A year before Donald Trump announced his presidential candidacy, two Russian operatives landed in the United States to lay groundwork for an intelligence operation targeting the legitimacy of the 2016 election.
What began as a Cold War-like attack by a long-time adversary would mix old-fashioned political agitation with 21st century social media tools that ultimately roiled the election and shook America's political landscape.
To get up to speed:
- The probe into interference in the 2016 US election began in July of that year with the FBI looking at links between Mr Trump's campaign and Russia
- In May 2017, Robert Mueller was appointed as special counsel to the investigation
- Mr Mueller has US indicted three Russian companies and 13 nationals for attempting to influence the outcome of the election
- In the indictment, the special counsel said there was an effort to support Mr Trump and to disparage his Democratic opponent Hillary Clinton
- Deputy Attorney-General Rod Rosenstein made the announcement and said the defendants conducted, what they themselves called, "information warfare against the United States"
The 37-page indictment described a conspiracy to disrupt the US election by people who adopted false online personas to push divisive messages.
It revealed that social media campaign relied on extensive intelligence work by operatives on US soil.
And we learned this all started earlier than commonly believed, first aiming to "sow discord" ahead of the 2016 election and later to boost Mr Trump's candidacy.
Funding came from 'The Organisation'
The indictment does not specifically tie the influence operation to Russia's intelligence apparatus.
Instead, it points fingers at a group of operatives working for a unit called "The Organisation", financed to the tune of millions of dollars.
According to the indictment, that money came from by Yevgeny Prigozhin.
He's a St Petersburg businessman dubbed "Putin's chef" because his restaurants have catered dinners for the Kremlin leader and foreign dignitaries.
Operatives travelled through US as tourists
The scheme outlined in the indictment began with fraudulent visa applications for US travel.
Though some of the Russians were rejected, two operatives, Aleksandra Krylova and Anna Bogacheva, allegedly travelled as tourists through at least nine states over about two weeks in June 2014.
They had developed "evacuation scenarios" in case their cover was blown.
Another unindicted operative travelled to Georgia in November of that year.
Intelligence gathered in the US taken home to Russia
Prosecutors say the operatives were gathering intelligence used to evaluate political targets on social media.
The operation developed metrics on social media groups, measuring things like frequency of posting and audience engagement.
Later, back in Russia, some of the operatives posed as US citizens to contact political and social activists.
The indictment describes one interaction with someone at a "Texas-based grassroots organisation" who suggested they target closely contested purple states like Colorado, Virginia and Florida.
It was banal conventional wisdom, but afterwards, the Russian operatives began using the jargon in their own interactions, which US authorities somehow were able to access.
Preparations included buying space on US servers
The early groundwork set the table before the campaign was in full swing.
Social media accounts were established to lend credibility to their covert efforts.
The Russian-based operatives posed as US political activists from all corners.
Later, goals were set and enforced by the group's leadership: undermine Mrs Clinton while boosting her Democratic opponent in the primary, Bernie Sanders, as well as Mr Trump.
To obfuscate their efforts, the operatives, working in concert with the Internet Research Agency — a St Petersburg-based troll farm — purchased server space in the US.
Using virtual private networks they could conduct their social media interactions while appearing to be based in the US.
Web of fake identities, bank and social media accounts
They also relied on identity theft, stealing and then using the social security numbers, home addresses and birthdates of real Americans without their knowledge, the indictment says.
The operatives set up bank accounts at a federally insured bank, set up accounts at PayPal using stolen identities and fake drivers' licences, and purchased fraudulent credit card and bank account numbers at as many as six US banks.
The operatives even received money from real Americans who wanted to use the Russian-backed social media pages for their own promotions, the indictment says.
The false identities and accounts aided the covert purchase of internet advertising, circumventing laws to prevent foreign influence in US politics.
That groundwork also helped to stage political rallies.
While posing as American political activists, the operatives paid people in the US to promote or disparage candidates.
Once Trump was nominated, the Russians scaled up
Starting in June 2016, just weeks after Mr Trump had officially clinched the Republican nomination, the Russians upped the ante on their clandestine work.
They began to organise and coordinate pro-Trump political rallies.
To build interest, the Russians promoted the events using their "false US persona social media accounts", contacting unwitting American administrators of large social media groups focusing on US political issues.
Using fake pro-Trump Facebook and Twitter accounts, the Russians touted two political rallies in New York, one slated for June 25, 2016, and a second for July 23.
The Russians soon grew bold enough to enlist unwitting Americans in their efforts.
One was asked to build a cage on a flatbed truck, while a second American was asked to wear a costume portraying Mrs Clinton in a prison uniform.
The Russians, the indictment notes, "paid these individuals to complete the requests".
On June 5, someone posing as an American activist used the Twitter account @March_for_Trump to contact an unnamed Trump campaign volunteer in New York.
The Trump volunteer "agreed to provide signs for the March for Trump rally", the indictment alleges.
That internet contact came four days before senior Trump campaign officials, including Mr Trump's son, Donald Junior, and his son-in-law, Jared Kushner, met in person with a group of representatives for Russian interests at Trump Tower.
The Trump Tower meeting — separately being investigated by the special counsel — is not cited in the indictment and is not known to have any connection with the allegations detailed in it.
Russian operatives targeted Florida — a key swing state
By August, the Russian group had moved its sights to Florida, a key swing state, again using false IDs to contact Trump campaign staff involved in Florida activities.
The Russians used Facebook and Instagram to promote a series of "Florida Goes Trump" rallies on August 20.
Using a false persona known as "Matt Skiber", the Russians messaged Florida-based Trump supporters.
"Hi there!" the fake Skiber allegedly wrote.
"I'm a member of Being Patriotic online community. Listen, we've got an idea."
Skiber suggested "organising a YUGE pro-Trump flash mob" in every Florida town.
"We've got the folks who are OK to be in charge of organising the events almost everywhere in FL. However, we still need your support. What do you think about that? Are you in?"
Trump won the election in Florida by just under 120,000 votes out of more than 9 million cast.
The operation also targeted minority communities to exploit racial fissures and suppress Democratic votes.
On October 16, 2016 — three weeks before the US election — the Russian-controlled Instagram account "Woke Blacks" encouraged followers not to go to the polls, saying hatred of Mr Trump was "forcing" black people to vote for "Killary".
The account said: "We cannot resort to the lesser of two devils. Then we'd surely be better off without voting AT ALL."
Indictment alleges meddling continued after Trump won
Even after Mr Trump won the presidency, the Russians continued to fuel his popularity with ersatz rallies, while at the same time using their false identifies to provoke anti-Trump rallies.
One anti-Trump rally was held four days after the election in New York. It was called "Trump is NOT my President".
A week later another protest was held in Charlotte, North Carolina and was described as "Charlotte Against Trump".
As reports of Russian influence began to surface in the US media, the operatives noticed.
In September, Facebook said it had found evidence of Russians buying ads on its platform.
Prosecutors cited an email by Irina Viktorovna Kaverzina to a family member on September 13 that said: "We had a slight crisis here at work: the FBI busted our activity [not a joke]."
"So I got preoccupied with covering tracks together with colleagues."