Russian Influence Campaign: What’s in the Latest Mueller Indictment

None of the defendants indicted Friday for their alleged influence operation against the U.S. political system is likely to ever see the inside of an American courtroom. None is in custody. None is likely to surrender to U.S. authorities. And Vladimir Putin will probably not race to extradite them.

Nevertheless, the grand jury’s charges against the 13 Russians and three organizations mark a significant moment in the investigation of L’Affaire Russe. President Trump has spent the year since his victory casting doubt on the very premise that Russia interfered in the 2016 presidential election. Yet here is the Justice Department on the record declaring that the Russia investigation isn’t, in fact, a witch hunt. It isn’t a hoax. It isn’t just a “phony Democrat excuse for losing the election,” as the president has tweeted. There really was, the Justice Department is saying, a Russian influence operation to interfere in the U.S. political system during the 2016 presidential election, and it really was at the expense of Hillary Clinton and in favor of Donald Trump.

The U.S. intelligence community, of course, already knew this. It has already shouted it from the rooftops about as loudly as the intelligence community announces its conclusions. The intelligence community, after all, assessed in January 2017 that it had “high confidence” that “President Vladimir Putin ordered an influence campaign in 2016” targeting the U.S. presidential election. Before that, it had warned in October 2016 that the Russian government was behind the hacking and distribution of emails belonging to the Democratic National Committee and Clinton’s campaign chairman, John Podesta. None of these public conclusions stopped Trump from publicly casting doubt on Russian interference.

But the indictments on Friday reflect a different level of certainty, confidence and evidence. Here the special counsel is stating not merely that he has “high confidence” that the interference happened. He is stating that he can prove the existence of the Russian operation in court beyond a reasonable doubt, using only admissible evidence, and that the operation violated U.S. federal criminal law. And he is laying out an astonishingly specific set of forensic conclusions that reflect an impressive intelligence operation against the very operation on which the indictment reports. Even if the special counsel never gets the chance to prove his allegations in court by bringing any of the indictees before a federal judge, the formal statement that he is prepared and able to do so represents a remarkable rebuke of the president’s claims.

Notably, the allegations in this indictment do not deal with computer or email hacking. The operation described in this indictment did not relate to the hacking of the DNC network, nor to the theft or distribution of Podesta’s or the DNC’s emails in the summer and fall of 2016. The indictment makes no allegations about delivering “dirt” on Hillary Clinton, nor of Donald Trump Jr.’s Trump Tower meeting. To the extent that the indictment intersects with the hacking story, it does so obliquely; it includes no Computer Fraud and Abuse Act or other hacking charges. Instead, the indictment deals with an operation that the Russian organization itself described as “information warfare against the United States of America.”

Matt Tait and Benjamin Wittes sat down with David Kris and Paul Rosenzweig, earlier this evening, to discuss the indictment on the Lawfare Podcast:

In this post, we offer an analysis of the document itself and what inferences are reasonable to draw from it.

What the Indictment Alleges

The indictment’s first count charges 16 defendants with conspiring to defraud the United States (18 U.S.C. §371), alleging a conspiracy that “had as its object impairing, obstructing, and defeating the lawful governmental functions of the United States by dishonest means in order to enable the Defendants to interfere with U.S. political and electoral processes, including the 2016 U.S. presidential election.” In particular, the indictment alleges the defendants interfered with the Federal Election Commission’s administration of the Federal Election Campaign Act (prohibiting foreign nationals from certain kinds of political spending during elections); the Justice Department’s administration of the Foreign Agent Registration Act (requiring agents of foreign principals working within the United States on political matters to register as such); and the State Department’s program for issuing visas to foreign individuals entering the United States.

The defendants charged in the first count include three entities: the Internet Research Agency, a Russian organization allegedly engaged in political and electoral interference operations, along with Concord Management and Consulting and Concord Catering, related Russian entities that allegedly controlled funding, recommended personnel and oversaw activities of the Internet Research Agency. Among the individual defendants is Yevgeniy Viktorovich Prigozhin—a Russian billionaire famously known as “Putin’s chef” for his lucrative catering contracts with the Russian government. Prigozhin allegedly controlled Concord and approved and supported Internet Research Agency operations. The other defendants include the Internet Research Agency’s senior leadership and members of the team allegedly working on election interference.

