Mr. President, today I rise to continue my series of speeches on Russian hybrid warfare. I have done a series of speeches on the Russian hybrid warfare threat. It poses a great challenge to our national security. Russian hybrid warfare occurs below the level of direct military conflict, yet it is no less a threat to the national security and integrity of our democracy and society. 

One tactic that Russia deploys as part of their hybrid warfare arsenal, and the one I would like to focus on today, is information warfare. Russian information warfare includes the deployment of false or misleading narratives against the targeted civilian population or government, often through deceptive means, in order to intensify social tensions, undermine trust in government institutions, and sow fear and confusion, which advances their strategic objectives. The Defense Intelligence Agency highlights in their Russia military power report in 2017: "The weaponization of information is a key aspect of Russia’s strategy . . . Moscow views information and psychological warfare as a measure to neutralize adversary actions in peace and to prevent escalation to crisis or war." Russia developed its playbook over time, enhancing both the technical and psychological aspects of these information operations in capability, sophistication, and boldness. 

Lessons learned from previous information warfare campaigns culminated in the attacks the Kremlin unleashed against the United States during the 2016 Presidential election. The 2016 information warfare campaign, according to our intelligence community, "demonstrated a significant escalation in directness, level of activity, and scope of effort compared to previous operations." Let’s be clear: Russian interference in the 2016 election was an attack on the Nation. It was just not a type of attack that has been commonly recognized as warfare. As former Director of National Intelligence Jim Clapper stated recently, "[I]t’s hard to convey to people how massive an assault this was." While Russian hybrid attacks were detected by our intelligence community and our National Security Agencies in a run-up to the 2016 election, the seriousness of the threat was not absorbed across the government, including Congress. There are a variety of reasons for this, including political paralysis and a collective unwillingness to believe that these attacks could compromise our political and social institutions.

Two years on, we still have only scratched the surface in our understanding of about the nature of Russian information warfare attacks. Gaps in our knowledge include the extent to which these attacks have been perpetrated at Putin’s direction, by Russian military intelligence units, known as the GRU, and through Kremlin linked troll organizations. Yet we have no time to waste. 

Information warfare attacks continue against us, our allies, and our partners to this day, and they continue to pose a threat to our national security. Former CIA Acting Director and Deputy Director Mike Morell characterized the attacks of the Russians against our elections as "the political equivalent of 9-11." In the aftermath of the tragic September 11 attacks of 2001, we established a nonpartisan commission to understand what happened and why. One of the 9/11 Commission’s conclusions was that the U.S. Government showed a failure of imagination by not anticipating and preventing the 2001 attacks by the terrorists. 

We have had no similar wholesale reckoning in the aftermath of the attacks from 2016. Some elements of our government and society have taken steps to focus attention on this pressing problem. However, these efforts have not been sufficiently comprehensive, and the nature of the threats has not been fully communicated to the American public. As Senior Vice President for the Center of European Analysis, Edward Lucas assessed in a recent New York Times documentary on Russian disinformation we "are still playing catch up from a long way behind. We are looking in the rear view mirror, getting less bad at working out what Russia just did to us. We are still not looking through the windshield to find out what’s happening now and what’s going to be happening next." We must recover from our collective failure of imagination. We must rethink and refocus our strategy for countering these threats and implement necessary institutional policy and societal changes to support that strategy. Importantly, we must develop a playbook of our own to fight back. 

While the West has been slow to recognize the extent of the threat, these types of attacks are not new. Historically, informational warfare has long been a part of the Soviet and Russian arsenal. As security scholar Keir Giles noted in The Handbook of Russian Information Warfare, "For all their innovative use of social media and the internet, current Russian methods have deep roots in long-standing Soviet practice." During Soviet times, information warfare tactics were part of a broader collection of operations that were referred to as active measures. The State Department described active measures in a 1981 report as including "control of the press in foreign countries; outright and partial forgery of documents; use of rumors, insinuation, altered facts and lies; use of international and local front organizations; clandestine operation of radio stations; and exploitation of a nation’s academic, political, and media figures as collaborators to influence policies of the nation." Active measures were run by the KGB, which at its height employed approximately 15,000 officers devoted to these tactics. The same State Department report described the strategic rationale for such operations, stating: "Moscow seeks to disrupt relations between states, discredit opponents of the USSR, and undermine foreign leaders, institutions and values." 

The tactics of contemporary Russian information warfare mirrors Soviet-era active measures but have gained vastly greater potency in the digital age. The irony is, these are the tactics the Soviets employed, but they have been supercharged because in a digital age, you can reach more people, you can be more effective. Under Putin, Russia has institutionalized informational warfare with a 21st century twist that capitalizes on the interconnectedness of our global society in the speed and reach of today’s informational age through cyber space. This has important advantages for Moscow. For example, the Soviet-era KGB agents worked for years to get an information warfare campaign to "go viral" and be picked up in multiple news outlets. Today, GRU- and Kremlin-linked troll organizations spread propaganda and disinformation campaigns across social media platforms with ease—virtually instantaneously. 

These information warfare operations are not simply opportunistic meddling by Russia. Russia’s purpose is to further its strategic interests. Putin seeks to advance several strategic objectives, including preserving his grip on power and enhancing his ability to operate unconstrained domestically or in Russia’s perceived sphere of influence near and abroad. Putin further seeks for Russia to be seen as an equal to the United States on the world stage and regain the great power status it lost at the end of the Cold War. Putin knows that for now, Russia cannot effectively compete with the United States in conventionally military ways and win. Instead, Putin seeks to use tools from his hybrid warfare arsenal, including information warfare to divide the United States from our allies and partners in the West and weaken our institutions and open society from within. By weakening our democracy, Putin can make Russia look more powerful in comparison. 

