After American intelligence agencies failed to detect and stop Al Qaeda’s 9/11 attack, sixteen years ago, Congress more than doubled their budgets and gave them unprecedented secret authorities. As the intelligence beat reporter for the Washington Post at the time, I watched these agencies grow in size, as dozens of new buildings appeared around the Washington region to house a ballooning workforce of over a million people with top-secret security clearances.
The National Security Agency obtained permission to collect and store the private Internet correspondence and cell-phone data of millions of Americans. The F.B.I. was granted the power to obtain citizens’ banking, library, and phone records without court approval. The C.I.A. opened secret prisons abroad where they tortured terrorist suspects. Local police departments began employing military-grade weapons, armored vehicles, and cell-phone-tracking devices.
All these measures, and many more, were put in place in the name of national security. And yet, last year, these vastly larger agencies failed to defend, or even warn, the American public against the most audacious Russian covert operation toward the United States since the end of the Cold War. Only after the fact, when a Russian disinformation campaign had already tainted the 2016 Presidential election, did the Office of the Director of National Intelligence, another vast post-9/11 creation, disclose the Kremlin’s interference. The unclassified January, 2017, report, made public by the O.D.N.I., included only the thinnest of evidence, leaving many people wondering if it were true. Whether the Russian campaign actually changed the outcome of the election is impossible to know, but it clearly succeeded at exacerbating political divisions in the United States and undermining the credibility of the results.
Unlike 9/11, the Russian campaign did not occur without warning on a quiet fall day. Rather, it unfolded over at least six months on Americans’ social-media accounts—hardly the stuff of spy novels. Kremlin leaders had signalled their plans years in advance. The Russian playbook wasn’t a secret, either. It had been well documented by European governments, researchers, and journalists after the Kremlin’s information operations to destabilize Estonia, in 2007; Georgia, in 2008; Ukraine, in 2014; and Britain, in the leadup to the 2016 Brexit vote.
Facing one of the clearest domestic threats to the U.S. in a decade, neither the F.B.I., which has the responsibility for conducting counterintelligence inside the United States, nor the O.D.N.I. warned Americans that platoons of Russian-backed automated “bots” and human trolls were working online to amplify racial divisions and anti-government conspiracy theories. The F.B.I. deputy director, Andrew McCabe, admitted in a CNBC interview on October 4th that the U.S. intelligence community “should have predicted” the attacks “with more clarity, maybe, than we did.” “When you overlay these attacks onto what we’ve known on our counterintelligence side about the Russians for many years, it completely fits into their playbook,” he went on. “This ability to insert themselves into our system, to sow discord and social and political unrest, is right up their alley, and it’s something we probably should have seen.” In a recent interview, a senior intelligence official who was given permission to speak with me, agreed. “He’s spot-on,” the official, who asked not to be named, said of McCabe.
John Brennan, who served as the C.I.A. director from 2012 to 2016, has said that there was no way for U.S. intelligence officials to have seen such a Russian effort coming. “People have criticized us and the Obama Administration for not coming out more forcefully in saying it,” he said at a national-security forum in Aspen in July. “There was no playbook for this.”
Many members of the intelligence community, or I.C., as the collective agencies are known, blame President Obama for being reluctant to publicly criticize the Russian campaign during the 2016 election. But, by law, the intelligence chiefs must also keep congressional intelligence-committee members briefed on major threats to national security—yet it doesn’t look as if they gave the representatives many details either. Instead, members of Congress seemed as surprised as the rest of us when they learned about Russia’s social-media presence from recent testimony by Facebook and Twitter. Max Bergmann, who worked at the State Department until 2017, and had access to classified reports on the Russia activities, described the problem to me as “a failure of imagination. Everyone was guilty of the same sin.”
I don’t think even that sentiment captures the scope of the failure, and neither do the foreign officials and experts who watched the Russian effort unfold in the United States. A senior European diplomat, who asked not to be identified, told me recently that the two years that passed between Russia’s cyberattacks on the Ukrainian elections and the 2016 U.S. election “should have been enough to alert U.S. officials.”
Among the first to document Russia’s online disinformation tactics was Olga Yurkova, a thirty-two-year-old journalist who recently graduated from the National University of Kyiv-Mohyla Academy School of Journalism. On March 1, 2014, Yurkova watched on television and online as armed men in unmarked uniforms occupied Crimea. Russian media named them “polite people.” Yurkova and her university colleagues, steeped in previous Russian disinformation operations in the Baltics and elsewhere, knew better.
“Their lies were so blatant that all Ukrainian journalists were speechless with shock,” Yurkova told me from Kiev. “As responsible journalists, we had to do something with this.” The following day, Yurkova created a Web site called StopFake.org, which is dedicated to debunking fake news and identifying Russian disinformation. The article announcing the launch of the site, and its mission, was shared thirteen thousand times on Twitter within two hours, Yurkova told me by e-mail. Readers quickly began sending in bogus stories, and soon were even trying to debunk articles themselves. Every day, StopFake’s team combed Russian- and English-language media for suspicious content. They checked the veracity of sources cited, the accuracy of translations, the validity of numbers and statistics, and the authenticity of photos and videos. Sometimes, they made phone calls to people quoted in a story, or cross-checked facts with laws and regulations. It often took weeks to refute false articles with convincing evidence.
“We have been working for three years to inform very diverse people about why they should consider this problem, how they can reduce the impact of propaganda, and what are the possible ways of countering propaganda as a phenomenon,” Yurkova said. Although StopFake now publishes in eleven languages and has thirty employees, the organization still operates on a shoestring budget: two hundred and twenty-five thousand dollars in 2016, compared to an over-all U.S. intelligence budget of seventy billion dollars. StopFake doesn’t have an office, and, to save money, all of its workers use their personal computers and communicate via Facebook.
