Cyber-enabled influence operations as a ‘center of gravity’ in cyberconflict: The example of Russian foreign interference in the 2016 US federal election

Abstract

Russia’s cyber-enabled influence operations (CEIO) have garnered significant public, academic and policy interest. 126 million Americans were reportedly exposed to Russia’s efforts to influence the 2016 US election on Facebook. Indeed, to the extent that such efforts shape political outcomes, they may prove far more consequential than other, more flamboyant forms of cyber conflict. Importantly, CEIOs highlight the human dimension of cyber conflict. Focused on ‘hacking human minds’ and affecting individuals behind keyboards, as opposed to hacking networked systems, CEIOs represent an emergent form of state cyber activity. Importantly, data for studying CEIOs are often publicly available. We employ semantic network analysis (SNA) to assess data seldom analyzed in cybersecurity research – the text of actual advertisements from a prominent CEIO. We examine the content, as well as the scope and scale of the Russian-orchestrated social media campaign. While often described as ‘disinformation,’ our analysis shows that the information utilized in the Russian CEIO was generally factually correct. Further, it appears that African Americans, not white conservatives, were the target demographic that Russia sought to influence. We conclude with speculation, based on our findings, about the likely motives for the CEIO.

Keywords

cyber-enabled influence operations cyber conflict Russia semantic network analysis US presidential election

Introduction

Hollywood thinks it knows cyberwar. Popular imagery of conflict in the newest domain consists largely of explosions and nervous nerds with fast fingers consequentially clattering on keyboards. Strangely, this is not much different from the vision offered by cyber experts, who often concentrate on rare or even non-existent ‘cyber war’ events (Arquilla and Ronfeldt, 1993; Clarke and Knake, 2010; Gartzke, 2013; Rid, 2012).

Cyberspace is an informational domain. It is far easier to move (and manipulate) data and ideas in cyberspace than it is to alter the physical world directly. To date, the bulk of cyber conflict has involved the manipulation of information (espionage, theft of intellectual property (IP), election manipulation) rather than the damage or control of tangible ‘stuff.’¹ While all forms of conflict exhibit a ‘power law’ distribution by dispute intensity – with few large events and far more small ones – cyber conflict appears ‘flatter’ than other domains.² Cyber conflict more often revolves around subtle acts of influence and information control, not the percussive destruction of human life and property. Cases of low-intensity cyber conflict are mounting, creating an imperative to re-think conceptual frames and to collect better data. States and other actors are spying on each other, stealing information, and trying to manipulate elite and popular understandings of political processes through the use of cyber-enabled influence operations (CEIOs).

Consequentially for researchers plagued by the problem of cyber events data availability (Baram et al., 2023; Hamman et al., 2020), CEIO data are often publicly available. This feature of CEIOs allows researchers to study elements of cyber conflict that are otherwise inherently clandestine (Gartzke and Lindsay, 2015). However, despite data availability, little has been done thus far to examine how adversaries use cyber capabilities to select and target various domestic audiences. Here, we offer one pathway for researchers interested in the systematic empirical study of low-intensity cyber conflict.

We also seek to demonstrate that textual analysis can be used as a tool to assist in understanding the mechanisms by which CEIOs function. To analyze operations targeting networks, one would need to use forensic analysis to reverse-engineer such operations and understand their mechanisms. When it comes to cyber operations designed to target human minds, however, we can assess available textual data to gain a deeper understanding of how such operations seek to influence groups and individuals, their perceptions of surrounding reality, and their behavior. In the case of CEIOs, textual content is the nominal payload. Importantly, the content of CEIOs is often readily available in open-source format.

Interest in cyber-enabled influence operations in particular skyrocketed in the aftermath of the Russian effort to interfere in the 2016 United States presidential election. While Russian-funded influence operations have fueled considerable public debate, careful research has only started to build momentum. To date, scholars have yet to prepare a systematic examination of targeting as well as messaging strategies of Russian CEIOs. This project seeks to fill this gap. Researchers must examine mechanisms by which CEIOs function to both understand and counter such operations.

We examine the cyber-enabled influence operation during the 2016 United States presidential election initiated by Russia by using the Facebook ads dataset released by the Senate Select Committee on Intelligence. We do so by employing social media textual data analysis. First, we study what groups were targeted. Second, we use semantic network analysis (SNA), a form of social network analysis that treats words as network nodes and helps unveil themes utilized in bodies of text. We apply SNA to assess both the content and transmission of messages to identify different targeted populations and issues, understand how organic discourse was mimicked or ‘faked’ in target audiences, and the extent to which themes were amplified throughout a given network. SNA is thus especially salient as a technique in attempting to analyze CEIOs.

Cyberspace as a domain of conflict enables adversaries to target combatants and civilians alike. Cyber-enabled influence operations specifically target domestic audiences in adversary states with the goal of affecting these publics – an activity that is bound to be highly problematic in the context of democratic target states where voters ultimately determine national policy. As such, CEIOs provide states with a tool to pierce the democratic election process that is traditionally considered a domaine réservé.³

Researchers studying international security will benefit from considering CEIOs as part of the panoply of behaviors that pass below the threshold, or simply bypass, open armed conflict. Indeed, such operations represent a substantial portion of the most consequential, if subtle, conflict behaviors occurring in cyberspace. Whether practiced in isolation or in concert with other tools, CEIOs have the potential to undermine social cohesion or confidence in a regime or, alternately, to create foreign policy outcomes that are deemed desirable by a foreign power. CEIOs have increasingly been implemented in apparent attempts to influence domestic democratic processes. We detail one prominent example of a CEIO below, delineating the logic and likely impact of Russia’s interference in the 2016 US federal election.

‘Hacking’ human minds

Major overt acts of aggression make headlines, but subtler efforts can shape perceptions, and change the world. Cyberspace is especially well suited for influencing humans on a cognitive level for three reasons: (a) influence is conveyed via platforms rooted in cyberspace that users directly interact with; (b) cyber capabilities enhance the scale and speed of information dissemination; and (c) the emergence of cyberspace has enabled actors to micro-target audiences to an extent that was not technologically feasible in the past.

First, influence operations are facilitated in and via the virtual domain. In operational terms, cyberspace can be considered a ‘complex adaptive system’ (Kaminska, 2021), consisting of three layers: physical, logical, and social (United States Army, 2010). The three layers are further subdivided into five components (see Figure 1), consisting of geographic, physical network, logical, persona, and cyber persona components (United States Army, 2010). While terms (names) for the cyberspace layers vary from source to source (Gomez, 2020; Libicki, 2009), there is a general consensus regarding their ordering. The space where humans interact with machines (generally in a network) is considered the top layer and is where data are transformed ‘into a form suited for human consumption’ (Gomez, 2020; United States Army, 2010).

Figure 1.

Cyberspace layers as visualized by Yang and Yu (2014) adapted from Figure 2.1 in United States Army (2010) ⁵

While cyber operations that aim to affect networked systems often occur below the level of human interaction – at the physical and logical layers – the surface (social) layer of cyberspace is susceptible to information operations designed to reach and affect humans behind keyboards. Penetrating through this social layer, CEIOs can potentially have effects on their targets outside of cyberspace by producing a change in behavior ‘in real life’ (Gomez, 2020; Libicki, 2009; Lin and Kerr, 2017). Importantly, the psychological mechanisms that influence operations utilize on a cognitive level are arguably easier to exploit in the cyber domain (Gomez, 2020).⁴ The reach of such operations can be far and wide, given their relative ease of use and potential impact (Jensen et al., 2019; Whyte, 2020).

