How the Kremlin Changed Tactics from Its 2016 Election Strategy

The recent US indictment of two employees of Russia's state-run media network RT underscores a significant shift in the Kremlin's tactics to influence US elections since 2016, current and former US officials tell CNN.

Rather than relying on fake accounts and online personas, the current effort alleged in this week’s indictment involves co-opting real American influencers to try to promote Russian narratives to American audiences, particularly aimed at undermining support for Ukraine.

The indictment alleges that RT employees secretly paid nearly $10 million to a Tennessee company that hired prominent right-wing commentators who produced content on hot-button political issues, including Russia’s war on Ukraine. The influencers say they were unaware of any Russian interference in the operations of the media company, which CNN identified as Tenet Media, and that they controlled their own content.

“Buying authentic influencers is a much better use of funds than creating fake personas because they bring their own trusted audience and are actually, you know, real,” Renee DiResta, an online influencer operations expert, said in a social media post.

With its US bureaus forced to close in 2022 following Russia's invasion of Ukraine, RT has resorted to more covert operations to spread its message, prosecutors say.

The shift shows that Russia's best bet to undermine U.S. support for Ukraine may be to capitalize on influential American voices that bypass mainstream media and criticize aid to kyiv, the sources said.

“The Russians have diversified their activities well beyond the 2016 model,” said Chris Krebs, former director of the federal Cybersecurity and Infrastructure Security Agency. “It’s not clear what the real impact is, at least from a tactical perspective. My sense is that they’re not succeeding in changing specific behaviors or decisions, like the outcome of a single election,” Krebs said. “However, it’s much more likely that the Russian efforts are burning on a longer fuse, and we’re not really measuring the true damage that’s being done yet.”

“It's day and night”

The Russian shift in tactics also shows a keen understanding of the fractured media environment in the United States. Whereas in 2016, Russian intelligence services prioritized leaking hacked information to reach mainstream media outlets, they are now directly tapping into a disparate corner of conservative media, where individual podcasters reach audiences that rival those of traditional newspapers.

As a result, Russia no longer needs to orchestrate the type of hacking and information-leaking operation it successfully used in 2016, when Russian intelligence agents stole a trove of emails from Democratic officials and leaked them to WikiLeaks.

The Russians believed that the American media would view WikiLeaks as a relatively credible source of information, according to Michael van Landingham, a former CIA official who assessed Russian activity in 2016.

“But now, in the absence of an ongoing hacking and information leak campaign, Russia has reverted to the old tactic of supporting public voices that express views aligned with the Russian message,” van Landingham said.

Artificial intelligence has also allowed Russian (and other) intelligence agencies to pose as Americans online with fake photos and biographies.

“It’s night and day,” said Emerson Brooking, a senior fellow in residence at the Atlantic Council’s Digital Forensics Research Lab. Compared to 2016, this time around, “Russian actors have demonstrated a much more sophisticated understanding of the U.S. cyber environment,” Brooking said.

It's also unclear how useful hacking and leak operations would be in 2024. Journalists are more alert to foreign influence efforts, and at least one known operation aimed at influencing this year's election had questionable impact.

Iran carried out its own hack this summer, stealing documents from the Trump campaign and sending them to several major media outlets, as CNN previously reported. But the contents of the stolen documents have been little discussed, in part because they were unremarkable.

“It's basically a cycle of scams”

The Justice Department also seized dozens of fake news sites Wednesday that other Russian companies used to closely mimic the look and feel of Fox News and The Washington Post. The Russian companies used ChatGPT, the popular artificial intelligence tool, to write some of their content, according to an FBI statement.

Internal project documents from one of the Russian companies propose targeting American voters in six key states with disinformation, addressing themes such as the “risk of job loss for white Americans” and the alleged threat of crime from “Ukrainian immigrants,” according to the affidavit.

“They were obsessed with impact and set clear goals,” Brooking said.

But it’s hard to gauge the impact and effectiveness of Russian influence efforts. Influencers hired by Tenet Media, including Benny Johnson and Tim Pool, claim to have been victims of the alleged Russian scheme. They had millions of followers to whom they were channeling their opinions long before, according to the indictment, RT employees invested in Tenet Media.

“I'm skeptical that this operation would have resulted in preaching to someone who wasn't already converted,” Gavin Wilde, a former National Security Council official who specializes in Russia, told CNN.

“It’s basically a scam cycle,” said Jason Kikta, a former U.S. Cyber ​​Command official now employed by the security firm Automox. “Russian money allows them to expand their operations into the ideologically aligned population to further increase the scams, while the Russians can boast of their fanciful success within their government for budgetary and career advancement reasons.”

For more CNN news and newsletters, create an account at CNN.com