How Russia Is Using LinkedIn as a Tool of War Against Its U.S. Enemies

One night in mid-March, Alan Malcher, a British military veteran, dropped into the Queen’s Arms, a working-class pub in north London. He took a seat at the bar and ordered his customary pint of Foster’s. Within a few minutes, a stranger sidled up, ordered a drink and started a conversation. He soon brought up Russian President Vladimir Putin and began saying positive things about the Moscow-backed separatist civil war in Ukraine.

“He was going on about Putin being a strong leader,” Malcher recalls. “Somebody to admire.” The stranger’s comments, delivered with a thick Slavic accent, made Malcher’s security antennae vibrate: He had recently joined a Washington, D.C.–based think tank involved in combatting Russia’s stealthy infiltration of American social media. So when the stranger made passing reference to Malcher’s army service, he felt a twinge of apprehension. “There’s no way he could have known that except via LinkedIn,” Malcher says, referencing the professional online networking site where he and other critics of Moscow had been active in international affairs discussion groups. An expert in information warfare, Malcher reasoned that the Kremlin had dispatched the stranger to the Queen’s Arms with a message: We know everything about you. Watch your step.

Experts have increasingly called attention to Russia’s use of covert “propaganda factories” to subvert democracy, flooding Twitter and Facebook with millions of computer-generated bots posting under false names (often unwittingly picked up and amplified by supporters of U.S. President Donald Trump). But its battle on LinkedIn to neutralize enemies has gone largely unnoticed. There, however, Newsweek has found that pro-Moscow forces have put constant pressure on the company to suspend or evict adversaries, many with long, distinguished careers in the U.S. military or its intelligence agencies. Not only has this muzzled credentialed critics and damaged professional reputations, but if Malcher’s suspicions are right, the Kremlin’s campaign to combat its adversaries on social media may have moved beyond cyberspace and into the streets.

Related: Russia's greatest weapon may be its hackers

Russian President Vladimir Putin's image is visible on a computer screen in an internet cafe in Moscow on July 5, 2006. Denis Sinyakov/AFP/Getty

LinkedIn provides a rich hunting ground for Russian agents. Unlike Twitter and Facebook, most of its estimated 500 million, predominantly white-collar subscribers use it to advertise their expertise, seek employment or engage with peers in expert-based discussion groups. To bolster their credentials, most—even current and former U.S. national security officials—post detailed résumés and recommendations from their colleagues. That provides fodder for Russian intelligence to gather detailed information on its most formidable critics and cast doubt on the truth of those accomplishments.

“The Russian special services are for sure exploiting LinkedIn to gather personal information on certain targets and possibly recruit and blackmail them,” says a close Kremlin watcher at a university in a former Soviet satellite state, asking for anonymity to protect himself. “They operate under fabricated identities and credentials, while the Russian propaganda and trolling campaigns are widely applied on the platform.”

The pro-Moscow campaign has recently expanded—and, in some cases, gone offline—allege some American LinkedIn members who have been criticizing Russia’s covert attacks on the West. A few days before Malcher was approached in a London pub in March, a former U.S. national security official who had been contesting Kremlin propaganda on LinkedIn says he was assaulted near his retirement home in France. “I was shopping at the local supermarket when I was stung on my lower-right thigh by something, probably with an umbrella,” Giles Raymond DeMourot tells Newsweek. An hour later, he says, a doctor extracted bits of “what seemed like a wooden needle” from the wound. Lab tests determined it was “impregnated with carbapenem-resistant Pseudomonas aeruginosa,” a potentially lethal “superbug,” he says, and he’s had to make several visits to his doctor for treatments. “I am still not out of the woods,” he adds. (DeMourot supplied a hospital document confirming the wound was caused by “wooden splinters” and that “only an outside intervention [event] can explain the infection.”)

He strongly suspects his assailant was connected to Russia. Still working as a defense and foreign policy consultant for private clients, DeMourot had been writing exposés of alleged Russian intelligence front groups and agents in France and Belgium “with names, places and dates” on LinkedIn. And he had been relentlessly singled out for rebutting Kremlin apologists about the seizure of Crimea and subversion of Ukraine. “At one stage,” he says, “I received many…phone calls with death threats.”

