Report On The Investigation Into Russian Interference In The 2016 Presidential Election/Russian "Active Measures" Social Media Campaign

II. Russian "Active Measures" Social Media Campaign

The first form of Russian election influence came principally from the Internet Research Agency, LLC (IRA), a Russian organization funded by Yevgeniy Viktorovich Prigozhin and companies he controlled, including Concord Management and Consulting LLC and Concord Catering (collectively "Concord").[1] The IRA conducted social media operations targeted at large U.S. audiences with the goal of sowing discord in the U.S. political system.[2] These operations constituted "active measures" (активные мероприятия), a term that typically refers to operations conducted by Russian security services aimed at influencing the course of international affairs.[3]

The IRA and its employees began operations targeting the United States as early as 2014. Using fictitious U.S. personas, IRA employees operated social media accounts and group pages designed to attract U.S. audiences. These groups and accounts, which addressed divisive U.S. political and social issues, falsely claimed to be controlled by U.S. activists. Over time, these social media accounts became a means to reach large U.S. audiences. IRA employees travelled to the United States in mid-2014 on an intelligence-gathering mission to obtain information and photographs for use in their social media posts.

IRA employees posted derogatory information about a number of candidates in the 2016 U.S. presidential election. By early to mid-2016, IRA operations included supporting the Trump Campaign and disparaging candidate Hillary Clinton. The IRA made various expenditures to carry out those activities, including buying political advertisements on social media in the names of U.S. persons and entities, Some IRA employees, posing as U.S. persons and without revealing their Russian association, communicated electronically with individuals associated with the Trump Campaign and with other political activists to seek to coordinate political activities, including the staging of political rallies.[4] The investigation did not identify evidence that any U.S. persons knowingly or intentionally coordinated with the IRA's interference operation,

By the end of the 2016 U.S. election, the IRA had the ability to reach millions of U.S. persons through their social media accounts. Multiple IRA-controlled Facebook groups and Instagram accounts had hundreds of thousands of U.S. participants. IRA-controlled Twitter accounts separately had tens of thousands of followers, including multiple U.S. political figures who retweeted IRA-created content. In November 2017, a Facebook representative testified that Facebook had identified 470 IRA-controlled Facebook accounts that collectively made 80,000 posts between January 2015 and August 2017. Facebook estimated the IRA reached as many as 126 million persons through its Facebook accounts.[5] In January 2018, Twitter announced that it had identified 3,814 IRA-controlled Twitter accounts and notified approximately 1.4 million people Twitter believed may have been in contact with an IRA-controlled account.[6]

A. Structure of the Internet Research Agency

Harm to Ongoing Matter [7]Harm to Ongoing Matter[8]
      Harm to Ongoing Matter 
 [9]

The organization quickly grew. Harm to Ongoing Matter 
   [10]  
Harm to Ongoing Matter 
   
 [11]

The growth of the organization also led to a more detailed organizational structure.  
Harm to Ongoing Matter 

Harm to Ongoing Matter 
         [12]

Two individuals headed the IRA's management: its general director, Mikhail Bystrov, and its executive director, Mikhail Burchik. Harm to Ongoing Matter 
     [13] Harm to Ongoing Matter 
 [14]

As early as the spring of 2014, the IRA began to hide its funding and activities.  
Harm to Ongoing Matter 
       [15]

The IRA's U.S. operations are part of a larger set of interlocking operations known as "Project Lakhta,"Harm to Ongoing Matter 
    [16] Harm to Ongoing Matter 
   [17]

B. Funding and Oversight from Concord and Prigozhin

Until at least February 2018, Yevgeniy Viktorovich Prigozhin and two Concord companies funded the IRA. Prigozhin is a wealthy Russian businessman who served as the head of Concord.

Harm to Ongoing Matter  Prigozhin was sanctioned by the U.S. Treasury Department in December 2016,[18] Harm to Ongoing Matter  [19] Harm to Ongoing Matter 
 
 [20] Numerous media sources have reported on Prigozhin's ties to Putin, and the two have appeared together in public photographs.[21]

Harm to Ongoing Matter  
 
 [22]Harm to Ongoing Matter 
 

Harm to Ongoing Matter  
     
 [23]Harm to Ongoing Matter  [24]Harm to Ongoing Matter  

Harm to Ongoing Matter  
  Harm to Ongoing Matter  
  

Harm to Ongoing Matter  
 
 [25] Harm to Ongoing Matter  
   
 [26]

