Читать книгу: «The Apprentice»

CHAPTER 2
PUTIN’S TROLLS

VLADIMIR PUTIN, A NATIVE OF LENINGRAD, NOW ST. PETERSBURG, was born in 1952 in the lingering shadow of World War II. His father had been badly wounded in combat and his mother barely survived the 900-day siege of Leningrad when the Nazis tried to starve the city into surrender. The death toll in Leningrad was 640,000, including one of Putin’s brothers. Both parents got factory jobs after the war and Putin grew up in a walk-up communal apartment building where he recalled chasing rats in the stairwells. “There was no hot water, no bathtub,” Putin said many years later. “The toilet was horrendous. It ran smack up against a stair landing. And it was so cold—just awful—and the stairway had a freezing metal handrail.” A bright boy, Putin attended a school for the city’s best students. He also studied judo, earning a black belt, a skill that invested the diminutive young man with a quiet confidence.

After earning a law degree at Leningrad State University, Putin joined the KGB in 1975. “I was driven by high motives,” he said of his choice of profession. “I thought I would be able to use my skills to the best of society.” He had an undistinguished career, however, making it only to the rank of lieutenant colonel. He served in counterintelligence, monitoring foreigners in Leningrad, and then as an officer in Dresden, a backwater assignment, where he almost certainly attempted to recruit Westerners who came to East Germany. With the fall of the Berlin Wall, Putin returned to his native city and attached himself to the administration of the reformist mayor, Anatoly Sobchak, one of his old law professors. A fluent German speaker, Putin established a reputation as a competent but colorless bureaucrat who worked well with foreigners. His real skill was his ability to vault upward, almost unnoticed, on the coattails of powerful patrons.

In 1996, after Sobchak lost his reelection bid, Putin moved to Moscow, holding a series of positions in the administration of President Boris Yeltsin, until he was appointed director of the FSB, the intelligence and security agency that was rebuilding its power following the dismantling of the KGB. In August 1999, Putin was appointed prime minister in the chaotic Yeltsin administration, marked by the increasing decrepitude and alcoholism of the president. When Yeltsin resigned on December 31, 1999, Putin—looking very much like a nervous, pale junior staffer—became acting president. He won election to the post three months later with 53 percent of the vote.

The rich and powerful around Yeltsin had backed Putin’s rise because they believed he was malleable, but Putin, as ruthless as he was cunning, viewed them as a threat to his rule. He gradually used the powers of the state and the court system to bring the oligarchs under control, imprisoning those who crossed him and seizing their property. The man who’d once seemed destined for the background became the new tsar, and the country’s media, also brought to heel, portrayed the vigorous Putin as the embodiment of Russia’s revival, a state that he had returned to its proper place as a global power able to rival the United States—“the main enemy,” in the parlance of the KGB.

Seen from Moscow, the operation to sway the U.S. election had a long prologue. It was carried out by a regime that has fine-tuned the politics of grievance into a sophisticated propaganda weapon. Putin believes the United States engineered the breakup of the Soviet Union, eagerly plundered the fallen empire’s spoils, and has been using its influence ever since to keep Russia weak. His innovation has been to sharpen and magnify those charges into his raison d’état—and to point to them to show why responding to U.S. aggression was not only justified but a necessity.

His resentments, nurtured over many years of perceived slights and betrayals, had found a particular focus in his animus for Hillary Clinton. As Russians voted in the parliamentary election on December 4, 2011, videos documenting widespread fraud at the ballot box rocketed around the internet. The next day, Clinton offered her view on the sidelines of a conference in Bonn, Germany. “Russian voters deserve a full investigation of all credible reports of electoral fraud and manipulation,” she told reporters. “The Russian people, like people everywhere, deserve the right to have their voices heard and votes counted.”

As she spoke, activists in Moscow were readying a protest of the election results in the city center. They had registered an expected five hundred attendees with the police; five thousand showed up, the biggest anti-government demonstration of the Putin era. The frustrations of an urban middle class that increasingly yearned for not just material well-being but also for political freedom burst into the open. It would take months for the protests, which soon drew some hundred thousand participants, to subside.