To DeMourot, the attack was a disquieting replay of a Cold War–era, Russian KGB assault on Georgi Markov, a Bulgarian dissident who died in 1978 after being injected with a poison pellet from an umbrella jab on a London street. Other critics have been attacked with poison too, notably an ex-KGB officer turned freelance investigator named Alexander Litvinenko, who died in London in 2006 after a Kremlin agent laced his tea with polonium.

The grave of Alexander Litvinenko at Highgate Cemetery on April 17, 2013 in London. Jim Dyson/Getty

Paul Cobaugh, a former U.S. Army psychological warfare expert, says the accounts of DeMourot and Malcher sound right to him: “When I see influence operations, I know them.” Cobaugh, who retired from the U.S. Special Operations Command in 2015, has also been harassed by Russian trolls on LinkedIn after posting comments critical of Moscow. (In August 2016, he wrote to Republican Representative Will Hurd of Texas, a former CIA officer, urging a congressional inquiry into “Russian abuse of…LinkedIn to achieve a national security advantage over the U.S.”)

Cobaugh and other military and intelligence veterans and academics coalesced on LinkedIn in 2015 to combat dezinformatsiya, or disinformation, a branch of what Russian intelligence calls “active measures,” the tactic of spreading false rumors that the Kremlin has employed since the 1917 Bolshevik Revolution. A century later, Moscow has recalibrated the technique for social media.

One of the battlegrounds was the International Relations Professional Discussions group on LinkedIn, founded and managed by DeMourot. There, foreign affairs specialists from academia and the government post mainstream media articles and commentary, frequently on the subject of Russia’s so-called “hybrid warfare” tactics against NATO members and applicants. Soon, trolls arrived. “A group of about 40 of us from the West began exchanging notes,” says Joel Harding, who retired from the U.S. Army’s Intelligence and Security Command in 2003, “and we noticed a few of the profiles [on LinkedIn] were consistently not engaging us [in debate] but rallying the troops”—the defenders of Putin and the Russian invasion of Ukraine, critics of NATO, Trump-style European populists and the like.

A major target was Charles Leven, a highly decorated retired senior CIA operations officer with over 40 years’ experience jousting with the Russian KGB and its successor spy agencies. Leven was the manager of several foreign policy and security-issues discussion groups on LinkedIn with a combined following of about 130,000 members. Commentary on pro-Kremlin propaganda sites like Russia Insider, a website founded in 2014 to combat “coverage of Russia [that is] biased and inaccurate,” labeled him a “suspected pedophile” and pushed a long-discredited, KGB-generated story accusing him of embezzling funds from one of his Cold War–era Russian spies. On LinkedIn, Harding was also labeled a “pornographer” (a favorite meme used against Hillary Clinton and associates) following a lawsuit against him by a Malibu Media, a notorious Los Angeles company that lures browsers into clicking on links to X-rated movies then demands payment for “illegally” copying them. Harding settled out of court for $250, but the calumny was kept alive on pro-Moscow sites. Other Kremlin critics were repeatedly called a “bloody liar,” “scum” and “whackos.” A PBS documentary on Putin that Leven posted on LinkedIn was called the product of a “hardline meatpuppet propaganda machine.” And so on.

To Leven, DeMourot, Harding and their comrades, such commentary was just another front in a larger Russian media campaign that veteran Kremlin-watcher Celestine Bohlen, now a columnist for the International New York Times, had called “breathtaking, even by Soviet standards.” A key feature of the online effort was trolling, the tactic of injecting inflammatory, off-topic commentary into discussion groups and threads with the goal of defaming critics, provoking fights and chasing away thoughtful adversaries.

The verbal warfare peaked in the summer of 2016, as U.S. officials discovered Russian hackers breaking into voter rolls in California, Illinois and elsewhere. It also occurred around the time that the Moscow-backed hackers stole and promulgated embarrassing private emails from the Democratic National Committee and Clinton’s campaign manager, John Podesta. Such activities were designed to help Donald Trump and “undermine public faith in the U.S. democratic process,” an American intelligence report concluded in January.

