller picture of how the Internet Research Agency worked. It details a sophisticated operation that allowed the group to achieve such wide reach. The agency had a budget of over $1.25 million by September 2016 — big enough to include money for bonuses.
“To measure the impact of their online social media operations, Defendants and their co-conspirators tracked the performance of content they posted over social media,” it says. “They tracked the size of the online U.S. audiences reached through posts, different types of engagement with the posts … changes in audience size, and other metrics. Defendants and their co-conspirators received and maintained metrics reports on certain group pages and individualized posts.”
The group worked hard to make its work look like it came from real Americans. Apart from the occasional typo — or a phrase that, in hindsight, was clearly written by a non-native English speaker — the group’s Facebook, Twitter, Instagram, YouTube and Tumblr pages were convincing. They looked like many other politically-themed pages on social media: Designed to take advantage of Americans’ divisions, to get engagement by stoking outrage.
The sophistication may have been aided by a fact-finding mission that some of the defendants made to the United States in 2014. The Russians traveled under false pretenses to collect intelligence to inform their operations, the indictment says.
Once the operation was up and running, staff in St. Petersburg worked day and night and were instructed to post in accordance with U.S. time zones. They worked with a graphics department, the indictment says, which may explain why some of the group’s pages, like “Secured Borders” and “Blacktivist,” had slick custom logos.
The pages were not solely or even mostly devoted to talking about the election, and the operation was running before Donald Trump announced his candidacy for president. But eventually the group decided on a goal, the indictment says. In February 2016 employees at the IRA were instructed to “use any opportunity to criticize Hillary and the rest (except Sanders and Trump – we support them,” the indictment alleges.
In September 2016, according to the indictment, an internal review criticized the person running the “Secured Borders” Facebook page for its “low number of posts dedicated to criticizing Hillary Clinton.”
The Internet Research Agency also worked hard to ensure that its influence would stretch beyond social media and into the physical world, the indictment says. It successfully organized real demonstrations.
In one case, as CNN has previously reported, the troll group organized and promoted two opposing events on the same day at the same location in Houston, Texas.
“Heart of Texas,” a page that posed as a pro-Texas secession organization, promoted a “Stop Islamization of Texas” protest at the opening of a library at an Islamic Center on May 21, 2016. The same troll group used another page, “United Muslims of America,” to promote a “Save Islamic Knowledge” event at the same time.
Related: Stoking Islamophobia and secession in Texas — from an office in Russia
In the weeks leading up to the 2016 election, the group used its pages targeted at African Americans and Muslims to try to suppress minority voter turnout, Mueller’s team said. A post on the Instagram account “Woke Blacks” suggested that rather than for voting for the “lesser of two evils,” African Americans should not vote at all.
The group used its pages to promote grassroots Donald Trump events and in August 2016, they were contacted by a Florida-based political activist identified as the “Chair for the Trump Campaign” in a particular Florida county. The activists identified two additional sites in Florida for possible rallies, the indictment states.
After the election the group used its pages to promote events celebrating the election of Donald Trump and events protesting Trump’s election.
The indictment also says that, posing as Americans, some of the defendants solicited and compensated unwitting real Americans as part of their operation — a practice that continued at least into 2017.
Last year, CNN spoke to two personal trainers in New York and Miami who had been hired by a group called “Black Fist” to run self-defense classes for African Americans in their community.
Related: In attempt to sow fear, Russian trolls paid for self-defense classes
“Black Fist” later was confirmed to be part of the Internet Research Agency’s operation — the self defense classes were an apparent attempt to stoke fear and gather contact details of Americans potentially susceptible to propaganda.
One of the personal trainers with whom CNN spoke last year, Omowale Adewale, said he ran more than a dozen events for Black Fist between January and May, never suspecting that the Russian group was behind them.
The group paid him $320 each month through PayPal and Google Wallet, he told CNN.
In order to use PayPal, the indictment alleges, the Internet Research Agency employed the stolen identities of at least five different Americans, who it identifies only by their initials. CNN spoke with one of them, a woman in Georgia who asked not to be named, on Friday after the indictment was made public.
CNN had first discovered a fraudulent account in the woman’s name tied to Black Fist in October, and brought it to the attention of both the woman and of PayPal at the time. PayPal removed it shortly thereafter.
The woman said that her Social Security number had been used in 2016 to file a fraudulent tax return. She said she reported it to the IRS at the time, and that it conducted an investigation, but that she was not told whether the IRS had discovered who was behind the fraud.
No authorities have contacted her about this use of her Social Security number, the woman said. She told CNN she feels violated.
“It was a little frightening that this could happen,” she said.
“It’s crazy,” she said of Russians using her identity. “One thing I would say is to do your due diligence and protect your identity and the identity of your children.”
PayPal said in a statement Friday, “PayPal is intensely focused on combating and preventing the illicit use of our services. We work closely with law enforcement, and did so in this matter, to identify, investigate and stop improper or potentially illegal activity.”
