In 2015, the Obama administration received an ominous warning from the Dallas-based cybersecurity firm Trend Micro.

The company’s then–chief cybersecurity officer, Tom Kellermann, told the FBI and Director of National Intelligence James Clapper about a burgeoning Russian intelligence operation aimed at acquiring compromising information about influential Americans. The presentation, entitled “From Russia With Love,” was one of the earliest warnings of Russia’s cyberoperations, which are now at the center of two congressional probes and a special counsel investigation into Russian meddling in the 2016 election.

As he looks back on it today, it’s clear to Kellermann that aside from the hacking and leaking of John Podesta’s emails, Russia’s biggest win of 2016 was its success in spreading misinformation via Facebook, a notion that’s gaining traction among lawmakers and investigators in Washington.

Democratic Sen. Mark Warner, vice chair of the Senate Intelligence Committee, told the Daily Beast Tuesday that he has spoken previously with Facebook and would like to “have more conversations” with the company about how Russians may have used voter data to target Americans in social media.

While the full extent of meddling isn’t yet known, one thing seems certain: A great deal of what investigators need to know about how Russia pulled it off sits locked inside Facebook’s servers. That would include who controlled the accounts that posted fake news; who paid for ads that targeted that content at specific users in voter districts; and who, if anyone, provided voter information that helped fuel the suspiciously effective Russian cyber-ops on Facebook.

Facebook’s sheer scale and ability to accurately target its 2 billion users with advertising are unparalleled. But as a closed network, it will be hard for investigators to figure out just how — and by whom — Facebook was used as a weapon of misinformation during the 2016 U.S. presidential campaign.

“It’s not in Facebook’s best interest to acknowledge the fact that they have been used like this,” Kellermann told VICE News. “Facebook is so profitable because of the marketing aspects of the platform. And that marketing engine, that footprint, and the implicit trust that people place in them, it was essentially used against the American marketplace.”

To answer these questions conclusively, academic researchers have said that Facebook could very easily clear the air by releasing more of its data. But just as the company keeps its algorithm under wraps, the company has thus far declined to share broad data about the customers who use its advertising tools, making it difficult for investigators to learn how the cyberoperations were executed across Facebook.

Facebook says it plans to cooperate with investigators. “We have been in touch with a number of government officials who are looking into the 2016 U.S. presidential election,” the company said in a statement. “We will continue to engage with officials as their investigations continue.”

“[Facebook] has the metadata to identify precisely which accounts were created, where they operated, and what kinds of things those users were up to during the U.S. election,” wrote Oxford digital propaganda researchers Philip N. Howard and Robert Gorwa in a May 20 op-ed in the Washington Post. “Their data scientists could probably provide some insights that the intelligence services cannot.”

“Information operations”

In last year’s election, millions of people shared and read the stories on Facebook saying the pope had endorsed Trump; that Hillary Clinton ran a child sex ring out of a Washington, D.C., pizza parlor; that Democrats wanted to impose Sharia law in Florida. They were also targeted by political stealth ads, so-called “dark posts” that are only visible to the recipient and not subject to public disclosure, the way campaign expenditures on TV, newspapers, or the open web would be.

In addition to fake news targeted at a district level, Facebook users’ feeds were filled with fake likes generated by armies of fake accounts, as well as paid commenters and trolls originating from abroad in hopes of disrupting the democratic process in the U.S. and throughout U.S.- and EU-allied Europe.

Facebook’s advertising tools, which include “dark posts” and other ways to insert paid content into users’ feeds, are valuable because they allow the buyer to target specific demographics within Facebook’s 2 billion-user community. A dark post (a format that’s pretty popular with both politicians and brands) or another ad can be targeted based on voting district, interests, or demographics such as race.

“It’s not in Facebook’s best interest to acknowledge the fact that they have been used like this.”