Harm to Ongoing Matter  
             

Harm to Ongoing Matter  
   
 [27] Harm to Ongoing Matter     IRA employees were aware that Prigozhin was involved in the IRA's U.S. operations, Harm to Ongoing Matter 
 [28]
Harm to Ongoing Matter  
 [29] In May 2016, IRA employees, claiming to be U.S. social activists and administrators of Facebook groups, recruited U.S. persons to hold signs (including one in front of the White House) that read "Happy 55th Birthday Dear Boss," as an homage to Prigozhin (whose 55th birthday was on June 1, 2016).[30]Harm to Ongoing Matter 
 [31]

Harm to Ongoing Matter  
             

C. The IRA Targets U.S. Elections
1. The IRA Ramps Up U.S. Operations As Early As 2014

The IRA's U.S. operations sought to influence public opinion through online media and forums. By the spring of 2014, the IRA began to consolidate U.S. operations within a single general department, known internally as the "Translator" (Переводчик) department. Harm to Ongoing Matter   IRA subdivided the Translator Department into different responsibilities, ranging from operations on different social media platforms to analytics to graphics and IT.

Harm to Ongoing Matter  
 
 [32] Harm to Ongoing Matter 
    [33]

Harm to Ongoing Matter  
                           

Harm to Ongoing Matter  
 [34]
Harm to Ongoing Matter  
    [35]

Harm to Ongoing Matter  
  

 
   
 

  

 
 

  

   [36]

IRA employees also traveled to the United States on intelligence-gathering missions. In June 2014, four IRA employees applied to the U.S. Department of State to enter the United States, while lying about the purpose of their trip and claiming to be four friends who had met at a party.[37] Ultimately, two IRA employees—Anna Bogachevya and Aleksandra Krylova—received visas and entered the United States on June 4, 2014.

Prior to traveling, Krylova and Bogacheva compiled itineraries and instructions for the trip. Harm to Ongoing Matter 
   
 [38] Harm to Ongoing Matter  Harm to Ongoing Matter  [39]  
Harm to Ongoing Matter    [40]

2. U.S. Operations Through IRA-Controlled Social Media Accounts

Dozens of IRA employees were responsible for operating accounts and personas on different U.S. social media platforms. The IRA referred to employees assigned to operate the social media accounts as "specialists."[41] Starting as early as 2014, the IRA's U.S. operations included social media specialists focusing on Facebook, YouTube, and Twitter.[42] The IRA later added specialists who operated on Tumblr and Instagram accounts.[43]

Initially, the IRA created social media accounts that pretended to be the personal accounts of U.S. persons.[44] By early 2015, the IRA began to create larger social media groups or public social media pages that claimed (falsely) to be affiliated with U.S. political and grassroots organizations. In certain cases, the IRA created accounts that mimicked real U.S. organizations. For example, one IRA-controlled Twitter account, @TEN_GOP, purported to be connected to the Tennessee Republican Party.[45] More commonly, the IRA created accounts in the names of fictitious U.S. organizations and grassroots groups and used these accounts to pose as anti-immigration groups, Tea Party activists, Black Lives Matter protestors, and other U.S. social and political activists.

The IRA closely monitored the activity of its social media accounts.  
Harm to Ongoing Matter  
  Harm to Ongoing Matter 
          [46] Harm to Ongoing Matter 
  [47]

Harm to Ongoing Matter 
             

By February 2016, internal IRA documents referred to support for the Trump Campaign and opposition to candidate Clinton.[48] For example, HOM  directions to IRA operators Harm to Ongoing Matter 
  "Main idea: Use any opportunity to criticize Hillary [Clinton] and the rest (except Sanders and Trump - we support them)."[49] Harm to Ongoing Matter 
     

The focus on the U.S. presidential campaign continued throughout 2016. In HOM 2016 internal HOM  reviewing the IRA-controlled Facebook group "Secured Borders," the author criticized the "lower number of posts dedicated to criticizing Hillary Clinton" and reminded the Facebook specialist "it is imperative to intensify criticizing Hillary Clinton.[50]

IRA employees also acknowledged that their work focused on influencing the U.S. presidential election. Harm to Ongoing Matter 

Harm to Ongoing Matter 
 
 
 
 .[51]
3. U.S. Operations Through Facebook

Many IRA operations used Facebook accounts created and operated by its specialists. Harm to Ongoing Matter 

Harm to Ongoing Matter 
     
   
   
 [52]

Harm to Ongoing Matter 
   [53] IRA Facebook groups active during the 2016 campaign covered a range of political issues and included purported conservative groups (with names such as "Being Patriotic," "Stop All Immigrants," "Secured Borders," and "Tea Party News"), purported Black social justice groups ("Black Matters," "Blacktivist," and "Don't Shoot Us"), LGBTQ groups ("LGBT United"), and religious groups ("United Muslims of America").

