It was the day of the biker rally, the Sunday of Memorial Day weekend 2016, when thousands of motorcyclists descend in a cacophonous blitz on Washington, DC, for the annual Rolling Thunder rally. Soon-to-be Republican presidential nominee Donald Trump, wearing a blazer sans tie but with a red MAGA hat firmly ensconced on his head, worked the crowd around the Lincoln Memorial. “Look at all these bikers,” he said. “Do we love the bikers? Yes. We love the bikers.”
Looking around, though, it was not quite enough bikers for him. “I thought this would be like Dr. Martin Luther King, where the people would be lined up from here all the way to the Washington Monument,” he said, disappointed at the turnout for his gathering.
His campaign manager, Corey Lewandowski, spent the morning working the Sunday shows, downplaying concerns about the Trump campaign’s turmoil, dismissing rumors of infighting with his rival Paul Manafort (their relationship was “fantastic,” he told Fox News’ Chris Wallace), and expressing confidence about how the small campaign staff was all they needed to defeat Hillary Clinton (“This is media hype,” he said).
Amid the bustle of the capital and the general tumult of the campaign, there may not have been a person in Washington who noticed the American holding up a sign outside the White House, just blocks away from Trump’s glad-handing at the Rolling Thunder rally. “Happy 55th Birthday Dear Boss” it read. The unnamed American who held up the sign, posing for a picture, didn’t really know why he’d been hired for such a strange task.
The people who had hired him online to stand in front of the White House had simply told him they wanted the picture for “a leader here and our boss…our funder.”
Whoever the people who ordered the photo were, they got it held up in public in time for June 1.
It was a small detail, seemingly insignificant in the capital city, almost impossible to place in the grand scheme of a billion-dollar presidential election. Except for one thing, a fact that—more than a year later—would stand out to the investigators working with Special Counsel Robert Mueller: On June 1, 2016, Yevgeny V. Prigozhin turned 55 years old.
Prigozhin was hardly a household name in the United States—until last Friday, at least—but to investigators and intelligence officers, he was a key figure in the overlapping circles of oligarchs, spooks, and organized crime figures who run Russia under Vladimir Putin. You can only imagine that when he saw a photograph of the sign held aloft by an American, he smiled.
Because in the midst of an effort to influence and to disrupt American democracy, an effort that spanned four years, cost millions of dollars, and employed hundreds of Russians, the team at the Internet Research Agency in St. Petersburg had arranged a joke, a present, and a tribute for the Kremlin oligarch who was making it all possible.
In the days since Bob Mueller’s 37-page indictment of 13 Russians and three companies involved in sowing political discord in the midst of the 2016 US presidential election, much of the media focus has been on the Internet Research Agency, the so-called troll factory responsible for running a network of phony social media identities and paid political advertisements aimed at undermining Hillary Clinton and building up Donald Trump.
A closer read of the indictment, though, tells an even more interesting story—a story of how a restaurateur whom Vladimir Putin made wealthy repaid the favor by unleashing an army of trolls to promote #MAGA, bash Trump opponents, organize political rallies, suppress the votes of Clinton supporters, and hire Americans to dress up like Clinton in prison.
According to Mueller’s investigation, the IRA was overseen by two Prigozhin-controlled companies—Concord Management and Consulting and Concord Catering. While Concord Catering was—until last Friday at least—a name all-but unknown in the United States, it’s a corporate entity almost as infamous as major Russian conglomerates like Gazprom to those who track the epidemic of corruption unleashed by Putin.
Concord Catering was Prigozhin’s ticket out of obscurity. Growing up in the Soviet Union, where athletic prowess was celebrated as a path to greatness, he’d once had aspirations of being a champion cross-country skier. Instead, he became a low-level criminal and spent most of the 1980s in prison after being caught in a robbery and prostitution scheme. He gained freedom just as the country he’d known since birth unraveled. It was the perfect moment for an entrepreneur to remake himself—and he started with a hot-dog stand.
It was improbably successful, and by 1996 he had the wherewithal to found Concord Catering, the corporate home for a growing restaurant empire that included eateries aimed at the St. Petersburg elite. His first major success was the “Old Customs House” in St. Petersburg—a nod to the city’s glory days in the time of Peter the Great—that featured decadent dishes like oysters and foie gras from Finland.
