SIERRA: on a scale of one to ten, how strongly do you think we responded to 2016?

NANCE: Zero.

SIERRA: Oh. That’s—I didn’t even have it on the scale.

NANCE: It’s not on the scale. It’s not on the scale. We’re not prepared at all for 2020. The way Russia had attacked us was using truths, half-truths, and lies as sort of like information cruise missiles. And the air that they glide on is the internet. The explosive payload is the lie that’s embedded in there. And the problem is, unlike a regular cruise missile where the payload hits and explodes, this is more like spreading a—you know, a virus. 

SIERRA: Right, it’s like a rumor or a lie. And once it’s out, even if you say it was a lie or a rumor it can’t be put back.

NANCE: But it’s more insidious than a—just a rumor or a lie. What was hacked in 2016 wasn’t the Democratic National Committee; it was the mindset of the American voter. And the way they hacked it was to enter it, pour in misinformation, allow you and your loved ones to spread the virus. And now, completely infected, you refuse to believe that anything is wrong with you. 

SIERRA: Well, that’s bleak and scary. (Laughs.)

NANCE: (Laughs) I’m good at that.

Election talk can feel exhausting--hacking and meddling and disinformation. But we have to talk about it, because we got hacked in 2016, hard. Not just our voter databases, and not just the DNC email servers, but... us. 

I’m Gabrielle Sierra, and this is Why It Matters. Today, how Russia’s been hacking democracy, and whether or not we’re ready for 2020.  

SIERRA: All right. So let’s pretend that I was just frozen in a block of ice and I have no idea what happened in the 2016 election. So what the heck happened in the 2016 election?

NANCE: Well, fundamentally what happened in the 2016 election is that the United States carried out what we thought at the time was a free and fair election. 

This is Malcolm Nance, a former Naval Intelligence officer and an expert on national security and counterterrorism. He’s also a regular contributor to MSNBC. 

NANCE: But as we were coming into the election season in April and May of 2016, we were discovering that there was an intrusion at the Democratic National Committee’s computer servers, and that this intrusion was carried out by two Russian intelligence entities. And what they did was they penetrated the DNC’s servers, stole all of their information, and essentially carried out Watergate, but a—

SIERRA: Hmm. But a hacking Watergate.

NANCE: Right, a cyber Watergate. But why? So Russia apparently carried out this attack in order to spread information about the DNC, use the emails which came from their servers, and then used WikiLeaks, led by Julian Assange, gave them all of these emails, and then let them put them into the information stream to essentially act like catnip for the global media in order to damage Hillary Clinton.

PBS NEWSHOUR: 0:00: The CIA and other U.S. intelligence agencies have concluded, the Russian government was behind the email hack into the Democratic National Committee and other political organizations. 

https://youtu.be/-usx8bjKGV8

CBS NEWS: 0:26: Officials actually believe the hacking of the DNC went on for more than a year, starting back in June of 2015 as part of a wave of cyberattacks into American political and government institutions.   

https://www.cbsnews.com/news/russian-fingerprints-left-behind-on-dnc-hack/

Because of all the news coverage, it can be easy to think the DNC hack was the main element of Russia’s election interference. But there were two other major components. One, was the spreading of disinformation on social media. 

ROSENBERGER: What they did was essentially a largely covert social media operation...

This is Laura Rosenberger. She’s the director of the Alliance for Securing Democracy and a senior fellow at The German Marshall Fund. 

ROSENBERGER: ...in order to pit Americans against each other, sow chaos, create a more polarized electorate, and as the intelligence community assessment has concluded, undermine support for Secretary Clinton and, support, President Trump's prospects.

The final piece, used alongside the DNC hack and the spread of disinformation, was the hacking of voter registration databases. For this part we turned to Joseph Marks who writes a newsletter on cybersecurity for the Washington Post.   

MARKS: The U.S. intelligence agencies would tell you yes, Russia did interfere in the 2016 U.S. election. That’s the conclusion of seventeen U.S. intelligence agencies, of the Mueller report, and of the Senate Intelligence Committee. It was a multifaceted campaign. The major thing they did from a cybersecurity angle was to probe election systems probably across the country but it was at least twenty-some states this was noticed and recorded in. And it’s probably all fifty, according to the Senate Intelligence Committee and other people who have looked at it. They actually penetrated voter databases in Illinois and may have penetrated systems, in a couple of counties in Florida. There’s no evidence that they actually changed any votes or did anything once they got into those systems.