Soldiers of the Crimean honor guard prepare to march for the first anniversary of the signing of the decree on the annexation of the Crimea by the Russian Federation on March 18, 2015 in Sevastopol, Crimea. Alexander Aksakov/Getty

One of the most persistent critics of Leven and his cohorts was Yana Dianova, a top international law expert with ties to Roskomnadzor, the Russian internet regulator that censors opposition parties and foreign news reports critical of Moscow. A senior attorney in the Moscow office of Grata International, a firm based in Kazakhstan, Dianova has participated in two Roskomnadzor conferences, which are attended by senior security officials. In February, the firm drafted a paper for the agency putting a new series of internet censorship provisions in an uncritical light. She also is listed as an “expert’ with the Moscow Center of International Business Assistance. The company offers clients advice on the Russian gas and oil sector, as well as guidance on real estate investing in Cyprus, an area of “primary concern” for money laundering, according to a 2014 U.S. State Department report.

Beyond her legal work, Dianova used LinkedIn and other media to insinuate that the bogus KGB embezzlement story about Leven had merit and suggested that Harding, the “porn addict,” had done time in a “maximum correctional prison.” She frequently employed a favorite Kremlin rhetorical tactic, “whataboutism”—responding to exposés of Moscow’s interference in the 2016 elections with counter-narratives of U.S. support for pro-democracy groups in Russia. “Americans,” she wrote on LinkedIn, “may vehemently claim that they are Russian propaganda fighters but [what] they actually do 24/7 here is quite similar to…CIA and other U.S. government social media trolls/disinformation programs.”

She also leveled insults against her critics via LinkedIn and well-known Kremlin propaganda sites like the Russian International Affairs Council, a “soft power” arm of the Kremlin founded by former Russian President Dmitry Medvedev and chaired by Foreign Minister Sergey Lavrov. “In 2015 through 2016, Yana began making complaints” to LinkedIn management, says Harding, “calling us trolls, sending the screen shots in as evidence, getting a few of us temporarily restricted.” In a June 27, 2016, LinkedIn post, she wrote that she had compiled a “list of at least a dozen” of her enemies, “with [their] background and contacts details, adding that “those whose job is to survey these activities are aware of them.”

“Yana Dianova attacked me and my friends relentlessly on LI,” says DeMourot. “The attacks were…accompanied with our photo.… Among the allegations was that I had been sent by CIA with Charles Leven to battle Russians on LI. [But] I was not a CIA employee and never met with Charles Leven. I know him only through the internet.”

Dianova also “attacked a company I had set up in Paris” and later closed, DeMourot says. “She told LI my profile was a fake and that the company never existed.” By raising unfounded questions about their backgrounds and credentials, DeMourot and the others complain, Dianova was “trolling,” a violation of LinkedIn’s user agreement. She vehemently rejected the sobriquet, but whatever her intent, her writings certainly set her critics aflame. One called her “Trollvana,” another “a vicious attack dog.” In one particularly nasty exchange, Harding called her a “pigsty pinup girl.” LinkedIn, citing privacy rules, will not discuss individual cases.

Russian President Vladimir Putin, right, and Prime Minister Dmitry Medvedev attend a wreath laying ceremony on February 23 in Moscow, Russia. Mikhail Svetlov/Getty

Dianova continued her attacks on Harding and company on Russia Insider. “If they have not been able respond with fact-based arguments, they will employ the lowest argumentative fallacies, including…ad hominem attacks,” she wrote.

In a flurry of emails with Newsweek, Dianova offered to provide “a compilation” of “everything Charles Leven and his collaborators” have written about her—but only “in exchange” for Newsweek revealing its sources to her with screen shots of their comments. She promised she would “not disclose to anyone that you are the source of this information.” Newsweek declined the offer.

In July 2016, LinkedIn suspended the accounts of DeMourot, Leven, his attorney James Berger and several others. A representative of LinkedIn’s Department of Trust and Safety using the name “Scarlett” accused them of “repeatedly posting unwanted/inappropriate content, and using the platform to harass other members.” (The red connotation provoked bitter cracks among the Americans.) The evictions were first reported a year ago by Kseniya Kirillova, an exiled Russian journalist in California who has received death threats and applied for political asylum. In an email to Newsweek, Dianova says the suspensions of Leven and Berger were “not due to my efforts.”

