Clint Watts

• Robert A. Fox Fellow, Foreign Policy Research Institute

• Senior Fellow, Center for Cyber and Homeland Security, the George Washington University

Statement Prepared for the U.S. Senate Select Committee on Intelligence hearing:

“Disinformation: A Primer In Russian Active Measures And Influence Campaigns”

30 March 2017

On 26 October 2015, I authored a post at the Foreign Policy Research Institute (FPRI) entitled “Russia Returns As Al Qaeda And The Islamic State’s Far Enemy” noting:

“The Russians have used social media driven information campaigns to discredit the U.S. for years. Facebook and Twitter remain littered with pro-Russian, Western looking accounts and supporting automated bots designed to undermine the credibility of the U.S. government.”1

Just a few weeks later in November 2015, the FBI visited FPRI notifying their leadership that I had been targeted by a cyber attack. The FBI didn’t say who exactly had targeted me, but I had a good idea who it might be.

In the eighteen months prior to the above quote and in the three years leading up to today, two colleagues and I watched and tracked the rise of Russia’s social media influence operations witnessing their update of an old Soviet playbook known as Active Measures.

For me, I began watching these influence operations in January 2014 after I co-authored an article in Foreign Affairs entitled “The Good and The Bad of Ahrar al Sham.”2 Hecklers appearing to be English-speaking Europeans and Americans trolled me for my stance on Syrian President Bashar Assad. But these social media accounts, they didn’t look right - their aggression, persistence, biographies, speech patterns and synchronization were unnatural. I wasn’t the only one who noticed this pattern. Andrew Weisburd and J.M. Berger, the two best social media analysts I’d worked with in counterterrorism, noticed similar patterns around the troll discussions of Syria, Assad, al Qaeda and the Islamic State.

1 Clint Watts (26 October 2015) Russia returns as al Qaeda and the Islamic State’s ‘Far Enemy’. Foreign Policy Research Institute. Available at: http://www.fpri.org/2015/10/russia-returns-as-al-qaeda-and-the-islamic-states-far-enemy/ 2 Michael Doran, William McCants and Clint Watts (23 January 2014) The Good and Bad of Ahrar al-Sham. Foreign Affairs. Available at: https://www.foreignaffairs.com/articles/syria/2014-01-23/good-and-bad-ahrar-al-sham

1


Shortly after, in March 2014, we noticed a petition on the WhiteHouse.gov website. “Alaska Back To Russia” appeared as a public campaign to give America’s largest state back to the nation from which it was purchased.3 Satirical or nonsensical petitions appearing on the White House website are not out of the norm. This petition was different though, having gained more than 39,000 online signatures in a short time period. Our examination of those signing and posting on this petition revealed an odd pattern – the accounts varied considerably from other petitions and appeared to be the work of automated bots. These bots tied in closely with other social media campaigns we had observed pushing Russian propaganda.

Through the summer and fall of 2014, we studied these pro-Russia accounts and automated bots. Hackers proliferated the networks and could be spotted amongst recent data breaches and website defacements. Closely circling them were honeypot accounts, attractive looking women or passionate political partisans, which appeared to be befriending certain audience members through social engineering. Above all, we observed hecklers, synchronized trolling accounts that would attack political targets using similar talking points and follower patterns. These accounts, some of which overtly supported the Kremlin, promoted Russian foreign policy positions targeting key English speaking audiences throughout Europe and North America. From this pattern, we realized we were observing a deliberate, well organized, well resourced, well funded, wide ranging effort commanded by only one possible adversary – Russia.

Active Measures: Everything Old Is New Again

Soviet Active Measures strategy and tactics have been reborn and updated for the modern Russian regime and the digital age. Today, Russia seeks to win the second Cold War through “the force of politics as opposed to the politics of force”.4 As compared to the analog information wars of the first Cold War, the Internet and social media provide Russia cheap, efficient and highly effective access to foreign audiences with plausible deniability of their influence.

