Anatomy of a Russian attack: From robocalls to hoaxes, a look at tactics used

About this series: The U.S. intelligence community has concluded an attempt to interfere in the 2016 presidential election was ordered by Russian President Vladimir Putin. A WTOP investigation that began in November 2016 examined how the attack happened, when it started, who was involved and what’s next. Dozens of interviews with current and former U.S. intelligence officials, members of Congress, cyber security and intelligence experts, foreign government officials, Russian nationals and American victims were conducted. Here is what WTOP learned.

Part 1: Anatomy of a Russian attack
Part 2: Anatomy of a Russian attack
Part 3: Anatomy of a Russian attack
Part 4: Anatomy of a Russian attack
Part 5: Anatomy of a Russian attack

WASHINGTON — In the early hours of Feb. 13, 2017, just after returning home from a trip to Africa earlier in the month, David Pollock woke up to the incessant ringing of his mobile phone. 

He answered it. On the other end was someone speaking in Russian, who abruptly hung up.

“It started probably about 7 a.m. and continued many hours after that. I was getting robocalls from Russia in Russian,” he said.

Some of the relentless callers “left messages. Sometimes, they hung up, and sometimes, there was just noise after I answered,” said Pollock, the Kaufman fellow at The Washington Institute. He said that for nearly an entire working day, “the calls were coming in so fast; I couldn’t block them or delete them until many hours went by.”

Pollock believes he was targeted after publicly confronting a Russian academic, who denigrated the U.S. military and the U.S. government during a plenary session at a security conference in Morocco a few days before.

But as annoying as it was, what happened to Pollock was tame compared to the scene that unfolded in St. Mary Parish, Louisiana, on the morning of Sept. 11, 2014.

‘A certain mission’

“We started getting phone calls in regards to a message titled ‘toxic fumes, hazard warning,’” said Duval Arthur, director of the office of Homeland Security and Emergency Preparedness.

He told WTOP that citizens received a text message alert about 8 a.m. about an explosion at a manufacturing plant. The alert read “‘take shelter, check local media,'” according to Arthur; the dispatch was sent from Columbia Chemical Company and listed its website as columbiachemical.com.

Within two hours, social media users from the Gulf of Mexico to the Great Lakes were inundated with posts about the incident.

Twitter and other social media platforms were jammed with images of the explosion and a screenshot of a CNN homepage. Even a YouTube video had been posted showing someone watching a TV broadcast in which ISIS had allegedly claimed responsibility for an attack on the plant.

But not a word of it was true. It was all an elaborately staged hoax.

The organization mentioned in the alert, Columbia Chemical Company, does not exist.

There is a company in the area called Columbian Chemical, owned by Birla.

Arthur told WTOP he called the company, and they said the following in a news release:

“We have been informed by the community that a text message has been received by several individuals indicating a release of toxic gas from the Birla Carbon’s Columbian Chemicals Plant near Centerville, Louisiana. The content as stated by the text message is not true. There has been no release of such toxic gas, explosion or any other incident in our facility. We are not aware of the origin of this text message.”

When WTOP asked who was responsible, Arthur said, “I was told it was the Russians, but I have no information on that — none whatsoever.”

WTOP contacted the New Orleans Field Office of the FBI and asked about the investigation. A spokesman declined to comment on the disposition and nature of the inquiry.

Arthur is uncertain about who was behind the incident, but current and former U.S. intelligence sources are clear that it and other incidents like it are the work of a Russian government-funded network.

Both Pollock and St. Mary Parish, Louisiana, were likely victims of a troll house operation.

“These folks have a certain mission. They go 24 hours a day in 12-hour shifts. In those shifts, they are given a certain number of posts that they have to fulfill,” said former Congressman Michael J. Rogers, R-Mich.

FILE — House Intelligence Committee Chairman Mike Rogers, R-Mich., leaves a news conference about proposed changes to the NSA’s program of sweeping up and storing vast amounts of data on Americans’ phone calls, at the Capitol in Washington, Tuesday, March 25, 2014. (AP Photo/J. Scott Applewhite)

Rogers, who chaired the House Intelligence Committee from 2011-2015, told WTOP hundreds of workers at the troll houses are assigned to target websites, social media accounts and online platforms, “which have some impact on people’s opinion on either a person or some idea or a political candidate,” that is important to the Russian government.