It is not surprising that Putin, who spent most of his Soviet career in the KGB and its successor, the FSB, has deployed these techniques during his rule. Putin mourned the downfall of the Soviet Union, lamenting in 2005 that the breakup of the Soviet Union was, in his words, "the greatest geopolitical tragedy of the 20th century." When he assumed power, Putin revitalized a number of methods of hybrid warfare from the Soviet system, including information warfare. Over time, Putin came to see Russia’s nearly continuous campaign of information confrontation with the West as both a justified and defensive response to perceived U.S.-led international activism, regardless of our intentions. Keir Giles confirms this idea, assessing that Russia interpreted the color revolutions in former Soviet states and the Arab Spring as resulting from information operations by the United States and the West. Those operations were seen as posing a serious and growing threat to Putin’s rule. The Kremlin’s development of its information warfare capabilities reflects those perceptions and Putin’s concern with preservation of his regime. 

Putin moved from earlier ad hoc information warfare campaigns, such as the operations against Estonia in 2007 and in Georgia in 2008, to the systematic application of these tools. Most experts point to the Russians' public reaction to Putin’s return to the Presidency for a third term in 2012 as the turning point that led to development of Russian information warfare as we experience it today. It began with the announcement in September 2011 that Putin—then acting as Prime Minister—and Medvedev— then serving as President—would switch roles. This revelation, coupled with the rigged parliamentary elections in late 2011, created an unexpected backlash from the Russian people. Massive demonstrations ensued, with thousands of people taking to the streets. To Putin, the grievances of the protests appeared personal as they chanted "Putin is a thief" and "Russia without Putin." 

The year of 2011 is particularly relevant for revolutions and the overthrow of dictatorships. The year 2011 gave rise to the Arab Spring, in which dissidents relied heavily on Facebook and Twitter—American inventions—to organize their protests and cast-off authoritarian governance in places across the Middle East. Again, Putin conceived U.S. actions in places such as Egypt and Libya as proof that the United States actively cultivated regime change. Protests in Russia began to resemble the protests of the Arab Spring, including the similar use of Facebook and Twitter. Putin viewed these activities as a threat to his hold on power. 

Around that time, then-Secretary of State Hillary Clinton raised concerns about the Kremlin’s electoral conduct. She urged that the "Russian people, like people everywhere, deserve the right to have their voices heard and their votes counted." In response, Putin accused the United States of interfering in the Russian elections and blamed Secretary Clinton for the massive protests taking place in Russia, alleging that Secretary Clinton gave the, in his words, "signal to some actors in our country to rise up." He further bemoaned what he called ‘‘foreign money’’ being used to influence Russian politics and warned: "We need to safeguard ourselves from this influence in our internal affairs." 

After his inauguration for a third term, Putin promoted a close ally and tasked him with getting control over the Russian’s people use of the internet. Putin and his cronies also put political pressure on the creators of prominent websites. Those who were not willing to cooperate, such as the owner of the Russian version of Facebook, were pushed out so that the chosen oligarchs could become majority shareholders and then begin to control content. About the same time, the Russian Parliament passed legislation helping the Kremlin monitor and criminalize unfavorable cyber activities. In concert with the new online restrictions, the Kremlin began paying bloggers to slip in pro-Russian material amongst other benign posts, which was the beginning of government-directed troll operations.

In late 2013, a leading Russian newspaper reported that the tools put in place to co-opt new forms of media were ‘‘recognized as so effective that [the Kremlin] insiders send these weapons outside—to the Americans and European audiences.’’ This may mark the beginning of Putin’s move to institutionalize a more sustained and permanent state of information confrontation with the West. Russia also used these external operations to further develop its toolkit for information warfare. Central to these efforts included what many experts agreed was the development of a hybrid warfare doctrine, as articulated by the chief of the general staff of a Russian Armed Forces general, Valery Gerasimov, in 2013. Gerasimov argued that asymmetric approaches to dealing with conflict, including the use of ‘‘political, economic informational, humanitarian, and other nonmilitary measures,’’ have grown and in many instances have ‘‘exceeded the power of force and weapons in their effectiveness.’’ He further discussed how hybrid warfare tactics, including what he termed ‘‘informational actions,’’ can nullify the enemy’s advantage and reduce its fighting potential. 

One of his conclusions was ‘‘that it is necessary to perfect activities in the information space,’’ including the defense of our own objectives. About the same time, in August 2013, RT, which is a Russian television station, reported on Russian plans to create a new branch of the military that would ‘‘include monitoring and processing external information as well as fighting cyber threats.’’ In the article, Putin acknowledged that information attacks are already being applied to solve problems of a military and political nature and that their striking force may be higher than those of conventional weapons. Based on RT’s reporting and observations of the GRU’s activities, it is clear that Russia has created ‘‘information warfare troops’’ with no parallel in the United States. These GRU units combine the arts of technical cyber operations with psychological manipulation. Malcolm Nance, a former U.S. naval intelligence officer, characterized the GRU as ‘‘the armed forces of Russia and the intelligence apparatus that does reconnaissance, surveillance, and . . . strategic cyber operations.’’ Russian security services expert Mark Galeotti explained: [H]istorically, the GRU has been Russia’s main agency for operating in uncontrolled spaces, which mean civil wars and the like. 

In some ways, the internet is today’s uncontrolled space. In hindsight, we can trace Russia’s development and conduct of its information warfare campaign against perceived foreign threats from its neighbors and the West. These campaigns generally progressed along three major lines of effort, all of which benefited from advances in technology from the Soviet days. First, the campaigns involved overt propaganda and disinformation, much of it carried out on Russian state owned media, such as RT and Sputnik. The second line of effort involved covert cyber attacks, including hacking and weaponizing stolen information. The third line of effort in the Russian information campaigns involved weaponizing the internet, particularly social media networks, to amplify messages to a vastly greater audience and promote themes that advanced Russia’s strategic interests. While Russia’s technical and psychological capabilities grew over time, the outlines of the Russian information warfare playbook were evident during Russia’s invasion of Ukraine in 2014 and during the United Kingdom’s Brexit debate the following year, but we largely did not understand the extent of these operations and the threat to our national security and that of our allies and partners. 