The indictment’s second count charges the Internet Research Agency and two of its employees with conspiracy to commit wire fraud and bank fraud (18 U.S.C. §1349). According to the special counsel, these defendants opened U.S. bank and PayPal accounts under false names in order to receive and send money into and out of the United States—both to support the Internet Research Agency’s operations in the U.S. and for self-enrichment. The indictment alleges that in furtherance of this conspiracy, the defendants unlawfully used the Social Security numbers, home addresses and birth dates of real U.S. persons, without their knowledge or consent, to fraudulently open at least four bank accounts and six PayPal accounts. The defendants and their co-conspirators also allegedly purchased credit card and bank account numbers using the stolen identities of real U.S. persons obtained online.

Counts three through eight charge the Internet Research Agency and four of its employees with aggravated identity theft (18 U.S.C. §1028A) for knowingly transferring, possessing and using, without lawful authority, a means of identification of six different real persons during and in relation to the wire fraud and bank fraud alleged in count two.

The charges of wire and bank fraud appear related to a second set of court documents released Friday by the special counsel’s office: the plea deal of Richard Pinedo, whom Special Counsel Robert Mueller charged with one count of identity fraud (18 U.S.C. §1028). According to the statement of offense, Pinedo operated an online business called “Auction Essistence” from 2014 through the end of 2017, through which he sold services designed to circumvent the security measures of online payment companies. Reuters reports that Pinedo allegedly provided the services used by the Internet Research Agency to purchase political ads and pay for rallies through PayPal. (Pinedo’s attorney said in a statement that his client “had absolutely no knowledge of the identities and motivations of any of the purchasers of the information he provided.”)

The indictment provides a rich picture of the Internet Research Agency’s self-described “information warfare” operations. This work allegedly involved creating fictional and fraudulent American personas on Facebook, Instagram and Twitter, as well as political Facebook groups designed to attract American audiences. The organization then allegedly used these accounts to help Donald Trump, Bernie Sanders and Jill Stein, and to undermine Hillary Clinton, Marco Rubio and Ted Cruz, as well as to encourage U.S. minority groups to abstain from voting.

The organization allegedly sought to masquerade its Russian activities as American by registering hundreds of fictional email accounts with U.S. email providers and purchasing space on U.S. computer servers to set up virtual private networks (VPNs), as well as using stolen identities of U.S. persons to open bank and PayPal accounts. The indictment says that the Internet Research Agency used these bank and PayPal accounts to fund online advertising and organize political events in the U.S. linked to its fake personas and pages—including, in some cases, paying people to appear at rallies. During a “Florida Goes Trump” rally organized by the Internet Research Agency in August 2016, for example, it allegedly paid a U.S. person to pose as Hillary Clinton wearing a prison uniform inside a cage.

The Internet Research Agency purchased political advertisements in April 2016, the special counsel reports; by that June it had started to organize political rallies and counter-rallies both for and against Clinton and Trump. After Trump’s victory, the operation then sought to seed rallies both for and against the president-elect. In September 2017, according to the indictment, the organization began to destroy evidence of its work in response to news reports of Facebook’s cooperation with Mueller’s investigation. “We had a slight crisis here at work,” the indictment quotes an Internet Research Agency employee as writing to a family member. “The FBI busted our activity (not a joke).”

What the Indictment Can Tell Us

The indictment fills in a number of critical elements in the timeline of L’Affaire Russe. The document is what prosecutors term a “speaking indictment”; that is, it describes facts about the defendants’ activities beyond what is strictly necessary for the counts it charges. The purpose of a speaking indictment is more than to simply list charges; it is to tell a story, and the story this one tells is of the Russian side of the bigger picture—specifically, the Russian side of events that took place outside of the Russian government and intelligence agencies.

A number of things stand out in this account.

The first is the sheer scale of the alleged operation. The Internet Research Agency was funded to the tune of $15 million a year, the indictment claims, with a contingent of 80 full-time staffers by 2016 and bonuses running to the hundreds of thousands of dollars. Prigozhin, who allegedly funded the operation through a consortium of companies, is a personal friend of Putin’s and has an exclusive contract with the Russian Ministry of Defense to cook meals for the Russian military.

Prigozhin was added to the Office of Foreign Asset Control sanctions list in December 2016, and Concord Management and Consulting and Concord Catering—owned by him and named separately in the indictment—were added to that sanctions list in June 2017. So while the indictment doesn’t specifically allege a connection between the Internet Research Agency and the Russian government, the link between Prigozhin and the Kremlin is clear.