Throughout 2016, IRA accounts published an increasing number of materials supporting the Trump Campaign and opposing the Clinton Campaign. For example, on May 31, 2016, the operational account "Matt Skiber" began to privately message dozens of pro-Trump Facebook groups asking them to help plan a "pro-Trump rally near Trump Tower."[54]

To reach larger U.S. audiences, the IRA purchased advertisements from Facebook that promoted the IRA groups on the newsfeeds of U.S. audience members. According to Facebook, the IRA purchased over 3,500 advertisements, and the expenditures totaled approximately $100,000.[55]

During the U.S. presidential campaign, many IRA-purchased advertisements explicitly supported or opposed a presidential candidate or promoted U.S. rallies organized by the IRA (discussed below). As early as March 2016, the IRA purchased advertisements that overtly opposed the Clinton Campaign. For example, on March 18, 2016, the IRA purchased an advertisement depicting candidate Clinton and a caption that read in part, "If one day God lets this liar enter the White House as a president—that day would be a real national tragedy."[56] Similarly, on April 6, 2016, the IRA purchased advertisements for its account "Black Matters" calling for a "flashmob" of U.S. persons to "take a photo with #HillaryClintonForPrison2016 or #nohillary2016."[57] IRA-purchased advertisements featuring Clinton were, with very few exceptions, negative.[58]

IRA-purchased advertisements referencing candidate Trump largely supported his campaign. The first known IRA advertisement explicitly endorsing the Trump Campaign was purchased on April 19, 2016. The IRA bought an advertisement for its Instagram account "Tea Party News" asking U.S. persons to help them "make a patriotic team of young Trump supporters" by uploading photos with the hashtag "#KIDS4TRUMP."[59] In subsequent months, the IRA purchased dozens of advertisements supporting the Trump Campaign, predominantly through the Facebook groups "Being Patriotic," "Stop All Invaders," and "Secured Borders."

Collectively, the IRA's social media accounts reached tens of millions of U.S. persons. Individual IRA social media accounts attracted hundreds of thousands of followers. For example, at the time they were deactivated by Facebook in mid-2017, the IRA's "United Muslims of America" Facebook group had over 300,000 followers, the "Don't Shoot Us" Facebook group had over 250,000 followers, the "Being Patriotic" Facebook group had over 200,000 followers, and the "Secured Borders" Facebook group had over 130,000 followers.[60] According to Facebook, in total the IRA-controlled accounts made over 80,000 posts before their deactivation in August 2017, and these posts reached at least 29 million U.S persons and "may have reached an estimated 126 million people."[61]

4. U.S. Operations Through Twitter

A number of IRA employees assigned to the Translator Department served as Twitter specialists. Harm to Ongoing Matter [62]

The IRA's Twitter operations involved two strategies. First, IRA specialists operated certain Twitter accounts to create individual U.S. personas, Harm to Ongoing Matter [63] Separately, the IRA operated a network of automated Twitter accounts (commonly referred to as a bot network) that enabled the IRA to amplify existing content on Twitter.

a. Individualized Accounts

Harm to Ongoing Matter [64] Harm to Ongoing Matter   [65] The IRA operated individualized Twitter accounts similar to the operation of its Facebook accounts, by continuously posting original content to the accounts while also communicating with U.S. Twitter users directly (through public tweeting or Twitter's private messaging).

The IRA used many of these accounts to attempt to influence U.S. audiences on the election. Individualized accounts used to influence the U.S. presidential election included @TEN_GOP (described above); @jenn_abrams (claiming to be a Virginian Trump supporter with 70,000 followers); @Pamela_Moore13 (claiming to be a Texan Trump supporter with 70,000 followers); and @America_1st_ (an anti-immigration persona with 24,000 followers).[66] In May 2016, the IRA created the Twitter account @march_for_trump, which promoted IRA-organized rallies in support of the Trump Campaign (described below).[67]

Harm to Ongoing Matter 
   

Harm to Ongoing Matter 
 
 [68]