Russia’s new and improved online Active Measures shifted aggressively toward U.S. audiences in late 2014 and throughout 2015. They launched divisive messages on nearly any disaffected U.S. audience. Whether it be claims of the U.S. military declaring martial law during the Jade Helm exercise5, chaos amongst Black Lives matter protests6

3 The original petition is no longer accessible on the White House website but a summary of the campaign can be found at: Soraya Sarhaddi Nelson (1 April 2014) Not An April Fools’ Joke: Russians Petition To Get Alaska Back. NPR. Available at: https://www.foreignaffairs.com/articles/syria/2014-01-23/good-and-bad-ahrar-al-sham 4 U.S. Information Agency (June 1992) Soviet Active Measures in the “Post Cold War” Era 1988-1991. U.S. House of Representatives Committee on Appropriations. Available at: http://intellit.muskingum.edu/russia_folder/pcw_era/exec_sum.htm 5 Dan Lamothe (14 September 2015) Remember Jade Helm 15, the controversial military exercise? It’s over. Washington Post. Available at:

2


or tensions in the Bundy Ranch standoff in Oregon7, Russia’s state sponsored outlets of RT and Sputnik News, characterized as “white” influence efforts in information warfare, churned out manipulated truths, false news stories and conspiracies. Four general themes outlined these propaganda messages:

• Political Messages – Designed to tarnish democratic leaders and undermine democratic institutions

• Financial Propaganda – Created to weaken confidence in financial markets, capitalist economies and Western companies

• Social Unrest – Crafted to amplify divisions amongst democratic populaces to undermine citizen trust and the fabric of society

• Global Calamity – Pushed to incite fear of global demise such as nuclear war or catastrophic climate change

From these overt Russian propaganda outlets, a wide range of English language conspiratorial websites (“gray” outlets), some of which mysteriously operate from Eastern Europe and are curiously led by pro-Russian editors of unknown financing, sensationalize conspiracies and fake news published by white outlets further amplifying their reach in American audiences. American looking social media accounts, the hecklers, honeypots and hackers described above, working alongside automated bots further amplify and disseminate Russian propaganda amongst unwitting Westerners. These covert, “black” operations influence target audience opinions with regards to Russia and undermine confidence in Western elected leaders, public officials, mainstream media personalities, academic experts and democracy itself.

Through the end of 2015 and start of 2016, the Russian influence system outlined above began pushing themes and messages seeking to influence the outcome of the U.S. Presidential election. Russia’s overt media outlets and covert trolls sought to sideline opponents on both sides of the political spectrum with adversarial views toward the Kremlin. The final months leading up to the election have been the predominate focus of Russian influence discussions to date. However, Russian Active Measures were in full swing during both the Republican and Democratic primary season and may have helped sink the hopes of candidates more hostile to Russian interests long before the field narrowed.

The final piece of Russia’s modern Active Measures surfaced in the summer of 2016 as hacked materials from previous months were strategically leaked. On 22 July 2016, Wikileaks released troves of stolen communications from the Democratic National

https://www.washingtonpost.com/news/checkpoint/wp/2015/09/14/remember-jade-helm- 15-the-controversial-military-exercise-its-over/?utm_term=.10e43e79bbc8 6 (2 October 2016) Tensions at rival White & Black Lives Matter protests flare in Houston. RT. Available at: https://www.rt.com/usa/361346-blm-wlm-protests-houston/ 7 (20 December 2016) Hands up or charging? Conflicting reports on shooting of Oregon militia spokesman. RT. Available at: https://www.rt.com/usa/330365-oregon-lavoy- shooting-police/

3


Committee and later batches of campaign emails. Guccifer 2.0 and DC Leaks revealed hacked information from a host of former U.S. government officials throughout July and August 2016. For the remainder of the campaign season, this compromising material powered the influence system Russia successfully constructed in the previous two years.

