One thirty-seven-page indictment turned vague talk of “Russian bots” into a story of budgets, payrolls, and fake driver’s licenses. This is a story about infrastructure.
On February 16, 2018, the team of special counsel Robert Mueller released a document known, dryly, in the American legal system as case No. 1:18-cr-00032-DLF. The defendants were Internet Research Agency LLC, two companies in the Concord group (Concord Management and Consulting LLC and Concord Catering), and thirteen Russian nationals named individually. They included Yevgeny Prigozhin, who financed the operation; Mikhail Bystrov and Mikhail Burchik, who ran the agency’s day-to-day work; and ten others—from Aleksandra Krylova and Anna Bogacheva, who traveled across the United States on a reconnaissance trip in 2014, to Irina Kaverzina, who—according to the indictment—wrote to a colleague after the prosecutor’s filing was published that the FBI had “gotten to” their activity. The document did not claim that the operation “elected a president.” It described something more specific, and in some ways more disturbing: the detailed mechanism by which a private company from St. Petersburg rented ad space in America’s digital economy to run a political campaign that neither voters nor platforms knew existed.
The indictment’s legal theory rested on conspiracy to defraud the United States. Prosecutors did not charge the defendants with espionage or cyberattacks. The point was different: American law prohibits foreign nationals from secretly taking part in electoral activity—funding ads, organizing rallies, posing as American activists. The indictment alleged that this was precisely what the IRA had done for several years, systematically skirting the rules that separate a country’s domestic politics from outside influence.
Any operation on this scale begins with bookkeeping. The indictment reconstructed the financial architecture of Project Lakhta—the umbrella name under which, according to prosecutors, all IRA activity was conducted. By September 2016, the project’s monthly budget exceeded 73 million rubles—more than $1.25 million. That included employee salaries, advertising costs, server infrastructure, and roughly 1 million rubles in bonus payments.
The money did not go directly from Concord to the agency. Between them sat a shell of fourteen intermediary companies: Glavnaya Liniya, Merkuriy, Obshchepit, Potentsial, RSP, ASP, MTTs, Kompleksservis, SPb Kulinariya, Almira, Pishchevik, Galant, Rayteks, Standart. The names give away their origins—several were tied to Prigozhin’s restaurant and catering business. Payments were disguised as charges for software and technical services. The scheme was, broadly speaking, a classic laundering setup: create enough legal entities that any individual transaction looks like an ordinary commercial operation when examined. Fourteen firms is not paranoid excess. It is the working minimum needed to keep any bank compliance officer from asking one question too many.
What still surprises me is the scale of that paperwork. Building and maintaining fourteen legal entities, each with its own reporting requirements, is a separate management project running parallel to the main operation. Someone kept those books day after day, and in the indictment those people are almost invisible.
The IRA was not a chaotic group of enthusiasts. The indictment describes an organization with an internal structure resembling a middling digital agency: specialized departments, platform assignments, performance metrics. The central unit working with American audiences was the so-called “translator project.” By July 2016, it employed more than 80 people—people who wrote posts, comments, and articles in English every day, managing dozens of accounts on Facebook, Instagram, Twitter, and YouTube.
The work was organized around thematic groups and personas. Each group served a particular segment of the American audience. “Secured Borders” worked the immigration issue. “Blacktivist” impersonated Black activism. “United Muslims of America” addressed the Muslim community. “Army of Jesus” targeted conservative Christians. “Heart of Texas” exploited Texas separatism and Southern identity. “South United” played on nostalgia for the Confederate legacy. Each of these groups built followers organically—through content that genuinely resonated with its target audience because it was calibrated to their pressure points.
The Twitter account @TEN_GOP deserves special mention—a fake page posing as the unofficial voice of the Tennessee Republican Party. By the time it was exposed, it had more than 100,000 followers, and real American politicians and journalists regularly quoted its content. This is the crucial point: the operation reached the stage where a fake source became part of the real information stream, and distinguishing it from “genuine” party activism was impossible without a technical check.
Employees worked in shifts—night shifts in St. Petersburg coincided with daytime on the U.S. East Coast. They had production quotas: a set number of posts, comments, followers per day. Bluntly put, it was assembly-line work, and its effectiveness was measured by the same metrics used at any content-marketing agency: reach, engagement, audience growth.
Perhaps the most inventive part of the operation was the creation of fake American identities. Not avatars, not bots in the usual sense, but fully fledged digital identities capable of passing checks by platforms and financial services. To do that, they used stolen personal data belonging to real U.S. citizens—Social Security numbers and dates of birth. Those details were used to open accounts with PayPal and other electronic payment systems. They produced counterfeit driver’s licenses—documents that serve as the primary form of identification in everyday American life.
Why all this? Because Facebook’s or Google’s advertising system requires a payment method. A payment method requires identity verification. And identity verification requires a Social Security number. The chain looks simple, but each link is a separate problem that has to be solved without arousing suspicion. The operation, in essence, exploited the same infrastructure of trust that millions of Americans use every day to buy sneakers on Amazon: a name, a number, a card, confirmation.
To disguise internet traffic, IRA employees rented servers located in the United States and used them as VPN gateways. From St. Petersburg, traffic ran through an American server, and to the platforms it looked like an ordinary login from New York or Houston. This was not hacker sophistication—it was standard practice, available to anyone for a few dollars a month. That is precisely the paradox: the tools that concealed the operation were entirely legal and commercially available.