Second, cyberspace increases the rapidity and scale of information (and influence) transmission. When compared with more traditional ‘black propaganda,’⁶ cyber operations spread disinformation with unprecedented speed (Warner, 2019). During the Cold War, the USSR initiated Operation Infektion, also known as Operation Denver, intended to disseminate the falsehood that the United States engineered AIDS at military medical laboratories in Fort Detrick (Rid, 2020; Walton, 2022). The Soviet Union took an indirect route to spread this false information through a news story that first appeared in the Indian daily The Patriot, in 1983. By 1987, the accusation that the United States had engineered AIDS appeared on the CBS evening news with Dan Rather (Yaffa, 2020). It took this lie propagated by Soviet operators four years to reach broad American audiences. The lie had special resonance among African Americans, 50% of whom believed in 2005 that AIDS was human-made (Bogart and Thorburn, 2005). The Internet, along with social media, makes it much easier to propagate false information at a greater speed and scale.

Third, algorithms enable the ‘micro-targeting’ of citizens with information aimed to influence and mobilize them, specifically. Perceptions of social media have evolved, however, and are increasingly gaining a security context for several reasons, including privacy concerns. Social media platforms collect and store troves of information about their users, which are then monetized by promising to connect advertisers with the closely matched users (Cotter et al., 2021), including in political campaigning.

The Cambridge Analytica scandal revealed an especially dark side of this issue (Cadwalladr and Graham-Harrison, 2018). The now defunct company used personal user data to build psychographic user profiles (Garcia-Diaz et al., 2022; Kanakia et al., 2019) and influence voting preferences through tailored advertising (Hinds et al., 2020). Brad Pascarle, digital media director for Donald Trump’s successful 2016 presidential campaign, claimed that targeting highly specific clusters of voters daily on Facebook helped win the election (Cotter et al., 2021). On Facebook, users are grouped into different ‘interest’ categories, that are then sold to advertisers. Russian propagandists gained access to domestic US audiences in their efforts to interfere in the 2016 election using these sources.

While the role of social media in spreading civil revolutions and toppling authoritarian regimes can be seen as enhancing the spread of democracy, democratic institutions are themselves vulnerable to assault through the internet. For example, the internet has been shown to facilitate protest mobilization (Breuer et al., 2015), including the spread of information about protests (Tufekci and Wilson, 2012), and to undermine government censorship of conventional news outlets (Chowdhury, 2008).

On the other hand, social media raise a host of concerns about the manipulation of electoral processes. Indeed, studies have examined the use of social media as a means of spreading false information (Allcot et al., 2019) aimed at influencing audience opinions and behaviors for malicious purposes (Prier, 2020), especially during elections (Kim et al., 2018). Influence operations employed through social media can be used to ‘hack’ democracies with the intent to undermine democratic processes by corrupting the marketplace of ideas and ‘dampening the capacity’ of democracies to engage in healthy self-correction (Whyte, 2020).

Taking a closer look: Cyber-enabled influence operations

We focus on what we consider two of the most important features of cyber-enabled influence operations. First, CEIOs are an expression of international competition at a lower level than overt physical violence. Second, contrary to much of the reporting on the topic, which has labeled these cyber-enabled attempts at influence as ‘misinformation’ and ‘disinformation’ campaigns, much of the actual content delivered by social media is factually accurate. We discuss these two important features of CEIOs, each in turn.

The human dimension of cyber conflict is becoming increasingly important (Shandler and Canetti, 2023). Instead of a modern, electronic equivalent to conventional warfare, scholars argue that cyber conflict to date is akin to espionage/counter-espionage contests (Lindsay, 2024; Rovner, 2020). Indeed, there is considerable continuity between Cold War influence operations and today’s cyber operations (Walton, 2022; Rid, 2020), where cyber ‘attacks’ are instruments of subversion (Maschmayer, 2022).

While the use of social media to conduct influence operations is a modern phenomenon (Libicki, 2020), information is a perennial tool of statecraft (Warner, 2014).⁷ Russia, and before it the Soviet Union, is a major exponent of various influence techniques as a function of state policy (Shultz and Godson, 1984). These operations have been studied as a continuation of Russian disinformation and ‘active measures’ (Rid, 2020), and as elements of informational warfare (Lin and Kerr, 2017).

Perhaps to a greater extent than any other form of political competition or conflict, influence operations blur neat distinctions between peace and war. Influence operations allow the ‘supreme art of war’ – ‘to subdue the enemy without fighting’ (Sun Tzu, 2007), and are increasingly understood as a major non-military means of competition (Jonsson, 2019; Kania, 2020). If international politics is considered an ongoing struggle (as Bolshevik leaders historically defined it), as opposed to alternating between periods of war and peace (Shultz and Godson, 1984), then cyber-enabled influence operations constitute a particularly insidious tool. Indeed, successfully countering cyber threats necessitates a response to cyber-enabled influence operations, which are integral to how countries advance their goals in the cyber domain (Libicki, 2020).

Discussions of CEIOs and their equivalents often emphasize terms like ‘misinformation’ and ‘disinformation,’ suggesting the unintentional or intentional spread of falsehoods, respectively.⁸ For example, the events of 2016 sparked much interest within the social science literature on the effects of cue giving, fake news, disinformation, and counter-messaging campaigns.⁹ While many influence operations may contain falsehoods, CEIOs that rely on information that is factually correct are arguably far more effective. Yet, this feature of influence operations is often either omitted, or noted just in passing (Shultz and Godson, 1984: 38).

The use of falsehoods for political purposes is neither novel nor reserved for non-democratic states.¹⁰ However, the use of truthful information as part of a broader influence campaign requires more nuance, research, and planning. Truthful claims may take hold of public thinking more than ‘fake news.’ According to a former senior disinformation officer Ladislav Bittman, when targeting Western audiences, the first step was to obtain intelligence about existing societal cleavages, and then amplify these, instead of creating a ‘big lie’ (Walton, 2022). In the case of Operation Infektion, it was not the Soviets who came up with the idea that AIDS had been secretly manufactured by the US government. In fact, as reported by Rid (2020), this theory first emerged in the gay rights activist community in the United States.

CEIO mechanisms

CEIOs can be understood as targeted efforts to influence the perceptions or beliefs of a given audience, with the goal of altering behavior in order to advance a specific political agenda (Larson et al., 2009). CEIOs can be pursued with the intent of instilling confusion in a population, but they can also be used to promote or reinforce consensus, or to induce apathy. CEIOs are influence activities conducted through cyberspace, aimed at affecting an individual’s cognitive status/condition and/or psychological perceptions (Larson et al., 2009). Adversaries may seek to reinforce existing latent perceptions by targeting certain groups that hold specific biases and amplify those biases. We focus on CEIOs where the apparent intended effects involve achieving behavioral (political) changes among members of a given electorate.

While CEIOs can be seen as an extension of an intelligence contest (Rovner, 2020), the ability to target audiences with unprecedented scale and speed (Warner, 2019), as well as the precision and accuracy afforded by such campaigns, represent a considerable source of innovation. Social media platforms such as Facebook allow actors to micro-target audiences based on their interests and place the messages in the format that the users are most likely to pay attention to and engage with. This targeting process might be consequential, as it allows for inauthentic behavior to affect how political messages are received and shared on social media. We adopt a framework further detailed in previous research (Vićić, 2021; Vićić and Harknett, 2024).