Our collective failure to understand the pattern of Russian information warfare emboldened Putin. The Kremlin’s tactics and techniques were further refined and deployed in the Russian information campaign against the U.S. Presidential election in 2016. Starting in 2014 and 2015, Putin turned his information arsenal first on the near abroad, deploying information warfare operations against Ukraine during the conflict over Crimea and eastern Ukraine. Russia used Ukraine as a testing laboratory for experimenting with new tactics of information warfare through cyber space and social media. 

The impetus for Russian intervention in the Ukraine arose in response to domestic unrest which caused the Russian-backed Ukrainian President to flee the country. Events tipped off when Ukrainian President Viktor Yanukovych signaled he was no longer willing to continue efforts to integrate Ukraine with the West, which had broad public support. Instead, he accepted a Kremlin offer of a $15 billion bailout for Ukraine and a deal on gas imports. 

Protests broke out, which grew into what was known as the Maidan revolution. The numbers and strength of the protests alarmed the Kremlin. Putin wanted to ensure Ukraine stayed in Russia’s sphere of influence. He deployed hybrid warfare, including a full scale information warfare campaign, to force the Ukrainian people back in line. The goal of the information warfare campaign was to convince the people of Ukraine that they were in imminent danger from fascists and Nazis who were taking over the country and committing atrocities on their fellow citizens.

The Kremlin deployed all three lines of effort that I laid out for their information warfare campaign against Ukraine—a barrage of overt propaganda and disinformation; cyber attacks, including weaponizing stolen information; and the manipulation of the internet and social media platforms. These efforts sowed fear and magnified mistrust toward the Ukrainian Government, which the Kremlin was able to exploit for the seizure of Crimea and to achieve other Russian strategic interests. The Russian campaign deployed a significant volume of propaganda and disinformation against Ukraine to magnify a climate of fear and distrust amongst the Ukrainian people. Examples include photos doctored to look like scenes of carnage from Ukraine, fake stories of dead children caught in the crossfire, supposed attacks on Jewish Ukrainians who were forced to flee the country, and, allegedly, a 3-yearold who was crucified by Ukrainian soldiers.

The messages also portrayed the Russians as the Ukrainian people’s saviors and that Russia had to intervene to help restore order. The second line of effort—covert military operations in cyber space— was also deployed as a Russian campaign against Ukraine. At the time, attacks against Ukraine were described as coming from Cyber Berkut, which the U.K. Government’s National Cyber Security Centre has recently announced ‘‘is almost certainly’’ the same branch of the GRU that infiltrated the Democratic National Committee. The GRU forces responsible for these ‘‘hack-and-weaponize’’ information operations were later named by their unit numbers in Special Counsel Mueller’s July 2018 indictment and have been given many names, including Cyber Berkut, Fancy Bear, and Advanced Persistent Threat (APT) 28. 

In the spring of 2014, as Ukraine held its Presidential election, Cyber Berkut penetrated Ukraine’s Central Election Commission, directly altering the nationwide Presidential vote tallies in favor of Russia’s preferred candidate. The Ukrainian officials caught the change before the results were announced, although it was broadcast on Russian news that the Russian-backed candidate had won, sowing doubt on the validity of the election and magnifying distrust in the Ukrainian Government. Seeing as how they couldn’t change voting tallies and fully get away with it, Russia’s tactics evolved to try to change people’s minds about whom to vote for or make the public so distrustful of the system that they wouldn’t vote at all. 

These same units began to steal private information through cyber intrusions on Ukrainian Government and political officials and weaponize it by posting it on the internet. As the Defense Intelligence Agency noted in the ‘‘Russia Military Power’’ report from 2017, the intent of publicizing the stolen information was ‘‘to demoralize, embarrass and create distrust of elected officials.’’ A third line of effort by the Russian campaign focused on leveraging cyber space to reinforce and amplify their messaging, which was carried out by the GRU and Kremlin-linked troll organizations. While these efforts were often unsophisticated, this may have been the first time that organizations embarked on wide-scale social media campaigns to amplify information warfare beyond Russia’s borders. 

The Washington Post reported, based on internal Russian military documents, that the GRU fabricated numerous accounts on social media after Ukrainian President Yanukovych fled in 2014. These accounts on Facebook and the Russian version of Facebook, known as VK, posed as ordinary Ukrainians who were against the Kiev protests. They preyed on people’s emotions, magnifying fear and distrust. One example of a message posted by the GRU from a fraudulent social media account was ‘‘brigades of Westerners are now on their way to rob and kill us. . . . Morals have been replaced by thirst for blood and hatred toward anything Russian.’’ The same GRU unit was also responsible for the creation of the fictitious persona ‘‘Ivan Galitsin,’’ who placed pro-Kremlin comments on English language websites. 

The intercepted Russian military documents also detailed how the GRU created four fraudulent groups on Facebook and its Russian equivalent to support its campaign in Crimea and used paid Facebook ads to increase traffic to their fraudulent sites. Subsequent reporting by the Washington Post uncovered the specific GRU unit—54777. The GRU unit responsible for this operation bragged to their superiors that these 4 groups alone received at least 200,000 views. All of these tactics would appear in later information warfare campaigns. 