He said each troll, “based on the information I saw, is assigned about 135 online posts (or targets).”

In each post, according to Rogers, the troll is required to include a minimum number of characters — “something like 200,” said Rogers.

Whether it’s robocalling people perceived as hostile to the Russian government or launching intricately scripted hoaxes, it’s all believed to be a part of the Russian military’s new information warfare division — designed specifically to fight the U.S. and the West.

“They took all of their cyber-actors and combined them in this information warfare center. They talked openly about propaganda being a part of what they do. They said they were going to be smart and effective in everything they do to protect the Russian federation,” Rogers said.

Russia’s influence operations

Moscow’s new hybrid warfare machine was on full display last year.

“What we have seen in the 2016 election was an unprecedented attempt by Russia to manipulate our most basic democratic process: our electoral process and the jewel of the crown, the presidential process,” Sen. Mark Warner, D-Va., vice chairman of the Senate Intelligence Committee, said in an exclusive interview with WTOP.

The operation was based on an old idea.

“Russia, a long time back in time inside the Soviet Union, was an agent of misinformation. When it was a communist dictatorship, it used propaganda to contain its own people,” Warner said.

Many of the tactics that Russia deployed in 2016 against the U.S., he said, “They’ve been using for the last decade in places like Poland, Hungary, Romania and, of course, Estonia, Latvia and Lithuania.”

A U.S. intelligence official told WTOP, “Russia relies on tools it uses in its influence campaigns, such as media messaging and funding of parties, to muddy the waters about Russian activities and bolster its preferred candidates.”

Russia “probably is also increasingly using cyber-enabled disclosures to undermine the credibility of Western institutions,” said the official, looking at how Moscow skillfully hacked the Democratic National Committee and John Podesta, former chairman of Hillary Clinton’s 2016 presidential campaign.

After both entities were hacked, sources told WTOP, the information was then funneled to organizations such as WikiLeaks and DCleaks.

Warner said, “Russia started by hacking into private individual accounts of both political parties, but decided to only release information that was harmful to the Democratic candidate — Clinton.”

Somewhere mid-spring to summer of 2016, according to Warner, “Moscow changed from saying they just wanted to sow chaos to deciding they’d rather see Trump over Clinton.”

Vice Chairman Mark Warner, D-Va., and Sen. Richard Burr, R-N.C., right, chairman of the Senate Select Committee on Intelligence, listen as Attorney General Jeff Sessions testifies before the Senate Select Committee on Intelligence about his role in the firing of FBI Director James Comey and the investigation into contacts between Trump campaign associates and Russia, on Capitol Hill in Washington, Tuesday, June 13, 2017. (AP Photo/J. Scott Applewhite)

There were two phases of the operation, he said.

The first was the selective hacking of information and then letting that information be released at critical times. The second part, which Warner said “was even more sophisticated, was using modern technology and the internet, and they would pay people to create fake social media accounts and create botnets.”

He said they would use those accounts and bots to flood the internet with fake news. And, according to Warner, they were so skilled at it that they could even target specific areas.

“Data scientists have shown that in certain areas, for example in Wisconsin, Michigan or Pennsylvania, during the last 10 days of the campaign, Twitter or Facebook users wouldn’t find stories about Clinton vs. Trump,” Warner said.

Instead, he said, they would encounter fake stories “about Hillary Clinton being sick or stealing money from the State Department.”

The reason, he said, was because the overwhelming number of bots and fake social media accounts — a part of Russia’s information warfare operation — could determine what the top trending stories would be on social media platforms.

Editor’s note: WTOP’s next article looks at the evolution of Russian influence operations in the U.S.

This story has been updated to reflect the Louisiana division of the FBI is the New Orleans Field Office of the FBI.

Part One | Part Three

J.J. Green

JJ Green is WTOP's National Security Correspondent. He reports daily on security, intelligence, foreign policy, terrorism and cyber developments, and provides regular on-air and online analysis. He is also the host of two podcasts: Target USA and Colors: A Dialogue on Race in America.

Federal News Network Logo
Log in to your WTOP account for notifications and alerts customized for you.

Sign up