SIERRA: So even though they didn’t change anything, having the access is the problem?

MARKS: Yeah. You don’t want Russia to have access to your voter registration data or to internal parts of your voting systems —there are a couple of problems with that. One, they could do something if they chose to. And number two, just the possibility of them doing it makes it easier both for Russia or for people internally to suggest that the result of the election isn’t what it was supposed to be.

SIERRA: So that was their goal?

MARKS: Yeah, it was part of a broader goal to sow chaos, create dissension, show up American democracy as not working as well as we always claim it does.

SIERRA: So they were super successful then.

MARKS: Yeah, in a lot of ways. I mean, all of the chaos and the partisanship that we’ve experienced, and the lack of trust that the election came out well, the anxiety about 2020, that’s exactly what Vladimir Putin wanted.

Look, it’s impossible to say whether or not Russia changed the outcome of the 2016 election. But what has changed is the atmosphere surrounding elections. Facts seem up for debate in a way that they weren’t before. And this brings us to disinformation. 

ROSENBERGER: So I think it's important to understand that we use the term "disinformation" as a sort of broad-sweeping, you know, all-encompassing catchword. But in fact, the kind of things they did weren't necessarily all what's classically defined as disinformation. So for instance, the Russian social media manipulators were very active on issues of race. Racism in our country is a real problem, and it's authentically American, and it's a huge vulnerability, and the Russians have taken advantage of that. And so in 2016, and afterwards, what they did was, you know, this was the time when the Black Lives Matter movement was- was very active. They created a lot of fake accounts. 

One of those fake accounts portrayed a fictional woman named Louisa Haynes. 

ROSENBERGER: ...her handle was “Woke Louisa”. She was supposedly a young African American activist from New York. She believed that Hillary Clinton was a very bad candidate on criminal justice issues, and thought that African Americans shouldn't vote for her, she was an account created by operatives in Saint Petersburg at the Internet Research Agency. But she actually not only spread these views on social media but actual traditional media outlets cited-

SIERRA: Oh my gosh. 

ROSENBERGER: ... quote, "Louisa Haynes" as an example of African Americans who were concerned about Hillary Clinton's record on criminal justice issues. And there's some great research that was done by a professor out the University of Washington named Kate Starbird,  she found large clusters in both the Black Lives Matter conversation and the Blue Lives Matter conversation of these fake Russian accounts. They were pretending to be real Americans, talking about these issues. And she found that those accounts were doing two things. One, they were either the most active and prolific- of those clusters, or they were pushing the most extreme and most polarizing kinds of perspectives on those issues. 

SIERRA: Wow. And playing both sides. 

ROSENBERGER: Absolutely playing both sides. And I could go down a litany of issues, where we saw the Russians, where we now know from the accounts that have been released, that they were actually weighing in on both sides of these issues. 

SIERRA: Wow. 

Okay, Russia is good at stirring the pot. But why mess with U.S. elections? What’s the goal?

ROSENBERGER: So, Russia is an objectively declining power. And that means that for Vladimir Putin, he can't really use a lot of conventional tools and strategies in order to grow Russia's power on the world stage. For Putin, the things that matter most are his own power, and, sort of, his own security as a leader. And so, in order to actually convince the Russian people that he's working to restore Russia's greatness, his best approach is to weaken his competitors, and to use a series of asymmetric tactics in order to undermine and weaken those competitors from within.

You know, Putin has understood, that sort of weakening the foundations of democracy is a way of attacking democratic countries, and hindering our ability to effectively govern, to effectively carry out our national interests by forcing us to, you know, spend more time arguing with each other, which we're pretty good at by the way in the first place. So at this point, sometimes it's just accelerant to the fire. But I think really, that's the long-term strategy, is- is weakening us from within.

NANCE: Now we are in a Russia that is led by a former KGB officer. He has—he knows that his ideology is just money, but so is the Western ideology. But he also has political goals that, in essence, just means make Russia great again, right? And to make Russia great, he clearly just looked back at the Soviet model of how they spent decades trying to destabilize the West and bring down liberal democracies. And the way the Soviets tried to do it was, you know, subversion, paying off the Communist parties of each of these countries, on occasion buying a politician and trying to get them in a scandal. Putin realized that those old methods were never going to work, right? What you do is that you work within these democracies by creating political parties that are aligned with you, and you use democracy to vote democracy out of existence. 