This information warfare campaign against Ukraine also appears to be one of the first uses of a complementary social media effort—deploying Kremlin-linked trolls—against the population of a foreign country to enhance and amplify the GRU operation. A close Putin crony, Yevgeny Prigozhin, founded and funded the operation—known as the Internet Research Agency and its related companies—to amplify the Kremlin’s messages across social media platforms. According to a Russian press report in 2014, during the Ukraine operations, the Internet Research Agency was employing about 250 people to engage in online discussions ‘‘with a goal to undermine the authority of Ukrainian politicians and post hate speech and fake stories, thus shifting attention from the real events.’’ Copying the model that the Kremlin developed to manipulate its own citizens, these fake Ukrainian personas would pretend to be regular, local Ukrainian people and slip in politically charged messages. 

BuzzFeed detailed one such campaign entitled ‘‘Polite People’’ which ‘‘promoted the invasion of Crimea with pictures of Russian troops posing alongside girls, the elderly, and cats.’’ The trolls used innocuous pictures to gain a group of followers; then they were easily able to pump out pro-Kremlin messages to readymade audiences. Although the tactics were relatively simplistic—both for whom they were trying to reach and the technical aspects of their campaign—the Kremlin information warfare campaign appeared largely successful against Ukraine and contributed to the Kremlin’s seizure of Crimea. 

Indeed, Gen. Philip Breedlove, then head of the U.S. European Command and NATO Supreme Allied Commander Europe, warned at the time that Russia was ‘‘waging the most amazing information warfare blitzkrieg in the history of information warfare.’’ Even as these information operations overwhelmed Ukraine, the potential threat they posed to Western societies was largely unrecognized, and calls for help in combatting these types of campaigns—including manipulation of social media—went unanswered. 

The Washington Post reported last October that high-level Ukrainian officials, including President Poroschenko, personally appealed to Facebook’s Mark Zuckerberg in the spring of 2015. One of his deputies stated that they told Facebook: ‘‘I was explicitly saying that there were troll factories, that their posts and reposts promoted posts and news that are fake. . . . Have a look.’’ Facebook officials failed to take these pleas seriously and in 2015 declined President Poroschenko’s request to open a Facebook office in Kiev to address the problem. In a foreshadowing of events in the United States, Facebook failed to imagine the significant impact these campaigns could have on Ukrainian politics and security.

Our government, too, failed to realize the full extent of the threat. While we have been able to uncover a lot about Russian attacks on Ukraine, we have not been able to piece together the full picture of what Russia perpetrated against the United Kingdom in connection with the spring 2016 referendum on whether the United Kingdom should leave the EU, commonly known as Brexit. UK members of Parliament and others investigating these attacks have been able to piece together evidence that the Kremlin mounted an information warfare campaign to encourage and amplify anti-EU sentiment in the run up to voting day. However, because these investigations are limited to their committees of jurisdiction and there is no equivalent to the U.S. special counsel’s investigation pulling the disparate pieces of information together, we have yet to understand the full picture of what the Russians perpetrated against the British people. 

What we have learned so far indicates that the Kremlin appeared to run a more sophisticated campaign against the British people than the attacks it perpetrated against Ukraine. In this operation, the Kremlin was pushing one side of the argument, as they were in Ukraine, but they showcased increased psychological complexities in their attacks. This campaign focused on targeting segments of the British population that would likely be frightened by threats of increased immigration, particularly from Muslim-majority countries. 

The Kremlin and Kremlin-linked actors also pushed messages that the EU was corrupt and had little accountability to the people of the United Kingdom, which magnified feelings of mistrust of the EU. The first line of effort for this Kremlin information warfare campaign and the one that the West was able to track and analyze was propaganda and disinformation. The Kremlin unleashed a slew of overt Russian propaganda in English, advanced on TV and the internet by Kremlin-controlled media outlets. 

A United Kingdom parliamentary inquiry on disinformation cites 261 articles on RT and Sputnik with a heavy anti-EU bias in the 6 months prior to the referendum. These outlets advanced a steady drumbeat of stories stressing the continued dangers as long as the United Kingdom remained part of the EU’s so-called ‘‘open borders.’’ This included disinformation intended to magnify fear by alleging that British women would be subject to increased attacks from dangerous Muslim immigrants. It has yet to be determined whether the second line of effort—covert GRU operations in cyber space—was deployed as part of the Russian campaign promoting Brexit. It does not appear that hacking and weaponizing stolen data was deployed in connection with Brexit. However, as detailed in a separate parliamentary inquiry, on the night of the Brexit referendum, there was a suspicious crash of the voter registration website likely attributed to denial-of-service attacks. The timing of this attack appears consistent with other GRU covert cyber attacks, which aim to take key infrastructure or information offline at crucial times to advance Kremlin objectives. 

This crude information warfare tactic has been tied to GRU in previous operations, particularly Eastern Europe. Further, the UK Government has been able to tie the GRU to other cyber attacks, including attacks on a United Kingdom television station and the United Kingdom foreign office. If these Russian actors were culpable in this denial-of-service attack, then it would fit with the Russian playbook. The third line of effort, the use of cyber space to amplify and reinforce messaging, featured prominently in the information warfare campaign relating to Brexit. While we don’t know what role, if any, the GRU played in this line of effort, we have been able to identify a sustained campaign on social media against the British public by Kremlin and Kremlin-linked actors. 

These attacks included the use of trolls and automated bots amplifying pro-leave messages ahead of the date of referendum. The New York Times reported that tweets from the Russian accounts ‘‘sought to inflame fears about Muslims and immigrants to help drive the vote.’’ Tweets surged in the last days of the campaign, spiking from about 1,000 tweets a day to 45,000 tweets in the 48 hours prior to the polls closing. In the final days before the referendum, less than 1 percent of Twitter users accounted for one-third of all the conversations surrounding the issue, showing that these actions were artificially boosting the pro-leave messages to increase viewership size. Joint analysis from Swansea University and the University of California, Berkeley, concluded that the attacks emanated from 150,000 Russian-based accounts and that their tweets were viewed hundreds of millions of times. It must be noted that Russian amplification efforts in connection with Brexit also received a boost from local surrogates in the UK. 

