In a 37-page indictment issued by special counsel Robert S. Mueller III’s team on Friday, we got our first detailed look at how Russian trolls working for an organization called the Internet Research Agency allegedly tried to throw the 2016 election to Donald Trump.
What it does include, though, is significant. It shows a concerted years-long effort by a group dedicated to undermining the American political system. It shows the scale of that effort, eventually involving 80 staff in St. Petersburg, a budget of more than a million dollars a month, hundreds of social media accounts, stolen identities of American citizens — and even visits into the United States by Russians traveling under visas obtained through misrepresentation.
Below, a timeline of what the indictment lays out. We’ve included other noteworthy events, as well; they’re shaded in gray.
The Internet Research Agency gets to work
June 2013. The Internet Research Agency is registered with the Russian government.
Per indictment, The Internet Research Agency had a graphics department, a data analysis department, an SEO department, an IT department and a finance department -- a fake news version of what a real newsroom would look like.
— Tim Mak (@timkmak) February 16, 2018
October 2013. Mikhail Leonidovich Burchik joins the Internet Research Agency. He becomes executive director the next March.
2014. Agency staff begin tracking social media sites related to political issues. Part of the funding for this work comes from a company called Concord Management and Consulting, controlled by a man named Yvgeniy Prigozhin. Concord is involved in a broad-based effort to interfere in the American election called Project Lakhta.
Yevgeniy Prigozhin, Russian businessman who was indicted today, said: “Americans are very impressionable people, they see what they want to see. I have great respect for them. I'm not at all upset that I’m on this list. If they want to see the devil - let them see one."
— Manu Raju (@mkraju) February 16, 2018
February 2014. Mikhail Ivanovich Bystrov joins the Agency. He takes over leadership in April. Over the next two years, he’s regularly in contact with Prigozhin.
April 2014. The Agency forms a department called the translator project, which focuses on interfering in the U.S. election.
May 2014. The Agency begins those efforts with the goal of “spread[ing] distrust towards the candidates and the political system in general.”
June 2014. The Agency forms a number of other businesses meant to obscure its work.
June 4-26, 2014. Two Agency employees, Aleksandra Krylova and Anna Bogacheva, travel around the United States to collect intelligence. Stops include “Nevada, California, New Mexico, Colorado, Illinois, Michigan, Louisiana, Texas, and New York.”
They obtain visas by claiming that their travel was for personal reasons and not disclosing their employer. Another employee, Maria Bovda, is denied a visa.
Nov. 26-30, 2014. Another unnamed Agency employee travels to Atlanta.
2015. The Agency begins purchasing ads on social media sites. The cost, thousands of dollars a month, is included on budgets sent to Concord.
June 7, 2015. The New York Times publishes a lengthy investigative piece on the Internet Research Agency.
The campaign kicks off
June 16, 2015. Trump announces his candidacy for the presidency.
Summer 2015. Hackers believed to be linked to the Russian Federal Security Service (FSB) gain access to the network of the Democratic National Committee, according to U.S. intelligence agencies.
2016. Agency-controlled social media groups have collected hundreds of thousands of followers. The goal of their efforts with those accounts, per the indictment: to engage “in operations primarily intended to communicate derogatory information about Hillary Clinton, to denigrate other candidates such as Ted Cruz and Marco Rubio, and to support Bernie Sanders and then-candidate Donald Trump.”
Feb. 1, 2016. The Iowa caucuses is held.
Feb. 10, 2016. Agency staff circulate an outline of themes for future content to be posted to social media accounts. Focus was American politics and to “use any opportunity to criticize Hillary and the rest (except Sanders and Trump — we support them).”
March 19, 2016. Clinton campaign chairman John Podesta is sent an email that encourages him to change his email password, probably precipitating the hack of his account.
April 2016. The Agency begins buying ads on social media and elsewhere online specifically aimed at supporting Trump and criticizing Clinton.
April 6, 2016. Social media ad purchased by the Agency: “You know, a great number of black people support us saying that #HillaryClintonlsNotMyPresident.” The indictment includes several other such ads scattered over the course of 2016.
April 7, 2016. Ad: “I say no to Hillary Clinton / I say no to manipulation”
April 19, 2016. Ad: “JOIN our #HillaryClintonForPrison2016″
May 10, 2016. Ad: “Donald wants to defeat terrorism… Hillary wants to sponsor it”
May 19, 2016. Ad: “Vote Republican, vote Trump, and support the Second Amendment!”
May 24, 2016. Ad: “Hillary Clinton Doesn’t Deserve the Black Vote”
May 26, 2016. Trump clinches the Republican nomination.
May 29, 2016. The Agency arranges for an American to hold a sign at the White House reading, “Happy 55th Birthday, Dear Boss” — a reference to Prigozhin.
June 2016. Agency staff contact an unidentified American in Texas who suggests they focus on “purple states like Colorado, Virginia & Florida.”