In 1998, he opened what would become his most famous venture, a floating restaurant known as the “New Island Restaurant” that would become well known to wealthy Russians and a favorite of Putin himself, who hosted the Japanese prime minister at one of Prigozhin’s restaurants just after he took office in 2000.
In 2001, Putin took French President Jacques Chirac to New Island and returned the following year with President George W. Bush. Prigozhin, who would later explain that when he started he didn’t even know a restaurant’s wine specialist was known as a “sommelier,” wasn’t shy about touting his business success; as he bragged to one local publication, “Vladimir Putin saw how I built up my business from nothing.”
As the Anti-Corruption Foundation reports, Prigozhin holds a unique position in the constellation of Russian oligarchs—he’s there simply because Putin likes him: “The man did not invent anything, did not find the treasure, did not win at the Olympics. He received an award in gratitude for the good service of the president, as a tip. He was told that now you can freely and with impunity engage in corruption.”
Over the next 15 years, Prigozhin—and Concord Catering—became the go-to supplier for Russia’s government food contracts, serving meals in schools, the military, and even at Dmitry Medvedev’s presidential inauguration. Much of the capital that fueled Concord Catering’s early growth was underwritten by Vnesheconombank, the Russian development bank overseen by Putin’s ally Sergey Gorkov. (Not coincidentally Vnesheconombank has become a critical financial vehicle for oligarchs and served as cover for Russian intelligence operations overseas.)
Concord Catering faced regular criticism for its failure to deliver on its promised contracts; parents revolted against the heavily processed meals Concord served in their childrens’ schools. But competency was hardly a requirement for business success in the kleptocracy that had come to dominate Russia.
By 2011, Prigozhin was winning contracts worth hundreds of millions of dollars—and then, in 2012, more than $1 billion to feed more than 90 percent of the Russian military. The contracts transformed Prigozhin’s life; his family moved to a St. Petersburg compound with a basketball court and a helicopter pad, and they enjoyed a private jet and a 115-foot yacht.
He was known in the press as “Putin’s cook.” Russian opposition leader Alexey Navalny had a different nickname for him: “Putin’s troll.”
That moniker stemmed from Prigozhin’s unique side project. After all, one of the unwritten rules of Putin’s Russia is that those who see wealth showered upon them by the state owe a debt to aid Putin politically.
For Prigozhin, that meant funding the Internet Research Agency.
The Internet Research Agency was created in the summer of 2013 in St. Petersburg’s Lakhta-Olgino neighborhood; in short order it had hired hundreds of employees who generated a steady stream of pro-Putin, anti-west propaganda online. They flooded the internet with comments and bots, and by 2014, the IRA was so notorious that it became known simply as the troll factory. It attracted talent, in part, by paying higher-than-average salaries for those interested in digital marketing—about $700 a month, according to former workers who have been interviewed by western media.
According to Mueller’s indictment, Concord funded the IRA “as part of a larger Concord-funded interference operation that it referred to as ‘Project Lakhta,’” named after a nearby lake and the historic neighborhood where the agency was founded. The IRA’s mission was to spread misinformation via the internet around the world. Its initial targets were Ukraine and various European democracies.
Concord classified the payments for Project Lakhta as “software support and development,” and to conceal the funding funneled it through the bank accounts of 14 different affiliates. Over its first year, the IRA also set up a number of other front companies with names like MediaSintez LLC, GlavSet LLC, MixInfo LLC, Azimut LLC, and NovInfo LLC.
The project’s main leaders were an unlikely trio of a retired police officer, a tech entrepreneur, and a PR executive. The 50-something CEO, Mikhail I. Bystrov, had spent most of his career as a St. Petersburg police officer, retiring as a colonel and joining the IRA around February 2014; he was also listed as the head of other IRA front companies, including serving as the general director of Glavset LLC.
The executive director, Mikhail L. Burchik, was a 30-year-old tech entrepreneur; he joined IRA in the fall of 2013 and by March 2014 had risen to be its executive director, second only to Bystrov.
Alexandra Krylova was the IRA’s No. 3 official; she had previously worked at the “Federal News Agency,” a media outlet linked to Prigozhin that has played a key role in promoting Russia’s military operations in Syria.