The indictment discusses three distinct stages of the Internet Research Agency’s operation: a planning stage in 2014; an operational stage that began in 2015 and became increasingly direct and aggressive throughout the 2016 campaign; and a curious third stage involving money laundering and bank fraud that allegedly began in mid-June 2016.

Efforts began by May 2014, when the indictment says the Internet Research Agency had decided to “interfere with the 2016 U.S. presidential election.” Initially this involved several employees traveling to the United States—ostensibly on vacation but in fact covertly gathering intelligence. Those defendants allegedly gathered information and generated reports for the agency, which reimbursed their travel expenses. By June 2014, the indictment says, the organization was taking active steps to obscure its finances and control.

The indictment doesn’t shed light on why the Internet Research Agency might have chosen to meddle in the 2016 election in 2014—long before either Clinton or Trump announced their intent to run. But notably, the dates in the indictment coincide with the Ukrainian Maidan revolution of early 2014. Amid unrest against Viktor Yanukovych, the Russian-aligned politician who was president of Ukraine at the time, Russian officials accused the United States of covertly supporting Ukrainian protesters and seeking to undermine the Kremlin’s influence in the region. So a reasonable person might wonder, reading the indictment, whether the beginning of the operation was a retaliation for perceived U.S. meddling in Ukraine.

The operational stage of the influence campaign began around 2015 with a series of fake social media accounts, each designed to look like a U.S. citizen or political group, according to the indictment. The Internet Research Agency allegedly began purchasing advertisements to promote its fraudulent political groups on social media, spending thousands of dollars a month. Over time, the accounts attracted hundreds of thousands of followers.

But in April 2016, this operation became more aggressive, according to the indictment. On April 6, 2016, shortly after Trump clinched the Republican nomination, the group began spending money to promote content explicitly supporting Trump’s candidacy and opposing Clinton’s. On June 13, the Internet Research Agency allegedly opened fraudulent bank accounts with funds to obfuscate the source of its spending in the United States. And from July 2016, onward it organized political rallies, mostly in support of Trump and some supporting Clinton. That August, the Internet Research Agency directly contacted unwitting Trump campaign officials to discuss times and locations of proposed rallies.

We don’t know what specifically precipitated this change of tack—or what coordination, if any, this operation had with the hacking of the DNC and of Clinton’s campaign chairman, Podesta. The indictment makes no mention of either event; nor does it establish a causal link between those hacks and the Internet Research Agency’s work. But it is perhaps useful to recall other events around the time for context.

The fateful phishing email targeting John Podesta was sent on March 19, 2016. Two weeks later, on April 3, the trove of documents on hidden wealth known as the Panama Papers was released. Those documents first publicly implicated corruption involving Putin on April 6—the approximate date on which the indictment alleges the Internet Research Agency bought its first advertisement explicitly attacking Hillary Clinton. Russian journalist Andrei Soldatov has argued that Putin interpreted the Panama Papers as a personal attack against him and sought to intervene in the U.S. election in response.

On April 19, just two weeks after the release of the Panama Papers mentioning Putin and the Internet Research Agency’s purchase of its first anti-Clinton ad, the Russian military intelligence agency GRU registered dcleaks.com—which was used to distribute emails stolen by Russian military intelligence.

Equally interesting is the timeline and mechanism by which the Internet Research Agency set up fake U.S. bank accounts to conceal the financial trail leading back to Russia. According to the indictment, the organization began setting up these accounts on June 13, 2016. The very next day, the Washington Post first reported that the DNC’s network had been hacked by the Russian government.

A Vindication on Collusion?

In contrast to its narrative richness with respect to Russian activities, the document is noticeably quiet about the activities of Americans and the Russian government itself. Indeed, the introduction frames the targeting of Trump campaign officials: “Some Defendants, posing as U.S. persons and without revealing their Russian association, communicated with unwitting individuals associated with the Trump Campaign.”

The document is silent on what happened after these alleged communications—how the Trump officials responded or how the Russians pursued them. It is equally silent about the propriety of the conduct of every American it mentions. None of those targeted to voluntarily plan rallies or public demonstrations is accused of wrongdoing. No American said to have received compensation from the defendants or paid by them for posting advertisements on Russian-controlled social media accounts is accused of any wrongdoing. An American political activist who gave the Internet Research Agency insights that helped guide the organization’s strategy is said to have not known who he or she was speaking to.

