Foreign Threats to 2020 US Federal Elections (NICA)

Scope note: a downgraded version of a paper originally published 19 August 2020; updates NICM 2020-3 [REDACTED]; does not assess impact on the US or discuss efforts the IC cannot attribute to foreign actors (p.1).

Foreign states will continue using covert and overt influence measures to sway US voters, shift US policies, increase discord, and undermine confidence in democratic processes ahead of the 2020 elections (p.1).

The IC judges that Russia, China, Iran, and many nonstate actors have the capability to compromise election infrastructure (interfere with voting, steal data, or call into question validity), but it would be difficult to manipulate voting processes at scale and without detection (p.1).

Primary concern is ongoing/potential influence activity by Russia, China, and Iran (p.1).

Russia is using a range of measures primarily to denigrate former VP Biden and the "anti-Russia establishment," directing/encouraging proxies to spread claims about Biden; some Kremlin-linked actors seek to boost President Trump's candidacy on social media (p.1).

China prefers President Trump be defeated and has stepped up public rhetoric criticizing his Administration; the assessment states [REDACTED] Beijing did not intend to try to affect the election (p.1, p.3).

Terminology: "Election influence" = overt/covert influence by foreign governments/agents intended to directly or indirectly affect a US election (candidates, parties, voters, political processes); "Election interference" is a subset involving technical aspects — voter registration, casting/counting of ballots, and reporting of results (p.2).

Russia: President Putin and senior officials are overseeing proxy efforts (including Derkach, Kilimnik, and others affiliated with the Russian Government) to spread claims about Biden and alleged Ukrainian influence in the 2016 election, including claims tied to Ukrainian energy firm Burisma, aiming to defeat Biden and ensure Trump's victory (p.2-3).

As of June 2020, [REDACTED] Russian actors reconnoitered multiple state and local government [systems]; purpose unknown. In July a commercial cybersecurity company believed [REDACTED] may have targeted a US political organization, probably unsuccessfully (p.3).

Russian actors circulated narratives about voter fraud from mail-in balloting and called some US primary processes "rigged" by the Democratic Party (p.3).

Some Russian actors shifted from social media to online news sites; the Lakhta Internet Research (LIR) troll farm, Russia's Foreign Intelligence Service (SVR), and the GRU employed US and foreign authors to create anti-American content on English-language platforms including "United World International" (p.3).

If Beijing assessed the downward US-China trajectory threatened China's rise, it might attempt to more directly thwart the President's reelection, including by leaking information [REDACTED] or through an online influence network (p.4).

China uses mostly enticements, occasionally coercion, plus disinformation attacking US handling of COVID-19 and issues like the Houston Consulate closure, Hong Kong, South China Sea, and 5G; a pro-China network posted video content critical of President Trump before deactivation (p.4).

The IC assesses Beijing probably calculates a concerted effort to influence the presidential election would risk backfiring for uncertain benefit, but recognizes critical statements might affect the race (p.4).

A newspaper owned by the Chinese [Communist Party] claimed economic measures against supporters of COVID-19 compensation legislation/lawsuits may impact US state and congressional races — the first observed public warning that Beijing might impose economic costs affecting US elections (p.4).

Beijing expanded cyber collection related to the 2020 elections via opportunistic intrusions against US private-sector entities to collect on candidates, campaigns, donors, and voter data (p.5).

Iran / Threats to Election Infrastructure: hostile actors could exploit Internet-connected election infrastructure (voter-registration databases, pollbooks, official websites) due to ease of access and lack of security, to disrupt or sow doubt (p.5).

Hostile actors could manipulate vote-counting/tabulation systems on a localized basis, but coordinating a wide-scale alteration would be difficult; post-election audits and paper trails would most likely uncover such efforts in nearly all US states; large-scale mail-in manipulation would also be difficult and detectable via postal tracking (p.5).

Cyber operations targeting reporting of electronic tabulation results could delay reporting but probably would not affect integrity of certified results; DoS attacks would delay public access (p.5).

Iran is conducting an influence campaign to undermine the President and US democratic institutions and divide the country; Tehran sees the administration as promoting regime change in Iran; efforts focus on online covert influence and disinformation; Supreme Leader Khamenei probably authorized the campaign (p.5).

Iranian accounts have impersonated presidential candidates (including one in 2018); social media companies removed thousands of Iranian-origin inauthentic accounts over two years (p.5-6).

Iran could attempt to manipulate/attack election infrastructure — as it has in Middle East and South Asia elections — but the IC has no information it intends to do so in the US (p.6-7).

In January, Iranian-contract cyber actors tried to compromise a server tied to a US election-infrastructure business; the FBI worked with the company to remediate. In June, Google announced Iranian-linked actors unsuccessfully attempted to spearphish email accounts of campaign staffers working for the US President (p.6-7).

Other actors: senior Turkish officials, including President Erdogan, sought to covertly influence US politicians' thinking on Turkey; Ankara's efforts over the past year included covert funding of US municipal election campaigns, unregistered lobbying, and state-owned-media messaging (p.6-7).

Criminal/nonstate groups have the capability to compromise US election infrastructure; in April, unidentified actors used ransomware to compromise a Virginia county administrator's and voter-registration computers (p.7).

Other foreign leaders expressed preferences: German Chancellor Merkel almost certainly would prefer President Trump not win reelection (personality conflicts, policy impacts on Germany/EU/NATO), implicitly criticizing his COVID-19 response and citing the 2020 election as a "risk factor" for the EU; Saudi Crown Prince Muhammad Bin Salman (mid-2019) expressed concern Riyadh would lose US support if the President lost, viewing the President as the most Saudi-friendly (p.7).

A graphic ("Efforts by Selected Countries To Manipulate US Political Landscape") maps observed vs. preparatory vs. not-observed efforts across categories including public opinion, national/state leaders, leaking intelligence-acquired information, election processes, legal processes, economic leverage, and punitive measures; text notes China's state/local influence far outpaces Russia's and Turkey's and Russia has leaked intelligence-acquired information more often than Iran (p.8). Specific per-country marker values in the graphic are not legible in the OCR [OCR unclear] (p.8).

Document number NIC 2007-00866 appears at the end (p.8).