What the latest legal action in the United States reveals about the Russian influence operations

On October 19, the U.S. Department of Justice filed a criminal complaint against the Russian woman accused of acting as chief accountant of a number of entities including the Internet Research Agency, also known as the “troll farm” in St. Petersburg.

The troll farm carried out a covert influence campaign targeting the U.S. from 2014 to 2018, including the 2016 presidential election. It worked across social media to promote divisive, inflammatory, and politically charged content, widening America’s social and political divides.

Much has been reported on the troll farm, and credit is due to researchers and journalists, especially investigative journalists in Russia.

The criminal complaint against Elena Khusyaynova, based on an affidavit by FBI Special Agent David Holt, provides startling new granularity on the troll farm’s operation and funding. The complaint also provides new examples of the troll farm’s editorial policy, which included extremely nuanced and intimate understanding of American society, politics, and the vulnerable divisions within.

Catering Connections

The criminal complaint contends that Khusyaynova served as the chief accountant for an effort called “Project Lakhta”.

The complaint explained her role in detail.

She managed the budgeting and payment of expenses associated with social media operations, web content, advertising campaigns, infrastructure, salaries, travel, office rent, furniture, and supplies, and the registration of legal entities used to further Project Lakhta activities.

Project Lakhta was an umbrella organization that incorporated a number of separate legal entities, including the Internet Research Agency and other companies. The main companies that Project Lakhta billed to were Concord Management and Consulting, LLC and Concord Catering. While it may seem strange for a catering company to be in the media and influence business, it is owned by Russian oligarch Yevgeny Prigozhin.

Prigozhin was indicted in a case entitled United States of America v. Internet Research Agency brought forward on February 16, 2018 by Special Counsel Robert Mueller. In fact, on the same day that her colleagues were originally indicted, Khusyaynova billed an additional amount to Concord of approximately 15 million Russian rubles ($250,000 USD) for Project Lakhta.

In addition to his close proximity to Russian President Vladimir Putin and his successful catering business, which combined to earn him the nickname “Putin’s Chef”, Prigozhin has also reportedly bankrolled the Wagner private mercenary company (PWC), which has taken an active role in military operations in Ukraine and Syria.

Follow the Money

The first financial detail included in the criminal complaint against Elena Khusyaynova showed that between January 2016 and June 2018, Project Lakhta’s proposed operating budget was more than two billion Russian rubles ($35 million USD). In the first half of 2018, the proposed operating budget was 650 million Russian rubles (over $10 million USD).

Put simply, the budget for first half of 2018 nearly matched the total troll farm budgets from 2016 and 2017.

The itemized budget requests, which Khusyaynova allegedly organized, increased every single month in 2018.

Project Lakhta prioritized significant social media budgets in the first half of 2018, including approximately 3.7 million Russian rubles ($60,000 USD) on Facebook advertising and 385,000 Russian rubles ($6,000 USD) on Instagram advertisements. This amount would likely not include money spent on “organic” content, which in this context would be original content spread from troll farm accounts without paid advertising. Approximately 1.1 million Russian rubles ($18,000 USD) was spent on “bloggers” and “developing accounts” on Twitter.

While the budgeting and consequent billing was somewhat frantic, the sheer level of funding and line itemization of items further lifts the curtain on a professional organization operating to spread disinformation at scale. The consistent growth over time, signals that the main funders were seeing a substantial return on investment.

Raising Funds

On at least one occasion, according to the criminal complaint, the troll farm not only spent money, but solicited it. Paragraph 48 stated that the troll farm used one of its most prolific accounts, @CovfefeNationUS, to retweet a post from a Political Action Committee (PAC) asking for funding.

The indictment did not name the PAC, but the archive of troll farm posts shared by Twitter on October 17, 2018, showed that @CovfefeNationUS had retweeted an account called @SendEm_Packing.

@DFRLab found the post and confirmed the source.

The Twitter account linked to a website called SENDTHEMPACKING2018.ORG; as of October 19, 2018, the site was not accessible. A WhoIs search revealed that it had been registered through Domains by Proxy LLC, in Arizona. The Twitter feed had not posted since March 2018.

According to Max de Haldevang, a reporter at Quartz, the call for action did not have immediate results: an online record of PAC donations showed that it received one payment of $250 USD two days later.

https://twitter.com/MddeH/status/1053405769167749121

Editorial Control

The criminal complaint built on the February indictment of troll farm leaders, but it provided substantially more insight into the editorial process and included direct quotes from team members and the management.

Paragraph 26 quoted a “member of the Conspiracy” describing the troll farm’s policy of aggravating conflicts between minorities in America and society at large.

The troll farm’s managers advised their staff on how to target conservative and liberal groups, including which outlets not to share, and how to target “colored LGBT” social media users, calling them “less sophisticated than white.”

