ISSUE BRIEF Defining Russian Election Interference: An Analysis of Select 2014 to 2018 Cyber Enabled Incidents SEPTEMBER 2018 LAURA GALANTE & SHAUN EE FOREWORD f all the political ideas to defend themselves before the court of human history, few have proven as potent and as compelling as that of electoral democracy. Through the twentieth century, The Scowcroft Center for democracy has faced off many times against fascism, commu- Strategy and Security works to O nism, and other ideologies, and proven itself time and again to have develop sustainable, nonpartisan the stronger case. The central tenet of democracy—that people should strategies to address the most important security challenges be able to select for themselves the leaders who can best govern and facing the United States and the meet their political needs—has ascended around the world, so much so world. The Center honors Gener- that in many places it is difficult to remember that it was ever in doubt. al Brent Scowcroft’s legacy of Indeed, today’s authoritarians often go to great lengths to mimic the service and embodies his ethos trappings of democracy, ceding the point that elections are the best of nonpartisan commitment to the cause of security, support means to deliver political legitimacy. for US leadership in cooperation with allies and partners, and But in recent years, electoral democracy has once more come under dedication to the mentorship of challenge, threatening to undermine these hard-won social and political the next generation of leaders. freedoms. Around the globe, tensions over the distribution of global- ization’s boons have led to widespread discontent and a resurgence Defining Russian Election Interference: ISSUE BRIEF An Analysis of Select 2014 to 2018 Cyber Enabled Incidents in populism, while revisionist governments—such as in tangible examples of cyber activity within a broader the Kremlin—have demonstrated clear intent to manip- universe of election interference. ulate these seismic political forces to discredit democ- racy in other countries. Among the foremost drivers By providing a taxonomy of different forms and levels of this challenge, however, has been the rise of new of state involvement in election interference, it gives media and digital technologies, and their intersection a guide to the recent history of election influence and with traditional political and social life. These technolo- interference. From there, it posits what norms and tac- gies have at times demonstrated exhilarating promise, tics have emerged as commonalities in the behavior of giving citizens new tools to organize and governments nation-states, asking: How will the toolsets and norms new tools to lead. But they have also created new vul- we currently see in play shape nation-state use of tech- nerabilities, both technological and societal, that ma- nology in the future? licious actors have proven able and willing to exploit, damaging public trust in democratic institutions, ex- These may be titanic problems, but fortunately the ploiting societal tensions, and eroding the foundation Cyber Statecraft Initiative has not been alone in taking of our ruled based international system. them on, and is working alongside a number of other centers throughout the Atlantic Council and beyond. The magnitude and cross-cutting nature of this chal- Established in 1961 as part of a transatlantic effort to lenge means that no single actor can solve this prob- reinvigorate democracy and democratic values, the lem alone. Any effective solution must draw together Council is uniquely positioned to tackle yet another expertise from across all sectors, uniting technolo- set of challenges to democracy more than a half cen- gists, policymakers, civil society, and corporate lead- tury later. Its Eurasia Center has called attention to ers alike. Coming from the Cyber Statecraft Initiative Moscow’s influence operations throughout Europe with of the Atlantic Council’s Scowcroft Center for Strategy its Kremlin’s Trojan Horses reports, with two editions and Security, this Issue Brief is one such attempt to do released in November 2016 and November 2017, and just that. In the spirit of our mission to build bridges a forthcoming edition launching in November 2018. between the technology and policy communities, the The Eurasia Center convened the Global Forum on Council brought together a high-level group of ex- Strategic Communications (StratCom) in September perts and policymakers on the sidelines of the Munich 2017 and October 2018, and launched DisinfoPortal. Security Conference in February 2018. org, a one-stop interactive guide to the Kremlin’s infor- mation war, bringing together thirty organizations and Out of the many strands of that discussion, the more than one hundred experts working to counter Scowcroft Center’s senior fellow Laura Galante then disinformation. expertly wove together this Issue Brief. In January 2017, all seventeen United States intelligence agencies However, Russia is far from the only actor in this space, published a nearly unprecedented and unclassified as- and the Digital Forensics Research Lab (DFRLab) has sessment of Russian interference in the 2016 US presi- built a leading center of open source and digital forensic dential elections, which stated: analysts, as well a global network of “digital sherlocks,” tracking events in governance, technology, security, Moscow’s influence campaign followed a mes- and where each intersect as they occur. Over the past saging strategy that blends covert intelligence two years, the DFRLab has built capabilities to identify, operations—such as cyber activity—with overt ef- expose, and explain disinformation where and when it forts by the Russian Government agencies, state- occurs; to promote objective truth as a foundation of owned media, third party intermediaries, and paid government for and by people; to protect democratic social media users or “trolls.” institutions and norms from those who would seek to undermine them in the digital engagement space. The Cyber enabled influence operations encompass a DFRLab has focused on election integrity through a range of activity that is separate, but mutually reinforc- series of #ElectionWatch campaigns monitoring the ing, for instance hacking into an email account then spread of disinformation tactics and narratives around releasing embarrassing or false information via social prominent global elections, partnering both with local media content. This Issue Brief provides a lexicon and actors and tech companies in countries as far-ranging 2 ATLANTIC COUNCIL Defining Russian Election Interference: ISSUE BRIEF An Analysis of Select 2014 to 2018 Cyber Enabled Incidents as Brazil, Colombia, France, Germany, Italy, Malaysia, racy—or whether they undermine it—will be decided and Mexico. by how well today’s policymakers, technologists, and civil society cooperate to produce principles and stan- Ultimately, all these efforts—and more—will be needed dards that withstand the test of time. to ensure that electoral democracy can stand up to the challenges of the twenty-first century. This Issue Brief is a part of that, aiming to continue the conver- sation around cyber enabled influence operations, not to be the final word on it. As technological progress continues apace, new developments that have little precedent in democracy’s long history will continue to Damon Wilson emerge. Whether those developments bolster democ- Executive Vice President, Atlantic Council ATLANTIC COUNCIL 3 Defining Russian Election Interference: ISSUE BRIEF An Analysis of Select 2014 to 2018 Cyber Enabled Incidents INTRODUCTION agreement on interference activities. A lack of spec- ificity and consistency in terminology has contributed he past five years have demonstrated at least greatly to the confusion surrounding a number of the one thing about election interference: though interference cases discussed in this report. If there is a it keeps happening, nobody can agree on just single lesson from cyber activity over the last decade, Twhat it is. The 2016 US elections served as a it is that states must have a common lexicon in order flashpoint in recognizing modern election interference, to respond to cyber threats. It is not enough to simply but there have been numerous instances of interfer- speak of “hacking the vote.” Hopefully, by providing ence in other European elections that can provide these initial terms, this report can spur a wider discus- valuable lessons, and this report aims to connect them sion on defining actions and sponsorship in this domain. into a coherent and singular framework. While not meant to be exhaustive, this report assesses four elec- Interference Actions: tions and a referendum that have been characterized by attempted foreign interference. Infrastructure Exploitation: An action—including reconnaissance and collection efforts—that gathers The five case studies were selected because they illus- or distorts data or functionality of information tech- trate a variety of actions associated with modern cyber nology (IT) systems or networks. and information operations from both a technical and psychological perspective. Each case study summa- Vote Manipulation: An action that alters vote tal- rizes the openly available information about these inci- lies, vote input, vote transmission, or other modes of dents and identifies the state sponsorship and actions counting and transmitting the voters’ true choices. involved per the definitions developed for this report. This does not include