As the dust settles on Russian interference in the US election, journalists are confronting an aspect that has received less scrutiny than the hacking, but poses its own thorny questions: Moscow’s ability to steer Western media coverage by doling out hacked documents.
Reporters have always relied on sources who provide critical information for self-interested reasons. The duty, tricky, but familiar, is to publicize information that serves the public interest without falling prey to the source’s agenda, but in this case the source was Russia’s military intelligence agency, the GRU — operating through shadowy fronts who worked to mask that fact — and its agenda was to undermine the US presidential election.
By releasing documents that would tarnish then-US presidential candidate and former secretary of state Hillary Rodham Clinton and other US political figures, but whose news value compelled coverage, Moscow exploited the openness that is the basis of a free press. Its tactics have evolved with each such operation, some of which are still unfolding.
Illustration: Mountain People
Thomas Rid, a professor of security studies at King’s College London who is tracking the Russian influence campaign, said it goes well beyond hacking.
“It’s political engineering, social engineering on a strategic level,” Rid said.
Great powers have long meddled in one another’s affairs, but Russia, throughout last year, developed a previously unseen tactic: setting up fronts to seed into the press documents it had obtained by hacking.
“Doing public relations work in order to get the hacked material out as an exclusive story with the Daily Caller or Gawker or the Smoking Gun, that is new,” Rid said.
That public relations work was initially done by two Web presences that appeared this summer, Guccifer 2.0 and DCLeaks, each posing as activist-hackers in the mold of Julian Assange, the WikiLeaks frontman. Though neither acknowledged it, and the links were not immediately known, online security experts later concluded that both were Russian fronts.
Guccifer 2.0 claimed to be a Romanian “freedom fighter” who had hacked the Democratic National Committee (DNC). Using Twitter’s private message service, the account conducted weeks-long exchanges with journalists, pointing them to certain documents that had been hacked from the DNC and other targets.
“Whoever is doing this understands media. They understand the way that media works and how to manipulate media,” said Sheera Frenkel, a BuzzFeed News reporter who interacted with the fronts throughout the summer.
DCLeaks, established separately and with its own sets of hacked documents, claimed to be “launched by the American hacktivists who respect and appreciate freedom of speech.”
The fronts sold the act by peppering their messages with slang and emojis. When Frenkel asked Guccifer whether it would release more DNC documents, the reply came: “Yeah baby :)”
Journalists who interacted with the accounts say their tone and facility with English varied widely, suggesting each was run by multiple users.
A reporter with Motherboard, a technology site, quizzed Guccifer on the technical aspects of the hacking and on rudimentary Romanian. Guccifer failed both, lending credence to theories that it was a front.
Those suspicions were initially restricted to security experts, trickling out only after firms such as ThreatConnect were able to unmask the fronts in detailed reports.
In July last year, for instance, DCLeaks published e-mails belonging to retired US Air Force general Philip Breedlove. The Intercept, a left-leaning site, covered the e-mails in a story that portrayed Breedlove as trying to foment hostility against Russia. The story did not note Russian links to the hack. Its lead author, Lee Fang, said he had no interactions with DCLeaks and pointed out that the group’s suspected Russian ties were not widely publicized at that time.
Some reporters were offered documents exclusively, a familiar tactic of government press offices and public relations firms that want to shape coverage.
In September last year, DCLeaks contacted Peter Hasson, a reporter at the Daily Caller, a right-leaning Web site, with an offer: password-protected access to hacked e-mails belonging to former US secretary of state Colin Powell.
The Daily Caller’s story also did not note the growing belief that the documents had been hacked by Russia and leaked as part of an influence operation. Hasson said he was unaware of the alleged Russian links at the time.
After awareness grew, the front organizations dropped the pretense. The newest group called itself Fancy Bears Hack Team — a breathtakingly overt reference to “fancy bear,” the name some Western security groups use for GRU hackers.
Tom Cheshire, a reporter with the British network Sky News who has dealt with Fancy Bears, said they behaved “almost more like a PR firm, really” and were “very businesslike,” doling out scoops and trying to shape coverage.
“It’s the sort of horse trading you do with all sorts of sources, really,” Cheshire said, hitting on a key to the operation’s impact: the way that it played within the bounds of established journalistic norms.
Any leak by any source — Russian agent or citizen whistle-blower — poses a similar set of quandaries for reporters.
Do you emphasize the hacking itself in your coverage, knowing that this will undercut the source’s agenda, but could also be a disservice to readers by putting less focus on newsworthy information in the release?
Do you withhold newsworthy documents, even only temporarily, to check their veracity and provenance? What if they have been reported by other outlets that were shown the documents first?
If they did turn out to be hacked as part of a hostile foreign operation, does that really make their contents less newsworthy?
These are old questions for journalists, but they have taken on new urgency with the scale of Russia’s hacking and its aims.
Though the calculus of reporting on agenda-driven leaks might be familiar, one aspect of the Russian operation stands out: the lengths to which the fronts go to mask their identities and motives.
Because the Internet gives any outlet the potential to reach millions, all it takes is one well-placed leak to send the document flying across the Web.
