Russia

Russia is using a range of measures primarily to denigrate former VP Biden and the "anti-Russia establishment," directing/encouraging proxies to spread claims about Biden; some Kremlin-linked actors seek to boost President Trump's candidacy on social media (p.1).

Primary concern is ongoing/potential influence activity by Russia, China, and Iran (p.1).

The IC judges that Russia, China, Iran, and many nonstate actors have the capability to compromise election infrastructure (interfere with voting, steal data, or call into question validity), but it would be difficult to manipulate voting processes at scale and without detection (p.1).

Russia: President Putin and senior officials are overseeing proxy efforts (including Derkach, Kilimnik, and others affiliated with the Russian Government) to spread claims about Biden and alleged Ukrainian influence in the 2016 election, including claims tied to Ukrainian energy firm Burisma, aiming to defeat Biden and ensure Trump's victory (p.2-3).

Russian actors circulated narratives about voter fraud from mail-in balloting and called some US primary processes "rigged" by the Democratic Party (p.3).

Some Russian actors shifted from social media to online news sites; the Lakhta Internet Research (LIR) troll farm, Russia's Foreign Intelligence Service (SVR), and the GRU employed US and foreign authors to create anti-American content on English-language platforms including "United World International" (p.3).

As of June 2020, [REDACTED] Russian actors reconnoitered multiple state and local government [systems]; purpose unknown. In July a commercial cybersecurity company believed [REDACTED] may have targeted a US political organization, probably unsuccessfully (p.3).

A graphic ("Efforts by Selected Countries To Manipulate US Political Landscape") maps observed vs. preparatory vs. not-observed efforts across categories including public opinion, national/state leaders, leaking intelligence-acquired information, election processes, legal processes, economic leverage, and punitive measures; text notes China's state/local influence far outpaces Russia's and Turkey's and Russia has leaked intelligence-acquired information more often than Iran (p.8). Specific per-country marker values in the graphic are not legible in the OCR [OCR unclear] (p.8).

Russian government cyber actors attempted to identify and exploit SQL database vulnerabilities in webservers/databases; FBI reported lacking insight into extent of success, but in at least two separate instances Russian actors accessed voter registration files from a US county website (June 2016) (p.3).

Russian actors hacked the website of a state board of elections and stole information related to approximately 500,000 voters, including names, addresses, partial social security numbers, dates of birth, and driver's license numbers (July 2016) (p.3).

Russian actors hacked into computers of a U.S. vendor that supplied software used to verify voter registration information (August 2016) (p.3).

DHS and FBI confirmed Russian actors conducted election system reconnaissance and probed voter registration databases in all 50 states; they could not confirm how many probes resulted in successful breaches. In January 2017, White House officials reported the federal assessment was that networks in at least seven states were compromised (2016) (p.3).

Pro-Russian hacktivists claimed to have conducted a Distributed Denial of Service (DDoS) attack that temporarily restricted access to a public-facing US state election office website (2022) (p.4).

New Hampshire election officials discovered that a vendor selected to replace the state's aging voter registration database had offshored part of the project; the software had been configured to connect to servers in Russia, and a programmer had hard-coded the Ukrainian national anthem into the database. The issues were corrected prior to deployment (2023) (p.4).

A University of Oxford report found Russia and China ranked first and third, respectively, as nations posing the highest threat level of cybercrime; PII available to these adversaries can also be purchased or accessed on the dark web (p.9).

Assesses Russia, China, Iran, and many nonstate actors have the capability to compromise election infrastructure, though it would be difficult to manipulate voting processes at scale without detection (p.1).

Key takeaway: foreign states will continue to use covert and overt influence measures to sway U.S. voters, shift U.S. policies, increase discord, and undermine confidence in democratic processes; primary concern is Russia, China, and Iran (p.1).

Russia section: assesses Russia is using measures to denigrate former VP Biden; names the Lakhta Internet Research (LIR) troll farm, Russia's Foreign Intelligence Service (SVR), and the GRU; references Derkach and Kilimnik as proxy actors; as of June 2020 Russia reconnoitered multiple state and local government [systems] (purpose unknown); in April, unidentified actors used ransomware against a Virginia county administrator and voter registration [system] (p.2-3, p.5, p.7).

Includes a matrix graphic, "Efforts by Selected Countries To Manipulate US Political Landscape," describing efforts over at least the past four years; text notes the scope/scale of China's current influence activity at the state and local level "far outpaces Russia's and Turkey's" (p.8).

Russia almost certainly reconnoitered all US state election networks during the 2016 cycle, accessed election-related infrastructure in at least two states, and exfiltrated voter data from at least one state; Russia, China, Iran, and North Korea are all capable of similar operations in 2020 (p.1).

Assesses at least Russia, China, Iran, and North Korea have the capability to access and potentially manipulate data in US election-related computer systems, but the IC does not know whether they have specific plans to interfere (p.1).

Graphic covers Russia, China, Iran, and a fourth [REDACTED] country; comments requested by COB Tuesday 1 September; contains redacted material for Russia and China with serial numbers included for access verification (p.22).