In his news conference immediately after the indictment was released, Deputy Attorney General Rod Rosenstein went out of his way to emphasize that neither he nor Mueller was alleging wrongdoing on the part of any American—a comment seemingly designed to refer to Trump campaign officials. In response to a reporter’s question, Rosenstein said bluntly: “There is no allegation in this indictment that any American had any knowledge” of Russian involvement.

The indictment’s silence on American involvement led the White House to declare in a press release that Mueller has shown “NO COLLUSION”:

Statement from the Press Secretary Regarding the Russia Indictments

Earlier today, Deputy Attorney General Rod Rosenstein announced indictments against 13 Russian nationals and 3 Russian entities for meddling in the 2016 Presidential election, which began in 2014 before the President declared his candidacy. President Donald J. Trump has been fully briefed on this matter and is glad to see the Special Counsel’s investigation further indicates—that there was NO COLLUSION between the Trump campaign and Russia and that the outcome of the election was not changed or affected.

President Trump says, “it is more important than ever before to come together as Americans. We cannot allow those seeking to sow confusion, discord, and rancor to be successful. It’s time we stop the outlandish partisan attacks, wild and false allegations, and far-fetched theories, which only serve to further the agendas of bad actors, like Russia, and do nothing to protect the principles of our institutions. We must unite as Americans to protect the integrity of our democracy and our elections.”

The president himself tweeted:

The president would be wise to cool his heels on such claims of vindication. The fact that this indictment doesn’t allege misconduct on the American side does not necessarily mean that Mueller lacks evidence to support such an allegation—or that he will not develop it in the future. This indictment deals with a limited subject matter: one aspect of the Russian operation—that involving social media influence measures—undertaken by non-governmental actors. It makes a point of not addressing the conduct of U.S. actors. That is neither inculpatory or vindicating. It is, rather, a deferral of the matter to another day.

What this indictment does, rather, is establish part of the predicate for a later claim of collusion. That is, the indictment details part of what it was that any Americans might have been colluding with.

Mueller Knows More Than He’s Shown

The indictment is yet another reminder of something that’s been made clear over the past several months repeatedly: Mueller and his team know much more than is public, and they are unusual in Washington in being fully capable of keeping secrets.

Recall that Mueller’s team was able to keep the indictment and eventual plea deal of Trump foreign policy adviser George Papadopoulos secret for three months before the court documents were released in October 2017. Likewise, while the indictment of the Internet Research Agency is dated Feb. 16, 2018, the criminal information in Pinedo’s case bears a signature from the defendant dated Feb. 2. Not even a whisper of Pinedo’s indictment had reached the press before Friday. Indeed, journalists today were scrambling to figure out who he is.

The special counsel’s office not only appears to be decidedly leak-resistant, everything that has emerged of the investigation so far suggests that the special counsel’s office has information well beyond that which it has made public. This is another reason to avoid making predictions about the innocence of the Trump campaign—or its guilt, for that matter—based on the limited scope of the indictment. Nobody knows how much more to come there is, and anyone pretending to, either by way of claiming vindication for those not yet indicted or by way of asserting confidently what the next shoe to drop will be, deserves a healthy measure of skepticism.

Trump’s tweet also insisted that “The results of the election were not impacted.” This, too, is a matter on which the indictment remains silent. Rosenstein did state publicly today that “there is no allegation in the indictment of any effect on the outcome of the election.” But this a very different claim than the notion that it did not affect the election. The document makes no such claim.

Indeed, while the indictment spells out in great detail the lengths to which the Internet Research Agency went to purchase ads, organize rallies and interact with apparently unwitting Americans. It does not touch on the effects of those efforts either on a small scale (how many people attended these rallies?) or on a large scale (did the meddling affect voting behavior?).

There are reasons to be skeptical: for example, a Daily Beast report on a Russian-organized anti-immigrant rally in August 2016 notes that only four people attended. But what effect, if any, the operation had, is not a question of criminal law. It’s a question that, once the full facts are out, will require solutions beyond the special counsel’s purview. In contrast to the president’s claims, it would be a mistake to draw any conclusions now as to whether or not Russian involvement swayed the election or had more localized impacts.

Here’s what is clear, as U.S. intelligence officials emphasized in Senate testimony earlier this week: The danger described in the indictment is not going away anytime soon. As Director of National Intelligence Dan Coats put it: "There should be no doubt that Russia perceives its past efforts as successful and views the 2018 U.S. midterm elections as a potential target.”

Perhaps now that the special counsel has coaxed from Trump the admission that election interference happened in 2016, the president can focus on the threat of it happening again.