Using these accounts and others, the IRA provoked reactions from users and the media. Multiple IRA-posted tweets gained popularity.[69] U.S. media outlets also quoted tweets from IRA-controlled accounts and attributed them to the reactions of real U.S. persons.[70] Similarly, numerous highprofile U.S. persons, including former Ambassador Michael McFaul,[71] Roger Stone,[72] Sean Hannity,[73] and Michael Flynn Jr.,[74] retweeted or responded to tweets posted to these IRA-controlled accounts. Multiple individuals affiliated with the Trump Campaign also promoted IRA tweets (discussed below).

b. IRA Botnet Activities

Harm to Ongoing Matter [75]

Harm to Ongoing Matter 
 
 
 
 [76]

Harm to Ongoing Matter 
 [77]

In January 2018, Twitter publicly identified 3,814 Twitter accounts associated with the IRA.[78] According to Twitter, in the ten weeks before the 2016 U.S. presidential election, these accounts posted approximately 175,993 tweets, "approximately 8.4% of which were electionrelated."[79] Twitter also announced that it had notified approximately 1.4 million people who Twitter believed may have been in contact with an IRA-controlled account.[80]

5. U.S. Operations Involving Political Rallies

The IRA organized and promoted political rallies inside the United States while posing as U.S. grassroots activists. First, the IRA used one of its preexisting social media personas (Facebook groups and Twitter accounts, for example) to announce and promote the event. The IRA then sent a large number of direct messages to followers of its social media account asking them to attend the event. From those who responded with interest in attending, the IRA then sought a U.S. person to serve as the event's coordinator, In most cases, the IRA account operator would tell the U.S. person that they personally could not attend the event due to some preexisting conflict or because they were somewhere else in the United States.[81] The IRA then further promoted the event by contacting U.S. media about the event and directing them to speak with the coordinator.[82] After the event, the IRA posted videos and photographs of the event to the IRA's social media accounts.[83]

The Office identified dozens of U.S. rallies organized by the IRA. The earliest evidence of a rally was a "confederate rally" in November 2015.[84] The IRA continued to organize rallies even after the 2016 U.S. presidential election. The attendance at rallies varied, Some rallies appear to have drawn few (if any) participants, while others drew hundreds. The reach and success of these rallies was closely monitored Harm to Ongoing Matter 
 


Harm to Ongoing Matter 
                                     

A non-free image has been removed from this page.
An image captioned "IRA Poster for Pennsylvania Rallies organized by the IRA" has been removed due to copyright restrictions.

From June 2016 until the end of the presidential campaign, almost all of the U.S. rallies organized by the IRA focused on the U.S. election, often promoting the Trump Campaign and opposing the Clinton Campaign. Pro-Trump rallies included three in New York; a series of pro-Trump rallies in Florida in August 2016; and a series of pro-Trump rallies in October 2016 in Pennsylvania. The Florida rallies drew the attention of the Trump Campaign, which posted about the Miami rally on candidate Trump's Facebook (as discussed below).[85]

Many of the same IRA employees who oversaw the IRA's social media accounts also conducted the day-to-day recruiting for political rallies inside the United States.                    
Harm to Ongoing Matter                                      
                                                                                                                       
                                                                                                                       
                                                                               [86]

6. Targeting and Recruitment of U.S. Persons

As early as 2014, the IRA instructed its employees to target U.S. persons who could be used to advance its operational goals. Initially, recruitment focused on U.S. persons who could amplify the content posted by the IRA. Harm to Ongoing Matter                                                                                
                                                                               

Harm to Ongoing Matter                                                                                                                                                                                                        
 
 
 
                                                                                                                                                                                                       .[87]

IRA employees frequently used Investigative Technique           Twitter, Facebook, and Instagram to contact and recruit U.S. persons who followed the group. The IRA recruited U.S. persons from across the political spectrum. For example, the IRA targeted the family of          
Personal Privacy                                                                                 and a number of black social justice activists while posing as a grassroots group called "Black Matters US."[88] In February 2017, the persona "Black Fist" (purporting to want to teach African-Americans to protect themselves when contacted by law enforcement) hired a self-defense instructor in New York to offer classes sponsored by Black Fist. The IRA also recruited moderators of conservative social media groups to promote IRA-generated content,[89] as well as recruited individuals to perform political acts (such as walking around New York City dressed up as Santa Claus with a Trump mask).[90]

Harm to Ongoing Matter 
     
 [91] Harm to Ongoing Matter 
 [92] Harm to Ongoing Matter 
 
 [93]

HOM  as the IRA's online audience became larger, the IRA tracked U.S. persons with whom they communicated and had successfully tasked (with tasks ranging from organizing rallies to taking pictures with certain political messages). Harm to Ongoing Matter 
     
