On Dec. 1, Defense Secretary Mattis became the first Trump administration official to publicly confirm that the Kremlin continues to interfere in U.S. democracy, including in last month's midterm elections. Mattis has described Putin as a “slow learner,” but a new tracking project shows him to be an operator who has spent nearly two decades sharpening and deploying a set of asymmetric tools across the Atlantic.

The big picture: Election interference is just one part of Russia’s strategy. The Alliance for Securing Democracy has catalogued Kremlin fingerprints on over 400 incidents of interference in 42 countries. Beyond bots and troll farms, the toolbox includes information operations, cyberattacks, political subversion, strategic economic coercion and malign finance.

Russia's interference in Macedonia’s NATO accession efforts may seem unrelated to its malign finance campaign in Moldova, but deeper analysis shows these activities are part of a coordinated Kremlin effort to undermine democratic institutions throughout Europe and across the Atlantic. Rather than falling off after President Trump’s election in 2016, such efforts have continued apace, in a slow-burn destabilization strategy.

What to watch:

Escalating intensity of interference: Kremlin activities surged after the 2013 Euromaidan protests in Ukraine, suggesting it has come to rely more on these asymmetric tools, which come at minimal cost and offer a vital veneer of deniability.

Kremlin activities surged after the 2013 Euromaidan protests in Ukraine, suggesting it has come to rely more on these asymmetric tools, which come at minimal cost and offer a vital veneer of deniability. Expanding geographic scope: Interference efforts prior to November 2013 targeted fewer than 30 transatlantic countries, mainly those within Russia’s “near-abroad” in Eastern Europe, the Caucasus and the Baltics. Since then, efforts have expanded to 42 transatlantic countries, with an increasing emphasis on Western Europe and North America.

Interference efforts prior to November 2013 targeted fewer than 30 transatlantic countries, mainly those within Russia’s “near-abroad” in Eastern Europe, the Caucasus and the Baltics. Since then, efforts have expanded to 42 transatlantic countries, with an increasing emphasis on Western Europe and North America. Cyber and information operations: Since 2014, documented instances of cyberattacks and information operations (those making strategic, coordinated use of social or traditional media) have increased tenfold, indicating both the rising influence of the internet and the failure of democracies to deter action and secure vulnerabilities in cyberspace.

The bottom line: Moscow is playing a long game, and interference in specific elections is just one part of it. Getting ahead of the threat will therefore require Euro-Atlantic institutions to develop robust multilateral mechanisms to identify vulnerabilities and to coordinate rapid responses and effective deterrents.

Laura Rosenberger is director of the Alliance for Securing Democracy and a senior fellow at the German Marshall Fund of the United States.