Let me know if you need more, you willfully blind hack:
1. The IRA Ramps Up U.S. Operations As Early As 2014 The IRA’s U.S. operations sought to influence public opinion through online media and forums. By the spring of 2014, the IRA began to consolidate U.S. operations within a single general department, known internally as the “Translator” (Переводчик) department. Harm to Ongoing Matter IRA subdivided the Translator De responsibilities, ranging from operations on different social media platforms to analytics to 29 serials 131 & 204. See SM-2230634, 30 See SM-2230634, serial 156. 31 Internet Research Agency Indictment ¶ 12(b); see also 5/26/16 Facebook Messages, ID 1479936895656747 (United Muslims of America) & 32 see also Harm to Ongoing MatterHarm to Ongoing Matter U.S. Department of Justice 19 graphics and IT. 33 34 Harm to Ongoing MatterHarm to Ongoing MatterHarm to 33 Harm to Ongoing Matter See SM-2230634, serial 205. 34 See SM-2230634, serial 204 U.S. Department of Justice 20 Harm to Ongoing MatterHarm to Ongoing Matter 35 36 37 IRA employees also traveled to the United States on intelligence-gathering missions. In June 2014, four IRA employees applied to the U.S. Department of State to enter the United States, while lying about the purpose of their trip and claiming to be four friends who had met at a party.38 Ultimately, two IRA employees—Anna Bogacheva and Aleksandra Krylova—received visas and entered the United States on June 4, 2014. Prior to traveling, Krylova and Bogacheva compiled itineraries and instructions for the trip. Harm to Ongoing Matter 9 35 36 37 38 See SM-2230634, serials 150 & 172 Harm to Ongoing Matter 39 U.S. Department of Justice 21 41 Harm to Ongoing MatterHarm to Ongoing Matter 40 2. U.S. Operations Through IRA-Controlled Social Media Accounts Dozens of IRA employees were responsible for operating accounts and personas on different U.S. social media platforms. The IRA referred to employees assigned to operate the social media accounts as “specialists.”42 Starting as early as 2014, the IRA’s U.S. operations included social media specialists focusing on Facebook, YouTube, and Twitter.43 The IRA later added specialists who operated on Tumblr and Instagram accounts.44 Initially, the IRA created social media accounts that pretended to be the personal accounts of U.S. persons.45 By early 2015, the IRA began to create larger social media groups or public social media pages that claimed (falsely) to be affiliated with U.S. political and grassroots organizations. In certain cases, the IRA created accounts that mimicked real U.S. organizations. For example, one IRA-controlled Twitter account, @TEN_GOP, purported to be connected to the Tennessee Republican Party.46 More commonly, the IRA created accounts in the names of fictitious U.S. organizations and grassroots groups and used these accounts to pose as antiimmigration groups, Tea Party activists, Black Lives Matter protestors, and other U.S. social and political activists. The IRA closely monitored the activity of its social media accounts. 40 41 42Harm to Ongoing MatterHarm to Ongoing MatterHarm to Ongoing MatterHarm to Ongoing Matter 43 44 See, e.g., SM-2230634, serial 179 45 See, e.g., Facebook ID 100011390466802 (Alex Anderson); Facebook ID 100009626173204 (Andrea Hansen); Facebook ID 100009728618427 (Gary Williams); Facebook ID 100013640043337 (Lakisha Richardson). 46 The account claimed to be the “Unofficial Twitter of Tennessee Republicans” and made posts that appeared to be endorsements of the state political party. See, e.g., @TEN_GOP, 4/3/16 Tweet (“Tennessee GOP backs @realDonaldTrump period #makeAmericagreatagain #tngop #tennessee #gop”). U.S. Department of Justice 22 8 Harm to Ongoing MatterHarm to Ongoing Matter 7 By February 2016, internal IRA documents referred to support for the Trump Campaign and opposition to candidate Clinton.49 For example, HOM operators Harm to Ongoing Matter directions to IRA “Main idea: Use any opportunity to criticize Hillary [Clinton] and the rest (except Sanders and Trump -we support them).”50 Harm to Ongoing Matter The focus internal on the U.S. presidential campaign continued throughout 2016. In 2016 reviewing the IRA-controlled Facebook group “Secured Borders,” the 47 . Harm to Ongoing Matter 48 See, e.g. 49 The IRA posted content about the Clinton candidacy before Clinton officially announced her presidential campaign. IRA-controlled social media accounts criticized Clinton’s record as Secretary of State and promoted various critiques of her candidacy. The IRA also used other techniques. Harm to Ongoing Matter See 50 U.S. Department of Justice 23 author criticized the “lower number of posts dedicated to criticizing Hillary Clinton” and reminded the Facebook specialist “it is imperative to intensify criticizing Hillary Clinton.”51 IRA employees also acknowledged that their work focused on influencing the U.S. presidential election. Harm to Ongoing Matter . 