The Internet Research Agency organized itself like any modern digital marketing firm, with departments focused on graphics, data analysis, and search engine optimization, as well as the standard back-office functions like an IT department and finance department to handle budgeting. Estimates of its total staff have ranged from 400 to 1,000.
In April 2014, the IRA created a new unit, known as the Translator Project, that focused on “the US population and conducted operations on social media platforms such as YouTube, Facebook, Instagram, and Twitter,” according to the indictment. By the following month, the project outlined, apparently in an internal document, an explicit goal: “Spread distrust toward the candidates and the political system in general.”
Over the next three years, the project would move through distinct phases as the IRA’s team researched American politics, cultivated false personas, criticized the leading Democratic candidate Hillary Clinton—a particular nemesis of Vladimir Putin—and eventually went all-in for a Donald Trump victory. In time, the staff on the Translator Project burgeoned to more than 80 employees.
The Translator Project was originally overseen by Maria A. Bovda and Robert S. Bovda—how the two are related is unclear from the indictment—who both worked at IRA from November 2013 to October 2014 and laid the groundwork for the initial operation. In the fall of 2014, Dzheykhun Aslanov joined IRA and eventually took over as the head of the Translator Project, overseeing the operations that targeted the unfolding American presidential election and, like Bystrov, serving on paper as the head of front companies that helped funnel money to the effort.
The operation began to come together in the spring of 2014, months before the first formal event in America that unofficially kicked off the 2016 election, the November announcement by former Virginia Senator Jim Webb that he was forming a presidential exploratory committee.
Over the course of 2014, the IRA’s employees and what Mueller’s team calls “their co-conspirators” began “to track and study groups on US social media sites dedicated to US politics and social issues.” They carefully tracked the size and engagement of various online conversations, including the frequency of posts and the average number of comments or responses.
That spring, Krylova, Bogacheva, and Robert Bovda applied for visas to visit the United States themselves “to collect intelligence for their interference operations,” according to the indictment. All three stated, falsely, they were traveling to the US for personal reasons, concealing their place of employment. While Bovda was turned down for a visa, the other two were approved and set off on a three-week trip in June 2014 through Nevada, California, New Mexico, Colorado, Illinois, Michigan, Louisiana, Texas, and New York.
They came prepared for low-level espionage, purchasing cameras, SIM cards, and “drop phones”—untraceable burners—and with pre-planned “evacuation scenarios” in case something went wrong. There’s no record in the indictment of who they met with or where precisely they went, but their travels took them through most of the largest electoral states in the country.
When the two travelers returned to Russia, Krylova sat down with Burchik, the IRA’s executive director, for a debriefing. That fall, a third coconspirator spent four days in Atlanta, Georgia, for further research and, on returning to St. Petersburg, met with the manager of IRA’s IT department, Sergey P. Polozov, whose job it was to procure servers and other technical infrastructure inside the US to help mask the origins of the IRA’s activity. Underscoring just how banal even geopolitical espionage can be, this third traveler filed his expense report with Polozov.
This collective research, both online and on the ground in the US, provided a critical political education on America to the Russians. Even as Kyrlova and Bogacheva traveled across the country, their colleagues—posing online as Americans—began corresponding with a political activist in Texas, who explained how they should focus their influence efforts on “purple states like Colorado, Virginia, and Florida.”
It was a concept and phrase the IRA quickly grasped and adopted; from then on, the IRA employees would refer internally to their targets as “purple states.” They also circulated lists of US holidays to ensure that employees put out appropriate social media content.
That fall, as the Translator Project gained momentum, the IRA relocated, moving to a modern four-story office building with floor-to-ceiling windows at 55 Savushkina Street in St. Petersburg, just two blocks off the Neva River on the north shore of the Gulf of Finland.
While much of the IRA’s activity focused on promoting Putin and Russia, the Translator Project was seen as the organization’s elite by those who toiled elsewhere in the IRA on projects like attacking Ukraine or Putin’s domestic opposition. As one former worker in the “troll factory” told the Washington Post over the weekend, “They were totally modern-looking young people, like hipsters, wearing fashionable clothes with stylish haircuts and modern devices. They were so modern that you wouldn’t think they could do something like this.”