Putin was furious. To him, the fact that the first protests erupted just hours after Clinton’s remarks was far from a coincidence. His German biographer Hubert Seipel described Putin’s anger that day as a seminal moment in shaping his disdain for Clinton and his conviction that the United States sought regime change in Russia.

“I saw the first reaction of our American partners,” Putin told supporters a few days later. “The first thing the secretary of state did was to characterize and evaluate the elections and say that they were dishonest and unfair, even though she had not yet received the materials from the [election] observers. She set the tone for certain actors [in] this country—she gave them a signal. They heard that signal and, with the support of the U.S. State Department, began their active work.”

Putin would survive the challenge and eagerly start pushing back—with the same tools he accused the West of using against him.

FEBRUARY 2016 BROUGHT ST. PETERSBURG SNOW FLURRIES AND ICE fog, a curtain of crystals in the frigid air. The districts that hug the northern bank of the Neva River had for decades been dotted with factories that rose during the nineteenth century. The area had seen its fortunes fade with the Soviet Union’s collapse. But its tree-lined streets, historic apartment buildings, and green spaces had maintained their charm, and the closed factories gradually gave way to office buildings beckoning a digital-friendly generation of Russians and internet start-ups.

The shuttered factories had been well situated alongside the ancient waterways that braided Russia’s intersection with Europe. But now, with steamships replaced by fiber optics, those with enough know-how, funding, and cleverness could access different sorts of currents. The firm that leased the four-story building at 55 Savushkina Street seemed to be among this new breed of Russians who in their own modern ways were following in St. Petersburg’s mercantile tradition.

The name of the company, the Internet Research Agency, sounded vaguely impressive if uninspired. A street sign in front of the building warned cars to slow down for children crossing on the next block. A short stroll away, on a verdant island in the Neva, were tennis courts, a museum, and a palace overlooking the water that served as a summer retreat for Tsar Alexander I. Not that the tech-savvy employees of the Internet Research Agency had time for such diversions. Each morning they filed in for cubicle-bound jobs that combined two of their generation’s consuming pastimes: crafting posts for social media and clicking refresh to see whether their creations had gone viral.

On February 10, 2016, as the fog outside thickened, employees received new instructions for an important project. An internal memo directed the company’s “specialists” to devote their social media skills to a single target—the U.S. presidential election. The aims were explicit: “use any opportunity to criticize Hillary and the rest (except Sanders and Trump—we support them).”

The Internet Research Agency memo represented a distillation of a remarkable effort only alluded to in the company’s name. Since its founding, the agency had devoted inordinate attention to studying the political climate in the United States, with special focus on issues that seemed to strike deep emotional chords with Americans—guns, Islamist terrorism, and race. By April 2014, the firm had set up a special department for what was referred to internally as the “Translator Project,” an effort to infiltrate America’s dominant social media platforms—YouTube, Facebook, Instagram, and Twitter. And unlike the costly stratagems of the Cold War—planting sleeper agents, recruiting and running Western turncoats, launching satellites and spy planes, underwriting proxy wars—the disruptive potential of the internet was vast and unbelievably cheap.

The project required an immersive understanding not only of the way Americans interacted online but also the fault lines of the country’s political landscape. In June 2014, two of the company’s employees boarded flights for the United States. Aleksandra Krylova and Anna Bogacheva spent the next three weeks crisscrossing America, making stops in at least nine states, including California, Texas, Michigan, Louisiana, and New York. Posing as tourists, the travelers studied the contours of the country’s charged political atmosphere. The report they compiled upon their return was valuable enough that the agency sent another employee on a subsequent excursion, in November, to Atlanta, for a more focused, four-day mission whose purpose remains murky.

Even by tech start-up standards, the Internet Research Agency had an unusual business model. There were normal-seeming departments—graphics, data analysis, search-engine optimization—but no evident source of revenue. Nor were there any meetings with clients; the agency’s “research” was all consumed in-house. And yet it had kept adding employees, hundreds of them, with an annual budget in the millions of dollars.