The Agency backs real-world rallies
June 1, 2016. Agency groups plan a rally in Manhattan called “March for Trump.” They purchase ads for the event on Facebook.
June 4, 2016. Using the email account allforusa@yahoo.com, march organizers send out news releases to New York media outlets.
June 5, 2016. “March for Trump” organizers contact a Trump campaign volunteer who agrees to provide signs.
This is the first contact with a Trump campaign representative over the course of the indictment. There are four other attempts, one other that’s known to have been successful.
June 6, 2016. Clinton clinches the Democratic nomination.
Jun 7, 2016. Ad: “Trump is our only hope for a better future”
June 9, 2016. Donald Trump Jr., campaign chairman Paul Manafort and Jared Kushner meet with a Russian lobbyist and a Kremlin-backed lawyer at Trump Tower after being promised “dirt” on Hillary Clinton.
Summer 2016. Agency employees steal the identities of at least four Americans, including Social Security numbers. Those individuals are identified only with initials: T.B., A.R., T.C. and T.W. Three of those accounts are later used to set up PayPal accounts. The Agency also sets up two other PayPal accounts using two other stolen identities.
Through summer and into fall, they set up fake bank accounts linked to the PayPal accounts. This may be where the plea agreement issued by Mueller’s team on Friday comes into play.
That agreement centers on Richard Pinedo, who sold bank account numbers that could be used to verify identities.
From the statement of offense signed by Pinedo:
Company 1 required users to submit bank account numbers as a means of verifying a user’s identity. To circumvent this requirement, certain users (hereinafter “Users”) registered for Company l’s online services with bank account numbers in the names of other people. PINEDO sold Users bank account numbers over the internet to aid and abet, and in connection with, this scheme to defraud Company 1 by means of internet communications in interstate and foreign commerce.
June 23, 2016. Using the name “Matt Skiber,” organizers contact an American who will recruit for the “March for Trump” event.
June 24, 2016. An Agency group called “United Muslims of America” buys Facebook ads to promote a “Support Hillary, Save American Muslims” rally.
June 25, 2016. “March for Trump” rally is held.
June 30, 2016. Ad: “#NeverHillary #HillaryForPrison #Hillary4Prison #HillaryForPrison2016 #Trump2016 #Trump #Trump4President”
July 2016. The translator project at this point has more than 80 Agency employees.
July 5, 2016. “United Muslims of America” orders posters for its rally, including one attributing a quote to Clinton: “I think Sharia Law will be a powerful new direction of freedom.” Three days later, they contact an American about the posters; it’s not clear why.
July 9, 2016. The “Support Hillary, Save American Muslims” rally is held in D.C.
July 12, 2016. An Agency group buys Facebook ads for a rally in New York called “Down with Hillary.”
July 18-21, 2016. The Republicans hold their convention in Cleveland.
July 20, 2016. Ad: “Ohio Wants Hillary 4 Prison.”
July 22, 2016. WikiLeaks begins releasing emails believed to have been stolen from the DNC by Russian hackers. At some point after this, the FBI opens a counterintelligence operation looking at the Trump campaign after being tipped off by the Australian government that George Papadopoulos, a campaign adviser, had known about damaging emails in Russia’s possession.
July 23, 2016. “Down with Hillary” rally is held. Using the email address joshmilton024@gmail.com, the Internet Research Agency group sends out news releases to 30 media outlets.
Aug. 11, 2016. The @TEN_GOP Twitter account claims that fraud is being investigated in North Carolina.
Aug. 2, 2016. Using the “Matt Skiber” identity, Agency employees reach out to the real account “Florida for Trump” on Facebook.
They write: “Hi there! I’m a member of Being Patriotic online community. Listen, we’ ve got an idea. Florida is still a purple state and we need to paint it red. If we lose Florida, we lose America. We can’t let it happen, right? What about organizing a YUGE pro-Trump flash inob in every Florida town?”
That day and the day following they reach out to other grass-roots groups using another stolen identity, identified only as T.W.
Aug. 4, 2016. On a post at the Facebook account “Stop AI,” Clinton is accused of committing fraud during the caucus. There is an ad that uses the same language.
Agency groups also buy ads for the “Florida Goes Trump” rally that reach 59,000 Floridians, 8,300 of whom click on the ad and are sent to the Agency “Being Patriotic” Facebook page.
Aug. 5, 2016. The @March_For_Trump Twitter account recruits and hires someone to portray Clinton in prison costume at a rally in West Palm Beach.
From the indictment: “Defendants and their co-conspirators asked one U.S., person to build a cage on a flatbed truck and another U.S. person to wear a costume portraying Clinton in a prison uniform. Defendants and their co-conspirators paid these individuals to complete the requests.”
Aug 10, 2016. Ad: “We cannot trust Hillary to take care of our veterans!”