Reaching across the Atlantic from St. Petersburg presented a massive logistical challenge; the IRA employees opened hundreds of social media accounts, creating fictitious Americans who they, with time, transformed into “leader[s] of public opinion,” according to the indictment.
The IRA’s employees, known as “specialists,” worked around the clock, with a day-shift and a night-shift to ensure 24/7 coverage of the US, where the east coast is eight hours behind St. Petersburg. The indictment specifically cites four other Russian employees—Vadim V. Podkopaev, Gleb I. Vasilchenko, Irina V. Kaverzina, and Vladimir Vankow—who helped research American politics, draft social media content, and “operated” US personas online to post on sites like Facebook, Twitter, and Instagram. Their goal was to enflame “political intensity through supporting radical groups, users dissatisfied with [the] social and economic situation, and oppositional social movements.”
To do so, they focused on US foreign policy and economic issues, creating group pages on sites like Facebook and Instagram that targeted immigration (one group was called “Secured Borders”), Black Lives Matters (they created a “Blackivist” page), religious groups (“United Muslims of America” and “Army of Jesus”) and geography (“South United” and “Heart of Texas.” All told, their pages amassed hundreds of thousands of followers. They also built numerous Twitter accounts designed to appear as if they belonged to Americans, like @TEN_GOP, aka “Tennessee GOP,” and created an intricate account hierarchy, designating certain accounts to post original content and using others to repost, amplify, and promote it.
“Over time, these social media accounts became Defendants’ means to reach significant numbers of Americans for purposes of interfering with the US political system,” Mueller’s indictment says. “[They] had the strategic goal to sow discord.”
While some of the accounts barely received any tractions, others did quite well online; the @TEN_GOP amassed 100,000 followers and was retweeted at times by senior Trump aides like Kellyanne Conway, Donald Trump Jr., and Gen. Michael Flynn.
It was a sophisticated operation, akin to any other digital marketing campaign by a brand or political organization. The IRA studiously tracked the accounts and their engagements—including comments, likes, and reposts—to decipher what succeeded and helped boost their audience.
Colleagues helped audit the content created by the “specialists” to make sure it “appeared authentic” and they received regular guidance on post lengths and how to incorporate graphics and video. The IT manager, Polozov, and his team orchestrated a network of VPNs inside the US to disguise the origins of his colleagues’ work.
As the presidential campaign unfolded through 2015, the Russian operation expanded into paid political advertisements that amounted to thousands of dollars a month; the Mueller indictment shows that the IRA carefully calculated their ad spends and submitted the budgets to the parent company, Concord.
Then, as 2016 itself started, they expanded further, appropriating the Social Security Numbers of living Americans and using them to open accounts at Paypal. They used fake drivers’ licenses and false and stolen IDs to establish cover identities.
For some of this activity, they turned to a California man, Richard Pinedo, 28, who ran an online service called “Auction Essistance.” Pinedo—who pleaded guilty to identity fraud in a case unsealed Friday along with the other Mueller indictments—ran a service to circumvent the security features of sites like Paypal, selling bank accounts established under false identities to help people avoid declaring their real names to Paypal.
A one-time computer science major who lived in the suburbs of Ventura County and ran an SEO digital marketing company as his day job, Pinedo, according to rough estimates given in his sentencing documents, appears to have made somewhere between $40,000 and $60,000 in his scheme over the three years his company existed, from 2014 to 2017. (According to the special counsel’s office, he never knew he was working with the Russian Internet Research Agency. The Pinedo case was the first publicly known avenue of the investigation that involved Ryan Dickey, an experienced prosecutor who specializes in cybercrime and was brought to Mueller’s team in November; Dickey, who helped target major hackers like Guccifer, is one of the Justice Department’s top cybercrime investigators.)
All told, the IRA team set up more than a dozen fraudulent bank accounts. The fake Paypal accounts were used to purchase political advertisements, purportedly by Americans, with messages like “Vote Republican, vote Trump, and support the Second Amendment” and “Ohio Wants Hillary 4 Prison.” Just days before the IRA specialists hired the birthday sign-holder in front of the White House in May 2016, they promoted an ad saying “Hillary Clinton Doesn’t Deserve the Black Vote,” the Mueller indictment says.
On June 7, a day after Hillary Clinton clinched the 2,383 pledged delegates needed to secure the Democratic nomination, they paid for an ad saying “Trump is our only hope for a better future.”