Either way, such results can have professional repercussions beyond LinkedIn, many say. Berger’s own expulsion from LinkedIn came up during a recent visit to another law firm, when an associate asked him why he had been banned. “It was unsettling,” he says. “LinkedIn is a résumé-broadcast around the world. That's why their promise of professionalism is so important.”

DeMourot, who has a Juris Doctor degree, regained his account only after sending a copy of his passport to LinkedIn to prove he was who he said he was. But others in the International Relations discussion group remain banned, including Leven and his attorney Berger, who received permanent membership bans without explanation. Both remain furious about it. “He and I both lost our LinkedIn memberships without possibility of appeal,” Berger says. “That's the big deal.”

Outside of LinkedIn, the attacks on Leven and the others were echoed on other Russian propaganda sites. Dianova “repeatedly defamed my professional ethics, reputation and loyalty to the country for which I've risked my life,” Leven says through his attorney. He complains that she virtually labeled him “a thief” by publicizing the “long-ago-debunked allegation” that he had stolen money from one of his Russian spies. “Both U.S. and Russian intelligence officials agreed the story was a fabrication,” Leven points out, citing authoritative books and a magazine article on the affair.

A replica of the umbrella that a KGB agent used in 1978 to kill Bulgarian dissident and radio broadcaster Georgi Markov is displayed at the International Spy Museum in Washington, DC, July 16, 2002. Mark Wilson/Getty

Dianova countered in a LinkedIn post that she had “NEVER [her capitalization] asserted… that Mr. Leven ‘engaged in theft,’” but merely “ASKED him whether or not it is true that he had misappropriated the government funds.” She also wrote that another account of the case “contains NOTHING to counter the allegation…that ‘Charles Leven, had pocketed some of the money.” In fact, the article didn’t even mention the incident.

Such exchanges have prompted a few of Dianova’s critics to suspect she is connected to Russian intelligence. Leven, who spent over three decades recruiting Russian agents, says he does “not believe she is a Russian intelligence staff officer” but rather just another well-connected Moscow figure whom the Kremlin uses to send messages, like the Russians who got a meeting with Donald Trump Jr. and other campaign officials to deliver “dirt” on Clinton.

Dianova denied the allegations in an email to Newsweek. “No, I am not a Russian intelligence officer,” she says, nor a Russian agent of any kind. “Their allegations that I am somehow acting on behalf Russian government authorities/its agents,” she adds, “are totally false, crazed and made out of revenge.” She has regularly threatened to sue anyone who repeats the allegation, but in a response to one critic who floated the idea that she and her law firm had intelligence connections, she cracked, “Thanks for the free PR.”

As the rhetorical combat between the Americans and the Russians accelerated through 2016, DeMourot says he continued to see real-world consequences (though he does not allege these consequences were related to Dianova). He suspects he was set up for a possible “kidnapping” en route to a meeting at the Vatican, which had offered him a job as an international relations adviser. Just before leaving for Rome, he received an email with photos of two men who would meet him at the airport when he landed. Immediately recognizing them as “rogue” former British commandos, who he knew were working for an alleged Kremlin agent he had written about on LinkedIn, he suspected the email had come from a hijacked account. He canceled the trip. The incident was “probably only to scare me off,” he says. Such actions have increased his suspicions that at least some pro-Kremlin activists online are working with the Russian intelligence services.

DeMourot has learned of other odd offline activity seemingly directed at him. He says he once got a tip from a source in the Paris municipal government that a man “with a Russian accent” had tried to get confidential information about his company from the city’s business records. After being rebuffed, the man “left in a car with CD [diplomatic] plates,” the tipster told him.

Back online, DeMourot and his fellow Kremlin critics felt LinkedIn was inclined to accept the other side’s charges—and not theirs—even though they say many of their foes were hiding behind suspected multiple fake identities (including Russians posing as pro-Trump Americans, a violation of LI’s User Agreement). After being retained by Leven, Berger sent written protests to LinkedIn's Department of Trust and Safety, as well as senior executives at LinkedIn and Microsoft, which acquired the site for $26.2 billion in June 2016. The software giant rejected his argument and evidence and told him that neither he nor Leven could appeal their suspensions. “Our group consists of real professionals, many of whom have long track records of public service, military service and/or work in fields such as law,” Berger says. “They have thugs, fake profiles, anti-Western agents and a host of useful idiots—all carefully exploited by their Muscovite masters. There is zero moral equivalency.”

