DEEP DIVE — As Election Day 2024 draws near, the United States’ adversaries are bombarding American voters with propaganda and false narratives in unprecedented scope and intensity, U.S. intelligence officials and cybersecurity executives said this week.
The Office of National Intelligence (ODNI), Federal Bureau of Investigation and Cybersecurity and Infrastructure Security Agency (CISA) issued a joint warning Monday of intensified election interference efforts by Russia, China and Iran.
“The U.S. intelligence community (IC) assessment is that Russia is throwing its weight behind former President Donald Trump, while Iran favors Vice President Kamala Harris,” the unclassified summary of the IC assessment said. “Russia is leveraging a wide range of influence actors in an effort to influence congressional races and in particular to encourage the U.S. public to oppose pro-Ukraine policies and politicians. Russian influence actors have planned and likely created and disseminated content, particularly over social media, intended to encourage the election of congressional candidates Moscow assesses will oppose aid to Ukraine.”
Russia, China and Iran have all determined that the U.S. is particularly vulnerable during the campaign season, officials said, and are applying pressure in different ways – from posting disinformation about fake scandals on the web and trolling candidates on social media with posts that mimic legitimate users.
In a briefing for reporters, an ODNI official said that “Beijing is seeking to influence congressional races with candidates, regardless of their party affiliation, perceived by Beijing to threaten its core interests, especially in relation to Taiwan. The officials said China had targeted “tens of races…denigrating particular candidates with a range of social media and other online influence activities.”
The ODNI official said the Intelligence Community (IC) was notifying politicians and campaigns about the scope and nature of the attacks, which have mushroomed since the last presidential election - three times as many election-related threats as in 2020.
“We're under attack every day,” Glenn Gerstell, former general counsel at the National Security Agency, said at The Cipher Brief’s annual Threat Conference this weekend, in Sea Island, Georgia. “Every hour of every day there is a cyber attack, there's a ransomware attack, there's a foreign malign influence campaign underway.…We don't have a place in our democracy for malign Russian foreign influence payloads that are designed to divide us and disrupt our elections.”
How Russia and China interfere
The IC assessment and Cipher Brief experts agree that Russia and China are the primary offenders when it comes to efforts to interfere in the American election – and they cited a range of tactics and ploys the two countries have used.
Chinese agents are behind a “constant stream of information operations, a lot of it aimed at undermining the way that we think about democracies,” Sandra Joyce, vice president of Google Threat Intelligence, told The Cipher Brief conference.
Joyce, a veteran cybersecurity expert, said that during the current election cycle, Google-owned YouTube has taken down nearly one million Chinese government-created propaganda videos and 57,000 channels set up by Chinese agents for influence operations aimed at shaking voters’ confidence in the electoral system and in democracy itself. She described the videos generally as “attempts to create narratives that are anti-U.S. and pro-China.”
Joyce said that Chinese government propagandists, particularly a group called Dragonbridge, have accelerated the tempo of their attacks since 2019, when Hong Kong citizens staged pro-democracy demonstrations that attracted global support.
Chinese government operatives “went from just doing English- and Chinese-language information operations [in 2019]…to more than 10 different languages on 30 different social media platforms,” Joyce said. “We see the Chinese IO [disinformation[ campaigns looking for those divides in our society and doing what they can to put [derogatory] content out, hoping it'll get picked up and amplified by social media networks.”
The good news? Joyce said Google had found that despite the volume of posts, China’s Youtube videos and channels aimed at Western audiences had attracted almost no subscribers and few views. Of 900,000 videos taken down, Joyce said roughly 70% had viewership less than 100, and the rest had no viewers at all. In an interview with The Cipher Brief, she expressed confidence that China’s disinformation campaign had been defeated by a combination of U.S. government and industry vigilance, and Chinese failure to create compelling content.
“The impact isn't there, but it's not for lack of trying,” she said. “Everyone wants to be an influencer, but not everyone understands their audience.”
The Russia threat
Joyce, who is also a Lieutenant Colonel in the U.S. Air Force Reserve and faculty member at the National Intelligence University, said the threat of election interference by Russian spy services was as severe, or worse, but difficult to quantify, because malicious hackers “have some murky ties to the GRU [Russian military intelligence]” that are hard or impossible to prove.