Since November, Facebook has downplayed the role fake news or what it calls “information operations” played during the election, saying in a report issued in April that fake content accounted for “less than one-tenth of a percent of total reach of civic content on Facebook.” But since that report came out, Facebook has signaled it’s taking its role in an informed democracy more seriously.

Among recent steps to address the threat: Earlier this month Facebook announced it is putting $500,000 toward a new initiative at Harvard called the “Defending Digital Democracy” project, which “aims to identify and recommend strategies, tools, and technology to protect democratic processes and systems from cyber and information attacks.” Facebook is also currently testing a feature to highlight posts from local politicians, even if they don’t follow those accounts. Last week it started adding “related” article links to fake news posts in order to mitigate their damage without censoring them directly.

Facebook has thus far declined to identify which state actors or culprits may have pushed “information operations” on the platform, but intelligence officials and members of Congress have all repeatedly and publicly said that the Russian government was the primary culprit.

Targeting under scrutiny

Currently, congressional and Justice Department investigators are examining the possibility that the Trump digital team “helped guide” Russian-promoted fake news and social media targeting to certain districts, according to a pair of July reports from the Guardian and McClatchy. An earlier piece in Time said that investigators were specifically looking into the work of Cambridge Analytica, the data-focused political consultancy, and Breitbart News — both of which are funded by top Trump donor Robert Mercer.

“I would like to also look into the activities of Cambridge Analytica. I would like to look into the activities of the Trump digital campaign,” confirmed Sen. Warner in an interview with CNN’s Jake Tapper on July 16.

Though Congressional investigators have yet to disclose which social media tools are under scrutiny, Warner referenced geographic and demographic targeting in a May interview, noting that “it was interesting that those [swing states of Michigan and Wisconsin] seem to be targeted” by fake news and “suppression” efforts.

“Bots and the amplification of false stories are interesting. But they don’t matter unless they are targeted to susceptible people.”

Meanwhile, the House Intelligence Committee has called Trump digital ad guru Brad Parscale to testify. Parscale’s firm, Giles-Parscale, was paid over $83 million by the Trump campaign in the year and a half before Election Day for “digital consulting/online advertising,” according to FEC filings. He denied any “Russian involvement” in the campaign’s “digital and data operations” in a statement he posted to Twitter.

“This is the part that scares me most,” said Samantha Bradshaw, a doctoral student at Oxford University and the Oxford Internet Institute’s Computational Propaganda Project, which researches state actors’ behavior online. “Bots and the amplification of false stories are interesting. But they don’t matter unless they are targeted to susceptible people.”

U.S. intelligence agencies now agree the Russians’ goal was to boost the candidacy of now-President Trump, who was thought to be friendlier to Russia, and to harm the campaign of Hillary Clinton, who supported the Obama administration’s sanctions against Russia for Russia’s annexation of Crimea and invasion of Ukraine.

In Facebook, Russian operatives found a platform where they could actively peddle misinformation and stump for Trump, all while keeping their activities hidden.

“Silicon Valley and Facebook, among others, have developed technologies that are not bulletproof from being commandeered,” said Kellermann, who has since left Trend Micro to co-found an investment firm, referring to the advertising targeting tools available to Facebook ad buyers.

Special Counsel Bob Mueller, the Senate Intelligence Committee, and its counterpart in the House are all looking into whether Trump’s digital campaign operation, which spent heavily on Facebook in the closing weeks of the campaign, had any connection to Russian cyber ops conducted on Facebook.

Unless lawmakers or Mueller start pushing Facebook around, it doesn’t really have to do anything. Even if Facebook were to open up its black box today, it would still be very tough for investigators to find who bought what and for whom during the 2016 campaign.

“I can’t imagine that somebody who hopes not to be tracked in terms of their spend with Facebook would be stupid enough to go into the system and plop down a credit card,” said Tom Hespos, founder of the digital marketing firm Underscore, told VICE News.

This kind of information black box sets Facebook apart from TV, radio, newspapers, and even the open web, where political spending is tracked and monitored by myriad third parties and reported to the Federal Elections Commission.