On the evening of 30 July 2016, my colleagues and I watched as RT and Sputnik News simultaneously launched false stories of the U.S. airbase at Incirlik being overrun by terrorists. Within minutes, pro-Russian social media aggregators and automated bots amplified this false news story and expanded conspiracies asserting American nuclear missiles at the base would be lost to extremists. More than 4,000 tweets in the first 78 minutes after launching of this false story linked back to the Active Measures accounts we’d tracked in the previous two years. These previously identified accounts, almost simultaneously appearing from different geographic locations and communities, amplified this fake news story in unison. The hashtags incrementally pushed by these automated accounts were #Nuclear, #Media, #Trump and #Benghazi. The most common words found in English speaking Twitter user profiles were: God, Military, Trump, Family, Country, Conservative, Christian, America, and Constitution. These accounts and their messages clearly sought to convince Americans a U.S. military base was being overrun in a terrorist attack like the 2012 assault on a U.S. installation in Benghazi, Libya.8 In reality, a small protest gathered outside the Incirlik gate and the increased security at the airbase sought to secure the arrival of the U.S. Chairman of the Joint Chiefs of Staff the following day.9

This pattern of Russian falsehoods and social media manipulation of the American electorate continued through Election Day and persists today. Many of the accounts we watched push the false Incirlik story in July now focus their efforts on shaping the upcoming European elections, promoting fears of immigration or false claims of refugee criminality. They’ve not forgotten about the United States either. This past week, we observed social media campaigns targeting Speaker of the House Paul Ryan hoping to foment further unrest amongst U.S. democratic institutions, their leaders and their constituents.

As we noted two days before the Presidential election in our article describing Russian influence operations, Russia certainly seeks to promote Western candidates sympathetic to their worldview and foreign policy objectives. But winning a single election is not

8 Andrew Weisburd and Clint Watts (6 August 2016) How Russia Dominates Your Twitter Feed to Promote Lies. The Daily Beast. Available at: http://www.thedailybeast.com/articles/2016/08/06/how-russia-dominates-your-twitter- feed-to-promote-lies-and-trump-too.html 9 (1 August 2016) Chairman in Turkey to Meet With U.S. Troops, Turkish Officials. U.S. Department of Defense. Available at: https://www.defense.gov/News/Article/Article/881458/chairman-in-turkey-to-meet-with- us-troops-turkish-officials

4


their end goal.10 Russian Active Measures hope to topple democracies through the pursuit of five complementary objectives:

• Undermine citizen confidence in democratic governance

• Foment and exacerbate divisive political fractures

• Erode trust between citizens and elected officials and democratic institutions

• Popularize Russian policy agendas within foreign populations

• Create general distrust or confusion over information sources by blurring the lines between fact and fiction

From these objectives, the Kremlin can crumble democracies from the inside out creating political divisions resulting in two key milestones: 1) the dissolution of the European Union and 2) the break up of the North American Treaty Organization (NATO). Achieving these two victories against the West will allow Russia to reassert its power globally and pursue its foreign policy objectives bilaterally through military, diplomatic and economic aggression. Russia’s undeterred annexation of Crimea, conflict in Ukraine and military deployment in Syria provide recent examples.

Why did Soviet Active Measures fail during the Cold War but succeed for Russia today?

Russia’s Active Measures today work far better than that of their Soviet forefathers. During the Cold War, the KGB had to infiltrate the West, recruit agents and promote communist parties and their propaganda while under watch by Western counterintelligence efforts. Should they be too aggressive, Soviet spies conducting Active Measures amongst U.S. domestic groups could potentially trigger armed conflict or would be detained and deported.

Social media provides Russia’s new Active Measures access to U.S. audiences without setting foot in the country, and the Kremlin smartly uses these platforms in seven ways to win Western elections. First, Russia chooses close democratic contests where a slight nudge can usher in their preferred candidate or desired outcome. Second, Russia targets specific audiences inside electorates amenable to their messages and resulting influence – in particular alt-right audiences incensed over immigration, refugees and economic hardship. Third, Russia plans and implements their strategy long before an election allowing sufficient time for cultivating an amenable audience ripe for manipulation. Fourth, their early entry into electoral debates allows them to test many messages and then reinforce those messages that resonate and bring about a measurable, preferred shift in public opinion. Fifth, Russia brilliantly uses hacking to compromise adversaries and power their influence messaging – a tactic most countries would not take. Sixth, their employment of social media automation saturates their intended audience with narratives

