How (and why) Russia hacked the US election

Laura Galante

In brief

Laura Galante, a cybersecurity expert with experience tracking state-sponsored threat actors, explains how Russia's interference in the 2016 U.S. election transcended traditional espionage (hacking the DNC) to orchestrate a strategic information operation designed to undermine democratic institutions. Rather than merely stealing secrets, Russian operatives deployed those stolen materials—emails, phone calls, documents—alongside fabricated narratives and coordinated social media amplification to sow distrust in democratic processes, institutions, and truth itself. Galante describes this doctrine as "reflexive control": using information so that target audiences (the public, media, and policymakers) make decisions favorable to the attacker, unaware they are being manipulated. The talk emphasizes that Western democracies and their security apparatus were unprepared to recognize and counter modern information operations, despite the U.S. having wielded such tactics historically. Galante argues that defense against information warfare requires more than cybersecurity; it demands critical thinking, institutional resilience, and recognition that the human mind—exploited through curated information ecosystems—is now the most vulnerable "device" on the planet.

Key claims

Russian interference was an information operation, not merely a cyber breach. The 2016 DNC hack was one component of a larger, integrated campaign: stolen emails were released through personas, amplified by media consumption of the narrative, and coordinated across social platforms to shape public perception. The hack was the entry point, not the operation itself.
"Reflexive control" is the deliberate doctrine behind Russian information warfare. This concept—using information to induce target audiences to make decisions favorable to the attacker—explains why Russia combined hacks with disinformation narratives, social media bots, fabricated personas (e.g., "Romanian cybercriminal"), and media manipulation. The goal is not persuasion but manipulation of perception and erosion of institutional trust.
Russian state actors (APT28) conducted these operations with sophisticated, long-term persistence. Galante describes tracked evidence of APT28 (a Russian government-sponsored hacking group) operating during Moscow business hours (9am–6pm) for over a decade, with targets including journalists, Eastern European governments, and defense officials—all strategic interests to the Russian state. This was not amateur hacking but an industrialized, well-resourced state operation.
The West was institutionally blind to information warfare despite historical precedent. While the U.S. and its allies spent the last 20 years focused on cybersecurity infrastructure (hardening networks, setting up "cyber armies"), Russia recognized earlier that technology enables a fundamentally different threat: manipulation of information ecosystems and human perception. The Obama administration's hesitation to publicly call out Russian interference (caught in a catch-22 about appearing to meddle in the election) reflected this unpreparedness.
Authentic stolen material is uniquely exploitable because context is removed. A leaked email or phone call is inherently compelling—it appears to be truth published against intention. Yet without context, authentic material can be weaponized: cherry-picked, presented with false framing, or released strategically to shift narratives. This makes disinformation campaigns built on real data harder to counter than fabrication alone.
Information ecosystems curated by algorithms and personalization create vulnerability to exploitation. Galante frames the modern Internet as a "back door into your mind": news feeds, hashtags, social sorting all filter information toward individual tastes, creating curated realities. A state or actor can exploit this by injecting targeted narratives into these personalized streams, making the message appear organic and tailored to the individual's existing beliefs.
Critical thinking and institutional trust are the primary defenses against information warfare. No encryption, firewall, or authentication can protect against information operations targeting the mind. The defense is cognitive: the ability to think critically, call out falsehood, press for facts, and pursue truth unflinchingly. This places responsibility for resilience on individuals and societies to maintain intellectual rigor and institutional trust.

Illustrative examples from the talk

2016 DNC Hack and WikiLeaks Release: Russian operatives hacked Democratic National Committee networks and staff email accounts, then released the data through WikiLeaks with accompanying narratives pushed by online personas. Media consumption focused on the leak's content (perceived DNC bias against Bernie Sanders) rather than the fact that a nation-state was conducting information warfare. The hack's strategic use—not the breach itself—was the operation.

2014 Crimea Invasion and Leaked Diplomat Call: In early February 2014, weeks before Russia's invasion of Crimea, a recorded phone call between U.S. diplomats was posted on YouTube. The diplomats appeared to be "playing kingmaker" in Ukrainian politics and cursing the EU. Media coverage and diplomatic backlash created a rift between Washington and Europe, while the true strategic objective—Russia's territorial land grab—proceeded without coordinated Western resistance. The information operation succeeded in fragmenting Western response.

Hashtag Gaming and Social Media Coordination: Russian operatives would trend hashtags on Twitter, seeded fake news to audiences primed to receive it, and directed journalists to expend effort dissecting large caches of leaked data. These tactics (trending, targeted disinformation, distraction through data volume) served to camouflage the operation itself within the noise of normal online activity.

Concepts and frameworks

Reflexive Control: Galante articulates this Russian military doctrine—defined as inducing an opponent to voluntarily make decisions desired by the attacker. In 2016, this meant making American voters, media, and policymakers themselves question democratic institutions and truth, without appearing to do so overtly.

Information as a Weapon System: Rather than "cybersecurity" or "hacking," Galante reframes the 2016 interference as an information operation: a coordinated campaign combining technical breach, narrative manipulation, media dynamics, and platform amplification. This is a systems-level view: no single tactic (the hack, the leak, the bot, the fake account) succeeds in isolation; success comes from integration.

The "Exploitable Mind" in the Digital Age: Galante argues that while previous generations feared military might, the modern vulnerability is cognitive: the human mind processing curated information in algorithmic ecosystems. This inversion—from external military threat to internal cognitive exploitation—is what distinguishes modern information warfare.

Notes

Galante's talk is a practitioner's perspective from someone who tracked Russian state-sponsored threat actors (APT28) in real time and directly observed their operational tradecraft. Her framing of the 2016 interference as an information operation rather than a discrete "hack" prefigures much subsequent research (Howard & Woolley's computational propaganda, Rid's active measures, Bradshaw & Howard's global disinformation order) that treats Russian actions as integrated, sophisticated campaigns rather than isolated cyber incidents.

The concept of "reflexive control" she introduces (inducing target decision-making favorable to the attacker) aligns with Russian military doctrine and has since become central to academic analysis of information warfare. Her emphasis on removing institutional capacity to respond (via political catch-22) connects to governance and policy failures documented in subsequent work on platform governance and election security.

The talk's framing of "the mind as the most exploitable device" and algorithms as a "back door into your mind" anticipates contemporary concerns about algorithmic manipulation, filter bubbles, and personalization's role in amplifying targeted disinformation. However, the talk predates intensive focus on synthetic media (deepfakes, AI-generated content) and does not address LLM-era concerns about scalable, authentic-seeming content generation.

One limitation: while Galante emphasizes critical thinking and institutional trust as defenses, the talk does not engage with psychological research on belief persistence, backfire effects, or the limits of individual-level media literacy when disinformation is structurally embedded in information ecosystems (e.g., via algorithms, network effects, social proof). Subsequent research has shown that critical thinking, while necessary, is insufficient without systemic changes to platform design and institutional accountability.

The talk's historical context (circa 2016–2017 retrospective) and focus on electoral interference in Western democracies limit its scope; it does not address Russian information operations in Ukraine and Eastern Europe as deeply as do other GUIDE talks on the same subject (Yurkova).