 [94] Harm to Ongoing Matter 
               


7. Interactions and Contacts with the Trump Campaign

The investigation identified two different forms of connections between the IRA and members of the Trump Campaign. (The investigation identified no similar connections between the IRA and the Clinton Campaign.) First, on multiple occasions, members and surrogates of the Trump Campaign promoted—typically by linking, retweeting, or similar methods of reposting—pro-Trump or anti-Clinton content published by the IRA through IRA-controlled social media accounts, Additionally, in a few instances, IRA employees represented themselves as U.S. persons to communicate with members of the Trump Campaign in an effort to seek assistance and coordination on IRA-organized political rallies inside the United States.

a. Trump Campaign Promotion of IRA Political Materials

Among the U.S. "leaders of public opinion" targeted by the IRA were various members and surrogates of the Trump Campaign. In total, Trump Campaign affiliates promoted dozens of tweets, posts, and other political content created by the IRA.

-   Posts from the IRA-controlled Twitter account @TEN_GOP were cited or retweeted by multiple Trump Campaign officials and surrogates, including Donald J. Trump Jr.,[95] Eric Trump,[96] Kellyanne Conway,[97] Brad Parscale,[98] and Michael T. Flynn.[99] These posts included allegations of voter fraud,[100] as well as allegations that Secretary Clinton had mishandled classified information.[101]

A non-free image has been removed from this page.

Screenshot of Trump Facebook Account (from Matt Skiber)

  • A November 7, 2016 post from the IRA-controlled Twitter account @Pamela_Moore13 was retweeted by Donald J. Trump Jr.[102]
  • On September 19, 2017, President Trump's personal account @realDonaldTrump responded to a tweet from the IRA-controlled account @10_gop (the backup account of @TEN_GOP, which had already been deactivated by Twitter). The tweet read: "We love you, Mr. President!"[103]

IRA employees monitored the reaction of the Trump Campaign and, later, Trump Administration officials to their tweets. For example, on August 23, 2016, the IRA-controlled persona "Matt Skiber" Facebook account sent a message to a U.S. Tea Party activist, writing that "Mr. Trump posted about our event in Miami! This is great!"[104] The IRA employee included a screenshot of candidate Trump's Facebook account, which included a post about the August 20, 2016 political rallies organized by the IRA. Harm to Ongoing Matter 
 [105]

b. Contact with Trump Campaign Officials in Connection to Rallies

Starting in June 2016, the IRA contacted different U.S. persons affiliated with the Trump Campaign in an effort to coordinate pro-Trump IRA-organized rallies inside the United States. In all cases, the IRA contacted the Campaign while claiming to be U.S. political activists working on behalf of a conservative grassroots organization. The IRA's contacts included requests for signs and other materials to use at rallies,[106] as well as requests to promote the rallies and help coordinate logistics.[107] While certain campaign volunteers agreed to provide the requested support (for example, agreeing to set aside a number of signs), the investigation has not identified evidence that any Trump Campaign official understood the requests were coming from foreign nationals.

***

In sum, the investigation established that Russia interfered in the 2016 presidential election through the "active measures" social media campaign carried out by the IRA, an organization funded by Prigozhin and companies that he controlled. As explained further in Volume I, Section V.A, infra, the Office concluded (and a grand jury has alleged) that Prigozhin, his companies, and IRA employees violated U.S. law through these operations, principally by undermining through deceptive acts the work of federal agencies charged with regulating foreign influence in U.S. elections.