Giles Raymond DeMourot's LinkedIn profile. Obtained by Newsweek

Money, Berger suspects, has played a role. He argues that foreign markets are critical to the continued growth of LinkedIn and other social media platforms. Like virtually all U.S.-based social media sites, LinkedIn was looking to expand abroad, including in Russia, where it had a tenuous foothold with 6 million customers in 2016, according to Reuters. Whatever the value of the Russian market, Moscow booted LinkedIn on November 17 because it would not agree to move its data servers under Russian control. (The website TechCrunch speculated that “it was a warning to bigger sites to be on their guard.”) LinkedIn could get back in, the Russian news agency Tass reported in June this year, pending negotiations with Microsoft. However that turns out, company representatives say Russia was never a “priority” market, and any questions about incentives to stay there are now moot.

LinkedIn’s head of Trust and Safety, Paul Rockwell, rejected the charge of favoritism. “When we investigated this issue more than a year ago, we found it was a clear-cut case of harassment and a violation of our Terms of Service. We believe it was handled appropriately.” LinkedIn spokeswoman Nicole Leverich says policing the often rancorous exchanges on the site is an ongoing challenge. “A lot of it comes down to ‘he said, she said.’”

Critics strongly disagree, saying LinkedIn is rife with Kremlin favoritism. DeMourot points to the case of Fred Eidlin, whom he calls “an ardent and virulent pro-Russian propagandist” who was active mainly in another LinkedIn discussion group, Political Science. Eidlin, who died last year, claimed to be a visiting professor at Karlova (aka Charles) University in Prague. “I smelled something fishy there,” DeMourot says, so he made an inquiry at the school. A vice rector responded that Eidlin “does not have an official status of Visiting Professor,” according to the email Newsweek reviewed. “My colleagues have not seen him for at least two years.” DeMourot promptly copied the email to LinkedIn’s Department of Trust and Safety, with a complaint that Eidlin was in “flagrant violation of its terms of use” by misrepresenting himself. He got nowhere. Scarlett rejected the complaint, telling DeMourot that someone had filed a counter-complaint against him. In the meantime, Leven and others escalated their plea to Simon Pope, the security manager at Microsoft. Pope reviewed the matter with LinkedIn but let the decision stand.

The company’s policies appear, at best, inconsistent. “If we receive a report of a false profile or harassment of a member, we investigate…with our user agreement and professional community guidelines in mind,” LinkedIn spokeswoman Mary-Katharine Juric tells Newsweek. “If it violates those, we remove content or restrict accounts where appropriate.” Yet when Berger asked LinkedIn to remove Dianova’s “defamatory” post on Leven’s alleged espionage embezzlement, “Scarlett” cited a section of the Communications Decency Act that said “we are not responsible for such content, even when it’s alleged to be defamatory.” Another company spokesperson, granted anonymity to discuss the issue freely, said policing all the violators in real time was impossible.

Felix, a male polar bear, holds the portrait of Donald Trump in his mouth as it predicts the result of U.S. presidential election at the Royev Ruchey Zoo in Krasnoyarsk, Siberia, Russia, on November 7, 2016. REUTERS/Ilya Naymushin

And not every critic of Russia gets kicked off the site. “I’ve never been barred, even though I have been just as hard on the Kremlin as anyone else,” says Kandy Zabka, a cybersecurity specialist who has done work uncovering hackers for the FBI, Interpol and Europol. “Putin, for some reason, likes me,” she jokes. “I reported so many Russian fake profiles and trolls to LinkedIn that they gave me a Premium Account for a year.” (“She helped us a lot,” a company insider said on condition of anonymity because of the issue’s sensitivity.)

Meanwhile, Dianova finally got evicted with the same vague accusations from LinkedIn, that she had posted “defamatory” material, she says. Others have taken her place, while fake Russian accounts, in many cases computer-generated bots from Russia’s “propaganda factories,” continue to plague LinkedIn and other social media platforms, observers say. Rockwell, LinkedIn’s head of Trust and Safety, however, maintains that Kremlin interference is “not a systematic issue” now that the site has been blocked from Russia.