52 3. U.S. Operations Through Facebook Many IRA operations used Facebook accounts created and operated by its specialists. Harm to Ongoing Matter Harm to Ongoing Matter 53 4 IRA Facebook groups active during the 2016 campaign covered a range of political issues and included purported conservative 51 Harm to Ongoing Matter 52 53 54Harm to Ongoing MatterHarm to Ongoing Matter 24 U.S. Department of Justice groups (with names such as “Being Patriotic,” “Stop All Immigrants,” “Secured Borders,” and “Tea Party News”), purported Black social justice groups (“Black Matters,” “Blacktivist,” and “Don’t Shoot Us”), LGBTQ groups (“LGBT United”), and religious groups (“United Muslims of America”). Throughout 2016, IRA accounts published an increasing number of materials supporting the Trump Campaign and opposing the Clinton Campaign. For example, on May 31, 2016, the operational account “Matt Skiber” began to privately message dozens of pro-Trump Facebook groups asking them to help plan a “pro-Trump rally near Trump Tower.”55 To reach larger U.S. audiences, the IRA purchased advertisements from Facebook that promoted the IRA groups on the newsfeeds of U.S. audience members. According to Facebook, the IRA purchased over 3,500 advertisements, and the expenditures totaled approximately $100,000.56 During the U.S. presidential campaign, many IRA-purchased advertisements explicitly supported or opposed a presidential candidate or promoted U.S. rallies organized by the IRA (discussed below). As early as March 2016, the IRA purchased advertisements that overtly opposed the Clinton Campaign. For example, on March 18, 2016, the IRA purchased an advertisement depicting candidate Clinton and a caption that read in part, “If one day God lets this liar enter the White House as a president – that day would be a real national tragedy.”57 Similarly, on April 6, 2016, the IRA purchased advertisements for its account “Black Matters” calling for a “flashmob” of U.S. persons to “take a photo with #HillaryClintonForPrison2016 or #nohillary2016.”58 IRA-purchased advertisements featuring Clinton were, with very few exceptions, negative.59 IRA-purchased advertisements referencing candidate Trump largely supported his campaign. The first known IRA advertisement explicitly endorsing the Trump Campaign was purchased on April 19, 2016. The IRA bought an advertisement for its Instagram account “Tea Party News” asking U.S. persons to help them “make a patriotic team of young Trump supporters” by uploading photos with the hashtag “#KIDS4TRUMP.”60 In subsequent months, the IRA purchased dozens of advertisements supporting the Trump Campaign, predominantly through the Facebook groups “Being Patriotic,” “Stop All Invaders,” and “Secured Borders.” 55 5/31/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID 5/31/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID PP 56 Social Media Influence in the 2016 U.S. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/17) (testimony of Colin Stretch, General Counsel of Facebook). 57 3/18/16 Facebook Advertisement ID 6045505152575. 58 4/6/16 Facebook Advertisement ID 6043740225319. 59 See SM-2230634, serial 213 (documenting politically-oriented advertisements from the larger set provided by Facebook). 60 4/19/16 Facebook Advertisement ID 6045151094235. 25 U.S. Department of Justice U.S. Department of Justice 65 64 63Harm to Ongoing MatterHarm to Ongoing Matter 26 62 Social Media Influence in the 2016 U.S. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/17) (testimony of Colin Stretch, General Counsel of Facebook). Harm to Ongoing MatterHarm to Ongoing Matter 61 See Facebook ID 1479936895656747 (United Muslims of America); Facebook ID 1157233400960126 (Don’t Shoot); Facebook ID 1601685693432389 (Being Patriotic); Facebook ID 757183957716200 (Secured Borders). a. Individualized Accounts 4 65 Harm to Ongoing Matter Separately, the IRA operated a network of automated Twitter accounts (commonly referred to as a bot network) that enabled the IRA to amplify existing content on Twitter. certain Twitter accounts to create individual U.S. personas, The IRA’s Twitter operations involved two strategies. First, IRA specialists operated 63 A number of IRA employees assigned to the Translator Department served as Twitter 4. U.S. Operations Through Twitter Collectively, the IRA’s social media accounts reached tens of millions of U.S. persons. Individual IRA social media accounts attracted hundreds of thousands of followers. For example, at the time they were deactivated by Facebook in mid-2017, the IRA’s “United Muslims of America” Facebook group had over 300,000 followers, the “Don’t Shoot Us” Facebook group had over 250,000 followers, the “Being Patriotic” Facebook group had over 200,000 followers, and the “Secured Borders” Facebook group had over 130,000 