Last month, the Microsoft Threat Analysis Center revealed that Russia-linked trolls operating under the name Storm-1516 had posted a staged video falsely claiming that in 2011, Kamala Harris, the current Vice President and Democratic Party presidential nominee, was involved in a hit-and-run accident that paralyzed a girl. The same group posted another fabricated video which purported – falsely – to show black male Harris supporters beating up a white woman who had attended a rally in support of the Republican Party candidate, Donald Trump.
U.S. intelligence officials say that Moscow is trying hard to influence not only the Presidential campaign, an effort the Office of National Intelligence described in detail last month, but also Senate and House elections. “Russia's primary focus [on Congressional campaigns] is on an individual candidate's stance on Ukraine and further aid to Kyiv rather than specific party affiliation,” an ODNI official told reporters.
Iran’s in the game, too
Iran is the most active malign actor after Russia in trying to influence the Presidential campaigns, the U.S. intelligence officials said. (They said China hasn’t picked a candidate and seems interested in undermining the U.S., whoever is President.) Tehran’s efforts to undermine Trump’s campaign stem from the U.S. targeted assassination of General Qassem Soleimani, commander of the Quds Force, the overseas arm of the elite Islamic Revolutionary Guards, on Jan. 3, 2020. Trump boasted of approving the drone strike, asserting that Soleimani had to die because he was “plotting imminent and sinister attacks on American diplomats and military personnel.”
“We caught him in the act and terminated him,” Trump said. “Under my leadership, America’s policy is unambiguous: To terrorists who harm or intend to harm any American, we will find you; we will eliminate you.” Iranian leaders vowed to take revenge against Trump and the U.S.
In December, 2020, a website containing death threats against U.S. election officials appeared. Officials at the Office of National Intelligence assessed that “Iranian cyber actors almost certainly were responsible.”
During this election cycle, Iranian hackers have moved to disrupt the Presidential race. On September 27, the Justice Department charged three Iranian men with a hack-and-leak attack against Trump’s presidential campaign, describing Iranian efforts to penetrate online accounts of people in Trump’s circle, steal and leak documents that might be embarassing and sow general distrust in the election. Documents obtained by the hackers were sent anonymously to a number of news outlets. All but one chose not to publish the material.
This week the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint fact sheet for campaign and election officials, entitled How to Protect Against Iranian Targeting of Accounts Associated with National Political Organizations. The fact sheet warned candidates and political campaign officials about threat actors working with Iran’s Islamic Revolutionary Guard Corps, who they say are targeting and compromising accounts of politically-active Americans, aiming to stoke discord and undermine confidence in U.S. democratic institutions.
The FBI/CISA warning about Iran is the latest in a series of advisories on malicious cyber activities by hostile nation-states, including Russia, China and North Korea.
The officials said that adversaries’ efforts to influence the U.S. won’t end on Election Day.
“As we approach election day, the IC [intelligence community] … expects foreign influence actors to continue their campaigns by calling into question the validity of the election’s results after the polls close,” the assessment said. “Foreign actors are almost certainly considering the possibility of another contested presidential election and a tight contest for control of both the Senate and the House of Representatives. They will likely take advantage of such an opportunity to use similar tactics in a post-election period to undermine trust in the integrity of the election, election processes, and further exacerbate divisions among Americans.”
Joyce, speaking at the Threat Conference, said that “when we think about elections, we're really looking at a vast ecosystem,” that she said included voting machines, electoral commissions, local and regional governments, and the local schools and other entities that run the voting stations.
“We still have to be very, very diligent and vigilant when we're protecting the election ecosystem, because…it's not even over when the polls close,” Joyce said. She warned – as the IC has – that U.S. adversaries are putting out narratives on websites and on social media that question “whether or not these elections are even legitimate.”
The results sought by hostile nation-states include rage, distrust, upheaval, even violence among the American electorate. Which is why the U.S. intelligence community, law enforcement and industry partners are issuing warning after warning – to try to educate the public, companies and local election officials that the political storm surge is coming.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief.