And so what we saw was, in concert with this political ideology, he was using a new methodology on an old technique, right? He was using information warfare, but disseminated through social media, which was now moving at the speed of a keystroke. 

It is literally an attempt to realign the poles of the world as they have existed since World War II, which is where Russia becomes a major strong—asymmetric, though—player, even though they are a very poor country, you know, which is led by an oligarchy through a very, very severe autocrat.

SIERRA: What are some interference scenarios that we should be looking out for heading towards 2020 that maybe we didn't see in 2016 or have escalated since 2016?

ROSENBERGER: Yeah, so one of the things I'm really concerned about is the hijacking of activist's movements. I mentioned how we saw some of this around particularly the Black Lives Matter movement, before and after 2016. And that is one thing I'm particularly concerned about for a few reasons. One is that, by going after activists you're often going after groups that feel already that they may be disenfranchised in some way or another. And so by hijacking these movements it can actually serve to delegitimize them, and we actually saw this, for instance, in France, where the Gilets Jaunes movement, the yellow vests. The Russians not surprisingly sort of jumped on that movement, both on social media and a little bit in the streets. In order to, again, sort of discredit President Macron, undermine, French democracy, you know, just sow chaos, right?

SIERRA: Right, just a drop and it poisons the well.

ROSENBERGER: Yeah, and to me that is really dangerous because if activists are being discredited just because the Russians hijacked their movement, that, in certain scenarios, can drive people even further to extremes, those kinds of trends really, really worry me. Another concern I have is that the kind of cyber probes that we saw on election systems in 2016 could be repeated and could be potentially coupled with a disinformation campaign. So the cyber probes don't actually change anything, but simply the fact of those probes having occurred could be used to actually dispute the results of the election. 

This right here is the point. Once you’ve been hacked, it’s hard to trust again. The doubt sticks. A small cyber intrusion that doesn’t change a single vote might still be enough to get Americans to argue about who won. And according to Joseph Marks, the hack wouldn’t even have to hit voting infrastructure. 

MARKS: If you get into an electric grid and affect traffic lights in an urban area of a state but not the rural area of a state, and it’s a swing state, that could, uh, drive up Republican votes, drive down Democratic votes, and deliver that state for the Republican candidate. You could shut down lights in a particular area that affects the vote. You could do all sorts of things that make it tougher for people to get out and vote. And sow distrust in the system. And that also, because we’ve been talking about the ways in which Russia tries to play into divisions that already exist, there’s a lot of concern about voter suppression in this country. You could play into that in a way that makes people less likely to trust the outcome of a particular race, whether it’s, you know, congressional, presidential, or whatever.

SIERRA: So the idea is that I’d be stuck at a traffic light and I wouldn’t get to the polls before they closed?

MARKS: Yes. The idea that multiple people-

SIERRA: Lots of people.

MARKS: -would be stuck at traffic lights and decide that it’s not worth voting or create the perception that a lot of people decided that. And if that’s what happens in one area that trends Democratic versus Republican, or vice versa, that could lead into a narrative that had things happened differently the outcome of the election would have been different. 

Just enough doubt to get people riled up and questioning the outcome. And if it’s that easy to create division, how do we ever recover? What can we do to un-hack ourselves and create a basis of trust? 

MARKS: The number one thing that security experts will tell you is paper ballots. Paper ballots, or at the very least a paper backup that comes out of the machine that the voter can look at and say, yes, this is what I intended. And then you put that in lockbox, and it’s there to be counted afterwards. The second thing most people say is risk-limiting audits, which is essentially you look at the risks, you audit X percent of ballots after the race to make sure that what people mark is lining up with what the, um, computer reads from those ballots. And if there are any irregularities then you keep doing it until you’re doing a full hand recount. That’s the lion’s share of what states and localities have been doing since 2016. 

SIERRA: So you’re saying, technology has failed us. (Laughter.) We’re going back to paper. After that it’s raising our hands, just nothing on the computer at all.

MARKS: Yeah, it’s - it’s ironic because 2019 and paper’s the safest thing, but paper’s the safest thing.

But switching to paper ballots isn’t the only step we could take.

