WASHINGTON (AP) -- A year before Donald Trump announced his presidential candidacy, two Russian operatives landed in the United States to lay groundwork for an intelligence operation targeting the legitimacy of the 2016 election.
What began as a Cold War-like attack by an old adversary would mix old-fashioned political agitation with 21st century social media tools that ultimately roiled the election and shook America's political landscape.
The indictment of 13 Russians by special counsel Robert Mueller Friday revealed that the now well-documented Russian social media campaign also relied on extensive intelligence work by operatives on U.S. soil. It also began earlier than commonly believed, first aiming to "sow discord" ahead of the 2016 election and later to boost Trump's candidacy.
The indictment does not specifically tie the influence operation to Russia's intelligence apparatus. Instead, it fingers a group of operatives working for a unit called the "organization," financed to the tune of millions of dollars by Yevgeny Prigozhin, a St. Petersburg businessman dubbed "Putin's chef" because his restaurants have catered dinners for the Kremlin leader and foreign dignitaries.
The scheme outlined in the indictment began with fraudulent visa applications for U.S. travel.
Though some of the Russians were rejected, two operatives, Aleksandra Krylova and Anna Bogacheva, allegedly traveled as tourists through at least nine states over about two weeks in June 2014. They had developed "evacuation scenarios" in case their cover was blown.
Another unindicted operative traveled to Georgia in November of that year.
Prosecutors say the operatives were gathering intelligence used to evaluate political targets on social media. The operation developed metrics on social media groups, measuring things like frequency of posting and audience engagement.
Later, back in Russia, some of the operatives posed as U.S. citizens to contact political and social activists.
The indictment describes one interaction with someone at a "Texas-based grassroots organization" who suggested they target closely-contested purple states like Colorado, Virginia and Florida. It was banal conventional wisdom, but afterward, the Russian operatives began using the jargon in their own interactions, which U.S. authorities somehow were able to access.
The early groundwork set the table before the campaign was in full swing.
Social media accounts were established to lend credibility to their covert efforts. The Russian-based operatives posed as U.S. political activists from all corners. Later, goals were set and enforced by the group's leadership: undermine Hillary Clinton while boosting her Democratic opponent in the primary, Bernie Sanders, as well as Trump.
To obfuscate their efforts, the operatives, working in concert with the Internet Research Agency, a St. Petersburg-based troll farm, purchased server space in the U.S. Using virtual private networks they could conduct their social media interactions while appearing to be based in the U.S.
They also relied on identity theft, stealing and then using the social security numbers, home addresses and birthdates of real Americans without their knowledge, the indictment says.
The operatives set up bank accounts at a federally insured bank, set up accounts at PayPal using stolen identities and fake drivers' licenses, and purchased fraudulent credit card and bank account numbers at as many as six U.S. banks.
The operatives even received money from real Americans who wanted to use the Russian-backed social media pages for their own promotions, the indictment says.
The false identities and accounts aided the covert purchase of internet advertising, circumventing laws to prevent foreign influence in U.S. politics. It also helped stage political rallies — while posing as American political activists, the operatives paid people in the U.S. to promote or disparage candidates.
Starting in June 2016, just weeks after Trump had officially clinched the Republican nomination, the Russians upped the ante of their clandestine work. They began to organize and coordinate pro-Trump political rallies.
To build interest, the Russians promoted the events using their "false U.S. persona social media accounts," contacting unwitting American administrators of large social media groups focusing on U.S. political issues. Using fake pro-Trump Facebook and Twitter accounts, the Russians touted two political rallies in New York, one slated for June 25, 2016, and a second for July 23.
The Russians soon grew bold enough to enlist unwitting Americans in their efforts. One was asked to build a cage on a flatbed truck, while a second American was asked to wear a costume portraying Hillary Clinton in a prison uniform. The Russians, the indictment notes, "paid these individuals to complete the requests."
On June 5, someone posing as an American activist used the Twitter account @March_for_Trump to contact an unnamed Trump campaign volunteer in New York. The Trump volunteer "agreed to provide signs for the 'March for Trump' rally," the indictment alleges.
That internet contact came four days before senior Trump campaign officials, including Trump's son, Donald Jr., and his son-in-law, Jared Kushner, met in person with a group of representatives for Russian interests at Trump Tower. The Trump Tower meeting — separately being investigated by the special counsel — is not cited in Friday's indictment and is not known to have any connection with the allegations detailed in it.
By August, the Russian group had moved its sights to Florida, a key swing state, again using false IDs to contact Trump campaign staff involved in Florida activities. The Russians used Facebook and Instagram to promote a series of "Florida Goes Trump" rallies on August 20.
Using a false persona known as "Matt Skiber," the Russians messaged Florida Trump supporters.
"Hi there!" the fake Skiber allegedly wrote awkwardly in English. "I'm a member of Being Patriotic online community. Listen, we've got an idea." Skiber suggested "organizing a YUGE pro-Trump flash mob" in every Florida town.
"We've got the folks who are okay to be in charge of organizing the events almost everywhere in FL. However, we still need your support. What do you think about that? Are you in?"
Trump won the election in Florida by just under 120,000 votes out of more than 9 million cast.
The operation also targeted minority communities to exploit racial fissures and suppress Democratic votes.
On Oct. 16, 2016, three weeks before the U.S. election, the Russian-controlled Instagram account "Woke Blacks" encouraged followers not to go to the polls, saying hatred of Trump was "forcing" black people to vote for "Killary": "We cannot resort to the lesser of two devils. Then we'd surely be better off without voting AT ALL."
Even after Trump won the presidency, the Russians continued to fuel his popularity with ersatz rallies, while at the same time using their false identifies to provoke anti-Trump rallies. One anti-Trump rally was held four days after the election in New York. It was called "Trump is NOT my President." A week later another protest was held in Charlotte, N.C., and was described as "Charlotte Against Trump."
As reports of Russian influence began to surface in the U.S. media, the operatives noticed.
After Facebook said publicly last September that it had found evidence of Russians buying ads on its platform, an email by Irina Viktorovna Kaverzina to a family member on Sept. 13 cited by prosecutors said: "We had a slight crisis here at work: the FBI busted our activity (not a joke). So I got preoccupied with covering tracks together with colleagues."
Technology Writer Ryan Nakashima reported from Menlo Park, California.