  1. The Office is aware of reports that other Russian entities engaged in similar active measures operations targeting the United States. Some evidence collected by the Office corroborates those reports, and the Office has shared that evidence with other offices in the Department of Justice and FBI.
  2. Harm to Ongoing Matter see also SM-2230634, serial 44 (analysis). The FBI case number cited here, and other FBI case numbers identified in the report, should be treated as law enforcement sensitive given the context. The report contains additional law enforcement sensitive information.
  3. As discussed in Part V below, the active measures investigation has resulted in criminal charges against 13 individual Russian nationals and three Russian entities, principally for conspiracy to defraud the United States, in violation of 18 U.S.C. § 371. See Volume 1, Section V.A, infra; Indictment, United States v. Internet Research Agency, et al., 1:18-cr-32 (D.D.C. Feb, 16, 2018), Doc. 1 ("Internet Research Agency Indictment").
  4. Internet Research Agency Indictment ¶¶ 52, 54, 55(a), 56, 74; Harm to Ongoing Matter
  5. Social Media Influence in the 2016 U.S. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/17) (testimony of Colin Stretch, General Counsel of Facebook) ("We estimate that roughly 29 million people were served content in their News Feeds directly from the IRA's 80,000 posts over the two years. Posts from these Pages were also shared, liked, and followed by people on Facebook, and, as a result, three times more people may have been exposed to a story that originated from the Russian operation. Our best estimate is that approximately 126 million people may have been served content from a Page associated with the IRA at some point during the two-year period."). The Facebook representative also testified that Facebook had identified 170 Instagram accounts that posted approximately 120,000 pieces of content during that time. Facebook did not offer an estimate of the audience reached via Instagram.
  6. Twitter, Update on Twitter's Review of the 2016 US Election (Jan. 31, 2018).
  7. See SM-2230634, serial 92.
  8. Harm to Ongoing Matter 
     
  9. Harm to Ongoing Matter 
  10. See SM-2230634, serial 86Harm to Ongoing Matter 
  11. Harm to Ongoing Matter 
     
  12. Harm to Ongoing Matter 
  13. See, e.g., SM-2230634, serials 9, 113 & 180 Harm to Ongoing Matter 
     .
  14. Harm to Ongoing Matter 
  15. Harm to Ongoing Matter 
          See SM-2230634, serials 131 & 204.
  16. Harm to Ongoing Matter 
  17. Harm to Ongoing Matter 
  18. U.S. Treasury Department, "Treasury Sanctions Individuals and Entities in Connection with Russia's Occupation of Crimea and the Conflict in Ukraine" (Dec. 20, 2016).
  19. Harm to Ongoing Matter 
     
  20. Harm to Ongoing Matter 
       
  21. See, e.g., Neil MacFarquhar, Yevgeny Prigozhin, Russian Oligarch Indicted by U.S., Is Known as "Putin's Cook", New York Times (Feb, 16, 2018).
  22. Harm to Ongoing Matter 
  23. Harm to Ongoing Matter 
  24. Harm to Ongoing Matter  see also SM-2230634, serial 113 HOM  
  25. Harm to Ongoing Matter 
  26. Harm to Ongoing Matter 
  27. The term "troll" refers to internet users—in this context, paid operatives—who post inflammatory or otherwise disruptive content on social media or other websites.
  28. Investigative Technique  See SM-2230634, serials 131 & 204.
  29. See SM-2230634, serial 156.
  30. Internet Research Agency Indictment § 12(b); see also 5/26/16 Facebook Messages, ID 1479936895656747 (United Muslims of America) & Personal Privacy 
  31. Harm to Ongoing Matter  see also SM-2230634, serial 189. Harm to Ongoing Matter 
  32. Harm to Ongoing Matter   See SM-2230634, serial 205.
  33. See SM-2230634, serial 204 Harm to Ongoing Matter 
  34. Harm to Ongoing Matter 
  35. Harm to Ongoing Matter  
  36. Harm to Ongoing Matter 
  37. See SM-2230634, serials 150 & 172 Harm to Ongoing Matter .
  38. Harm to Ongoing Matter 
      Harm to Ongoing Matter 
     