In June 2014, Aleksandra Krylova and Anna Bogacheva obtained American visas and set off on a trip across the United States that lasted about three weeks. According to the indictment, the purpose of the trip was to gather intelligence: how political life worked on the ground, what issues concerned people in different states, what American activism looked like from the inside. They visited several states, took photographs, made notes. In their reports—and the indictment indicates that such reports existed—they described observations useful for calibrating a future online campaign.
This detail matters because it shows that the operation was not built exclusively on internet data. Someone considered it necessary to send living people across the ocean to understand the context that cannot be read from a screen. What kinds of signs are hung on fences in the suburbs. How people talk at rallies. What tone works for a Texas patriot, and what tone works for a Black Lives Matter activist in Baltimore. It was market research—only the market here was political.
From 2014, the operation began building audiences, and by 2016 those audiences were already large enough to serve as an instrument. The shift from stirring up polarizing issues to direct electioneering happened gradually. First—content about racial conflict, immigration, gun rights, religious tensions. Then—specific candidates: criticism of Hillary Clinton, Ted Cruz, and Marco Rubio; support for Bernie Sanders and Donald Trump. The logic was not to promote a single ideology, but to widen fractures that already existed.
Perhaps the most striking element of the operation was the organization of real political events on U.S. soil. From St. Petersburg. Through Facebook. IRA employees created events: “March for Trump,” “Down with Hillary,” “Florida Goes Trump.” They contacted real American activists—people who suspected nothing and believed they were talking to like-minded allies—and asked them to help organize: reserve a venue, print posters, bring friends. Sometimes they offered to cover expenses.
People showed up. Held signs. Chanted slogans. Photographs made it into local news. All of it was real—except for the organizer, who did not exist. The rally coordinator in New York or Florida was a fictional character, managed from an office on Savushkina Street in St. Petersburg. I can hardly imagine a more precise illustration of what an “information operation” means in the age of platforms: not hacking servers, not intercepting communications, but using the very same tools available to anyone organizing a charity run or a neighborhood cleanup.
After the election, when the result was already known, the operation did not stop. The IRA organized pro-Trump rallies and anti-Trump rallies simultaneously—sometimes in the same city, on the same day. By then, the task had shifted: not supporting a candidate, but spreading distrust in the process itself. The indictment points to the spread of false claims about election fraud—a theme that four years later would become one of the central issues in American politics for entirely different reasons.
Mueller’s indictment was a carefully constructed legal text, and its boundaries matter no less than its contents. Prosecutors did not claim that the Russian operation determined the outcome of the election. They did not claim that any American citizens knowingly collaborated with the IRA, though they noted contacts in which Americans did not know whom they were dealing with. The indictment focused on deception: foreigners posed as Americans, spent money on electioneering without registering as foreign agents, and used stolen personal data.
The procedural fate of the case proved more complicated than one might have expected. The thirteen individual defendants predictably did not appear in an American court—Russia does not extradite its citizens. But Concord Management, to many people’s surprise, hired American lawyers and entered the case. The company did not plead guilty and demanded disclosure of the evidence. Discovery began—the exchange of materials between the parties. And then a problem emerged that prosecutors may not have fully anticipated.
On March 17, 2020, Judge Dabney Friedrich granted the Justice Department’s motion to drop the prosecution of Concord Management and Concord Catering. The Department of Justice justified its withdrawal on national-security grounds: in the prosecution’s view, the defendant was using the court process as an intelligence-gathering tool—requesting classified materials, demanding disclosure of investigative methods. The case was dismissed before a verdict, with no ruling on the merits of guilt. That means that, legally speaking, none of the charges was either proved or disproved in court.
The situation, when you think about it, is paradoxical: an indictment that described the mechanics of the operation in the greatest detail never received a judicial resolution. The facts laid out in the indictment remained just that—allegations, the prosecution’s version, backed by evidence that never underwent the test of adversarial proceedings.
What, exactly, did this story reveal—beyond what was written in the indictment? It exposed an architectural feature of digital platforms that few people saw as a problem before 2016: Facebook, Google, and Twitter advertising systems were built for maximum ease of access. Anyone with a credit card could buy targeted advertising aimed at residents of a particular county in Pennsylvania who were interested in gun rights and attended evangelical churches. This was not a bug—it was the main commercial function. The platforms sold access to attention, and by and large did not care who the buyer was, so long as the payment cleared.
The IRA spent an amount on Facebook advertising that was negligible by the standards of campaign budgets—on the order of hundreds of thousands of dollars. For comparison: the Clinton and Trump campaigns together spent hundreds of millions on digital advertising. But the IRA operation was not trying to compete on volume. It worked at another level: creating organic content that spread free through platform algorithms tuned for maximum engagement. And engagement, as it turned out, is generated best by content that provokes anger and fear. The algorithmic architecture of social media proved to be the ideal amplifier for polarizing messages—regardless of who created them.
After the indictment was published, the platforms conducted their own investigations. Facebook reported that IRA content may have been seen by as many as 126 million American users. Twitter found thousands of linked accounts. These figures, though, should be read carefully: “may have seen” does not mean “saw,” and “saw” does not mean “changed their mind.” But the sheer scale of the reach achieved with comparatively little money forced a reconsideration of the basic assumptions behind how the security of the information environment works.
What has changed since then? Platforms introduced advertiser verification, transparency requirements for political advertising, systems for detecting coordinated inauthentic behavior. But the underlying business model—selling targeted access to attention—remained the same. The 2018 indictment captured the moment when the commercial infrastructure of the digital economy was first described in a court document as an instrument of foreign interference. The case against Concord was dismissed, the thirteen defendants remain beyond the jurisdiction of an American court, and the question of how compatible an open advertising ecosystem is with the sovereignty of national elections still has no answer that satisfies everyone.