Last year, Russian-linked hackers infiltrated the US Anti-Doping Agency, most likely in retaliation for accusations of state-sponsored doping among Russia’s Olympic athletes, but Fancy Bears struggled to place the stolen documents with US or British news outlets.
Reporters who saw the files said their news value did not outweigh the risk of serving Russian interests. When Fancy Bears offered the files to The Associated Press, the reporters instead published a story on the Russian-linked group itself.
Fancy Bears ultimately persuaded sportswriters with Der Spiegel, a prominent German media outlet, to report on e-mails that appeared to show US athletes requesting medical exceptions to take restricted drugs. The article noted a possible Russian link only in the final lines, alongside a quote from a US official arguing that the leak was intended to distract from state-sponsored doping.
If mainstream outlets pass on a hacking, government-linked fronts can always pass the documents to peripheral outfits who will lend them less weight, but can still send them across social media.
That has often included the Web site InfoWars, which was founded by right-wing radio host Alex Jones and often publishes conspiracy theories.
Guccifer 2.0 approached Mikael Thalen, a writer for InfoWars, with DNC documents that showed Democrats’ plans for attacking Paul Manafort, a campaign manager to US president-elect Donald Trump who had worked on behalf of former Ukrainian president Viktor Yanukovych, a Kremlin ally.
Thalen had come to believe, after many interactions with the front groups, that they “would reach out based on who would best carry the story the way they wanted it carried.”
He feared that Moscow was hoping InfoWars, by publishing the files, would muddy the water around accusations against Manafort, indirectly aiding Trump’s then-flailing campaign. Breaking with InfoWars’ usual reliance on such files, he declined to publish the documents.
Because everyone has secrets, even if it is only a few embarrassing personal e-mails, and because no network is impenetrable, skilled hackers can dig up compromising material on virtually any target.
Democracies, which give privilege to competitive politics and free media, are particularly susceptible.
“An open society is by choice more vulnerable than a closed society to some form of influence operation,” Rid said. “That is why we’re strong, but it’s also why we’re weak.”
The more that journalists and readers understand the motivations of foreign government leakers, he said, the better they would be able to place those leaks in context, undercutting the hackers’ agenda without hiding newsworthy information. He compared this to a healthy body developing antibodies against a disease — foreign influence operations — that cannot be wholly immunized against while maintaining democratic openness.
Still, some media trends — polarization, fake news, the crowd-driven nature of social media — cut against those hopes.
“This polarized election presented itself as a target of opportunity of the first order,” Rid said.
Reporters might at times be hindered by a lack of transparency between media organizations, which are often highly competitive, and prize speed and scoops. This has left reporters vulnerable because they cannot easily pool lessons on spotting foreign operations or, say, warn one another that a certain front is exaggerating the newsworthiness of its latest leak.
“The more light shone on this, the more information you have when dealing with a source, the better decisions you’re going to make,” Cheshire said.
Thalen said he was increasingly turning down leaks that he knows his audience would read avidly and reward with acclaim, but that he considered exaggerated to advance Russian interests. Still, he was unsure it had made much difference.
“A lot of people have swayed their reporting with their biases and I didn’t want to do that,” Thalen said. “People are believing what they want to be true.”
Could Asia be on the verge of a new wave of nuclear proliferation? A look back at the early history of the North Atlantic Treaty Organization (NATO), which recently celebrated its 75th anniversary, illuminates some reasons for concern in the Indo-Pacific today. US Secretary of Defense Lloyd Austin recently described NATO as “the most powerful and successful alliance in history,” but the organization’s early years were not without challenges. At its inception, the signing of the North Atlantic Treaty marked a sea change in American strategic thinking. The United States had been intent on withdrawing from Europe in the years following
My wife and I spent the week in the interior of Taiwan where Shuyuan spent her childhood. In that town there is a street that functions as an open farmer’s market. Walk along that street, as Shuyuan did yesterday, and it is next to impossible to come home empty-handed. Some mangoes that looked vaguely like others we had seen around here ended up on our table. Shuyuan told how she had bought them from a little old farmer woman from the countryside who said the mangoes were from a very old tree she had on her property. The big surprise
The issue of China’s overcapacity has drawn greater global attention recently, with US Secretary of the Treasury Janet Yellen urging Beijing to address its excess production in key industries during her visit to China last week. Meanwhile in Brussels, European Commission President Ursula von der Leyen last week said that Europe must have a tough talk with China on its perceived overcapacity and unfair trade practices. The remarks by Yellen and Von der Leyen come as China’s economy is undergoing a painful transition. Beijing is trying to steer the world’s second-largest economy out of a COVID-19 slump, the property crisis and
Former president Ma Ying-jeou’s (馬英九) trip to China provides a pertinent reminder of why Taiwanese protested so vociferously against attempts to force through the cross-strait service trade agreement in 2014 and why, since Ma’s presidential election win in 2012, they have not voted in another Chinese Nationalist Party (KMT) candidate. While the nation narrowly avoided tragedy — the treaty would have put Taiwan on the path toward the demobilization of its democracy, which Courtney Donovan Smith wrote about in the Taipei Times in “With the Sunflower movement Taiwan dodged a bullet” — Ma’s political swansong in China, which included fawning dithyrambs