We conceive of CEIOs as occurring in three phases, Identification–Imitation–Amplification (IIA). The first step in this cycle involves identifying (I) groups of individuals and issues that should be targeted and exploited through CEIOs. Microtargeting allows for a foreign entity to identify individuals using the individual’s online footprint. Social media is particularly suitable for microtargeting because the subjects of influence can be identified based on their various preferences, which are shared online as part of their online identities. Simultaneously, it is possible to identify potential fears, biases, and preferences of the chosen targets. In the second step, CEIOs imitate (I) organic conversations in the identified groups as a bridge to achieving influence over these groups. Cyberspace allows for imitation by foreign actors which can pose as members of the target group and participate in domestic conversations. In this way, target group identities and the salient issues can be emphasized and communicated back to the target groups. Third, manipulated conversations are then amplified (A) using social media tools, such as automated software ‘bots’ to increase the frequency of, and build on, previous messaging. The IIA pattern can be continuously expanded by identifying new salient issues and groups with the goal of creating discordant representations of perceived reality in the target groups or establishing group echo chambers.

CEIOs are distinctive in that the accumulation of effects, while difficult to measure, is part of the operational cycle. For CEIOs, the payload (information) persists, accumulates, and metastasizes. With a DDoS attack, for example, once the attack stops, the effects cease. In contrast, with CEIOs, the cognitive effects can persist and accumulate within a target’s mental models, and can be re-activated at a later point in time. Moreover, the effects of CEIOs are unlikely to be as direct as those of cyber operations targeting networked systems. While CEIOs could conceivably affect electoral outcomes directly by changing the behavioral preferences of target audiences, they may more often result in cognitive changes affecting (for example) militancy, distrust of institutions or digital outlets, changed cybersecurity behavior (Shandler and Gomez, 2022), as well as changes in a target’s location on the left–right political spectrum (further entrenchment), and changes in trust in government more broadly. These effects may vary – from swaying voters’ opinions, to mobilizing support, and even discouraging certain individuals from voting (suppression).

In the following section, we turn to the case of Russian use of cyber-enabled influence operations on Facebook during the 2016 US presidential election. In doing so, we identify the audiences that were targeted by this CEIO, and delineate the themes that were emphasized in targeting these audiences.

Russian election interference in 2016 US presidential election

Russian cyber operations linked to the 2016 US Presidential election garnered significant attention in the media and concern from policy makers and academics. Reportedly, 126 million Americans were exposed to the Russian CEIO on Facebook between 2015 and 2017 (Ingram, 2017). Facebook is said to have sold $150,000 worth of political advertising to Russian sources (Jensen et al., 2019). While a miniscule figure, particularly in national security terms, its consequences were disproportionate to its small size. This of course reflects both the efficiency and massive potential impact of CEIOs.

In official US government documents, the intelligence community has identified numerous and broad-ranging goals of Russia’s social media activity. For example, the US indictment against a Russian organization known as the Internet Research Agency (IRA) suggests that it ‘had a strategic goal to sow discord in the US political system, including the 2016 US presidential election’ (Indictment, United States v. Internet Research Agency, et al., 2018). Another putative objective of the IRA was the polarization of US society based on social, racial, and ideological differences. Additionally, undermining public faith in the democratic process, as well as compromising the campaign of Democratic candidate Hilary Clinton, were listed in other US government documents (Office of the Director of National Intelligence [ODNI], 2017; Senate Select Committee on Intelligence, 2020). According to a declassified report authored by staff members of the Central Intelligence Agency, the Federal Bureau of Investigation, and the National Security Agency, the Russian election interference represents both an effort to undermine the liberal international world order and an escalation as compared to previous operations (ODNI, 2017: ii).

The Report of the Senate Select Committee on Intelligence (2020), focused on Russia’s ‘active measures’ during the 2016 US election, remarked that the ‘Russian information campaign exploited the context of the election [. . .] the preponderance of the operational focus [. . .] was on socially divisive issues – such as race, immigration, and Second Amendment rights – in an attempt to pit Americans against one another and against their government.’ In assessing Russian activities and intentions during the 2016 US election, the Office of the Director of National Intelligence (2017) released a report stating that, ‘Russia’s goals were to undermine public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency.’ The report further states that, ‘Putin and the Russian Government developed a clear preference for President-elect Trump’ (Office of the Director of National Intelligence, 2017).

In the aftermath of the release of a redacted version of Russian-purchased Facebook ads, a limited number of studies examined the content of these political advertisements. For example, one study using sentiment analysis assessed the emotional appeals of the text of the ads, finding that textual sentiment ratings went down before the 2016 election, and then went up after the election results were announced (Alvarez et al., 2020). Another study (Kim et al., 2018) found that some of the topics used in the Russian Facebook ad campaign (including race, police brutality, nationalism, immigration, and gun rights) also appear on the Pew Research Center list of the top ten most important voting issues (Alvarez et al., 2020; Etudo et al., 2023).¹¹ Other studies find that the ads used in the Russian CEIO on Facebook were divisive, were facilitated by microtargeting (Riberiro et al., 2019), and were built to incite anger and fear (Vargo and Hopp, 2020; Etudo et al., 2023). In terms of scope and scale, the Russian campaign spread over platforms including Facebook and Twitter and was promoted through web search engines like Google and Bing (Spangher et al., 2018). In terms of resonance, studies investigating the propagation of ideology on Twitter show that conservatives retweeted Russian trolls 31 times more often than liberals, with the most retweeted content originating from Tennessee and Texas (Badawy et al., 2018).

Despite the interest that the Russian information campaign garnered, there is no unified way to understand its objectives. Sowing discord (Alvarez et al., 2020; Mueller and Special Counsel’s Office Dept of Justice, 2019) is broadly described as the goal of the CEIO, but deeper analysis is still lacking, and needed. Both the security community (Goldman et al., 2020) and Facebook itself (Kelly, 2019) highlight the urgency of conducting research to understand the cyber-enabled influence operation on Facebook. To date, both government reports and the academic literature refer to the diverse campaign goals described above. Additionally, the focus in analyzing the campaign has been on disinformation, while other aspects of the Russian social media CEIO have been somewhat overlooked. Finally, studies of cybersecurity have yet to come up with a generalizable theory to explain the events above in the broader context of CEIOs.

Methodology: Using text-as-data in network analysis

Cyber-enabled influence operations are aimed at producing effects on their target audiences via text, audio and visual messaging. Today, such messages, collected from platforms such as Facebook, Twitter, and Reddit, are available to researchers. Open-source text can be treated as data and used to develop relevant analytical details – a corpus meta-network (Carley, 2002; Krackhardt and Carley, 1998).

Network analysis refers to the study of relationships between ‘things,’ where the ‘unit of analysis is not an individual actor, but the collection of actors and relationships that form the network’ (Maynard, 1997). Semantic network analysis (SNA) refers to the study of relationships between words and concepts. SNA rests on the idea (Carley, 1997) accepted in cognitive science and psychology that people understand the world through internal representations or mental models (Jones et al., 2011). As was first recognized by Craik (1943), and further discussed by Johnson-Laird (1983), human beings employ tacit mental processes to construct mental models of the world. Semantic networks or maps are a verbal representation of cognitive constructs that reflect subjects’ knowledge and understanding of a certain thing (Johnson-Laird, 1983; Rouse and Morris, 1986). SNA can be defined as network analysis that treats words and concepts as nodes with the goal to build networks of concepts and uncover meaning from the structure of those networks (Shim et al., 2015). SNA is widely used in the natural and social sciences (Carley, 1993; Kim et al., 2007; Maynard, 1997; Shim et al., 2015).

Bi-modal networks are an example of a meta-network, which is used for structural data analysis. Meta-networks reveal how different entities are linked. Multi-mode networks can help to reveal relational social structure based on the categorization of text into different ontological groups (Diesner and Carley, 2005). There are eight ontological categories including: agent, event, knowledge, location, organization, resource, task, and attribute. Categories can be assigned to nodes to facilitate analysis. Bi-modal network analysis of the Russian CEIO can reveal the underlying relational structure between Facebook ads and target groups. Constructing a bi-modal network will help test the expectation that CEIOs are identifying and targeting particular groups. It can also visually represent the volume of the campaign. As the first step in this analysis, a bi-modal network will show how Russian ads cluster around different target groups.