Given their location in St. Petersburg, with an eight hour time difference from the East Coast, the troll farm managers gave advice and had apparently optimized timing posts for different audiences, for example “LGBT groups are often active at night.”

What to Share, and How

The indictment listed ten news articles the troll farm’s managers had highlighted for staff with advice on what political capital to make of them. The available evidence shows that the troll farm accounts on Twitter did share some of the articles, but did not follow up with the detailed comments; it was unclear whether they did so on other platforms.

The first was an article from website truepundit.com, featuring comments from the late Sen. John McCain, one of the main targets of Russian and far-right attacks.

Translated from Russian by the U.S. Department of Justice, the troll farm editorial advice was to “brand McCain as an old geezer who has lost it.” According to the Twitter archive, however, none of the troll farm’s accounts shared the post, the URL, or the sentiment.

The second article came from Breitbart, and focused on Speaker Paul Ryan’s reported opposition to President Trump’s immigration cuts.

The Twitter archive showed that one Russian troll farm account, @elizeestr, retweeted a tweet which shared the article, using an automation app called IFTTT.

As of October 19, 2018, the original tweet was still online.

The third article was headlined “11 California Counties Might Have More Registered Voters Than Eligible.” A Google search for that headline returned 12 different websites.

A search for the headline in the Twitter archive yielded no results.

The fourth headline shared an article from Infowars predicting a civil war if Trump were “taken down,” together with troll farm editorial direction to “forcefully support” the thesis, and “name those who oppose the President.”

Six different Twitter accounts run by the troll farm shared this article, but only one commented on it; the other five posted retweets using IFTTT. The one authored post shared the headline with the comment, “ABSOLUTELY YES!!!”

The fifth article misquoted its headline. The criminal complaint text wrote, “Trump: No Welfare To Migrants For Grants For First Five Years.” In fact, it appears to have been citing another Infowars article, which was headlined, “Trump: No Welfare To Migrants For First Five Years.”

The only Russian troll farm account to share the text was @CovfefeNationUS, which retweeted it from self-styled “Conservative news source” @SaveTWest.

https://twitter.com/SaveTWest/status/894193168991866880

The sixth article, a sweeping attack on Special Counsel Robert Mueller, came from a website called wnd.com.

This article was shared six times by Russian troll farm accounts, but all six were retweets of other, non-Russian, accounts, shared by IFTTT.

The seventh article quoted Ana Navarro, a Republican strategist interviewed by CNN, as comparing the Trump White House to a brothel. It appears to have come from a website called libertyheadlines.com. Revealingly, the troll farm manager commanded staff to turn the attack on CNN, rather than Navarro, and to accuse outlets such as the New York Times, Washington Post, CNN, CBS, Time, and Huffington Post, of being “fake news”.

No troll farm accounts appeared to share it on Twitter, although they did post the word “brothel” 147 times in other contexts.

The eighth article attributed to the troll manager came from Breitbart, and attacked Sen. Marco Rubio. This was flagged as “VERY IMPORTANT!” and accompanied by the call to “expose Marco Rubio as a fake conservative who is a traitor to Republican values.”

Despite the apparent importance, only one Russian troll farm account on Twitter shared it, the account called @daniistrs, which retweeted it (via IFTTT) from user @steph93065.

https://twitter.com/steph93065/status/894742518130032641

The troll farm accounts were barely more responsive to the next order, which was to use a Breitbart article to attack Californian “sanctuary cities”.

Only two Twitter troll farm accounts shared this story, both as automated retweets.

The final two articles both came from Fox News, one on a sanctuary city in Maryland, the other reporting a verbal attack on Mitch McConnell, leader of the Senate Republicans.

Two troll farm accounts shared the former, yet again by IFTTT; none shared the latter.

Conclusions

The indictment throws a bright light on the troll farm’s operations. It gives more detail on the operation’s financing and editorial control, and the lackluster performance of many troll farm accounts.

The instructions given were detailed and designed to target individual American communities in an attempt to “aggravate the conflict” between them. The editorial direction gave the troll farm operators a clear narrative to follow.

That said, at least on Twitter, the troll accounts did not oblige. Few shared any of the highlighted articles directly; those which did almost always did so as retweets using IFTTT, indicating that they were automated. This was not the stuff of a highly effective campaign.

It is unclear why the troll farm accounts on Twitter did so little. It may indicate that the action had moved to another platform, after Twitter suspended so many automated and named troll farm accounts in late 2017. It may indicate that the troll farm’s staff had lost motivation, or been replaced.

Elena Khusyaynova is unlikely to see her day in a U.S. courtroom any time soon, as she likely remains in Russia. Outside of the implications of the legal case, the utility of the criminal complaint is that it gives a precise description, apparently in the words of the troll farm’s employees, of what the intention of the ongoing operation was, after the 2016 election: to aggravate the conflict between Americans.

---

Follow along for more in-depth analysis from our #DigitalSherlocks.