Law Enforcement as a Counterintelligence Tool

A few years ago, shortly after stepping down as Assistant Attorney General for National Security, I published a long article called Law Enforcement as a Counterterrorism Tool. As its title suggests, the article’s central thesis was that law enforcement methods are useful in combating international terrorism. I did not try to make the case that law enforcement is the only, or even necessarily the best, way of combating terrorism. I argued merely that it is one very useful way to disrupt plots, incapacitate terrorists, and gather intelligence.^[1] This was anathema to some observers, who oppose law enforcement efforts here on the grounds that terrorists aren’t common criminals who tried to rob a liquor store.

Similar arguments have emerged about the recent indictment of Russia’s Internet Research Agency (IRA) by Special Counsel Robert Mueller. Andrew McCarthy thinks that the indictment is an “ineffectual” and “provocatively weak” response to Russian covert action. He criticizes “transnational-progressive governments that prize legal processes over the pursuit of national interests by the most effective means available.” McCarthy says he would not object to indictments charging Americans with these crimes, but that it makes no sense to charge Russians, in part because it is so unlikely that any of them will ever be apprehended.

Jack Goldsmith offers a more nuanced assessment but identifies several “downsides” and “costs of trying to deal with electoral interference of this sort through law enforcement institutions in our open society.” First, “concrete attribution followed by” the indictment and nothing more “reveals extraordinary weakness and vulnerability.” Second, “Mueller’s credible attribution may enhance the impact of the Russian information operation.” Third, “the indictment might reveal something about U.S. intelligence collection methods that will make it easier for the Russians to hide their tracks in the future.”

There are lots of important differences between international terrorism and state-sponsored covert action and espionage. We do not maintain diplomatic relations with al Qaeda, the Islamic State, or other terrorist groups. We do not regularly work with terrorist groups in settings outside our areas of disagreement. Terrorist groups likely don’t have nuclear weapons and intercontinental ballistic missiles—if they did, they would use them—at least not in sufficient quantity to end life on earth as we know it. They don’t have massive conventional armies with tanks and airplanes that could be used to invade other countries. Although the Islamic State was briefly an exception, as a rule terrorist groups do not control large areas of territory or perform important governmental functions for their citizens. We want international terrorist groups eradicated; we want Russia and certain other governments to behave differently.

For all of these reasons, and others, the value of law enforcement as a counterterrorism tool doesn’t necessarily mean it has equal value as a counterintelligence tool. In fact, there are reasons to be skeptical about the value of indictments, at least, in dealing with state actors such as foreign military personnel engaged in cyber espionage from their home countries. One of the key arguments I made in proposing the value of law enforcement efforts against terrorism was that “we should use the tool that is best suited for the problem we face.” I argued that this approach “complicates strategic planning, because it requires a detailed understanding of our various counterterrorism tools” and the threats they are designed to meet, and a careful comparison of the relative value of each tool in each specific case.^[2]

On that approach, to assess whether the IRA indictment is effective, we need to do more than identify its potential downsides. We need to consider also its upsides, and the up- and downsides of the alternatives, without a priori bias for or against government lawyers or law enforcement methods. We need to understand the threat we are facing, the problem we are trying to solve, and then assess, compare, and contrast the various ways of doing so, in isolation and in combination. This short paper is a preliminary effort in that direction with respect to the Russian covert influence threat.

I. The Threat

In January 2017, the Intelligence Community published an unclassified version of its assessment (ICA) of Russian activities and intentions in recent U.S. elections. This ICA focused on “Russian efforts to influence the 2016 U.S. presidential election” as part of “Moscow’s longstanding desire to undermine the U.S.-led liberal democratic order.” Russian President Vladimir Putin sees that democratic order as “a threat to Russia and [his] regime,” the ICA explained, and believes that the U.S. is engaged in various “efforts to defame Russia.”^[3]

In addition, the ICA stated, Putin “holds a grudge” against Hillary Clinton for her “aggressive rhetoric and criticism of him,” and specifically because he blames her for “inciting mass protests against his regime in late 2011 and early 2012.” Part of Russia’s preference for Trump, the ICA explained, was based on Putin’s “many positive experiences working with Western political leaders whose business interests made them more disposed to deal with Russia.” Russia’s goals were to “denigrate” Hillary Clinton “and harm her electability”; to aid then-candidate Trump by “publicly contrasting her unfavorably to him”; and thereby and more broadly “to undermine public faith in the U.S. democratic process.”