The firm’s founder had no apparent background or expertise in online ventures. The incomplete accounts of his life indicate that Yevgeny Prigozhin was born in St. Petersburg in 1961 and appeared headed for athletic glory as a cross-country skier before being imprisoned in 1981 for crimes including robbery. After his release amid the Soviet Union’s 1991 collapse, Prigozhin opened a hot dog stand, but the move that truly altered his fortunes in Russia came seven years later, with his purchase of a rickety vessel that he turned into a floating food establishment. New Island Restaurant, as it was called, attracted a different category of clientele—most notably another St. Petersburg native, Vladimir Putin. Prigozhin endeared himself to the future Russian president with an attention to detail and a willingness even as proprietor to engage in the more quotidian aspects of running a restaurant. Putin “saw how I built my business starting from a kiosk,” Prigozhin said in an interview with a St. Petersburg magazine. “He saw how I was not above serving a plate.”

The connection ultimately helped position Prigozhin for a series of lucrative catering contracts, supplying food to schools in St. Petersburg and the Russian military. (His bond with the increasingly powerful politician paid off in other ways, too: in 2002, Putin brought world leaders, including President George W. Bush, aboard the New Island for meals taken while drifting along the city’s waterways.) Those deals led to even greater riches as Prigozhin branched out, earning billions from contracts that came to include providing soldiers for hire to guard oil wells in Syria. Prigozhin family social media accounts offered glimpses of sprawling estates, private airplanes, and Yevgeny’s adult children cavorting on a luxury yacht. As he ascended into the ranks of the Russian oligarchs, the entrepreneur who so impressed Putin by personally busing dishes acquired the nickname “Putin’s cook” and was soon handling other kinds of dirty work.

According to a top-secret NSA report issued more than a year after the U.S. election, the Internet Research Agency conducted information warfare along several fronts. One was referred to internally as “govnostrana”—which the NSA translated as “crap country”—and referred to attacks meant to damage a nation’s reputation and sap its citizens’ confidence. This effort involved the creation of two types of trolls (the term for online provocateurs), one focused on influencing public opinion by amassing loyal followings, and another that used teams of four or five people to churn out a mass volume of posts to overwhelm any competition from those posting contrary opinions.

In a February 2018, interview with The Washington Post, Marat Mindiyarov, a teacher by training, explained that he began working at the agency in late 2014 because it was close to home and he needed to make money during a stretch of unemployment. “I immediately felt like a character in the book 1984,” he recalled. The agency, he said, was “a place where you have to write that white is black and black is white. Your first feeling, when you ended up there, was that you were in some kind of factory that turned lying, telling untruths, into an industrial assembly line.” Others hired at the Internet Research Agency described their assignments and the atmosphere there as similarly Orwellian. Lyudmila Savchuk, an activist and journalist who infiltrated the Internet Research Agency in 2015 as part of an investigation of the outfit, said, “Their top specialty was to slip political ideas inside a wrapping that was as human as possible.”

Like many employees at the agency, Mindiyarov’s main tasks involved producing pro-Putin propaganda for Russian-speaking audiences, particularly to drum up support for Russia actions in Ukraine. A former Soviet republic, Ukraine had since the fall of communism struggled to balance its close cultural and economic ties to Moscow against a desire to build a more independent and Western identity, developing democratic institutions and pursuing closer ties to Europe. That struggle had first taken on a frightening new dimension in 2004. During that year’s presidential campaign, reform candidate Viktor Yushchenko had become badly disfigured after ingesting what authorities later determined was a near-lethal dose of the same dioxin used in Agent Orange, a poisoning that few seemed to doubt had been carried out by the Kremlin. Yushchenko survived only to lose the race to a rival politician, Viktor Yanukovych, who was seen as a puppet of Moscow.

Amid evidence of widespread electoral fraud, Ukraine had been convulsed by prodemocratic protests that came to be known as the Orange Revolution. It was one in a series of popular uprisings inside and outside Russia that unnerved Putin, who came to suspect clandestine interference by the United States. A revote ordered by the country’s supreme court reversed the disputed outcome, handing the election to Yushchenko. Putin looked to the Russian military and intelligence services to undermine the democratically elected leader, and some of the strategies that did just that would be models for his later intervention in the American presidential contest.