In the second stage of this analysis, we examine the uni-modal semantic network built utilizing the text from the Facebook ads in the sample. SNA helps understand the meaning of the raw content.¹² As discussed by Shim et al. (2015: 58), important properties of textual data can be uncovered, such as dominant concept subgroups, bridging concepts, and frequently mentioned terms. SNA also helps unveil the underlying meaning of text. By mapping dominant concept subgroups in texts, and then using the bridging concepts (established through centrality analysis), SNA can help map both main arguments as well as the underlying meaning of text and reveal hidden meanings (Newman, 2006; Shim et al., 2015). SNA analysis helps to uncover the dominant words and themes used across ads to target specific social groups. It is thus possible to assess some of the theoretical expectations of this project. For example, how did the designers of the Facebook CEIO seek to mask their identity and pose as members of target groups? Additionally, what were the salient themes that were used, and how do they differ across different target groups? Are there underlying meanings within subgroups and what are those meanings?

This study adopts an exploratory approach. In applying SNA, we utilize the NetMapper software for extracting textual networks from Facebook ads, and ORA for network analysis and visualization.

Data and sampling procedure

To explore what a CEIO on social media looks like, and examine the mechanisms by which they function, we focused on Russian-purchased Facebook ads. The US House of Representatives Permanent Select Committee on Intelligence released all Russian-purchased ads in the period between 2015 and 2017.¹³ There were 3,519 ads released in the ‘.pdf’ format (for ad example see Figure 3). These data are unstructured text. Meta-data include the following categories: ad ID, ad text, ad targeting location, ad interests, excluded connections, age, language, number of ad impressions, ad clicks, ad spend, ad creation, and ad end date (see Figure 2). Most of the categories are self-explanatory except for ad impressions, which can be understood as the number of views of that particular ad. Impressions (n.d.) describes ad impressions as ‘if an ad is on screen and someone scrolls down, and then scrolls back up to the same ad, that counts as 1 impression.’ The act of viewing an ad through a user’s on-screen scrolling activity is thus recorded as viewing a given ad. Ad clicks are recorded separately. Some of the ads were redacted for either text or imagery, or both.

Figure 2.

Example of Facebook ad meta-data

For the purposes of this project, 200 ads were randomly selected for analysis. The selected ads constitute a representative sample of the ads that were released. Sampling is a well-understood and commonly applied technique in the social sciences that is particularly appropriate where intensive coding of data can help to make these data more usable (King et al., 1994).

Figure 3.

Visual representation of the Facebook ad (ad id 1982)

‘Building’ the network

To conduct SNA, textual data must first be preprocessed. Text preprocessing involves preparing documents for network extraction (network building) and analysis. Networks are then extracted from the preprocessed text, extracting words and concepts and coding them into nodes. Ties (links or connections) are identified between nodes based on co-occurrence in each ad text (performed by network extraction software). The process of building networks is described as the data-to-model (D2M) process (Carley et al., 2012). D2M workflow generally involves a series of separate steps leading to analysis, including data/text collection, text pre-processing, thesauri and delete list generation, network visualization, generation, and analysis (Carley et al., 2012). D2M was followed in this project. The step-by-step network extraction process is delineated in Online Appendix A. The coding procedure for identifying targeted groups based on ad meta-data information is described in Online Appendix B.

The coding procedure was applied to the whole sample of randomly selected ads. Overall, multiple groups of ads were identified (see Table I). Again, groups were coded using meta-data listed interests. There are thematic similarities among groups (e.g. ‘Anti-police’ and ‘Police brutality’). Ads where the target interests were listed as ‘Cops block’ were coded as ‘Anti-police,’ but ads where the interests were listed as ‘Police brutality’ were coded as such.

Table I.

List of target groups based on social identity, political issues, and miscellaneous topics

Social identity	Issues	Miscellaneous
African American Muslim Native American LBGT Liberal Hispanic Veteran Libertarian Ex-con	Anti-Clinton Anti-guns Anti-immigration Anti-Islam Anti-police Anti-Trump Clinton Guns (2nd Amendment) Police brutality Religion Trump US Independence/Patriotism	Humor College students Music Self-defense Business

Descriptive statistics

The largest primary target group of the Russian ad buy based on listed Facebook interests were African Americans, targeted with 108 ads (54.27% of the sample), followed by issue ads targeting Anti-Immigration (16 ads or 8.04%), and Hispanic (11 ads or 5.53% of the sample). For ads in the sample, total spending was 350,777.25 rubles, or roughly $5,500 (Shane and Goel, 2017). Prima facia, in terms of the validity of the content, 186 ads or 94.42% of the sample employed information that was factually accurate (i.e. not false), 7 ads or 3.55% used false information, while the information in 4 ads (2.01%) could not be verified. Digging a bit deeper, 56.86% of the ads are framed as an opinion, and only 31.47% of the ads actually reference factual details. However, of those ads where factual details are referenced, this information (as presented) is truthful in 87.10% of cases. For distribution of ads employing false information, see Table II.

Table II.

Showing the percentage of ads that employed false information

False information	Frequency	Percent	Cumulative
No	186	94.42	94.42
Yes	7	3.55	97.99
Could not verify	4	2.03	100.00
	197	100.00
Is the text framed as an opinion?
No	85	43.15	43.15
Yes	112	56.85	100.00
	197	100.00
Does the text reference factual details?
No	135	68.53	68.53
Yes	62	31.47	100.00
If referenced, are factual details truthful?
No	8	12.90	12.90
Yes	54	87.10	100.00
	62	100.00

The location of ads does not appear especially inconsistent with the geographical distribution of the US population (see Figure 4). Rural regions are represented (Idaho, Minnesota) as well as the Midwest (Illinois, Kansas), North (New York), South (Georgia, Texas) and West (California). Some ‘swing states’ in the 2016 election are included in the sample (Ohio, Pennsylvania, Virginia, Wisconsin) but others are not (Colorado, Florida, Iowa, Michigan, Nevada, New Hampshire, North Carolina). In short, the strategy emphasized in Donald Trump’s successful electoral campaign of targeting key swing states to win electoral votes does not appear to have been the focus of the Russian ad buy (Mahtesian, 2016).

Figure 4.

Map showing locations in the United States that were targeted with ads in the sample

Results

Two sets of results generated in ORA are presented below. Figure 5 depicts a visualization of the Russian Facebook influence operation based on the randomly drawn sample used in this study. This is a between-ads (documents) network, which shows relational ordering of the ads and groups targeted based on declared interests. We can see that there is clustering in the data around target groups as expected.

Figure 5.

Bi-modal network

Tables III and IV represent the top ranked concepts, and general semantic network properties of the seven largest textual networks.¹⁴ The results confirm expectations that specific marginalized groups were targeted; targeting was based on social identity or political, economic, and social issue support (Table III). Results also appear to show that the messaging is incendiary and diverse across groups. Additional textual analysis was employed to examine the most salient concepts used in group targeting (Table III). Bolded words indicate concepts with high in-degree and betweenness measures, identifying nodes that act as hubs to connect different thematic communities (Shim et al., 2015). Use of these words in ads across groups supports the expectation that CEIOs seek to achieve influence through the IIA mechanism by imitating organic conversations and posing as in-group members, while potentially obscuring the identity and intent of the authentic creators of the message (i.e. Russia). This strategy might be used to increase the influence of given messaging. Table III also shows some overlap in key words between the African American target group and Police target group.¹⁵ For example, results show that words such as ‘police_officer’ feature prominently in the ads targeting both groups, as well as references to blackness.¹⁶ This finding confirms the expectation of inflammatory topics in CEIOs.