This was consistent with Russia’s “history of conducting covert influence campaigns focused on U.S. presidential elections”—including recruitment of a Democratic Party activist to report on Jimmy Carter’s campaign, the use of Directorate S sleeper agents to report on the 2008 election, RT’s propaganda efforts in the 2012 U.S. presidential election, and Russia’s self-described “information warfare” in connection with the Occupy Wall Street movement—as well as elections in Europe. But, the ICA reported, Russia’s 2016 influence campaign also “demonstrated a significant escalation in directness, level of activity, and scope of effort compared to previous operations.”

Tactically, Russia’s approach blended “covert intelligence operations—such as cyber activity—with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or ‘trolls.’” The campaign “reflected years of investment in its capabilities, which Moscow has honed in the former Soviet states,” and the use of a “multifaceted approach” that is “designed to be deniable” because it involves “a mix of agents of influence, cutouts, front organizations, and false-flag operations.” In particular, the “Kremlin’s campaign aimed at the US election featured disclosures of data obtained through Russian cyber operations [e.g., John Podesta’s email]; intrusions into US state and local electoral boards [DHS assessed that the “types of systems” targeted “are not involved in vote tallying”]; and overt propaganda [principally RT and Sputnik]. Russian intelligence collection both informed and enabled the influence campaign.”

In other words, the Russian campaign included all of the following:

Hacking, Espionage and Other Cyber Activity. The ICA reported that Russian intelligence enjoyed “access to Democratic National Committee (DNC) networks” for a year in 2015-2016 and was able to exfiltrate “large volumes of data from the DNC.” Further, the Russian GRU was able to “compromise the personal e-mail accounts of Democratic Party officials and political figures” (most famously, John Podesta), and “used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” The ICA also alleged that “Russian intelligence accessed elements of multiple state or local electoral boards.” A March 2017 indictment of two FSB officers and others alleged that they stole “information from about at least 500 million Yahoo accounts and then used some of that stolen information to obtain unauthorized access to the contents of accounts at Yahoo, Google and other webmail providers, including accounts of Russian journalists, U.S. and Russian government officials and private-sector employees of financial, transportation and other companies.” In general, the ICA explained, the “pattern of Russian intelligence using hacked information” includes “releasing or altering personal data, defacing websites, or releasing e-mails.”

Overt Propaganda (Information/Disinformation). The spread of favorable information and disinformation was accomplished both overtly and covertly. The overt activity, involving media, diplomacy, and related efforts, was conducted through RT, Sputnik, and Putin’s own statements. As the ICA put it, “Putin publicly indicated a preference for President-elect Trump’s stated policy to work with Russia, and pro-Kremlin figures spoke highly about what they saw as his Russia-friendly positions on Syria and Ukraine.” By contrast, “RT’s coverage of Secretary Clinton throughout the US presidential campaign was consistently negative and focused on her leaked e-mails and accused her of corruption, poor physical and mental health, and ties to Islamic extremism.” Probably there were other public relations and lobbying efforts through U.S. firms that may well have registered under the Foreign Agents Registration Act (FARA), the statute that compels disclosure of such firms’ affiliations with their foreign principals.

To be sure, not all of this is nefarious—for example, there is no law against Vladimir Putin writing an op-ed for the New York Times in his own name, as he did in 2013 concerning Syria. But at least some of the overt activity was connected to the hacking and related cyber activity described above: as the ICA put it, RT “actively collaborated with WikiLeaks,” and “RT’s editor-in-chief visited WikiLeaks founder Julian Assange at the Ecuadorian Embassy in London in August 2013, where they discussed renewing his broadcast contract with RT, according to Russian and Western media . . . RT routinely gives Assange sympathetic coverage and provides him a platform to denounce the United States.”