One pro-leave local surrogate was Nigel Farage, then leader of the rightwing populist UKIP Party. Whether unwittingly or not, Farage echoed aspects of Russian propaganda, including lending his voice to stories broadcast on Russian propaganda channel RT. Farage was also often quoted in Russia media articles, including when he warned that British women could be at risk of mass attacks of gangs of migrants due to ‘‘big cultural issues’’ should Britain choose to remain in the EU, again, echoing the message that Russian agents and authorities were promoting. Here, too, it seems we have just begun to scratch the surface of our understanding about what the Kremlin was doing, including how they had insight into whom to target with their information warfare campaign. 

Member of Parliament Damian Collins, who is leading an investigation into Russian disinformation connected to Brexit, fears that what we know at this point about the extent of the Russian attack against the British people ‘‘may well be just the tip of the iceberg.’’ We can’t point with all certitude to whether the Kremlin’s information warfare campaign made a difference in the outcome of the vote. However, we know that those who voted to leave the EU won by a small margin. It was a stunning upset that no one expected, let alone then-Prime Minister Cameron. He cited the outcome as the reason for his resignation. The Kremlin has also turned these weapons on the United States. The most prominent example was the sustained, multipronged information warfare campaign deployed against the American people, as I stated, during the 2016 Presidential election. 

While the Kremlin’s information warfare campaign against Ukraine and Brexit supported and amplified one side of an issue For this operation Russia showed increased technical and psychological advances by targeting multiple aspects of contentious issues to advance the Kremlin’s objectives. Grievances about race, religion, immigration, social justice, and even U.S. institutions writ large were woven into anti-Clinton, pro-Trump fabric. These efforts were a toxic mix, trying to poison Clinton’s candidacy, promote Trump’s favorability, taint the electoral process, and weaken democratic institutions altogether. Similar to the information warfare campaign against Brexit, we are still trying to get a full picture of how Russia attacked us during the 2016 election and, particularly, the role that the GRU played. But what is now clear is that the Kremlin’s information warfare campaign regarding the 2016 election was not neutral or even-handed in its messaging on Clinton compared to that of President Trump. 

As affirmed in the intelligence community’s January 2017 assessment, in their words: ‘‘Putin ordered an influence campaign in 2016 aimed at the U.S. presidential election, the consistent goals of which were to undermine public faith in the U.S. democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency.’’ They also assessed, in their words, that ‘‘Putin and the Russian Government developed a clear preference’’ for President Trump. Similarly, Special Counsel Mueller’s February indictment against the Kremlin-linked troll operation found that the Russians ‘‘engaged in operations primarily intended to communicate derogatory information about Hillary Clinton, to denigrate other candidates such as TED CRUZ and MARCO RUBIO, and to support BERNIE SANDERS and the candidate Donald Trump.’’

The clear anti-Clinton and Pro Trump themes in Russia’s efforts aligned with Russian strategic interests. As mentioned earlier, Putin blamed Hillary Clinton for protests in Russia in December 2011. Weakening Clinton as a candidate would reduce the perceived threat to Putin’s grip on power from a Clinton Presidency. President Trump, on the other hand, offered Russia a freer hand in conducting its affairs. Similar to Brexit, the Russian information warfare campaign against the American people in 2016 demonstrated a high degree of sophistication in targeting susceptible groups of Americans, potentially including the use of data analytics. We are still learning details of how the Russians were able to build an audience for its information warfare attacks and whether they had any help from any Americans.

However, Justice Department indictments, including those from the special counsel, and two reports commissioned by the Senate Intelligence Committee analyzing data provided by social media companies are providing a better picture of the information warfare campaigns against us. One of those reports, a joint study by Oxford University and the social media analytics firm Graphika, assessed that the Kremlin-linked troll organization was able to segment users into different groups based on ‘‘race, ethnicity, and identity.’’ Once they categorized people in such a manner, they tailored ads to entice users to engage with their fraudulent accounts and pages. This process engineered messages to manipulate and polarize receptive audiences. 

The other study commissioned by the Senate Intelligence Committee, a collaboration between the social media research firm New Knowledge, Columbia University, and Canfield Research, confirms this idea, detailing how specific ethnic and Russian groups were targeted. Their analysis concluded that these operations were directed overwhelmingly at African Americans. As the Washington Post technology reporter Craig Timberg explained, social media companies created this technology and, in the process, have ‘‘atomized’’ us into different categories and put us into a ‘‘thousand different buckets.’’ The Russians co-opted this American technology, just as they have exploited other aspects of our open society and democratic system, and weaponized it against us. Similar to campaigns in the past, this information warfare operation followed the three established lines of effort as detailed in the intelligence community’s January 2017 assessment. The Kremlin’s campaign ‘‘followed a longstanding Russian messaging strategy that blends covert intelligence operations—such as cyber activity—with overt efforts by Russian Government agencies, state-funded media, third party intermediaries and paid social media users or trolls.’’ 

The first line of effort involved overt propaganda and disinformation focusing on a number of themes that advanced Russia’s strategic interest. Having tested their methodology in previous campaigns, including in Ukraine and Brexit, the Russians had an arsenal of tried-and-tested methods of influence they deployed in the U.S. Presidential election to maximize fear and distrust. Propaganda and disinformation to stoke these negative emotions were pumped out by Kremlin-funded channels RT and Sputnik. They sought to flood an unsuspecting

American public with stories portraying Secretary Clinton as untrustworthy and dangerous, thus amplifying negative feelings toward her. Articles painted Clinton as a warmonger who would lead the United States into future conflicts or alleged that she was of ill health and hiding her condition from the public. Additional reports were aimed at bolstering the perceptions that she was not trustworthy and accused her of nefarious dealings detailed in the emails she deleted as a cover up of her so-called ‘‘crimes.’’ A third group of accounts alleged that Clinton used her high-ranking position as Secretary of State to enrich her family foundation with foreign donations by engaging in quid quo pro schemes. 