Table III.

Overall top ranked concepts using ORA node level centrality measures

Group	African American	Anti-immigration	Hispanic	Independence/ Patriotism	LGBT	Guns	Police
Degree andBetweennessCentrality	Black, United_States, People, We, Police_Officer, White, Our, Group, Man, Know, blackmatters.com	Our, Refugee, Death, We, Protect, Terror, United_States, You, Simple, Muslim, Stop, Become, Just, Group	Lies_of_the_Devil, Spanish, Conquest, Priest, You, Maya, History, Record, Writing_System, Survive, Husband, Group, Survive, Connect, Entertain	United_States, We, Our, Group, History, Banned, Ban, Building, Community, Decade, Attack, Say, Texas, Muslim	We, People, LGBT, law, against, United_States, Our, Students, Group, Feel, Ridiculous, Group, Place, Learn	We, United_States, Our, Group, History, Banned, New, United_States, Building, Community, Attack, Texas, Muslim, Now, Time, Ban	Video, Police_Officer, BM, White, Go_Viral, Kid, United_States, Chant_n_Word, Facebook, Montgomery_County, Kill, Just, Live, Meet, Took, Error

The value for a node is the average of its measure values (converted to z-scores). Final scores are then normalized between 0 and 1 (bolded).

Table IV.

Network properties

Characteristics	African American	Anti-immigration	Hispanic	Independence/ Patriotism	LGBT	Guns	Police
Nodes	1300	205	83	404	281	421	187
Ties	82400	3050	283	11853	6897	12649	1637
Isolates	3	1	3	0	3	0	2
Density	0.049	0.073	0.041	0.073	0.087	0.071	0.047
Clustering coefficient	0.738	0.401	0.300	0.416	0.412	0.411	0.388
Number of groups	14	8	13	9	8	7	8
Largest group	240	60	27	83	79	113	46
Largest group density	0.167	0.321	0.226	0.348	0.320	0.249	0.093

As expected, the African American group is the largest overall in terms of network size (most nodes, Table IV). Network size varies across targeted groups, with the Hispanic group as the smallest. In terms of structural network properties, there is variation by network density and clustering. Network density refers to the number of connections of each node divided by the total possible connections a node can have. Network density is helpful for understanding the diversity of concepts in a network; networks that are rich in diversity of concepts have lower densities (Pereira et al., 2016). When it comes to network density, African American, Hispanic, and Police groups are similar, although density is higher in the Anti-Immigration, US Independence/Patriotism, LGBT, and Guns groups, suggesting that these groups address a smaller diversity of topics. Clusters refer to what surrounds a node, as a basic measure of local density in a network. They show how well-connected groups of nodes are (Drieger, 2013). The clustering coefficient is calculated as number of edges (links) connecting a node’s neighbors, divided by the total number of possible links. The coefficient can take on values between 0 and 1. Higher numbers indicate more connections in a node’s neighborhood. There is limited variation in the clustering in groups other than African Americans, which has a clustering coefficient of 0.79, suggesting strong connections between components that encode specific semantic topics or concepts (Drieger, 2013).

Based on these results, it appears that African Americans were considered an especially important target group for the Russian CEIO. The cyber-enabled influence operation against African Americans included a larger number of diverse topics as well as stronger connections between the topics than other target groups. This focus on African Americans suggests the group was perceived as especially salient, and vulnerable. In terms of topics, race, justice, and police were featured in this group. Marxist-inspired Soviet ideology regarded race and class as key societal cleavages. The USSR emphasized race as a theme in influence operations, with numerous documented campaigns since the 1950s (Shultz and Godson, 1984).

Table V lists the largest subgroups of concept networks within the African American target group, based on internal degree – the number of links a node has in a particular network. The largest single community of concepts features police brutality and racism as themes. The second largest thematic group focuses on celebrating blackness, while the third largest community is focused on mobilizing audiences to participate in advertised channels. The fourth largest group is focused on black culture cast in a positive light, while the fifth largest community of concepts centers around themes of race and brutality.

Table V.

The analysis calculates for each node its total degree using only links to and from nodes in its own group (internal links)

Group	Largest community	2nd largest community	3rd largest community	4th largest community	5th largest community
African Americans	United_States, police_officer, we, racism, shooting, life, fatally_shot, justice, breaking_news, suspicion (240)	BM, let, point, celebrate, critical, today, major, join, birthday, deepen(174)	People, know, you, my, Facebook, channel, subscribe_to, follow_me, Twitter, our(165)	Diversify, #hiphop, #blackexcellence, stereotype, #melanin, #blackperfection, race, #rap, #blackbeauty, #blackbusiness(133)	Black, found, dead, blackmatters.com, racial, new, difference, reason, driver, call(130)

Numbers in parentheses are the size of the concept community.

Limitations

There are (at least) two types of limitations in our analysis – relating to the dataset used, and to semantic network analysis. We address each in turn. First, we do not examine all of the Facebook ads that were released by the US House of Representatives Permanent Select Committee on Intelligence. Including the full dataset might facilitate new types of inquiry, for example examining changes in the content of the Facebook campaign over time. Second, some of the released ads were redacted which could potentially have affected the analysis.¹⁷ Third, this article is concerned with, and analyzes, only the cyber-enabled influence campaign on Facebook. Russian operations surrounding the 2016 US Presidential elections were broader than the Facebook campaign, including activity on other social networking platforms.

Semantic network analysis also has limitations as an approach to textual analysis. First, coding affects the analysis, and for that reason, validation can be difficult (Diesner, 2012). The preprocessing techniques that are chosen and applied affect network construction. A researcher must make multiple coding choices that can alter results (Carley, 1993; Diesner, 2012). Consider the following example: it is often recommended that non-meaning bearing words be deleted. So, in other studies, words such as ‘like, we, our’ are often removed. However, for the purposes of this study, these words remained in the dataset because usage of ‘we’ and ‘our’ reflect imitation of organic discourse. The word ‘like’ can represent an invitation to mobilize via social media liking functions. Theory thus dictated that we retain these words in our analysis. Similarly, words like ‘cops’ and ‘police’ were coded as ‘police_officers’ to assess how often certain themes were used. The meaning of words should remain as objective as possible (Shim et al., 2015). Had the interest of this project been to offer a sentiment analysis, words such as ‘cops’ should perhaps be coded as ‘cops’ because this might be a sentiment-bearing word. For our purposes, however, a different coding was deemed more appropriate. Finally, ads were coded into target groups based on listed interests, which produced groups that appear similar but are distinct, such as ‘Anti-Immigration’ and ‘US Independence/Patriotism,’ or ‘Anti-Police’ and ‘Police Brutality.’

Conclusion

Despite widespread interest in the impact of Russian interference in the 2016 US federal election, it is nearly impossible to demonstrate an actual electoral effect.¹⁸ We cannot identify individuals exposed to the Russian campaign¹⁹ or whether they voted, and for whom. It is far easier, however, to infer the goals of Russian operations, their strategy, and the mechanisms they utilized in seeking to sway US voters.

While often conceptualized as disinformation, our analysis shows that the Russian CEIO did not attempt to introduce factually incorrect information into the public discourse (a ‘big lie’). Instead, the Russian CEIO appears to have been designed to shape the focus of certain US audiences by emphasizing certain genuine (recurring) themes. Our findings suggest that in terms of scope, the Russian CEIO was aimed at a diverse group of targets and included issues such as race, immigration, gun rights, nationalism, LGBT rights, and police brutality. In terms of the scale of the CEIO, most ads were targeting African Americans and race-related topics, while other possible targets received substantially less exposure.