Yushchenko was unable to fully stabilize the country, and after five years the pro-Moscow Yanukovych regained power. Drawing upon (and paying heavily for) the advice of an American consultant, Yanukovych lasted four years before an uprising removed him from office. Moscow responded to the disintegration of the government it backed by sending in Russian forces—the insignias stripped from their green uniforms—to begin dismembering the country. Russia annexed the Black Sea peninsula of Crimea and sent arms and “volunteers” from the ranks of its own military to bolster pro-Russia separatists in eastern Ukraine. Putin claimed that Russian speakers in Ukraine needed to be protected in the wake of a nationalist revolution, but much of the world saw the Russian invasion as a violation of international law and Ukraine’s sovereignty.

When Russia’s currency began tumbling under crippling sanctions imposed by the United States and the European Union, Mindiyarov was enlisted in a campaign to post glowing comments on Russian news sites and online magazines. “I was writing that everything was the opposite: how wonderful our life was, how wonderful it is that the ruble was strengthening … that sanctions were going to make us stronger and so on and so forth,” he recalled.

Days at the agency were divided into two twelve-hour shifts, Mindiyarov said, with quotas requiring employees to deliver 135 website comments per shift, 200 characters apiece. “You come in and spend all day in a room with the blinds closed and twenty computers,” he said, adding that he was paid 40,000 rubles, or about $800, a month after Russia’s currency crashed in late 2014. It was decent money at a time when Russia’s economy had been crumpled by Western sanctions.

Mindiyarov said he wasn’t involved in the “Translator Project,” but knew there were other sections of the company aimed at an audience in the United States. An unnamed troll told an independent television station in Russia that Internet Research Agency employees were told to engage with Americans online and “get into an argument in order to inflame it, and rock the boat.” The troll said their orders by 2016 were to specifically attack Clinton. “The main message is: aren’t you tired, brother Americans, of the Clintons, how long have they been around?” the station quoted the troll as saying. To ensure that their use of English was seamless enough for online political debate, employees in St. Petersburg watched the Netflix drama House of Cards, a show about a corrupt American pol who rises to become president.[1]

As an English speaker, Mindiyarov had been approached to apply for the “Facebook department,” where pay was twice as high. (The employees who emerged from that section for smoke breaks were younger, hipper, with newer phones and better haircuts.) But Mindiyarov was tripped up by the entrance test: his English wasn’t strong enough to pass as native in the rapid-fire encounters of social media, where you had to be fluent even in American idioms. In response to the essay question “What do you think of Hillary Clinton?” he wrote that she seemed to have a strong chance to be the next U.S. president. It was unclear, he reflected later, whether the answer itself was disqualifying or merely the caliber of the English he used to articulate it.

THE WEEKEND OF THE WHITE HOUSE CORRESPONDENTS’ ASSOCIATION Dinner at the start of May was supposed to bring a momentary respite from the pressure of the presidential campaign. Many Washington insiders, including senior officials at the DNC, would be donning gowns or tuxedoes for the annual bash near Dupont Circle. The so-called nerd prom always attracts an influential if eclectic crowd—cabinet secretaries, cable news anchors, and a smattering of Hollywood stars. Five years earlier, with Trump in attendance, Obama had mercilessly taken full advantage of the chance to return fire on the reality TV star who had used his fame to fan a baseless conspiracy about the president’s place of birth. The jokes mocked Trump’s ego and boorishness, and as the audience roared, Obama’s target was visibly annoyed, so much so that some would later wonder whether that moment of humiliation had motivated him to mount his own serious run for the White House.

Saturday night’s event, Obama’s last as president, was expected to have a more valedictory tone for the Democrats, but the prospect of another Democrat in the Oval Office come 2016 also provided reason to celebrate. Preparation for the pre-event parties was already under way on Friday when DNC executive director Amy Dacey learned for the first time around four P.M that the committee’s network had been penetrated. Immediately she picked up the phone and dialed Michael Sussmann at Perkins Coie.