In contrast, Kremlin-funded media pushed positive stories about President Trump, promoting him as a pragmatist who understood that the United States needed to stop interfering in the internal affairs of other countries. An additional widely used theme, which sought to maximize feelings of distrust and ran through much of what Kremlin media broadcast, revolved around corruption in the United States, American hypocrisy, and that our elections were rigged and fraudulent. Painting the American political system as unfair, biased, and tainted served Putin’s strategic interests, allowing the Kremlin to counter pro-democracy forces within Russia by asserting a moral equivalence between a ‘‘flawed’’ American democratic system and his autocratic rule of Russia. 

The second line of effort in the Kremlin’s information warfare playbook, covert Russian operations in cyber space, repeated tactics used against Ukraine but this time with greater sophistication. In particular, the Kremlin and Kremlin-linked actors engaged in hacking and weaponizing the release of stolen data. From what our intelligence community, the Department of Justice, and FBI have compiled, it appears that the GRU undertook the largest share of this aspect of the information warfare campaign, with complementary efforts undertaken by the FSB. The special counsel’s indictment from July 2018 detailed how the GRU ‘‘intentionally conspired . . . to gain unauthorized access into the computers of U.S. persons and entities involved in the 2016 election, steal documents from those computers and stage releases of the stolen documents to interfere with the 2016 U.S. presidential election.’’ As we now know, two of the main targets of this operation were the DNC and Clinton campaign chairman, John Podesta. 

Press reports indicate that approximately 50,000 emails and documents were stolen. Once in possession of these stolen documents, the GRU repeated its playbook from the earlier campaigns. It sought to weaponize the hacked information by releasing it in a manner and at key times when it could cause the most damage, while concealing Russia’s role in the process. As the Mueller indictment against the GRU describes, ‘‘They did so using fictitious online personas, including ‘DCLeaks’ and ‘Guccifer 2.0.’’’ The Mueller indictment from last July further detailed the GRU’s use of fake persona, Guccifer 2.0, which the GRU falsely claimed was a Romanian hacker. Guccifer 2.0 released stolen documents and was active in promoting so-called ‘‘exclusives’’ of stolen information as a way to launder it to third parties, including journalists from traditional media outlets. The GRU’s covert efforts also took advantage of a willing amplifier, WikiLeaks. 

WikiLeaks had an established reputation for spilling State secrets, including those of the U.S. Government and military. WikiLeaks also offered a ready-made audience and had an understanding of how to time releases for political impact. Indeed, according to the Mueller indictment, the GRU, posing as Guccifer 2.0 ‘‘discussed the release of the stolen documents and the timing of those releases’’ with WikiLeaks ‘‘to heighten their impact on the 2016 presidential election.’’ WikiLeaks released the stolen documents during the Democratic National Convention to cause conflict between Clinton and Sanders supporters at a time when many Americans were very likely to be paying attention. WikiLeaks also released documents in the last few weeks of the election, again, when the Nation was very likely to be following campaigns.

The first release of stolen emails from the Clinton campaign chairman, John Podesta, coincided with a warning from the Department of Homeland Security and Office of the Director of National Intelligence in October 2016 about Russian attacks against our election. It also occurred on the same day as the release of the Trump ‘‘Access Hollywood’’ tape. These efforts, too, suggest a high level of sophistication that hadn’t been seen in earlier Russian influence campaigns. 

The third component of the Russian information warfare campaign, message amplification and reinforcement through social media, was deployed in parallel with the other lines of effort to achieve an unprecedented impact. While we don’t know the full extent of the GRU’s involvement, the Mueller indictment revealed that an entire military intelligence unit—74455—was active in this line of effort. In his July 2018 indictment, the special counsel explained that unit No. 74455 assisted in the promotion of the released stolen material ‘‘and the publication of Anti-Clinton contact on social media accounts operated by the GRU.’’ That includes the site DCLeaks, which was, in fact, established by the GRU. It went live in early June 2016, posing as a site run by American hacktivists, promising to ‘‘expose the truth’’ about U.S. politicians. The GRU even created a DC  Leaks Facebook page, authored by the fictitious U.S. woman Alice Donovan, which sought to drive traffic to its site. 

The July indictment further details how the GRU used additional fake accounts posing as Americans named Jason Scott and Richard Gingrey to promote the DCLeaks site. Before it was shut down in March of 2017, the DCLeaks site was viewed over a million times. The GRU also used social media to magnify fears about Hillary Clinton. The July indictment from the special counsel revealed that the GRU was the true operator behind the fraudulent Twitter account @BaltimoreIsWhr [Baltimore is War], which encouraged U.S. audiences to ‘‘[j]oin our flash mob’’ opposing Clinton and to share images with the hashtag ‘‘Blacks Against Hillary.’’ In addition to the GRU’s weaponizing social media against the United States, there was a complementary effort from the Kremlin-linked troll organization, the Internet Research Agency. 

By the 2016 U.S. Presidential election, the deployment of the troll organization appeared to be a standard part of the Kremlin’s playbook. The October 2018 indictment of the Internet Research Agency’s accountant in the Eastern District of Virginia provides additional confirmation of the troll organization’s role in the information campaign. The indictment confirms the existence of the Agency’s operation known as Project Lakhta—since at least May of 2014—and notes that this project targeted Ukraine, Europe, and the United States with a stated goal in the United States to ‘‘spread distrust toward candidates for political office and the political system in general.’’ Social media researchers, including P.W. Singer, have also noted how some of the same trolls were repurposed for different operations.