Why did Russian operators disproportionately target African Americans? Racial tensions in the United States are an attractive – and resilient – target for foreign agitation. Well-documented systemic inequalities have historically disadvantaged African Americans. By targeting existing racial cleavages and emphasizing the disenfranchisement of minority groups, a foreign actor can build on recurring narratives and shift attention away from other political issues. However, in our view, this is simply the mechanism by which CEIOs work, and does not explain the focus on African Americans. With the same intensity, it was possible to target any other groups in the United States, and yet under-represented minority groups were chosen as a prime target. There are several possible explanations to contextualize these results.

The first possibility is that interference in the 2016 election was simply a recent manifestation of a venerable playbook of active measures, dating back to the Soviet era (Jonsson, 2019; Rid, 2020; Walton, 2022). Standard Operating Procedures (SOPs) drive bureaucratic activities, a phenomenon that is well understood in international relations (Allison, 1971). The matrix of contemporary Russian intelligence agencies (in particular the SVR and/or the FSB) may simply have chosen to continue the formulaic application of earlier KGB statecraft, tactics that are heavily oriented toward exploitation of racial tensions and ‘class struggle.’

A second explanation, also reflected in early analyses of Russian CEIO, is that Russian operators simply utilized brute force, ‘throwing stuff at a wall to see what sticks.’ Similar to their efforts to target domestic audiences inside Russia (Kerr, 2019), experimentation could travel abroad (Lin and Kerr, 2017). CEIOs can be applied to a broad array of goals and targets, including efforts to undermine credibility and trust, sow confusion and uncertainty, support extremism and polarization, etc. The focus on African Americans might then just have been coincidence. We are skeptical of this view, as the most obvious strategy in this case would be to (also) conduct explicit positive messaging favoring the Trump campaign.

A third view is that the Russian focus on the African American community was triggered by contemporary events, in particular the Black Lives Matter (BLM) movement (Etudo et al., 2023). While plausible, the temporal nature of BLM, and its role in the 2016 election, implies that Russian operatives would need to mobilize quickly and largely only after the triggering event. However, the very persistence of African American mistreatment, and resentment, as a focus of Russian/Soviet information operations indicates more continuity than this argument suggests. While it may have reconfirmed their efforts, we believe that Russian operators had determined to focus on African Americans as targets prior to BLM.

Finally, there are major parallels between the CEIO run by Russian authorities and the electoral strategy of the Donald Trump campaign. As we now know, Paul Manafort, Donald Trump’s campaign manager, supplied Russian operatives with polling data and the campaign’s electoral strategy documents (Ladden-Hall, 2022; Tucker, 2021). Manafort pleaded guilty to this in 2022 in a US Federal court (Rutenberg, 2022). Suspicion of collusion between the Trump campaign and Russian operatives emerged early on and was documented by the Robert Mueller investigation (United States Department of Justice, 2019: vols I and II). For the purposes of this project, the missing piece of the puzzle was why the Russian CEIO chose to focus on discouraging African American voters, given other available options (e.g. raising Republican turnout). Information that Trump planned to pursue a negative campaign against the presumptive Democratic candidate, Hillary Clinton, evidence that the campaign supplied their strategy and the reasons for it to Russian agents, and a peculiar correlation between the type and topics employed by both entities all seem to form a coherent pattern and story of indirect collusion. Timing again is critical; the Russian CEIO may have arrived at these tactics independently from the Trump campaign or used the Manafort information to develop or refine their efforts. While one can never know for sure, we plan to investigate further, using time-series data to track the progression of the Russian CEIO.

More broadly, we argue that our collective understanding of CEIOs should be expanded beyond disinformation operations. As the analysis here reveals, the information utilized in the 2016 Russian cyber-enabled influence campaign on Facebook was generally factually correct. This contradicts the common misconception that CEIOs disseminate or amplify ‘fake news.’ Such campaigns tend to stimulate debate about issues that emerge organically from within domestic audiences, rather than as a (pure) result of intervention.

The more general, organic, issue is influence; manipulation often occurs even in the presence of statements that are factually correct. Directing the focus toward particular truths privileges certain issues, shapes debates and prejudices the formation or ascent of specific groups or coalitions. In short, CEIOs determine winners and losers. Would some issues, if not amplified, take up as much space in the public consciousness? Would the same factions and cleavages form without the CEIO? It is difficult to tell.

CEIOs demonstrate the centrality of human dimension of cybersecurity. As our evidence shows, individuals were micro-targeted by influence operations in the context of presidential election in the United States. Indeed, instead of hacking networked systems, cyber capabilities can also be used to ‘hack human minds,’ and have the potential to undermine the integrity of electoral process. The case we examine in this manuscript is not isolated – increasingly, state actors are using cyber-enabled influence operations to sway domestic public opinion.

As nations struggle with the meaning, or even the presence, of thresholds of warfare in an era where new technologies are blurring better-established boundaries, scholars have an opportunity (perhaps even a responsibility) to investigate. CEIOs are an especially attractive area in which to focus collective research. They are apparent, measurable, systematic, and designed and authorized at the highest levels of government. Yet, they are also subtle and durable; their effects may linger and even merge with other phenomena, perceptions and events. CEIOs are not ‘flashy,’ but for this very reason they may represent the state and nature of cyber warfare more accurately than elusive (thankfully) ‘cyber Pearl Harbors.’

Our efforts here have only scratched the surface. Our goal was to provide an ‘existence proof,’ suggesting that cumulative research into the great bulk of low-intensity cyber conflict may prove fruitful. Even this initial foray has proven provocative. We hope our study suggests that more can indeed be done.

Footnotes

ORCID iDs

Jelena Vićić

Erik Gartzke

Notes

JELENA VIĆIĆ, PhD in Political Science (University of Cincinnati, 2021); Assistant Professor, Leiden University (2022– ).

ERIK GARTZKE, PhD in Political Science (University of Iowa, 1997); Professor, University of California, San Diego (2007– ).

References

Allcott

Gentzkow

(2019) Trends in the diffusion of misinformation on social media. Research & Politics 6(2): 2053168019848554.

Allison

(1971) Essence of Decision: Explaining the Cuban Missile Crisis. Boston, MA: Little, Brown.

Alvarez

Choi

Strover

(2020) Good news, bad news: A sentiment analysis of the 2016 election Russian Facebook ads. Journal of Communication 14: 3027–3053.

Arquilla

Ronfeldt

(1993) Cyberwar is coming! Comparative Strategy 12(2): 141–165.

Badawy

Ferrara

Lerman

(2018) Analyzing the digital traces of political manipulation: The 2016 Russian interference Twitter campaign. IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM): 258–265.

Baram

Vićić

Gartzke

(2023) Patterns of cyber competition: The missingness problem in cyber events data. Working paper.

Bogart

Thorburn

(2005) Are HIV/AIDS conspiracy beliefs a barrier to HIV prevention among African Americans? JAIDS Journal of Acquired Immune Deficiency Syndromes 38(2): 213–218.

Breuer

Landman

Farquhar

(2015) Social media and protest mobilization: Evidence from the Tunisian revolution. Democratization 22(4): 764–792.

Cadwalladr

Graham-Harrison

(2018) Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach. Guardian, 17 March.

10.

Carley

(1993) Coding choices for textual analysis: A comparison of content analysis and map analysis. Sociological Methodology 23: 75–126.

11.