Aug. 11, 2016. “Skiber” recruits someone else to depict Clinton in a prison uniform.
Aug. 15, 2016. An activist identified as a Trump campaign county chair contacts the Agency email accounts and suggests other locations for rallies. (This is the second contact with someone purportedly linked to the campaign.)
Aug. 16, 2016. Internet Research Agency groups buy ads on Instagram for the Florida rallies.
Aug. 18, 2016. The “Florida for Trump” account connects “Skiber” to a Trump campaign official involved in the Florida efforts. Using the joshmilton email account, the Internet Research Agency employees email the campaign staffer.
That email requested campaign support at the rallies and read, in part: “You know, simple yelling on the Internet is not enough. There should be real action. We organized rallies in New York before. Now we’ re focusing on purple states such as Florida.” No response is indicated. (This is the third campaign representative the Russians contacted or tried to contact.)
The same day, the Internet Research Agency groups paid an American to build a cage to hold the person dressed as Hillary Clinton.
Aug. 19. A Trump supporter suggests that the “March for Trump” Twitter account contact another Trump campaign official, who is then emailed from the joshmilton address. The same day, the “Skiber” persona contacts a third campaign official on Facebook. No response is indicated. (These are the fourth and fifth campaign contacts.)
They also contacted the person in Texas who recommended a focus on purple states; that person agrees to share information about the upcoming rallies.
Aug. 20, 2016. Agency groups hold “Florida Goes Trump” rallies.
Aug. 24, 2016. The Agency updates a list of more than 100 Americans who had been contacted through social media accounts.
Aug. 31, 2016. An American contacts Being Patriotic about holding an event in Miami on Sept. 11.
The same day, Agency employees buy ads for a rally to be held in New York on Sept. 11.
The campaign approaches
September. Funding for Concord’s Project Lakhta hits $1.25 million monthly.
Sept. 9, 2016. The Internet Research Agency groups send money to support the Miami rally and money to pay the Clinton impersonator in West Palm Beach.
Sept. 14, 2016. An Agency account specialist is criticized for having a “low number of posts dedicated to criticizing Hillary Clinton.” The specialist is told that “it is imperative to intensify criticizing Hillary Clinton.”
Sept. 22, 2016. The Internet Research Agency groups buy Facebook ads for rallies in Pennsylvania called “Miners for Trump.”
Oct. 2, 2016. The “Miners for Trump” rallies are held. According to the indictment, Agency employees “used the same techniques to build and promote these rallies as they had in Florida, including: buying Facebook advertisements; paying U.S. persons to participate in, or perform certain tasks at, the rallies; and communicating with real U.S. persons and grassroots organizations supporting then-candidate Trump.”
DOJ indictment says this guy at Trump rally in Wilkes Barre, PA in Oct 2016 was paid by Russia. pic.twitter.com/zQnRJx83LH
— Trip Gabriel (@tripgabriel) February 16, 2018
Oct. 7, 2016. WikiLeaks begins releasing emails stolen from Podesta.
Oct 14, 2016. Ad: “Among all the candidates Donald Trump is the one and only who can defend the police from terrorists.”
Oct. 16, 2016. A post at the “Woke Blacks” Instagram account aims to tamp down black voting: “We cannot resort to the lesser of two devils. Then we’d surely be better off without voting AT ALL.”
Oct 19. Ad: “Hillary is a Satan, and her crimes and lies had proved just how evil she is.”
Oct. 27, 2016. Bloomberg reports on the Trump campaign’s digital efforts. It details a push to suppress the vote among Clinton supporters.
An official tells the magazine: “We have three major voter suppression operations under way. They’re aimed at three groups Clinton needs to win overwhelmingly: idealistic white liberals, young women, and African Americans.”
Nov. 2, 2016. Another TEN_GOP accusation: “VoterFraud by counting tens of thousands of ineligible mail in Hillary votes being reported in Broward County, Florida.”
Donald Trump Jr. retweets it.
Nov. 3, 2016. A post at the Instagram account “Blacktivist” promotes Jill Stein as an alternative.
Nov. 8, 2016. Trump is elected president.
The aftermath
Nov. 12, 2016. The Agency continues its efforts to divide the country, hosting dueling protests in New York. One is meant to “show your support for President-Elect Donald Trump,” and another called “Trump is NOT my President.”
Nov. 19, 2016. The Agency organizes a rally in Charlotte called “Charlotte Against Trump.”
Jan. 20, 2017. Trump is inaugurated.
September. Social media companies begin identifying Russia-linked accounts.
Sept. 13. An Agency employee named Irina Kaverzina writes in an email to a relative: “We had a slight crisis here at work: the FBI busted our activity (not a joke). So, I got preoccupied with covering tracks together with the colleagues.”
What did she do at her job? “I created all these pictures and posts,” she writes, “and the Americans believed that it was written by their people.”