Covert Propaganda (Information/Disinformation). Information and disinformation was also spread covertly. The special counsel’s October 2017 indictment against Paul Manafort and Rick Gates includes their failure to register under FARA in connection with a “multi-million dollar lobbying campaign in the United States at the direction of [Viktor] Yanukovych,” the former President of Ukraine who has been living in exile in Russia since his removal from power in 2014; “the Party of Regions,” the pro-Russia Ukrainian political party formerly headed by Yanukovych; and “the Government of Ukraine.” Two American firms sub-contracted by Manafort and Gates, referred to in the indictment as Companies A and B, “lobbied multiple Members of Congress and their staffs.” Based on what is currently public, this work does not appear to have been directly linked to the 2016 presidential election, although of course Manafort was Trump’s campaign manager from March 2016 until August of that year.

Covert information activity directly linked to the presidential election included the use of fake social media accounts as detailed in the IRA indictment. The ICA cited “[a] journalist who is a leading expert” on the IRA as claiming that “some social media accounts that appear to be tied to Russia’s professional trolls . . . started advocating for President-elect Trump as early as December 2015.” Journalist Adrian Chen wrote an extensive article on the IRA for the New York Times in June 2015 that makes for compelling reading even now.

Offering or Providing Things of Value (e.g., money and information). The Special Counsel’s IRA indictment details the use of nominee and fraudulently-opened bank accounts to provide financial assistance to Trump supporters in connection with the 2016 election. The ICA noted that the “likely financier” of these operations was “a close Putin ally with ties to Russian intelligence”—aka Yevgeniy Prigozhin, aka Putin’s Chef—who is the lead individual defendant in the IRA indictment. This sort of financial activity is not unprecedented. Anatoly Dobrynin, the former Soviet Ambassador to the United States, published a book in 1995 (summarized in this excellent review) describing sympathetic notes sent from Leonid Brezhnev to Richard Nixon during Watergate—but Dobrynin also noted Russian financial support offered to Democratic candidate Hubert Humphrey in connection with the 1968 presidential election (Humphrey apparently refused).

The Washington Post has reported that in January 2016, Michael Cohen, one of President Trump’s attorneys and business advisors, emailed one of Vladimir Putin’s longtime advisors seeking help with “the development of a Trump Tower-Moscow project in Moscow City.” As the ICA explained, “Putin has had many positive experiences working with Western political leaders whose business interests made them more disposed to deal with Russia, such as former Italian Prime Minister Silvio Berlusconi and former German Chancellor Gerhard Schroeder.”

As to information, the emails released by Donald Trump Jr. show that he was advised, and apparently believed, that “The Crown prosecutor of Russia . . . offered to provide the Trump campaign with some official documents and information that would incriminate Hillary and her dealings with Russia and would be very useful to your father.” In June 2016, Trump Jr. convened a meeting in Trump Tower with Paul Manafort, Jared Kushner, and others, to obtain the information from someone who was described to him as a “Russian government attorney.” It is also well within Russian historical tradecraft to offer other benefits to potential assets.

Violence and Blackmail. Once a thing of value has been provided, of course, the carrot can be converted into a stick. We do not yet know whether the Russians are or were using financial, informational, sexual or other blackmail against any U.S. officials or civilians, but again it is certainly within the wheelhouse of Russian tradecraft. Finally, one extensive article on the subject of Russian efforts notes that “In the past few decades, dozens of Russian officials and Putin critics have died under suspicious circumstances.” It does not appear that the Russians have attempted or threatened violence against any Americans in this country in connection with their covert influence campaign, although they have used such tactics against American personnel in Russia.

* * *

Looking ahead, the ICA predicted that “Russian intelligence services will continue to develop capabilities to provide Putin with options to use against the United States.” Immediately after the 2016 election, for example, “Russian intelligence began a spearphishing campaign targeting US Government employees and individuals associated with US think tanks and NGOs in national security, defense, and foreign policy fields.”