Another research center whose work is public is the Strategic Communications Centre of Excellence, a NATO-affiliated organization housed in a boxy white building, which I visited last spring in Riga, Latvia. The center’s 2014 report on Russia’s campaign against Ukraine identified the same themes that the Kremlin would use against the United States two years later. “Russia media has systematically cultivated a feeling of fear and anxiety,” the report found. The Presidential Administration, a Kremlin office under the direct authority of Vladimir Putin, “controls a large number of bloggers and trolls in the social media to spread information supporting Russia’s narrative and to silence opponents.” The report said that the bloggers use false personas and identities to flood Facebook and Twitter discussions.
Another analyst who publicly identified Russian disinformation tactics more than two years ago is the former journalist Ben Nimmo, now an Edinburgh-based propaganda expert and senior fellow at the Atlantic Council’s Digital Forensic Research Lab. Nimmo first noticed Kremlin-linked social media interfering in Western democratic processes during the 2014 Scottish independence referendum, and he says that they remain active in the U.S. today.
“The structures that are in place are still operating,” Nimmo said. The hundreds of fake accounts that Facebook and Twitter recently identified as Russian-created, he warned, “are like cannon fodder. The Russians use them and just throw them away and create new ones.” Yet the intelligence community remains silent, as if the Russians had gone away.
I found at least a dozen other institutes that appeared to be producing groundbreaking work. Mark Laity, the director of strategic communications at NATO military headquarters, lauded the work of research groups. “They’ve very often done far better than officialdom,” he told me. “They’re producing product that is superb.”
None of the work of these non-government researchers is conducted using surveillance systems, supercomputers, or subpoena power. Nothing the public researchers do is classified. And that is precisely the problem. Government analysts have always viewed open-source information, or OSINT, as it is called in the intelligence world, as a poor substitute for classified information. Intelligence officials often dismiss the importance of public pronouncements by foreign leaders, actions recorded by journalists, data collected by university professors, and discussions at open conferences. It is a decades-old problem. In 2002, the practice helped blind U.S. intelligence officials to the International Atomic Energy Agency’s evidence that Iraq did not actually possess weapons of mass destruction. In 2010, it blinded them again to the Arab Spring revolutions brewing across the Middle East. Devaluing OSINT has become a more significant problem as Russia and China use social media as an arena to wage disinformation operations.
Unless F.B.I. agents and American intelligence officers get over this bias, they will continue asking for special powers to snoop on Internet users in ways that should not be allowed. If they are denied their surveillance requests, they will likely throw up their hands and say that they then can’t help fix the problem. (The F.B.I. declined to comment for this article.)
Russian disinformation operations in the United States continue unabated. Leaving a recent closed-door hearing on the Russian campaign, the Senate Intelligence Committee chairman, Richard Burr, a Republican from North Carolina, told reporters, “You can’t walk away from this and believe that Russia’s not currently active.”
The senior intelligence official I interviewed expressed the same concern. “I don’t think we’ve seen a change at all in Russian activity,” she told me. “They are still trying to use race, religion, Democrats, Republicans, E.U., NATO issues as a division. They are still on social media in every way. There’s no change.” The official expressed worry because there has been no intense public debate in the United States, as there has been in the Baltics and Ukraine, about how to respond to Russian disinformation. “I don’t think we’ve been through the same national conversation as Ukraine and other countries to say we will use everything we can to defend against it,” she said.
To see the ongoing Russia disinformation campaign for myself, one day in late September, I went to the Alliance for Securing Democracy’s new public dashboard of trending stories on six hundred Kremlin-oriented or -influenced Twitter accounts. That day, they included claims that the United States is helping ISIS in Syria, conspiracies about the Las Vegas mass shooting, and an attack on the actor Morgan Freeman for launching the Committee to Investigate Russia. The Freeman post—with the headline “Morgan Freeman Psy-Op Proves How Desperate the Deep State Has Become,”—was the most popular.
The 9/11 attacks were followed by a cascade of investigative journalism, congressional committees, and special panels that uncovered damning evidence of the I.C.’s failure to detect the plot and warn the public beforehand. This pattern could repeat itself soon in the Russian debacle. It doesn’t matter that President Trump believes that the allegations are a hoax perpetrated by the media and Democrats. It doesn’t matter that he believes Putin when the Russian leader told him this weekend that he did not meddle in the American elections. It doesn’t matter because the press and Congress are still free to do what they are empowered and protected by the Constitution to do—hold the executive branch accountable.
To avoid long drawn-out investigations and the wasting of even more time, the I.C. should remember two of the most important lessons that emerged after 9/11: it is unwise to conceal the truth and to pretend that all is well. Instead, the director of National Intelligence, Daniel Coats, one of the few members of the Trump Cabinet whose reputation for independence is still intact, could quickly deliver to the public the details of the Russian disinformation effort—minus only the most perishable sources and methods. He could commission educational materials, like those on StopFake’s Web site, that help the public spot online disinformation. He could disclose to Congress the weaknesses in the I.C.’s capabilities, and make the case for rearranging resources to combat this not-so-new threat. Members of Congress should pay special attention to the F.B.I., which conducts counterintelligence in the United States but which, according to most insiders I interviewed recently, is not up to the job of detecting and countering Russian disinformation.
If Coats doesn’t take these steps, then Congress should do so. There is no time to waste. As the senior intelligence officer told me recently, “We have no reason to believe that 2018 will be any different.”