Coincidentally or not, there was a flurry of activity in mid-June 2016 the same week that the Washington Post first reported that the DNC had been hacked by the Russian government. One day before the Post report on June 14, 2016, the Russian IRA operation used the wemakeweather@gmail.com email address to fraudulently obtain a bank account, the first listed such action in Mueller’s indictment. Then, two days after the Post report, on June 16, they fraudulently used a stolen Social Security number to set up a bank account and a Paypal account using an email accounted called allforusa@yahoo.com.
The overall mission of all of this effort—the fake Facebook groups, the false Twitter posts, the undercover identities, the online ads—was clear: As the IRA instructed its specialists, “use any opportunity to criticize Hillary and the rest (except Sanders and Trump—we support them).”
The team appropriated and amplified relevant hashtags, like #Trump2016, #TrumpTrain, #MAGA, and #Hillary4Prison,” and seized on new events to create even more accounts, like “Trumpsters United,” which they used to communicate with what Mueller’s indictment calls “unwitting members, volunteers, and supporters of the Trump Campaign involved in local community outreach, as well as grassroots groups that supported then-candidate Trump.”
Those astroturf accounts that weren’t enthusiastic enough were singled out for corrective action; one of the organization’s internal audits concluded that the Facebook group “Secured Borders” was insufficiently critical of Hillary and its team was told “it is imperative to intensify criticizing Hillary Clinton,” according to the indictment.
The effort, well-staffed and expensive—by the fall it was spending upward of $1.25 million a month—was a top priority for the IRA. Its CEO, Bystrov, communicated “frequently” with its oligarch patron, Prigozhin, about Project Lahkta and had “regularly scheduled in-person meetings” throughout 2015 and 2016, according to Mueller’s indictment.
As the summer of 2016 unfolded—two years after the original scouting trip that launched the project—the IRA took its influence campaign to a new level, organizing and coordinating political rallies inside the US, pretending to be grassroots activists themselves. They built attendance by promoting events through fake social media accounts and contacted the administrators running other large, legitimate social media groups.
Using that same email address linked to the fraudulent bank account, allforusa@yahoo.com, they sent out press releases for a “March for Trump” in New York on June 25, 2016, and used a Facebook account for a fake American named “Matt Skiber” to contact a rally recruiter offering to “give you money to print posters and get a megaphone.”
They helped promote a July 9, 2016, rally in DC, that was supposed to showcase how Hillary Clinton would turn the country over to Sharia law. They hired a “real US person,” the indictment says, to hold up a sign showing Hillary Clinton and a quote falsely attributed to her: “I think Sharia Law will be a powerful new direction of freedom.”
They used a Gmail account, joshmilton024@gmail.com, to promote a “Down with Hillary” rally on July 23, sending out press releases to more than 30 media outlets, and also bought Facebook ads to promote the event. (Intriguingly, the day of the “Down with Hillary” rally coincided with the day that Wikileaks released thousands of emails stolen from the Democratic National Committee.)
In August, they helped coordinate and promote “Florida Goes Trump” rallies, using their fake personas to communicate with Trump campaign staff and local community organizers, and purchased Facebook and Instagram ads to promote the series of events on August 20, 2016.
In one message to the Facebook group “Florida for Trump,” they even adopted their preferred candidate’s verbal proclivities, writing, “Listen we’ve got an idea. Florida is still a purple state and we need to paint it red. If we lose Florida, we lose America. We can’t let it happen, right? What about organizing a YUGE pro-Trump flash mob in every Florida town?”
More than 8,300 Facebook users clicked on the ads they were promoting for the Florida rallies, leading them to the IRA’s fake Facebook page “Being Patriotic.”
The sheer volume of the IRA’s effort staggers the imagination. All told, it posted some 80,000 pieces of content in 2015, 2016, and 2017. Facebook has struggled to wrap its arms around the IRA’s activities in the year since the election; according to Facebook’s estimates, more than 126 million Americans saw some of the IRA’s propaganda. The company estimates that the IRA spent around $100,000 to promote some 3,000 different ads related to the campaign, all part of what it says are about 470 “inauthentic accounts and Pages.” On Twitter, the Russian efforts garnered more than 131,000 tweets, and there were more than 1,000 videos uploaded to YouTube.