More recently, the Center for Strategic and International Studies (CSIS) published a report that is consistent with the ICA in identifying Russian efforts against the 2016 election as part of a larger and longer-term campaign. The CSIS report argues that “Putin’s objective is to weaken us by sowing chaos and discord, and to undermine the appeal of democracy itself.” If he can demonstrate that “American-style democracy . . . is incompetent, illegitimate, and hypocritical, he can use that narrative to undermine its potential appeal along Russia’s population and in other countries around the world where we compete for influence.” The report maintains that Russia’s targets “go beyond the executive branch to include the Congress, the justice system, and the media.” As such, it argues, “we need a whole-of-nation strategy to counter foreign adversary attacks on these fundamental institutions of democracy.”

II. The Response

Against that understanding of the threat, there are several reasons to value a law enforcement approach, even if it is clearly not the only, or even the best, approach under all circumstances. First, it is public. As one former CIA officer argued, “The most effective method to combat Russia’s intrusions into our political process is to be clear, transparent and honest with ourselves about how the Kremlin operates and what it hopes to achieve.” By its nature, covert action is most effective when it is covert—a point made as effectively as it can be by a 2013 article in the Onion, 231 CIA Agents Killed in Overt Ops Mission. Real-time, accurate reporting of Russian influence could turn a potentially effective covert social media campaign into the equivalent of a series of op-eds by Vladimir Putin.

Seen in this light, the main benefit of the IRA indictment is that it explains to us, the American people, an important part of what the Russians have done, and will almost surely do in the future. As I discussed on a recent episode of the Lawfare Podcast, the Russian efforts represent a virus for which we presently do not have sufficient antibodies. Over time, we can develop those antibodies—culturally, legally, operationally—but not without first recognizing the virus for what it is. Not all national security threats can be addressed through exposure—knowing that there are missiles in Cuba, for example, does not make them go away. But in this case, identifying the threat helps to remove it. Sunlight disinfects, if it shines in near real-time.

At least in the absence of any follow-up assessment by the intelligence community, the IRA indictment is a powerful, public account of (one aspect of) the Russian campaign. Our criminal justice system enjoys well-deserved credibility, and Justice Department policy, to which the Special Counsel is bound, permits charges to be filed only when “the admissible evidence will probably be sufficient to obtain and sustain a conviction” through proof beyond a reasonable doubt. Indictments are only charges, not proof—but when they are credible they send a strong message, even if that is not their primary purpose.

It may well be, as Jack Goldsmith suggests, that “Mueller’s credible attribution may enhance the impact of the Russian information operation,” and that in a parallel universe where the author of the information warfare campaign was never discovered, it would be better to deprive the Russians of credit by not naming names. I am very skeptical of this approach, because I think that failure to confront a bully only encourages bullying, and also because the ICA noted that the Russian influence campaign was “designed to be deniable,” which suggests that they may not have wanted to be caught (they continue to deny the campaign even now). In any event, such an approach would leave Putin with the option to make a disclosure and take credit whenever it suits him. Indeed, a similar argument for non-attribution could be made about terrorist attacks, but rarely is, because we don’t want to rely on terrorists’ voluntary silence.

In any event, however, the ICA already named the Russians, albeit without the credibility-enhancing detail supplied by the IRA indictment. It is certainly possible to imagine that our immune system will go into overdrive and create a “[r]ed-scare mentality in our marketplace of ideas” as Jack fears. I am sympathetic to that concern, and made a similar point on the Lawfare Podcast, but right now the overriding problem is that our marketplace of ideas is being flooded with grey goods. We need to address that first, and then be sure to calibrate our response. We can’t afford to remain inactive for fear of becoming over-active.

Moreover, in exposing the Russian efforts publicly and credibly (which I think is necessary), an indictment may be more protective of intelligence sources and methods than other approaches, such as a public, follow-up ICA. The provenance of the evidence described in the IRA indictment is not yet clear, but it may well have been acquired using only traditional law enforcement methods, even if the ICA (or media reporting) served as a kind of background roadmap for the investigation. In some respects, the indictment could be an example of what some refer to as “parallel construction,” which relies on traditional Fourth Amendment rules (e.g., inevitable discovery or independent-source doctrine) to assess whether intelligence methods must be disclosed in a criminal case. It is in the special counsel’s litigation interest to avoid intelligence entanglements in these cases, so I would expect that he has relied as little as possible on intelligence community sources and methods to construct his indictment. It is certainly the case that the IRA indictment provides more detail about the Russian plot, but probably not at the risk of any of our more exotic collection platforms.

