#10B The Playbook: How Russia Pulled It Off

If you’ve made it this far in The Receipts, you already know the 2016 operation - the troll farms, the DNC hacks, the Cambridge Analytica voter-data play Rykov bragged about, and what I’d call the bills Trump paid back to Russia once they put him in the chair. (If you missed that piece, it’s all in Part 10A.) This is the bigger story underneath all of it - the playbook the 2016 operation was actually running, where it came from, and what it’s pointed at right now in May 2026.

The 2016 op wasn’t an improvisation, and it wasn’t the first time Russia ran something like it. It was the latest deployment of a hybrid-warfare playbook the Russian state had been refining in live operations against other countries for almost a decade.

In April 2007, Estonia moved a Soviet-era war statue from a public square in Tallinn. Within hours, Estonia got hit with a wave of cyberattacks against its parliament, ministries, banks, newspapers and broadcasters - one of the biggest cyber assaults any country had experienced at the time. Estonia blamed the Kremlin, Russia called that unfounded, and NATO and European Commission experts never found proof the Russian government took part, but security analysts widely believe the Kremlin at least condoned it [1].

In August 2008, when Russian troops rolled into Georgia in a five-day ground war, Georgian government and media websites were already being knocked offline by a coordinated cyber attack timed to the invasion. Experts quoted by The New York Times called it the first time in history a major cyberattack and a real shooting war had happened at the same time, though Russia denied it was behind the attacks [2].

In February 2014, when Russia annexed Crimea, the soldiers seizing Ukrainian government buildings showed up in unmarked uniforms and refused to identify themselves - the so-called “little green men” - while Russian state media flooded the information space with stories denying any Russian troops were even present [3].

In May 2014, a Russian-government-linked group called CyberBerkut hacked the Ukrainian Central Election Commission, and Ukrainian officials say a virus planted on the commission’s computers almost succeeded in faking the presidential election results - their cybersecurity experts ripped it out 40 minutes before the announcement [9]. In December 2015, a different Russian hacking group called Sandworm knocked out power in parts of western Ukraine in the middle of winter, leaving about 230,000 people without electricity for up to six hours - the first publicly acknowledged cyberattack to take down a power grid [10].

Each of those was a live deployment of pieces from the same kit: cyber attack, information warfare, deniable special forces, weaponized media - and in Crimea, all of them at once, coordinated to produce a fait accompli before anyone could decide what was even happening. By the time 2016 rolled around, the Russian state had been running this play for almost ten years against smaller countries and watching it work. The United States was just the biggest target on the list.

The political-influence half of the playbook - the front organizations and weaponized media side - is even older, going back almost a hundred years.

In the 1920s and 1930s, a German named Willi Münzenberg ran something for the Communist International, the Soviet umbrella organization known as the Comintern, called “Innocents’ Clubs” [4]. These were networks of front organizations with friendly-sounding names like “Friends of Soviet Russia,” “International Workers’ Relief,” and the “League Against Imperialism” that recruited Western artists and intellectuals into causes the recruits thought were independent humanitarian or anti-fascist projects. Romain Rolland, Henri Barbusse, Upton Sinclair - prominent Western writers and thinkers lending their names and their reputations to what looked like grassroots progressive movements that were actually being run from Moscow [11][12].

By the time Münzenberg died in 1940, he’d built the operating model that Soviet intelligence services would expand for decades under a name that went back to the 1920s - “active measures,” which covered everything from propaganda to front organizations and was run by one Soviet security service after another, all the way up to the KGB [5].

Münzenberg’s whole insight was that you don’t have to convince everyone to win the war for public opinion - you just have to organize the people with influence and let them convince everyone else, which means you plant your people in universities, in publishing, in media, and in government, and you make the movement feel organic, until suddenly there’s a whole subculture of smart people all pushing the same direction without ever noticing they’re being pushed.

That’s the same architecture that ran in 2016, just upgraded for the internet. The Internet Research Agency was the Innocents’ Clubs scaled to Facebook. The hacked DNC emails laundered through WikiLeaks were the same active-measures move with a faster delivery system. The way I see it, Trump himself was the asset-grade version of the same play, except instead of a famous novelist convinced he was helping a noble cause, he was a New York real estate guy convinced he was just doing business with rich friends from Moscow. The pieces are different. The play is identical.

And the whole point of information warfare, going back to Münzenberg, is that it wins not when you make people believe the lie, but when you make them stop being able to recognize the truth. Which brings us to right now.

Here’s where I have to talk about the present, because this isn’t history - it’s happening in real time as I’m writing this, and the receipts are still being printed.

It is now May 2026, Trump is in his second term after winning again in November 2024, and in the fifteen months since he was inaugurated, the bills haven’t just come due - he’s been writing checks Russia hasn’t even asked for yet.

In March 2026, his administration paused U.S. sanctions for 30 days on Russian oil already loaded on tankers, giving buyers a green light while the rest of the world was choking on the 2026 Strait of Hormuz crisis - set off by the U.S.-Israeli war with Iran, which shut down most tanker traffic through the Strait and spiked global oil prices [6] - and in April the waiver got extended, two days after Treasury Secretary Scott Bessent said it wouldn’t be [7]. He has spent most of his second term pressuring Ukrainian President Volodymyr Zelensky, whose country Russia invaded outright in February 2022 in a full-scale ground war that’s still going, to make one-sided concessions to Russia, treating Ukraine as the problem that needs to be solved rather than the country that got invaded [8]. He suspended military aid to Ukraine in 2025, and the weapons deal he later agreed to has NATO allies buying U.S. weapons to pass along to Kyiv [8]. He talks about Putin like a peer and Zelensky like a difficult employee.

You don’t need a leaked KGB codename to see what this is. You don’t need an ex-spy’s Facebook post. You have the pattern.

When you stack everything in this series end to end (the KGB checklist, the cash from Bogatin, the Moscow trip, the mob in his buildings, the casinos as laundromats, Deutsche Bank lending to him when most big U.S. banks wouldn’t, Bayrock literally inside Trump Tower, the international pipeline, Miss Universe, the Sater email, the Moscow Tower deal during the campaign, the GOP platform on Ukraine, the IRA, the hacks, Helsinki, Lavrov in the Oval Office, Syria, the INF Treaty, NATO, the G7, and now sanctions relief on Russian oil while Russia is at war with a U.S. ally), the case is the case. The cumulative weight is the receipt. You can call it cultivation, you can call it being an asset, you can call it whatever you want - but the operation worked. I believe they cultivated him for forty years, they put him in the White House, he delivered for them once, and he is delivering for them again.

And here is the worst part, which is that half of America still doesn’t believe any of this happened - not because the evidence isn’t there (the evidence has been there since 1987) but because, the way I see it, the same operation that put him in power also made it impossible for half the country to recognize the truth when they’re staring directly at it. The Mueller report exists, the Senate Intelligence Committee report exists, the indictments exist, the sanctions waivers exist, the photos with Lavrov in the Oval Office exist, the Helsinki press conference exists, and yet we are still arguing about whether any of it actually happened, in real time, while it happens again.

That’s the endgame of information warfare.

It’s not that you believe the lie - it’s that you can’t believe the truth.