The accounts that pretended to be Ukrainian then posed as British citizens and then as Americans as the focus of attacks shifted over time. Against the United States, the troll operation capitalized on issues of importance to groups inside American society to magnify fear and distrust in ways that aligned with the Kremlin strategic interest of hurting Clinton and helping President Trump. As the special counsel’s February indictment detailed, ‘‘These groups and pages, which addressed divisive U.S. political and social issues, falsely claimed to be controlled by U.S. activists when, in fact, they were controlled by [Kremlinlinked trolls].’’ 

The indictment further asserted this was the manner in which the troll organization reached ‘‘significant numbers of Americans for the purpose of influencing the Presidential election of 2016.’’ The report prepared for the Senate Intelligence Committee by New Knowledge, Columbia, and Canfield Research that analyzed certain data from social media companies identifies a number of tactics employed by the Internet Research Agency in its assault on the 2016 election. These include building brands across platforms, including Twitter, Facebook, YouTube, and Instagram; deploying or repurposing popular memes to spread propaganda; reinforcing key themes by resharing the same story across multiple accounts; impersonating local media on Twitter and Instagram to win the trust of Americans in their local news; and amplifying conspiratorial narratives among both left- and right-leaning audiences. As I mentioned, the report found that one of the troll organization’s concerted lines of attack was against African Americans. These efforts, however, went beyond just trying to sow discord and reinforce fears about Clinton.

Campaigns against African-American groups were pushed across Twitter, Facebook, Instagram, and YouTube with the goal of suppressing voter turnout ‘‘through malicious misdirection, candidate support redirection and turnout depression.’’ Kathleen Hall Jamieson, a scholar who studies political campaigns, examined polling data throughout the campaign and documented similar tactics at disenfranchisement in her recent book, including fake ads that encouraged minority viewers to text or tweet their support for Clinton rather than to vote at the polls or to rally support for other candidates in the race. These efforts may have been particularly effective in peeling off voters who would have been likely to vote for her candidacy. 

They also may have influenced undecided voters at a key time. Polls in the final month of the campaign showed a marked drop in the number of Americans saying they intended to vote for Secretary Clinton. The reports prepared for the Senate Intelligence Committee highlighted that Twitter was an important component of the attacks Kremlin-linked troll organizations deployed against the American people. The nearly 4,000 inauthentic Russian Twitter accounts, like their Facebook counterparts, promoted messages related to divisive social issues, such as gun control, race relations, and immigration. The troll organization also deployed bots, or automated accounts, to amplify messages and drive traffic to specific Facebook pages, Kremlin propaganda sites, or other targeted websites. 

The Kremlin-linked troll operation went into overdrive on election day with strategic messaging that mimicked the spike in activity on Twitter during the Brexit referendum. According to the Daily Beast, Kremlin-linked trolls began a ‘‘final push’’ and used ‘‘a combination of high-profile accounts with large and influential followings and scores of lurking personas established years earlier with stolen photos and fabricated backgrounds’’ to send ‘‘carefully metered tweets and retweets voicing praise for Trump and contempt for his opponent from the early morning until the last polls closed in the United States.’’ 

As the recent studies commissioned by the Senate Intelligence Committee illuminate, the information warfare campaign against the American people was an extensive, widespread, coordinated effort across many social media platforms, both big and small. The increased sophistication of the troll organization’s techniques on social media provided a relatively low-cost but highly effective method of influencing the American public. For example, these trolls spent only $100,000 on 3,000 ads on Facebook. While this may seem like a small amount compared to the millions of dollars spent on the Presidential campaign, the impact and reach of these Kremlin ads, once amplified through these Russian operations, was extensive. 

While Facebook estimates that approximately 126 million Americans saw Kremlin-linked messages, Jonathan Albright, the research director for Columbia University’s Tow Center for Digital Journalism, extrapolated that they could have been shared hundreds of millions and, perhaps, many billions of times. Kathleen Hall Jamieson concluded that the widespread reach of the troll organization’s disinformation ‘‘increases the likelihood’’ that the Russian activities changed the outcome of the election. A study from the Ohio State University on propaganda and disinformation affirmed Hall Jamieson’s assessment and concluded Russian information warfare attacks ‘‘most likely did have substantial impact on the voting decisions of a strategically important set of voters— those who voted for Barack Obama in 2012. Indeed, given the very narrow margins of victory by Donald Trump in key battleground states, this impact may have been sufficient to deprive Hillary Clinton of a victory in the Electoral College.’’ That is their conclusion. 

As with the Brexit campaign, the Russian information warfare campaign during the 2016 election was aided by others who, either wittingly or unwittingly, helped to advance Russia’s strategic objectives. Among these were major American news outlets, which covered much of what was in the WikiLeaks disclosures. They treated it as legitimate news without reminding viewers of how the information was obtained or that it was being pushed by a foreign adversary. Thomas Rid, a professor of security studies at King’s College, testified to the Senate Intelligence Committee in March of 2017 that the journalists functioned as ‘‘unwitting agents . . . who aggressively covered the political leaks while neglecting or ignoring their provenance’’ or, as Kathleen Hall Jamieson concludes, the American media ‘‘inadvertently helped [the Russians] achieve their goals.’’ Further, as in the Brexit campaign, a number of local surrogates appeared to echo the Kremlin messages. This included associates of the Trump campaign and even the President himself. 

He boasted of his love of WikiLeaks at least 124 times in the last month of the election alone and even tweeted a link to access the stolen disclosures from WikiLeaks. According to the Washington Post, at least five close Trump associates, albeit perhaps unknowingly, retweeted messages from Kremlin-linked troll accounts, including the account @Ten—GOP, a Russian fake handle that impersonated the Tennessee Republican Party. The President and his campaign also used talking points that were similar to Russian propaganda and disinformation, including disparaging Secretary Clinton’s health and accusing her repeatedly of being ‘‘crooked.’’ The President encouraged Russia, in many respects, to continue these activities. From what we know from the July indictment from the special counsel, the night that Trump called on the Russians to hack her emails, the GRU did, in fact, attack the server that housed Clinton’s personal accounts. 