Carley

(1997) Extracting team mental models through textual analysis. Journal of Organizational Behavior 18(S1): 533–558.

12.

Carley

(2002) Smart agents and organizations of the future. In: Lievrouw

Livingstone

(eds) The Handbook of New Media. Thousand Oaks, CA: Sage, pp. 206–220.

13.

Carley

Bigrigg

Diallo

(2012) Data-to-model: A mixed initiative approach for rapid ethnographic assessment. Computational and Mathematical Organization Theory 18(3): 300–327.

14.

Casey

(1944) What is propaganda? American Historical Association. Available at: https://www.historians.org/about-aha-and-membership/aha-history-and-archives/gi-roundtable-series/pamphlets/em-2-what-is-propaganda-(1944) (accessed 7 February 2024).

15.

Cederman

L-E

(2003) Modeling the size of wars: From billiard balls to sandpiles. American Political Science Review 97(1): 135–150.

16.

Clarke

Knake

(2010) Cyber War: The Next Threat to National Security and What to Do About It. New York, NY: Ecco.

17.

Chowdhury

(2008) The role of the Internet in Burma’s Saffron Revolution. Berkman Center for Research publication 2008-8.

18.

Cotter

Medeiros

Pak

, et al. (2021) Reach the right people: The politics of ‘interests’ in Facebook’s classification system for ad targeting. Big Data and Society 8(1): 2053951721996046.

19.

Craik

(1943) The Nature of Explanation. Cambridge: Cambridge University Press.

20.

Diesner

(2012) Uncovering and managing the impact of methodological choices for the computational construction of socio-technical networks from texts. Unpublished PhD dissertation, Carnegie Mellon University.

21.

Diesner

Carley

(2005) Revealing social structure from texts: Meta-matrix text analysis as a novel method for network text analysis. In: Narayanan

Armstrong

(eds) Causal Mapping for Research in Information Technology. Hershey, PA: IGI Global, pp. 81–108.

22.

Drieger

(2013) Semantic network analysis as a method for visual text analytics. Procedia-Social and Behavioral Sciences 79: 4–17.

23.

Etudo

Whyte

Yoon

, et al. (2023) From Russia with fear: Fear appeals, active measures and the digital political interference threat lifecycle. Journal of Cybersecurity 99(1): tyad016.

24.

Garcia-Díaz

Colomo-Palacios

Valencia-García

(2022) Psychographic traits identification based on political ideology: An author analysis study on Spanish politicians’ tweets posted in 2020. Future Generation Computer Systems 130: 59–74.

25.

Gartzke

(2013) The myth of cyberwar: Bringing war in cyberspace back down to earth. International Security 38(2): 41–73.

26.

Gartzke

Lindsay

(2015) Weaving tangled webs: Offense, defense, and deception in cyberspace. Security Studies 24(2): 316–348.

27.

Goldman

Barnes

Haberman

, et al. (2020) Lawmakers are warned that Russia is meddling to re-elect Trump. New York Times, February 20. Available at: http://www.proquest.com/docview/2358872233/abstract/788228AFD3F04ACDPQ/1 (accessed 7 February 2024).

28.

Gomez

(2020) Cyber enabled information warfare and influence operations: A revolution in technique? In: Whyte

Thrall

Mazanec

(eds) Information Warfare in the Age of Cyber Conflict. London: Routledge and CRC, pp. 132–146.

29.

Hamman

Vićić

Mewhirter

, et al. (2020) Deciphering cyber operations. Cyber Defense Review 5(1): 135–152.

30.

Hinds

Williams

Joinson

(2020) ‘It wouldn’t happen to me’: Privacy concerns and perspectives following the Cambridge Analytica scandal. International Journal of Human-Computer Studies 143: 102498.

31.

Impressions (n.d.). Meta business help center. Available at: https://www.facebook.com/business/help/675615482516035 (accessed 28 July 2021).

32.

Indictment, United States v. Internet Research Agency, . (2018) Case 1: 18-cr-00032-DLF (DDC 16 February 2018).

33.

Ingram

(2017) Facebook says 126 million Americans may have seen Russia-linked political posts. Reuters, 30 October. Section on Media and Telecoms. Available at: https://www.reuters.com/article/us-usa-trump-russia-socialmedia-idUSKBN1CZ2OI (accessed 7 February 2024).

34.

Jensen

Valeriano

Maness

(2019) Fancy bears and digital trolls: Cyber strategy with a Russian twist. Journal of Strategic Studies 42(2): 212–234.

35.

Johnson-Laird

(1983) Mental Models: Towards a Cognitive Science of Language, Inference, and Consciousness. Cambridge, MA: Harvard University Press.

36.

Jonsson

(2019) The Russian Understanding of War: Blurring the Lines Between War and Peace. Washington, DC: Georgetown University Press.

37.

Jones

Ross

Lynam

, et al. (2011) Mental models: An interdisciplinary synthesis of theory and methods. Ecology and Society 16(1).

38.

Kaminska

(2021) Restraint under conditions of uncertainty: Why the United States tolerates cyberattacks. Journal of Cybersecurity 7(1): tya008.

39.

Kanakia

Shenoy

Shah

(2019) Cambridge Analytica: A case study. Indian Journal of Science and Technology 12(29): 1–5.

40.

Kania

(2020) The ideological battlefield: China’s approach to political warfare and propaganda in an age of cyber conflict. In: Whyte

Thrall

Mazanec

(eds) Information Warfare in the Age of Cyber Conflict. London: Routledge and CRC, pp. 42–53.

41.

Kelly

(2019) New data will give insight into Facebook’s influence on elections. Verge, 29 April. Available at: https://www.theverge.com/2019/4/29/18522473/facebook-election-influence-meddling-research-data-democracy (accessed 7 February 2024).

42.

Kerr

(2019) The Russian model of digital control and its significance. In: Writer

(ed.) Artificial Intelligence, China, Russia, and the Global Order Technological, Political, Global, and Creative Perspectives. Maxwell AFB, AL: Air University Press, pp. 62–74.

43.

Kim

T-Y

Hong

(2007) The influence of geopolitics and foreign policy on the US and Canadian media: An analysis of newspaper coverage of Sudan’s Darfur conflict. Harvard International Journal of Press/Politics 12(3): 87–95.

44.

Kim

Hsu

Neiman

, et al. (2018) The stealth media? Groups and targets behind divisive issue campaigns on Facebook. Political Communication 35(4): 515–541.

45.

King

Keohane

Verba

(1994) Designing Social Inquiry: Scientific Inference in Qualitative Research. Princeton, NJ: Princeton University Press.

46.

Krackhardt

Carley

(1998) A PCANS model of structure in organization. In: Proceedings of the 1998 International Symposium on Command and Control Research and Technology Evidence Based Research, Vienna, VA, pp. 113–119. Available at: https://www.researchgate.net/publication/239719773_A_PCANS_model_of_structure_in_organization (accessed 7 February 2024).

47.

Ladden-Hall

(2022) Manafort owns up to passing campaign data to suspected Russian agent. Daily Beast, 8 August. Available at: https://www.thedailybeast.com/trump-campaign-chief-paul-manafort-owns-up-to-passing-sensitive-data-to-suspected-russian-agent (accessed 7 February 2024)

48.

Larson

Darilek

Dassa Kaye

Morgan

Nichiporuk

Dunham-Scott

Quantic Thurston

Leuschner

(2009) Understanding commanders’ information needs for influence operations. Rand Corporation. Arroyo Center.

49.

Libicki

(2009) Cyberdeterrence and Cyberwar. Santa Monica, CA: RAND.

50.