  39. Harm to Ongoing Matter 
     
  40. Harm to Ongoing Matter  
     
  41. Harm to Ongoing Matter 
     
  42. Harm to Ongoing Matter 
     .
  43. See, e.g., SM-2230634, serial 179 Harm to Ongoing Matter  
     
  44. See, e.g., Facebook ID 100011390466802 (Alex Anderson); Facebook ID 100009626173204 (Andrea Hansen); Facebook ID 100009728618427 (Gary Williams); Facebook ID 100013640043337 (Lakisha Richardson).
  45. The account claimed to be the "Unofficial Twitter of Tennessee Republicans" and made posts that appeared to be endorsements of the state political party. See, e.g., @TEN_GOP, 4/3/16 Tweet ("Tennessee GOP backs @realDonaldTrump period #makeAmericagreatagain #tngop #tennessee #gop").
  46. Harm to Ongoing Matter 
  47. See, e.g., SM-2230634 serial 131 HOM .
  48. The IRA posted content about the Clinton candidacy before Clinton officially announced her presidential campaign. IRA-controlled social media accounts criticized Clinton's record as Secretary of State and promoted various critiques of her candidacy. The IRA also used other techniques.  
    Harm to Ongoing Matter 
      See SM-2230634, serial 70.
  49. Harm to Ongoing Matter 
  50. Harm to Ongoing Matter 
  51. Harm to Ongoing Matter
  52. Harm to Ongoing Matter
  53. Harm to Ongoing Matter
  54. 5/31/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID PP  5/31/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID Personal Privacy
  55. Social Media Influence in the 2016 U.S. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/17) (testimony of Colin Stretch, General Counsel of Facebook).
  56. 3/18/16 Facebook Advertisement ID 6045505152575.
  57. 4/6/16 Facebook Advertisement ID 6043740225319.
  58. See SM-2230634, serial 213 (documenting politically-oriented advertisements from the larger set provided by Facebook).
  59. 4/19/16 Facebook Advertisement ID 6045151094235.
  60. See Facebook ID 1479936895656747 (United Muslims of America); Facebook ID 1157233400960126 (Don't Shoot); Facebook ID 1601685693432389 (Being Patriotic); Facebook ID 757183957716200 (Secured Borders). Harm to Ongoing Matter
    Harm to Ongoing Matter

    Harm to Ongoing Matter

  61. Social Media Influence in the 2016 U.S. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/17) (testimony of Colin Stretch, General Counsel of Facebook).
  62. Harm to Ongoing Matter
  63. Harm to Ongoing Matter
  64. Harm to Ongoing Matter
  65. Harm to Ongoing Matter
  66. Other individualized accounts included @MissouriNewsUS (an account with 3,800 followers that posted pro-Sanders and anti-Clinton material).
  67. See @march_for_trump, 5/30/16 Tweet (first post from account).
  68. Harm to Ongoing Matter
  69. For example, one IRA account tweeted, "To those people, who hate the Confederate flag. Did you know that the flag and the war wasn't about slavery, it was all about money." The tweet received over 40,000 responses. @Jenn_Abrams 4/24/17 (2:37 p.m.) Tweet.
  70. Josephine Lukito & Chris Wells, Most Major Outlets Have Used Russian Tweets as Sources for Partisan Opinion: Study, Columbia Journalism Review (Mar. 8, 2018); see also Twitter Steps Up to Explain #NewYorkValues to Ted Cruz, Washington Post (Jan. 15, 2016) (citing IRA tweet); People Are Slamming the CIA for Claiming Russia Tried to Help Donald Trump, U.S. News & World Report (Dec. 12, 2016).
  71. @McFaul 4/30/16 Tweet (responding to tweet by @Jenn_Abrams).
  72. @RogerJStoneJr 5/30/16 Tweet (retweeting @Pamela_Moore13); @RogerJStoneJr 4/26/16 Tweet (same).
  73. @seanhannity 6/21/17 Tweet (retweeting @Pamela_Moore13).
  74. @mflynnJR 6/22/17 Tweet ("RT @Jenn_Abrams: This is what happens when you add the voice over of an old documentary about mental illness onto video of SJWs…").
  75. A botnet refers to a network of private computers or accounts controlled as a group to send specific automated messages. On the Twitter network, botnets can be used to promote and republish ("retweet") specific tweets or hashtags in order for them to gain larger audiences.
  76. Harm to Ongoing Matter
  77. Harm to Ongoing Matter
  78. Eli Rosenberg, Twitter to Tell 677,000 Users they Were Had by the Russians. Some Signs Show the Problem Continues, Washington Post (Jan. 19, 2019).
  79. Twitter, "Update on Twitter's Review of the 2016 US Election" (updated Jan. 31, 2018). Twitter also reported identifying 50,258 automated accounts connected to the Russian government, which tweeted more than a million times in the ten weeks before the election.
  80. Twitter, "Update on Twitter's Review of the 2016 US Election" (updated Jan. 31, 2018).
  81. 8/20/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID PP
  82. See, eg. 7/21/16 Email, joshmilton024 at gmail.com to PP; 7/21/16 Email, joshmilton024 at gmail.com to Personal Privacy
  83. @march_for_trump 6/25/16 Tweet (posting photos from rally outside Trump Tower).
  84. Instagram ID 2228012168 (Stand For Freedom) 1 1/3/15 Post ("Good evening buds! Well I am planning to organize a confederate rally […] in Houston on the 14 of November and I want more people to attend.").
  85. The pro-Trump rallies were organized through multiple Facebook, Twitter, and email accounts. See, eg., Facebook ID 100009922908461 (Matt Skiber); Facebook ID 1601685693432389 (Being Patriotic); Twitter Account @march_for_trump; beingpatriotic at gmail.com. (Rallies were organized in New York on June 25, 2016; Florida on August 20, 2016; and Pennsylvania on October 2, 2016.)
  86. Harm to Ongoing Matter                                                            
  87. Harm to Ongoing Matter                                                                                                                                                                
  88. 3/11/16 Facebook Advertisement ID 6045078289928, 5/6/16 Facebook Advertisement ID 6051652423528, 10/26/16 Facebook Advertisement ID 6055238604687; 10/27/16 Facebook Message, ID Personal Privacy & ID 100011698576461 (Taylor Brooks).
  89. 8/19/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID PP 
     