As journalist and legal analyst Jeffrey Toobin characterized it, ‘‘All of these separate [Russian] efforts are completely aligned with Donald Trump’s interests, often word for word.’’ Some have argued that despite this extensive and sophisticated Russian influence campaign, there was no effect on the outcome of the election because no vote tallies were changed. While we may never know definitively what the actual impact of the Kremlin’s operation was, it is hard to believe that the Kremlin would mount a sustained, multiyear information warfare campaign against our democratic institutions if it had no reason to expect that it would have an impact. 

To the contrary, based on its experience in Ukraine, Brexit, and elsewhere, the Kremlin had every reason to believe that it could successfully influence the outcome of the 2016 election with minimal risk of being discovered or suffering retaliation. As I have laid out, Russia is engaged in a sustained information warfare campaign against the United States, our allies, and partners. This Russian interference can’t be dismissed as a one-off operation. As Deputy Attorney General Rod Rosenstein told the Aspen Forum last July, the Russian effort to influence the 2016 Presidential election is ‘‘just one tree in a growing forest. Russian intelligence officers did not stumble onto the idea of hacking American computers and posting misleading messages because they had a free afternoon. It is what they do every day.’’ Our intelligence community assessed in January 2017 that the campaign against us represented a ‘‘new normal’’ in Russian influence efforts in which ‘‘Moscow will apply lessons learned from its campaign aimed at the U.S. presidential election to future influence efforts in the U.S. and worldwide.’’

Russian information warfare operations have a real and ongoing impact on our national security. Russia has not paused its information warfare operations since the 2016 election, and, in fact, the level of Russian operations has increased since then. As John Kelly, the founder of Graphika, a social media intelligence firm, who testified to the Senate Intelligence Committee in August and who collaborated on one of the reports for the Senate Intelligence Committee I discussed earlier, stated: ‘‘After election day, the Russian government stepped on the gas . . . confirming again that the assault on our democratic process is much bigger than the attack on a single election.’’ This idea was confirmed by data in both his report and the other report commissioned by the Senate Intelligence Committee on the Kremlin-linked troll organization. 

The report done by New Knowledge, Columbia University, and Canfield research noted that the Kremlin-linked troll organization went after those who are investigating Russian information warfare and other malign influence activities in the United States, including attempts to label Russian interference in the election as ‘‘nonsense’’ and casting former FBI Director James Comey and Special Counsel Mueller as corrupt. We don’t have to look too far for other examples of Russia’s ongoing campaign against the American people and our allies and partners. 

Kremlin-linked troll operations flooded Twitter with messages that were intended to sow division and disinformation in the wake of numerous controversies, including the tragic shootings in Las Vegas and Parkland, FL, and during the Kavanaugh confirmation hearings. Last September, we learned from an indictment in the Western District of Pennsylvania that GRU officers, including some agents who were previously indicted by Special Counsel Mueller, attempted information attacks against prominent world organizations, including those who were investigating Russian malign influence activities. It is now clear that Russian information operations also targeted the 2018 midterm elections. 

The October indictment from the Eastern District of Virginia details an ongoing and advanced operation to influence the American electorate up through 2018. As the indictment states, this campaign ‘‘has a strategic goal, which continues to this day, to sow division and discord in the U.S. political system.’’ The indictment also details how Russian troll operations are using U.S.-based virtual private networks, or VPNs, paid for with Bitcoin through multiple bank accounts, to disguise the origin of Russian messaging on social media. The sophistication of these operations continues to increase. 

The Internet Research Agency has a dedicated ‘‘search engine optimization’’ department that is devoted to manipulating social media search algorithms to advance the goals of Russian troll operations. The troll organization spent millions of dollars annually in 2017 and 2018 and is still buying ads on Facebook and Instagram. These operations continue to cover a broad range of divisive issues, and as the indictment details, the organization’s employees are instructed on strategies and guidance for targeting particular audiences with carefully tailored messages. Despite efforts by Facebook and Twitter to eliminate inauthentic accounts, there are still thousands of active social media and email accounts appearing to be U.S. persons when they are, in fact, Kremlin-linked trolls that are acting as part of an information warfare campaign. 

Last February, in testimony before the Armed Services Cyber Subcommittee, Russia expert Heather Conley warned that Russian information warfare campaigns in 2018 and 2020 will adapt and ‘‘look more American, and [it] will look less Russian.’’ The New Knowledge, Columbia University, and Canfield research study notes that we need to be on the lookout for increasingly sophisticated operations, including ‘‘increased human-exploitation tradecraft and narrative laundering.’’ The technology already exists to create ‘‘deepfakes,’’ false videos of real people saying or doing things that are damaging. Advances in artificial intelligence are enabling rapid, automated responses on social media that mimic authentic accounts. 

We are still gathering data about information warfare attacks, including the 2018 midterms. Between the indictments I referenced and the additional Kremlin-directed troll operations discovered by Facebook in conjunction with our Intelligence Committee, the FBI, and DHS, we seem to be getting better at responding to the types of attacks perpetrated against United States in 2016, but that is no indicator that we have become better at anticipating future attacks. The Director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency warned last November that ‘‘the [2018] midterm is . . . just the warm-up or the exhibition game. . . . The big game . . . for the adversaries is probably 2020.’’ I want to thank my colleague for being generous and patient with my presentation, but I do want to make, I think, an important and concluding point that ties in directly with what is going on right now. 

To read the rest of the speech, please see part 2.