“We’ve had an intrusion,” she told him. The contract IT team first thought they could contain the damage and keep the committee’s systems up and running, she explained, but it seemed obvious they were overmatched, especially if the bureau’s suspicions proved correct and the hackers were Russian. Finally Tamene and his team were getting it: the DNC was in big trouble. “They were mature enough to know that they couldn’t fight the Red Army,” Dacey said.

While still on the phone with Dacey, Sussmann fired off a text to Shawn Henry, a former top cyber official at the FBI who had left the bureau to take a top job with a Silicon Valley cybersecurity firm, CrowdStrike. With his shaved head and dark suits, Henry would never be mistaken for a member of the hacker crowd, but he had been on the front lines of previous election-cycle cyberattacks. In 2008, he was in charge of the FBI cyber division when Chinese officials hacked the computers of the presidential campaigns of John McCain and Barack Obama, looking to steal intelligence that would give them insight into how each man would steer U.S. foreign policy regarding China.

As the White House Correspondents’ Dinner and a weekend of follow-up events got under way in Washington, Sussmann formally moved to enlist CrowdStrike to protect the DNC. The intrusion and the plan to counter it were to be kept secret from most DNC staff. “You can’t let the attackers know you know they’re there,” Sussmann instructed Dacey. “You only have one chance to raise the drawbridge.” If the hackers were tipped off, they could destroy logs and wipe their tracks or worse—steal piles of data while making a scorched-earth retreat. Most Democrats would party in blissful ignorance of the potential nightmare going on back at their national committee headquarters.

For the DNC, the timing was terrible. Half a dozen primaries had just ended, with Clinton taking a commanding lead, but the coming weeks formed a brutal final sprint, with potentially decisive contests in ten states, including Oregon, Indiana, and California. The Democratic National Convention, the committee’s showcase event, was twelve weeks away. The party had picked Philadelphia for the 2016 event, and 50,000 people were expected to attend, including about 5,000 delegates, with millions more watching on television.[2] The DNC’s staff was working around the clock planning for the general election. It was also an intense period of political maneuvering. Supporters of Bernie Sanders, the senator from Vermont, were already suspicious that a party apparatus held tightly in the Clinton family grip had sought to deny them the nomination, and the internal debates about candidates, strategies, fundraising, and campaigning were detailed in thousands of internal DNC emails, spreadsheets, and other files—all residing on a computer system that might have been thoroughly compromised by Russia.

“You had staff running full tilt, gathering research on the Republican front-runner, Donald Trump,” Dacey recalled. “You had an intruder inside the system who was interested in that opposition research, and a convention to plan for. It was the perfect storm.”

By Friday, May 6, CrowdStrike had worked with Tamene’s team to install stronger threat detection system software. Immediately it turned up troubling evidence of two Russian hacking teams—the newly discovered, “noisier” intruder as well as the quieter one that the FBI had long warned the DNC was already inside.

U.S. intelligence agencies had for years been reluctant to publicly identify hacking groups by country out of concern that doing so would jeopardize sources as well as run the risk of complicating diplomatic relations. When they wanted to signal publicly that a nation-state was behind a cyber campaign, they adopted the euphemism “advanced persistent threat,” or APT. The term had been coined in 2006 by an Air Force intelligence officer looking for a way to pass information to defense contractors getting hammered by a specific set of foreign hackers, without revealing the classified detail that the country behind the assault was China. It had then spread to cyber firms in the private sector and now was used throughout the industry. A Chinese cell known as People’s Liberation Army Unit 61398 had carried off a string of thefts of intellectual property and commercial secrets from American and European defense contractors, and engaged in espionage against countries including the United States, Canada, India, and Israel as well as against the United Nations. They were so prolific and brazen that like graffiti artists, they sometimes left telltale signs of who they were, lines of computer code that sometimes included nicknames such as “Ugly Gorilla.” Unit 61398 became known as APT1.

The teams rummaging through the DNC machines were known from previous intrusions on other targets and already had their designated monikers: APT 28 and APT 29. CrowdStrike had its own branding conventions using animals to represent various countries. Chinese groups were pandas, while the label for the Russian teams was based on a symbol associated with that country for centuries: the DNC hackers were dubbed Fancy Bear and Cozy Bear.