ROSENBERGER: We don't yet have robust enough multilateral mechanisms to share information either about threats and threat analysis, or to share information about responses, best practices, lessons learned, what's working, what's not. 

SIERRA: So we gotta break down silos from the very beginning, from the platforms, to the government, all the way through to everybody across the world, talking about what's happening.

ROSENBERGER: Yes. Breaking down silos and creating more integrated and coordinated and collaborative approaches, underpin almost all of the responses, I think we need to be taking to this problem set.

NANCE: The only way to defeat this is for democracy to truly reassert itself. The greatest disinfectant is truly sunlight. You have to talk about it. You have to make it clear. And the only way you can do that is you really are—we are really going to have to take democracy seriously. And I have no problem blowing the alarm. The America as you know it and have known it and have sat around and enjoyed for 243 years may transform itself into an America you won’t recognize.

SIERRA: So how prepared are we for 2020? 

ROSENBERGER: I think that we're certainly more aware of the threats- we've certainly taken some steps. I would argue that none of that is sufficient. If anything the country's just gotten more polarized since 2016. The other thing, I would say on this, is that, you know, candidly, this is a problem where we need real strategic leadership from the top. And, we need communication very clearly to the American people about the threats that we see. And we have not had that. And in fact, we've had what I think are counterproductive messages on this, from senior officials, including from the President, about, you know, whether it's inviting other countries to interfere, or the idea that accepting foreign help in an election is not something that's problematic.

SIERRA: Right.

ROSENBERGER: And frankly even casting doubt on whether Russia interfered, right? 

MARKS: You know, a lot of machines that did not have paper ballots or paper backups in 2016 will have them in 2020. The Homeland Security Department, which had visibility into just a fraction of the digital happenings around election systems in 2016 will have visibility into close to 100 percent of it in 2020. State and local election officials who didn’t know a whole lot about cybersecurity before 2016 know a lot more about it now. Those are all big and substantial changes. 

Have we done as much about disinformation? We’ve done less. People are tracking it. They’re paying a whole lot of attention to it. Social media companies are paying a lot of attention to it. But there’s still certainly more to be done. A point that some Homeland Security Department officials sometimes make is part of this is just about educating the public about what to expect. And that’s really tough to do because we see things on social media, and we react, and it’s tough to shift people’s perspective once they think something. Chaos is just something we’re going to have to live with. I mean, if you look at the last three years, Putin got what he wanted in a number of cases. Our trust in the system is not going to change automatically on, you know, mid-November of 2020. It’s going to take some time to regain trust in the system, if we ever do.

Looking ahead, not just to 2020, but to the future state of our democracy can be... rough. New norms are being established every day as technology races ahead and we struggle to understand how our world has changed. 2016 can feel like old news, but it’s only been a few years since this all went down. It’s still a fresh bruise. And the attacks are going to keep coming.   

ROSENBERGER: So my hope, and trying to be positive on this topic is sometimes hard, but my hope is that one of the things it taught the world is that democracy is something we can't take for granted. I think that is something we have been doing for a little bit too long, especially in democracies that had been considered to be consolidated. We had this idea that democracy would be just self-perpetuating. And we stopped investing in some of the really core aspects of our democracy.

There’s a lot more to learn about election security, so check out the show notes for this episode at CFR.org. And while you’re there, have a look at our Candidate tracker. It’s an easy way to see where each candidate stands on foreign policy. 

We would also like to take this moment and encourage you to register to vote. Your voice matters. Visit vote.gov, and make sure you are good to go. 

Please subscribe to Why It Matters on Apple Podcasts, Spotify, or wherever you get your podcasts. Your feedback makes this show better, so leave us a review or send us an email at whyitmatters@cfr.org. If you dig the show, you can show us some love by telling your friends or rating us with five stars. 

Why It Matters is a production of the Council on Foreign Relations. The show is created and produced by Jeremy Sherlick, Asher Ross, and me, Gabrielle Sierra. Our sound designer is Markus Zakaria. Robert McMahon is our Managing Editor, and Doug Halsey is our Chief Digital Officer. Christian Wolan is our Product Manager. Original music was composed by Ceiri Torjussen. Special thanks for this episode go to Richard Haass, Jeff Reinke, and Adam Segal. For Why It Matters, this is Gabrielle Sierra, signing off. See you on election day!