President Donald Trump personally signed off on a U.S. military cyber operation that blocked internet access for a Russian troll farm during the 2018 midterm election, multiple sources briefed on the matter told NBC News.
The action by U.S. Cyber Command against the Internet Research Agency (IRA) — first reported Tuesday by The Washington Post — marks the most aggressive known move to date by the Trump administration to combat Russian election interference.
The IRA has been charged by special counsel Robert Mueller with interfering in the 2016 election. Financed by a Kremlin-connected oligarch, Yevgeniy Prigozhin, the St. Peterburg-based company employed Russians who posed as Americans on social media and sought to sow division in U.S. politics by launching and amplifying extreme messages at the far ends of the political spectrum, according to federal prosecutors.
U.S. Cyber Command, working with intelligence gathered by the National Security Agency, shut down internet access at the facility in the hours before the 2018 midterms and for a few days afterward, the sources said.
Employees of the IRA complained to their IT department about the disruption, the sources said.
“I would not be surprised if the IRA is extremely frustrated right now,” John Hultquist, chief of intelligence at cyber security firm FireEye, told NBC News.
U.S. intelligence agencies are believed to be closely monitoring the activities of the IRA, but it's far more difficult for the government and private social media companies to deal with the broader phenomenon of social media manipulation.
Bots and trolls have been avoiding detection by creating less original content and merely amplifying extremist messages from politicians and other legitimate sources, Hultquist said.
The military operation against the IRA was part of a larger effort by Cyber Command, led by Gen. Paul Nakasone, to strike against attempts to interfere in U.S. politics ahead of the midterm elections, the sources said.
Trump approved the broader effort, but he also signed off on the specific operation to strike the Internet Research Agency, a U.S. official with direct knowledge told NBC News.
The White House declined comment.
Joseph Holstead, a Cyber Command spokesman, said: "We do not discuss classified cyberspace planning and operations. U.S. Cyber Command will continue to work as part of the whole-of-government effort to defend our elections and democratic institutions from foreign malign influence."
Prigozhin told the Post in a statement he had no connection to the IRA. A company he controls, Concord Management, is fighting the Mueller case in federal court, but Prigozhin, believed to be in Russia, has not appeared.
Trump has spoken favorably about Russian President Vladimir Putin and has cast doubt on U.S. intelligence assessments describing Russia’s 2016 election interference, but his administration has imposed new sanctions on Russia over a massive cyberattack and over the poisoning of a former Russian spy in London.
U.S. intelligence agencies said they did not see the same level of interference from Russia in 2018 as happened in 2016, when a Russian intelligence campaign of hacking and leaking sought to help Trump and hurt his Democratic opponent, Hillary Clinton.
However, private cybersecurity analysts have told NBC News they see evidence that Russia is ramping up efforts that could lead to interference in 2020.
There is no known U.S. government-wide strategy to combat foreign election interference, and Trump last year scrapped the position of White House cybersecurity advisor.