  90. 12/8/16 Email, robot at ecraigslist.org to beingpatriotic at gmail.com (confirming Craigslist advertisement).
  91. 8/18-19/16 Twitter DMs, @march_for_trump & PP 
  92. See, 11/1l-27/16 Facebook Messages, ID 100011698576461 (Taylor Brooks) & ID Personal Privacy (arranging to pay for plane tickets and for a bull horn).
  93. See, e.g., 9/10/16 Facebook Message, ID 100009922908461 (Matt Skiber) & IDPersonal Privacy  (discussing payment for rally supplies); 8/18/16 Twitter DM, @march_for_trump toPP (discussing payment for construction materials).
  94. Harm to Ongoing Matter 
     
     
  95. See, e.g., @DonaldJTrumpJr 10/26/16 Tweet ("RT @TEN_GOP: BREAKING Thousands of names changed on voter rolls in Indiana. Police investigating #VoterFraud. #DrainTheSwamp."); @DonaldJTrumpJr 11/2/16 Tweet ("RT @TEN_GOP: BREAKING: #VoterFraud by counting tens of thousands of ineligible mail in Hillary votes being reported in Broward County, Florida."); @DonaldJTrumpIr 11/8/16 Tweet ("RT @TEN_GOP: This vet passed away last month before he could vote for Trump. Here he is in his #MAGA hat. #voted #ElectionDay."). Trump Jr. retweeted additional (@TEN_GOP content subsequent to the election.
  96. @EricTrump 10/20/16 Tweet ("RT @TEN_GOP: BREAKING Hillary shuts down press conference when asked about DNC Operatives corruption & #VoterFraud #debatenight #TrumpB").
  97. @KellyannePolls 11/6/16 Tweet ("RT @TEN_GOP: Mother of jailed sailor: 'Hold Hillary to same standards as my son on Classified info' #hillarysemail #WeinerGate.").
  98. @parscale 10/15/16 Tweet ("Thousands of deplorables chanting to the media: 'Tell The Truth!' RT if you are also done w/ biased Media! #FridayFeeling").
  99. @GenFlynn 11/7/16 (retweeting @TEN_GOP post that included in part "@realDonaldTrump & @mike_pence will be our next POTUS & VPOTUS.").
  100. @TEN_GOP 10/11/16 Tweet ("North Carolina finds 2,214 voters over the age of 110!!").
  101. @TEN_GOP 11/6/16 Tweet ("Mother of jailed sailor: 'Hold Hillary to same standards as my son on classified info #hillaryemail #WeinerGate.'").
  102. @DonaldJTrumpJr 11/7/16 Tweet ("RT @Pamela_Moore13: Detroit residents speak out against the failed policies of Obama, Hillary & democrats ....").
  103. @realDonaldTrump 9/19/17 (7:33 p.m.) Tweet ("THANK YOU for your support Miami! My team just shared photos from your TRUMP SIGN WAVING DAY, yesterday! I love you — and there is no question — TOGETHER, WE WILL MAKE AMERICA GREAT AGAIN!").
  104. 8/23/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID PP  
  105. Harm to Ongoing Matter 
     
  106. See, e.g., 8/16/16 Email, joshmilton024 at gmail.com to PP at donaldtrump.com (asking for Trump/Pence signs for Florida rally); 8/18/16 Email, joshmilton024 at gmail.com to PP at donaldtrump.com (asking for Trump/Pence signs for Florida rally); 8/12/16 Email, joshmilton024 at gmail.com to PP at donaldtrump.com (asking for "contact phone numbers for Trump Campaign affiliates" in various Florida cities and signs).
  107. 8/15/16 Email Personal Privacy to joshmilton024 at gmail.com (asking to add locations to the "Florida Goes Trump," list); 8/16/16 Email, Personal Privacy to joshmilton024 at gmail.com (volunteering to send an email blast to followers).