LinkedIn’s critics dismiss such a claim. The platform’s “mobile application remains available both in the AppStore and in Google Play, and the network’s e-mail service continues delivering messages sent via its website,” Nabi Abdullaev, a senior analyst at the Control Risks security firm, wrote last December in Forbes. Alan Malcher, the British army infowar veteran, is more blunt. “They don’t have a clue” about Russian access, he says. “LinkedIn can’t say they are blocking the Russians,” he adds, “because they [the Kremlin and its proxies] can have servers anywhere.” Plus, they can use “disposable email addresses,” just like Al-Qaeda and Islamic State group militants.

“LinkedIn is well aware of the huge amount of trolls and fake profiles” on its site, says Zabka. “Most of the Russian trolls are still active on LinkedIn,” says the Eastern European expert on Russian internet practices, who supplied Newsweek with web addresses and screen shots of dozens of alleged fake users spouting anti-Western and pro-Kremlin messages. “A small army of social media operatives...are deployed to promote all of this material to unknowing audiences,” three well-regarded former government experts wrote last November for the War on the Rocks website.

Top U.S. intelligence officials say there’s no reason to believe the Kremlin will pull back: “Moscow will apply lessons learned from its Putin-ordered campaign aimed at the [2016] U.S. presidential election to future influence efforts worldwide,” they concluded in their January 2017 report, “including against U.S. allies and their election processes.” Such techniques have worked all too well with the rise of Trump, whose tweets denouncing investigations into contacts between the Russians and his campaign aides and family members have found a friendly echo chamber in social media sites. “They will be back,” former FBI Director James Comey warned at a Senate Intelligence Committee hearing in June. But to most analysts of the Russian efforts, they’ve never gone away—as the LinkedIn case shows.

Russian President Vladimir Putin watches a display during the MAKS 2017 air show in Zhukovsky, Russia, on July 18. Sputnik/Alexei Nikolsky/Kremlin via REUTERS

“It is a new and open issue as to whether our kind of self-government can function successfully when…much of the electorate gets its news from social media easily employed by foreign powers,” two top former White House cybersecurity officials, Richard Clarke and Robert Knake, wrote recently in Politico. “Infrastructure of all types—perhaps including the voting system—can be infiltrated by sophisticated hackers based overseas.”

Late last year, Facebook founder Mark Zuckerberg called the idea that his site could be manipulated to influence voters “pretty wacky.” But in April, his company produced a report on its own investigation, saying it “does not contradict” the finding of U.S. intelligence that “information warfare” ordered by Putin was carried out on Facebook and other social media sites—despite their best efforts to stop it. The report said Facebook had “observed many actions by fake account operators that could only be performed by people with language skills and a basic knowledge of the political situation in the target countries, suggesting a higher level of coordination and forethought.”

“In many cases,” The Atlantic noted, “such information operations are aimed at gaming Facebook’s algorithm, using tactics like the mass creation of fake accounts and the creation of groups populated by those accounts.” In April, Facebook said it had made progress in blocking or deleting tens of thousands of fake accounts.

Yet such automated techniques put democracy at risk, says Tim Wu, the author of The Attention Merchants: The Epic Scramble to Get Inside Our Heads. “Robots are…being used to attack the democratic features of the administrative state,” he recently wrote in The New York Times. “The problem is almost certain to get worse, spreading to even more areas of life as bots are trained to become better at mimicking humans.” Unfortunately, Wu argued, social media companies “lack a serious financial incentive to do anything about…the millions of fake users who are corrupting the democratic process.”

During his March encounter with that stranger at the Queen’s Arms pub, fake users and bots were the least of Malcher’s concerns. He had no doubt the Russians were trying to bully him in person, as they had others.

“I mean, that’s their endgame, isn’t it?” Malcher says. “Intimidation?”

Corrections: A previous version of this story reported that Kseniya Kirillova fled Ukraine and arrived in the United States. She has never lived in Ukraine. A previous version of this story also said that when Raymond DeMourot landed in Rome, he saw two potential kidnappers in the crowd and slipped away. He in fact cancelled the trip after receiving an email with photos of two men who would meet him at the airport when he landed; he had reason to believe they were Russian operatives. A previous version of this story also said that Grata International drafted a paper that put a new series of internet censorship provisions in “a favorable light.” We have changed "favorable" to "uncritical."