followers.61 According to Facebook, in total the IRA-controlled accounts made over 80,000 posts before their deactivation in August 2017, and these posts reached at least 29 million U.S persons and “may have reached an estimated 126 million people.”62 66 The IRA operated individualized Twitter accounts similar to the operation of its Facebook accounts, by continuously posting original content to the accounts while also communicating with U.S. Twitter users directly (through public tweeting or Twitter’s private messaging). The IRA used many of these accounts to attempt to influence U.S. audiences on the election. Individualized accounts used to influence the U.S. presidential election included @TEN_GOP (described above); @jenn_abrams (claiming to be a Virginian Trump supporter with 70,000 followers); @Pamela_Moore13 (claiming to be a Texan Trump supporter with 70,000 followers); and @America_1st_ (an anti-immigration persona with 24,000 followers).67 In May 2016, the IRA created the Twitter account @march_for_trump, which promoted IRA-organized rallies in support of the Trump Campaign (described below).68 9 Using these accounts and others, the IRA provoked reactions from users and the media. Multiple IRA-posted tweets gained popularity.70 U.S. media outlets also quoted tweets from IRA-controlled accounts and attributed them to the reactions of real U.S. persons.71 Similarly, numerous high66 67 Other individualized accounts included @MissouriNewsUS (an account with 3,800 followers that posted pro-Sanders and anti-Clinton material). 68 See @march_for_trump, 5/30/16 Tweet (first post from account). 69 70 For example, one IRA account tweeted, “To those people, who hate the Confederate flag. Did you know that the flag and the war wasn’t about slavery, it was all about money.” The tweet received over 40,000 responses. @Jenn_Abrams 4/24/17 (2:37 p.m.) Tweet. 71 Josephine Lukito & Chris Wells, Most Major Outlets Have Used Russian Tweets as Sources for Partisan Opinion: Study, Columbia Journalism Review (Mar. 8, 2018); see also Twitter Steps Up to Explain #NewYorkValues to Ted Cruz, Washington Post (Jan. 15, 2016) (citing IRA tweet); People Are Slamming the CIA for Claiming Russia Tried to Help Donald Trump, U.S. News & World Report (Dec. 12, 2016). U.S. Department of Justice 27 profile U.S. persons, including former Ambassador Michael McFaul,72 Roger Stone,73 Sean Hannity,74 and Michael Flynn Jr.,75 retweeted or responded to tweets posted to these IRAcontrolled accounts. Multiple individuals affiliated with the Trump Campaign also promoted IRA tweets (discussed below). b. IRA Botnet Activities 6 7 78 In January 2018, Twitter publicly identified 3,814 Twitter accounts associated with the IRA.79 According to Twitter, in the ten weeks before the 2016 U.S. presidential election, these accounts posted approximately 175,993 tweets, “approximately 8.4% of which were election72 @McFaul 4/30/16 Tweet (responding to tweet by @Jenn_Abrams). 73 @RogerJStoneJr 5/30/16 Tweet (retweeting @Pamela_Moore13); @RogerJStoneJr 4/26/16 Tweet (same). 74 @seanhannity 6/21/17 Tweet (retweeting @Pamela_Moore13). 75 @mflynnJR 6/22/17 Tweet (“RT @Jenn_Abrams: This is what happens when you add the voice over of an old documentary about mental illness onto video of SJWs. . .”). 76 A botnet refers to a network of private computers or accounts controlled as a group to send specific automated messages. On the Twitter network, botnets can be used to promote and republish (“retweet”) specific tweets or hashtags in order for them to gain larger audiences. 77 78 Harm to Ongoing Matter 79 Eli Rosenberg, Twitter to Tell 677,000 Users they Were Had by the Russians. Some Signs Show the Problem Continues, Washington Post (Jan. 19, 2019). U.S. Department of Justice 28 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e)related.”80 Twitter also announced that it had notified approximately 1.4 million people who Twitter believed may have been in contact with an IRA-controlled account.81 5. U.S. Operations Involving Political Rallies The IRA organized and promoted political rallies inside the United States while posing as U.S. grassroots activists. First, the IRA used one of its preexisting social media personas (Facebook groups and Twitter accounts, for example) to announce and promote the event. The IRA then sent a large number of direct messages to followers of its social media account asking them to attend the event. From those who responded with interest in attending, the IRA then sought a U.S. person to serve as the event’s coordinator. In most cases, the IRA account operator would tell the U.S. person that they personally could not attend the event due to some preexisting conflict or because they were somewhere else in the United States.82 The IRA then further promoted the event by contacting U.S. media about the event and directing them to speak with the