Libicki

(2020) The convergence of information warfare. In: Whyte

Thrall

Mazanec

(eds) Information Warfare in the Age of Cyber Conflict. London: Routledge and CRC, pp. 15–26.

51.

Lin

Kerr

(2017) On cyber-enabled information/influence warfare and manipulation. Available at: https://cisac.fsi.stanford.edu/publication/cyber-enabled-informationinfluence-warfare-and-manipulation.

52.

Lindsay

(2024) Abducted by hackers: Constructing a theory of cyber performance from the case of Bletchley Park. Journal of Peace Research 61(1): 87–102.

53.

Mahtesian

(2016) What are the swing states in 2016? Politico, 15 June. Available at: https://www.politico.com/blogs/swing-states-2016-election/2016/06/what-are-the-swing-states-in-2016-list-224327 (accessed 7 February 2024).

54.

Maness

Valeriano

Jensen

, et al. (2023) The Dyadic Cyber Incident and Campaign Data (DCID), Version 2.0. Available at: https://drryanmaness.wixsite.com/cyberconflict/cyber-conflict-dataset (accessed 7 February 2024).

55.

Maschmeyer

(2022) A new and better quiet option? Strategies of subversion and cyber conflict. Journal of Strategic Studies 46(3): 570–594.

56.

Maynard

(1997) Opportunity in paid vs. unpaid public relations internships: A semantic network analysis. Public Relations Review 23(4): 377–390.

57.

Mueller

III and Special Counsel’s Office US Department of Justice (2019) The Mueller Report: Report on the Investigation into Russian Interference in the 2016 Presidential Election. Hoboken, NJ: Melville House.

58.

Newman

MEJ

(2006) Modularity and community structure in networks. Proceedings of the National Academy of Sciences 103(23): 8577–8582.

59.

Office of the Director of National Intelligence (2017) Assessing Russian activities and intentions in recent US Elections. Intelligence Community Assessment (Unclassified Version), 6 January. Available at: https://www.intelligence.senate.gov/sites/default/files/documents/ICA_2017_01.pdf (accessed 7 February 2024).

60.

Ossoff

(2021) Hacking the Domaine Réservé: The rule of non-intervention and political interference in cyberspace. Harvard International Law Journal 62(1): 295–324.

61.

Pereira

HBB

Fadigas

Monteiro

RLS

, et al. (2016) Density: A measure of the diversity of concepts addressed in semantic networks. Physica A: Statistical Mechanics and its Applications 441: 81–84.

62.

Prier

(2020) Commanding the trend: Social media as information warfare. In: Whyte

Thrall

Mazanec

(eds) Information Warfare in the Age of Cyber Conflict. London: Routledge and CRC, pp. 88–113.

63.

Ribeiro

Saha

Babaei

, et al. (2019) On microtargeting socially divisive ads: A case study of Russia-linked ad campaigns on Facebook. In: Proceedings of the Conference on Fairness, Accountability, and Transparency: 140–149.

64.

Rid

(2012) Cyber war will not take place. Journal of Strategic Studies 35(5): 5–32.

65.

Rid

(2020) Active Measures: The Secret History of Disinformation and Political Warfare, Illustrated edn. New York: Farrar, Straus and Giroux.

66.

Rouse

Morris

(1986) On looking into the Black box: Prospects and limits in the search for mental models. Psychological Bulletin 100(3): 349–363.

67.

Rovner

(2020) What is an intelligence contest? Texas National Security Review 3(4): 114–120.

68.

Rutenberg

(2022) The untold story of ‘Russiagate’ and the road to war in Ukraine: Russia’s meddling in Trump-era politics was more correctly connected to the current war than previously understood. New York Times, 7 November. Available at: https://www.nytimes.com/2022/11/02/magazine/russiagate-paul-manafort-ukraine-war.html (accessed 7 February 2024).

69.

Senate Select Committee on Intelligence (2020) Russian active measures campaigns and interference in the 2016 US election. Volume 2: Russia’s use of social media with additional views, 116–290. United States Senate. Available at: https://www.intelligence.senate.gov/publications/report-select-committee-intelligence-united-states-senate-russian-active-measures (accessed 7 February 2024).

70.

Shandler

Canetti

(2024) Special Issue Introduction: Cyber-conflict – Moving from speculation to investigation. Journal of Peace Research 61(1): 3–9.

71.

Shandler

Gomez

(2022) The hidden threat of cyber-attacks: Undermining public confidence in government. Journal of Information Technology & Politics 20(4): 359–374.

72.

Shane

Goel

(2017) Fake Russian Facebook accounts bought $100,000 in political ads. New York Times, 6 September. Available at: https://www.nytimes.com/2017/09/06/technology/facebook-russian-political-ads.html (accessed 7 February 2024).

73.

Shim

Park

Wilding

(2015) Identifying policy frames through semantic network analysis: An examination of nuclear energy policy across six countries. Policy Sciences 48: 51–83.

74.

Shultz

Godson

(1984) Dezinformatsia: Active Measures in Soviet Strategy. New York: Pergamon.

75.

Spangher

Ranade

Nushi

, et al. (2018) Analysis of strategy and spread of Russia-sponsored content in the US in 2017. ArXiv:1810.10033 [Cs], October.

76.

Tucker

(2021) US says Russia was given Trump campaign polling data in 2016. Associated Press, 16 April. Available at: https://apnews.com/article/donald-trump-paul-manafort-russia-campaigns-konstantin-kilimnik-d2fdefdb37077e28eba135e21fce6ebf (accessed 7 February 2024).

77.

Tufekci

Wilson

(2012) Social media and the decision to participate in political protest: Observations from Tahrir Square. Journal of Communication 62(2): 363–379.

78.

Tzu

(2007) The Art of War, 1st edn. S.l: Filiquarian.

79.

United States Army (2010) Cyberspace Operations Concept Capability Plan 2016–2028. Fort Monroe, VA: Army Training and Doctrine Command.

80.

United States Department of Justice (2019) Report on the investigation into Russian interference in the 2016 presidential election, Vols I and II. Available at: https://www.justice.gov/storage/report_volume1.pdf; https://www.justice.gov/storage/report_volume2.pdf (accessed 7 February 2024).

81.

Vargo

Hopp

(2020) Fear, anger, and political advertisement engagement: A computational case study of Russian-linked Facebook and Instagram content. Journalism and Mass Communication Quarterly 97(3): 743–761.

82.

Vićić

(2021) The other means? Examining the patterns and dynamics of state competition in cyberspace. PhD dissertation, University of Cincinnati.

83.

Vićić

Harknett

(2024) Identification-imitation-amplification: Understanding divisive influence campaigns through cyberspace. Intelligence and National Security. DOI: 10.1080/02684527.2023.2300933.

84.

Walton

(2022) What’s old is new again: Cold War lessons for countering disinformation. Texas National Security Review 5(4): 49–72.

85.

Warner

(2014) The Rise and Fall of Intelligence: An International Security History. Washington, DC: Georgetown University Press.

86.

Warner

(2019) A matter of trust: Covert action reconsidered. Studies in Intelligence 63(4): 33–41.

87.

Whyte

(2020) Cyber conflict or democracy ‘hacked’? How cyber operations enhance information warfare. Journal of Cybersecurity 6(1): tyaa013.

88.

Yaffa

(2020) Is Russian meddling as dangerous as we think? New Yorker, 14 September. Available at: https://www.newyorker.com/magazine/2020/09/14/is-russian-meddling-as-dangerous-as-we-think (accessed 7 February 2024)

89.

Yang

(2014) Study of cryptography-based cyberspace data security. In: Fifth International Con-ference on Computing, Communications and Networking Technologies (ICCCNT), Hefei, China, 1–7. New York: IEEE.