Russian trolling 2.0: How the Kremlin shifted tactics from its 2016 election strategy

The recent US indictment of two employees of Russian state-run media network RT underscores a significant shift in the Kremlin’s tactics to influence US elections since 2016, current and former US officials told CNN.

Rather than relying on fake accounts and bogus online personas, the current effort alleged in this week’s indictment involves coopting real American influencers to try to push Russian narratives to US audiences, particularly aimed at undermining support for Ukraine.

The indictment alleges that the RT employees secretly poured nearly $10 million into a Tennessee company that hired prominent right-wing commentators who produced content on hot-button political issues, including Russia’s war on Ukraine. The influencers say they were unaware of any Russian hand in the operations of the media company, which CNN has identified as Tenet Media, and that they controlled their own content.

“Buying authentic influencers is a far better use of funds than creating fake personas, because they bring their own trusting audiences and are actually, you know, real,” Renee DiResta, an expert on online influence operations, said in a social media post.

With its US offices forced to shut down in 2022 following Russia’s invasion of Ukraine, RT has resorted to more covert operations to disseminate its message, prosecutors allege.

That shift shows that Russia’s best bet for undermining US support for Ukraine may lie in capitalizing on influential American voices that bypass the mainstream media and are critical of aid to Kyiv, the sources said.

“The Russians have diversified well beyond the 2016 model,” said Chris Krebs, former head of the federal Cybersecurity and Infrastructure Security Agency. “It’s unclear what the real impact is, at least from a tactical perspective. My sense is that they’re not successful in changing specific behaviors or decisions, like the outcome of a single election,” Krebs said. “However, it’s much more likely that the Russians’ efforts are burning on a longer fuse, and we don’t quite understand the real damage done just yet.”

The shift in Russian tactics also shows a keen understanding of a fractured media environment in the US. Where in 2016, Russian intelligence prioritized leaking hacked information in order to reach mainstream news outlets, they’re now tapping directly into a disparate corner of conservative media, where individual podcasters reach an audience that rivals that of traditional newspapers.

As a result, Russia no longer needs to orchestrate the kind of hack-and-leak operation it used to great effect in 2016, when Russian intelligence officers stole a trove of emails from Democratic officials and leaked them to Wikileaks.

The Russians thought that American media outlets would see Wikileaks as a relatively credible source of information, according to Michael van Landingham, a former CIA official who assessed the 2016 Russian activity.

“But now, in the absence of a current hack-and-leak campaign, Russia has reverted to the age-old tactic of supporting public voices that express views aligned with Russian messaging,” van Landingham said.

Artificial intelligence has also made it much easier for Russian (or any other) intelligence agencies to pose as Americans online with fake photos and bios.

“It’s night and day,” said Emerson Brooking, a resident senior fellow at the Atlantic Council’s Digital Forensic Research Lab. Compared to 2016, this time, “Russian actors showed a far more sophisticated understanding of the US information environment,” Brooking said.

It’s also unclear how useful hack-and-leak operations would be in 2024. Journalists are more attuned to foreign influence efforts, and at least one known operation aimed at influencing this year’s election has had questionable impact.

Iran conducted its own hack-and-leak this summer, stealing documents from the Trump campaign and sending them to multiple major news outlets, as CNN previously reported. But there was little news coverage of the content of the stolen documents, partly because they were unremarkable.

The Justice Department also on Wednesday seized dozens of fake news sites that other Russian companies used to closely mimic the appearance of Fox News and the Washington Post. The Russian companies used ChatGPT, the popular AI tool, to write some of their content, according to an FBI affidavit.

Internal project documents from one of the Russian companies propose targeting US voters in six swing states with disinformation, hitting on themes such as the “risk of job loss for white Americans” and the purported threat of crime from “Ukrainian immigrants,” according to the affidavit.

“They obsessed over impact and set clear targets,” Brooking said.

But measuring the impact and efficacy of Russian influence efforts is difficult. The influencers hired by Tenet Media, including Benny Johnson and Tim Pool, say they were victims of the alleged Russian scheme. They had millions of followers to whom they’ve been broadcasting their views long before, according to the indictment, RT employees invested in Tenet Media.

“I’m skeptical that this operation would have resulted in preaching to anyone who wasn’t already converted,” Gavin Wilde, a former National Security Council official focused on Russia, told CNN.

“It’s mostly a grift cycle,” said Jason Kikta, a former US Cyber Command official now with security firm Automox. “The Russian money lets them expand operations within the ideologically aligned population to further grift, while the Russians can claim fanciful success within their government for budget and career promotion.”