10 Andrew Weisburd, Clint Watts and JM Berger (6 November 2016) Trolling For Trump: How Russia Is Trying To Destroy Our Democracy. War On The Rocks. Available at: https://warontherocks.com/2016/11/trolling-for-trump-how-russia-is-trying- to-destroy-our-democracy/

5


that drown out opposing viewpoints. Finally, Russia plays either side should the contest change – backing an individual candidate or party so long as they support a Kremlin policy position and then turning against the same party should their position shift against Russia.11

The implications of Russia’s new Active Measures model will be two fold. The first is what the world is witnessing today – a Russian challenge to democracies throughout the West. Russian influence surfaced in Eastern Europe elections and the United Kingdom’s Brexit vote before the U.S. Presidential election, helped bolster a losing far-right candidate recently in the Netherlands12 and right now works diligently to shape the upcoming 2017 elections in France and Germany. Over the horizon, Russia has provided any authoritarian dictator or predatory elite equipped with hackers and disrespectful of civil liberties a playbook to dismantle their enemies through information warfare. Fledgling democracies and countries rife with ethnic and social divisions will be particularly vulnerable to larger authoritarian regimes with the time, resources and patience to foment chaos in smaller republics.

The U.S. Can Counter Russia’s Modern Active Measures

America can defuse Russia’s Active Measures online by undertaking a coordinated and broad range of actions across the U.S. government. Currently, the U.S. ignores, to its own detriment, falsehoods and manipulated truths generated and promoted by Russia’s state sponsored media and their associated conspiratorial websites. While many Active Measures claims seem ridiculous, a non-response by the U.S. government introduces doubt and fuels social media conspiracies. The U.S. should generate immediate public refutations to false Russian claims by creating two official government webpages acting as a U.S. government “Snopes” for disarming falsehoods. The U.S. State Department would host a website responding to false claims regarding U.S. policy and operations outside U.S. borders. The U.S. Department of Homeland Security would host a parallel website responding to any and all false claims regarding U.S. policy and operations domestically – a particularly important function in times of emergency where Russian Active Measures have been observed inciting panic.

Criminal investigations bringing hackers to justice will continue to be vital. However, the FBI must take a more proactive role during investigations to analyze what information has been stolen by Russia and then help officials publicly disclose the breach in short order. Anticipating rather than reacting to emerging Russian data dumps through public

11 Clint Watts and Andrew Weisburd (13 December 2016) How Russia Wins An Election. Politico. Available at: http://www.politico.com/magazine/story/2016/12/how-russia-wins- an-election-214524 12 Andrew Higgins (27 February 2017) Fake News, Fake Ukrainians: How a Group of Russians Tilted a Dutch Vote. New York Times. Available at: https://www.nytimes.com/2017/02/16/world/europe/russia-ukraine-fake-news-dutch- vote.html

6


affairs messaging will help U.S. officials and other American targets of kompromat prepare themselves for future discrediting campaigns.

Russian propaganda sometime peddles false financial stories causing rapid shifts in American company stock prices that hurt consumer and investor confidence and open the way for predatory market manipulation and short selling. At times, U.S. business employees unwittingly engage with Russian social media hecklers and honeypots putting themselves and their companies at risk. The Departments of Treasury and Commerce should immediately undertake an education campaign for U.S. businesses to help them thwart damaging, false claims and train their employees in spotting nefarious social media operations that might compromise their information.

The Department of Homeland Security must continue to improve existing public-private partnerships and expand sharing of cyber trends and technical signatures. This information will be critical in helping citizens and companies prevent the hacking techniques propelling Russian kompromat. Finally, U.S. intelligence agencies have a large role to play in countering Russian Active Measures in the future, but my recommendations in this regard are not well suited for open discussion.