Indeed, law enforcement investigation may be especially effective given the domestic aspects of the Russian conduct. Only the intelligence community can put a hidden microphone in Vladimir Putin’s tea kettle, but the activity described in the IRA indictment took place here (e.g., rallies in Florida and New York), was perpetrated through our financial and communications infrastructure (e.g., U.S. banks, and email and social media providers), and was facilitated by Russian operatives’ covert travel to this country. The evidence of this misconduct is very much domestic and very much within the reach of federal law enforcement. In some cases, e.g., involving customer records from U.S. banks, law enforcement may enjoy easier access to information than do intelligence community members devoted solely to foreign intelligence. (The FBI is a hybrid organization, and grand jury subpoenas are very powerful investigative tools, even as compared to National Security Letters.)

The gravamen of the offense identified in the indictment is also very much domestic. It was directed at Americans in America and was designed to affect elections and our domestic politics. Andrew McCarthy has no quarrel with criminal charges against Americans, but while the IRA indictment charges only Russians whom the U.S. government may never get its hands on, it’s also true that those Russians came to our country and tried to manipulate it—so domestic criminal charges do not seem unwarranted. The IRA indictment also may encourage cooperation from others, and lay the groundwork for future charges against any Americans who conspired with or aided and abetted the Russians.

Finally, it must be said: law enforcement, precisely because it is traditionally more independent of White House and congressional real-time influence in particular cases, may be the best or only available option right now. It is reasonably clear that President Trump has downplayed the Russian threat, or at least equivocated about it, including in 2017, after the ICA was released.^[4] He certainly has not made it a national priority, and apparently has never convened a Cabinet meeting on the issue.^[5] Nor is much serious congressional leadership forthcoming. In terms of investigations into Russian conduct, the House Intelligence Committee is a disaster, perhaps due to some historical issues but also largely because of the behavior of Chairman Devin Nunes. The Senate Intelligence Committee and the Senate Judiciary Committee are better but still not very effective.

In light of this, other measures may not realistically be available. For example, is it plausible to believe that President Trump has issued a finding authorizing an aggressive new covert action campaign to respond to the Russian efforts? It is certainly possible, but I do not think it is likely. Admiral Mike Rogers, the director of NSA, explained in congressional testimony on February 27 that “we have not opted to engage in some of the same behaviors that we are seeing” from the Russians (by executive order, it is CIA, not NSA, that may “[c]onduct covert action activities approved by the President,” and so this sentence should not be understood to suggest anything about covert action, or to denigrate existing NSA and Cyber Command authorities). Further, although Congress enacted legislation to impose new sanctions on Russia, President Trump recently declined to impose some of them, at least for the present. The New York Times reported in March 2018 that “the State Department has yet to spend any of the $120 million it has been allocated since late 2016 to counter foreign efforts to meddle in elections or sow distrust in democracy.” To the extent the law permits it, of course, those choices are the President’s prerogative. But worries that the IRA indictment is crowding out or interfering with other efforts must come to grips with the serious question of whether any such efforts are likely to be underway. As Admiral Rogers testified in response to the question, “what do you need” to “go after and punish” the Russian attackers beyond current authorities: “I’d need a policy decision that indicates that there’s specific direction to do that.” As it stands, Rogers explained, nothing we have done has “changed the calculus or the behavior on the part of the Russians.” If it were not for the special counsel, what would the U.S. government be doing about the Russian influence campaign? If the indictment makes us look weak—and I am not at all sure this is the case, as explained above—how would we look if nothing were done?

Law enforcement is not the solution to every counterintelligence problem. It is not the best solution to many counterintelligence problems. With respect to some problems it may be unproductive or even counterproductive. But for the particular challenge posed by Russian covert influence efforts, for which the first countermeasure is credible and detailed exposure, and at a time when the President is—at best—not providing strong leadership on the issue, the IRA indictment is a helpful step primarily because it educates the American people to the risks they face. We ought not expect the special counsel to solve this problem on his own, especially because that is not his mission, but we can appreciate his contribution to a solution without abandoning hope that other aspects of U.S. power also will be brought to bear.