coordinator.83 After the event, the IRA posted videos and photographs of the event to the IRA’s social media accounts.84 The Office identified dozens of U.S. rallies organized by the IRA. The earliest evidence of a rally was a “confederate rally” in November 2015.85 The IRA continued to organize rallies even after the 2016 U.S. presidential election. The attendance at rallies varied. Some rallies appear to have drawn few (if any) participants, while others drew hundreds. The reach and success of these rallies was closely monitored Harm to Ongoing Matter80 Twitter, “Update on Twitter’s Review of the 2016 US Election” (updated Jan. 31, 2018). Twitter also reported identifying 50,258 automated accounts connected to the Russian government, which tweeted more than a million times in the ten weeks before the election. 81 Twitter, “Update on Twitter’s Review of the 2016 US Election” (updated Jan. 31, 2018). 82 8/20/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID . 83 See, e.g., 7/21/16 Email,
joshmilton024@gmail.com to ; 7/21/16 Email,
joshmilton024@gmail.com to PPPPPersonal Privacy84 @march_for_trump 6/25/16 Tweet (posting photos from rally outside Trump Tower). 85 Instagram ID 2228012168 (Stand For Freedom) 11/3/15 Post (“Good evening buds! Well I am planning to organize a confederate rally [. . .] in Houston on the 14 of November and I want more people to attend.”). 29 30 U.S. Department of Justice U.S. Department of Justice 87 88 Harm to Ongoing Matter 31 86 The pro-Trump rallies were organized through multiple Facebook, Twitter, and email accounts. See, e.g., Facebook ID 100009922908461 (Matt Skiber); Facebook ID 1601685693432389 (Being Patriotic); Twitter Account @march_for_trump;
beingpatriotic@gmail.com. (Rallies were organized in New York on June 25, 2016; Florida on August 20, 2016; and Pennsylvania on October 2, 2016.) IRA employees frequently used Twitter, Facebook, and Instagram to contact and recruit U.S. persons who followed the group. The IRA recruited U.S. persons from across the political spectrum. For example, the IRA targeted the family of and a number of black social justice activists . 88 amplify the content posted by the IRA. As early as 2014, the IRA instructed its employees to target U.S. persons who could be used to advance its operational goals. Initially, recruitment focused on U.S. persons who could 6. Targeting and Recruitment of U.S. Persons IRA Poster for Pennsylvania Rallies organized by the IRA Harm to Ongoing Matter Many of the same IRA employees who oversaw the IRA’s social media accounts also conducted the day-to-day recruiting for political rallies inside the United States. From June 2016 until the end of the presidential campaign, almost all of the U.S. rallies organized by the IRA focused on the U.S. election, often promoting the Trump Campaign and opposing the Clinton Campaign. Pro-Trump rallies included three in New York; a series of pro-Trump rallies in Florida in August 2016; and a series of pro-Trump rallies in October 2016 in Pennsylvania. The Florida rallies drew the attention of the Trump Campaign, which posted about the Miami rally on candidate Trump’s Facebook account (as discussed below).86while posing as a grassroots group called “Black Matters US.”89 In February 2017, the persona “Black Fist” (purporting to want to teach African-Americans to protect themselves when contacted by law enforcement) hired a self-defense instructor in New York to offer classes sponsored by Black Fist. The IRA also recruited moderators of conservative social media groups to promote IRA-generated content,90 as well as recruited individuals to perform political acts (such as walking around New York City dressed up as Santa Claus with a Trump mask). 91 2Harm to Ongoing Matter93 94 Harm to Ongoing MatterHarm to Ongoing as the IRA’s online audience became larger, the IRA tracked U.S. persons with whom they communicated and had successfully tasked (with tasks ranging from organizing rallies to taking pictures with certain political messages). 95 Harm to Ongoing 89 3/11/16 Facebook Advertisement ID 6045078289928, 5/6/16 Facebook Advertisement ID 6051652423528, 10/26/16 Facebook Advertisement ID 6055238604687; 10/27/16 Facebook Message, ID & ID 100011698576461 (Taylor Brooks). 90 8/19/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID 91 12/8/16 Email,
robot@craigslist.org to
beingpatriotic@gmail.com (confirming Craigslist advertisement). 92 8/18-19/16 Twitter DMs, @march_for_trump & 93 See, e.g., 11/11-27/16 Facebook Messages, ID 100011698576461 (Taylor Brooks) & IDPersonal Privacy bull horn). 94 (arranging to pay for plane tickets and for a See, e.g., 9/10/16 Facebook Message, ID 100009922908461 (Matt Skiber) & IDPersonal Privacy (discussing payment for rally supplies); 8/18/16 Twitter DM, @march_for_trump to (discussing payment for constr 95 U.S. Department of Justice 32
apnews.com