The most important actions to diffuse Russia’s modern Active Measures actually come from outside the U.S. government – the private sector and civil society. Russia’s social media influence campaigns achieve great success because mainstream media outlets amplify the salacious claims coming from stolen information. If forewarned by law enforcement of a Russian compromise (as noted above), the world’s largest newspapers, cable news channels and social media companies could join in a pact vowing not to report on stolen information that amplified Russia’s influence campaigns. While they would stand to lose audience in the near term to fringe outlets, Russia’s Active Measures would be far less effective at discrediting their adversaries and shaping polities if they lacked access to mainstream media outlets. Mainstream media outlets unifying and choosing not to be Kremlin pawns would also be a counter to Russia’s suppression of free speech and harsh treatment of journalists and the press.

Social media companies have played an outsized role in recent elections as they increasingly act as the primary news provider for their users. Tailored news feeds from social media platforms have created information bubbles where voters see only stories and opinions suiting their preferences and biases – ripe conditions for Russian disinformation campaigns.13 In the lead up to the 2016 election, fake news stories were consumed at higher rates than true stories.14 As a result, Facebook initiated a noble effort

13 Yochai Benkler, Robert Faris, Hal Roberts and Ethan Zuckerman (3 March 2017) Study: Breitbart right-wing media ecosystem altered broader media agenda. Columbia Journalism Review. Available at: http://www.cjr.org/analysis/breitbart-media-trump- harvard-study.php 14 Craig Silverman (18 November 2016) This Analysis Shows How Viral Fake Election Stories Outperformed Real News On Facebook. Buzzfeed. Available at:

7


to tag fake news stories for their readers.15 But Facebook’s push must be expanded and joined by other social media companies or they will be overwhelmed by the volume of stories needing evaluation and will find difficulty protecting freedom of speech and the freedom of the press.

Social media companies should band together in the creation of an Information Consumer Reports. This non-governmental agency would evaluate all media organizations, mainstream and otherwise, across a range of variables producing news ratings representative of the outlet’s accuracy and orientation. The score would appear next to each outlet’s content in web searches and social media streams providing the equivalent of a nutrition label for information. Consumers would not be restricted from viewing fake news outlets and their erroneous information, but would know the risks of their consumption. The rating, over time, would reduce consumption of Russian disinformation specifically and misinformation collectively, while also placing a check on mainstream media outlets that have all too often regurgitated false stories.16

Over the past three years, Russia has implemented and run the most effective and efficient influence campaign in world history.17 Russian propaganda and social media manipulation has not stopped since the election in November and continues fomenting chaos amongst the American populace. American allies in Europe today suffer from an onslaught of hacks and manipulation, which threaten alliances that brought U.S. victory in the Cold War. The U.S., in failing to respond to Russia’s Active Measures, will surrender its position as the world’s leader, forgo its role as chief promoter and defender of democracy, and give up on over seventy years of collective action to preserve freedom and civil liberties around the world.

Our nation’s democratic principles and ideals are under attack by a kleptocratic Russian regime sowing divisions amongst the American public and Western society through information warfare. Russia’s strategic motto is “divided we stand, divided we fall”. It’s time the United States remind the world, that despite our day-to-day policy debates and political squabbles, we stand united, alongside our allies, in defending our democratic

https://www.buzzfeed.com/craigsilverman/viral-fake-election-news-outperformed-real- news-on-facebook?utm_term=.etYEzgQno#.im3kXQAKR 15 Olivia Solon and Julia Carrie Wong (16 December 2016) Facebook’s plan to tackle fake news raises questions over limitations. The Guardian. Available at: https://www.theguardian.com/technology/2016/dec/16/facebook-fake-news-system- problems-fact-checking 16 Clint Watts and Andrew Weisburd (22 January 2017) Can the Michelen Model Fix Fake News? Daily Beast. Available at: http://www.thedailybeast.com/articles/2017/01/22/can-the-michelin-model-fix-fake- news.html 17 Kathy Frankovic (14 December 2016) Americans and Trump part ways over Russia. YouGov. Available at: https://today.yougov.com/news/2016/12/14/americans-and-trump- part-ways-over-russia/

8


system of government from the meddling of power-hungry tyrants and repressive authoritarians that prey on their people and suppress humanity.

9