CrowdStrike was confident that Fancy Bear—the later arrival at the DNC—was an extension of the GRU. Cozy Bear’s affiliation was less clear. CrowdStrike suspected that it was tied to Russia’s domestic intelligence service, the FSB. But U.S. intelligence agencies had for years been certain that whatever the name—Cozy Bear, APT 29, or the Dukes—the team was an extension of Russia’s foreign intelligence service, the SVR.

The original Cozy Bear DNC hack had taken place so long ago that log files were difficult to come by, but with what they could find, CrowdStrike investigators began to reconstruct the intruders’ actions. The Cozy Bear crew had been disciplined and patient. They had compromised the DNC’s email, chat, and internet phone systems. They had set up an automated mechanism so that every time a DNC employee got an email, a copy was forwarded to Cozy Bear. The unit stole passwords and log-ins for system administrators, but behaved cautiously with these keys, never gorging themselves on data they could access, always minimizing the chances of getting caught. The April newcomer, however, had no such manners—it foraged without restraint.

Investigators saw no indication the two teams were working together or were even aware of one another’s presence, though they did seem to target separate areas of the network: Fancy Bear went after research files, at one point making off with a trove of opposition material on Trump, while Cozy Bear focused on emails and chats. The bottom line was clear: the committee and many of its internal secrets had been utterly exposed. Yet in calculating the damage, DNC leaders and investigators relied on an assumption that seemed reasonable: that while whatever information the Russians had taken might be mined by Kremlin analysts, it wouldn’t be exposed publicly. Cozy Bear, after all, had attacked other nongovernmental organizations and defense contractors as well as foreign governments and political organizations. “This is a sophisticated foreign intelligence service with a lot of time, a lot of resources,” Henry concluded. “There’s no doubt this is a nation-state targeting a United States political system. What are candidates thinking about? What are they developing? What are their strategies? It’s classic espionage.” And classic espionage meant not revealing to the world what had been stolen, if for no other reason than it would jeopardize subsequent efforts.

Having taken measure of the breach, the experts began drafting a plan to kick the hackers out. Doing so would require rebuilding entire systems, resetting passwords, and picking a time to shut the network down. On an aggressive timeline, the operation could be carried out starting around May 20. But DNC leaders were reluctant to disrupt the network at a time when the party’s nomination had not yet been secured, so a date was set for the three-day Memorial Day weekend, when it would be easier to take the system offline without cutting into work time or raising suspicions. Yet while Clinton’s lead was commanding, Bernie Sanders was still in the race and drawing energetic crowds. The DNC leadership decided it was better to wait even longer and ensure that the contest was clinched. CrowdStrike held off, scheduling the work for mid-June.

During that stretch, the Russians amassed more emails that appeared to show DNC bias in favor of Clinton—not only old correspondence, but new messages written during the stretch when the DNC could have been in cleanup mode. And because the hacking was still being kept secret, nobody outside the inner circle had any sense that they should be more cautious than usual when sending emails and documents. On May 21, Mark Paustenbach, a committee communications official, wrote to a colleague, “Wondering if there’s a good Bernie narrative for a story, which is that Bernie never ever had his act together, that his campaign was a mess.” Other damaging emails had been written before CrowdStrike had even had enough time to conclude the attack was being carried out by Russians. For example, on May 5, a committee staffer emailed Paustenbach and Dacey suggesting a way to call voters’ attention to Sanders’s faith. “It might make no difference, but for KY and WVA can we get someone to ask his belief. Does he believe in a God,” wrote Brad Marshall, the DNC’s chief financial officer, who had lived and worked for years in Kentucky. “He had skated on saying he has a Jewish heritage. I think I read he is an atheist … My Southern Baptist peeps would draw a big difference between a Jew and an atheist.” This was way beyond the official DNC position, which was that the organization was there to help all Democratic candidates without favor toward any in particular. Marshall added in a second email that it came down to the “Jesus thing.” Dacey replied: “AMEN.” Dacey later insisted that she had meant her remark not as affirmation of the plan but to express understanding of the venting by her staff. Regardless of intention, it was a comment that would later add fuel to a fire.