According to the indictment, they even did individual voter outreach through social media—contacting, according to an internal IRA list, more than 100 voters individually—encouraging people to show up at rallies and lining up individuals to provide signs for an event. For the Florida rallies, they even recruited and paid one US person to build a cage on a flatbed truck, and someone else to wear a costume portraying Hillary in prison.
A Trump campaign chair for a county in Florida contacted the masquerading Russians to suggest two other cities to host events, and the “Matt Skiber” persona contacted a Trump campaign staffer at the official’s DonaldTrump.com email address—the official is known only in the indictment as “Campaign Official 1”—to introduce himself as heading a “grassroots conservative online movement” and reporting that they had 13 confirmed rally locations. In the days ahead, they contacted two additional Trump campaign officials; there’s no record in the indictment whether the campaign staff responded or corresponded with the fake IRA accounts.
The events were such a success that the IRA moved to organize similar events in New York and Pennsylvania in the fall, paying protesters at the rallies and buying Facebook ads to promote the events.
That summer, in the heat of the campaign, the IRA began to promote allegations of voter fraud, seeking to sow uncertainty and division among Democratic voters by circulating rumors that Clinton had stolen the Iowa caucuses from Bernie Sanders and posting reports that Clinton was getting illegal mail-in votes in Broward County, Florida.
Then, in the final weeks of the presidential campaign, the IRA’s specialists adopted a new tactic: Voter suppression. They encouraged minority voters to sit out the election entirely or to support third-party presidential candidates like Jill Stein, the Green Party nominee who had attended a December 2015 dinner in Moscow, sitting at the same table with Vladimir Putin and retired General Michael Flynn
In an October 16, 2016, an Instagram account called “Woke Blacks” posted, “[A] particular hype and hatred for Trump is misleading the people and forcing Blacks to vote Killary. We cannot resort to the lesser of two devils. Then we’d be surely better off without voting at all.” On Election Day itself, a similar post by “United Muslims of Americans” encouraged Muslims to boycott the elections because “most of the American Muslim voters refused to vote for Hillary Clinton.”
The third-party candidate vote proved critical to Donald Trump’s victory; the vote total in Michigan for Jill Stein represented four times the size of Trump’s margin of victory over Clinton, and also exceeded Trump’s victory margin in Wisconsin.
According to the indictment, Election Day and Trump’s surprise victory hardly slowed the IRA’s efforts; in the days after November 8, the specialists began organizing rallies on both sides, supporting Trump, with a November 12 rally in New York, and also organizing rallies to protest his election, with a “Charlotte Against Trump” rally on November 19. After months of doing all it could to promote Trump’s election, it appears that the IRA was—at least for a time—reverting to its original agenda: dividing Americans and sowing doubt and distrust in democracy.
While there was regular reporting on the Internet Research Agency and the suspicious activity of what appeared to be Russian bots and trolls online, those running the organization apparently didn’t fear exposure of their efforts. In fact, two of the fraudulent bank accounts listed in the indictment were set up as late as March 30, 2017, and one of the stolen identities in the indictment was taken in May 2017, indicating that the Translator Project continued apace well past Trump’s inauguration.
Then last fall, as Robert Mueller’s investigation gained steam and the social media platforms began to face tough questions from Congress, the IRA appeared to panic.
On September 13, 2017, one of the specialists—Irina Kaverzina—wrote to a family member: “We had a slight crisis here at work: the FBI busted our activity (not a joke). So I got preoccupied with covering tracks together with colleagues.”
As she explained, “I created all these pictures and posts, and the Americans believed that it was written by their people.”
It was a message echoed Friday by none other than the oligarch patron himself. “The Americans are very impressionable people, and they see what they want to see,” Prigozhin told a Russian news agency after Friday’s indictment. “I respect them very much.”
Garrett M. Graff (@vermontgmg) is a contributing editor for WIRED and the author of The Threat Matrix: Inside Robert Mueller's FBI. He can be reached at garrett.graff@gmail.com.
- Here's everything you need to know about Mueller's sweeping indictment against Russian operatives
- Facebook has had a hard enough two years before Goldman brought it the wrong kind of attention
- When one Facebook exec went against the company line on Russia—and Robert Mueller—the apology came soon after
