Iran, China and Russia were prepared to conduct information operations after Election Day to “create uncertainty and undermine the legitimacy of the election process,” the U.S. National Intelligence Council warned in a memorandum declassified on Oct. 16, 2024. “They might also consider stoking unrest and conducting localized cyber operations to disrupt election infrastructure.” The intelligence community did not have reporting about a specific plot but noted that the three countries were probably better prepared to be disruptive than in previous election cycles. The following are Iran-related excerpts from the memorandum.
Foreign Threats to US Elections After Voting Ends in 2024
Key Takeaways
Scope Note: This assessment responds to a tasking from the Director of National Intelligence to examine the threat of foreign election influence or interference in the US general election from the time the polls close on Election Day (5 November 2024) through Inauguration Day (20 January 2025).
The IC assesses that this year China, Iran, and Russia are better prepared to exploit opportunities to exert influence in the US general election after the polls close on Election Day due to lessons drawn from the 2020 election cycle. We expect these actors to at least conduct information operations denigrating US democracy through Inauguration Day.
- These and other foreign actors conducting election operations after voting ends would probably continue to use the same types of tools: information operations, cyber operations, and potentially physical threats or violence. Although we lack information on each actor’s threshold for action, we assess their level of activity will likely be shaped by their perception of opportunity, tolerance for risk, and, for those seeking to influence the election toward a particular candidate, how the projected outcome aligns with their preference.
- Some foreign actors may conduct activities that seek to disrupt or delay the time-sensitive and tightly sequenced series of processes and events that begin after polls close. Each step, from the tabulation of votes and certification of results to completion of the Electoral College process and inauguration, is potentially susceptible to foreign influence and interference operations in different ways.
The IC assesses that foreign actors—particularly China, Iran, and Russia—seeking to influence the US general election will conduct at least information operations after Election Day until the culmination of the process on Inauguration Day. They might also consider stoking unrest and conducting localized cyber operations to disrupt election infrastructure. However, we judge that operations that could affect voting or official counts are less likely because they are more difficult and bring a greater risk of US retaliation. Although we have no reporting as of 1 October about specific foreign plans to target election administration processes after voting ends, foreign actors such as China, Iran, and Russia have previously sought to amplify discord, including after the breach of the US Capitol on 6 January 2021, and probably are now better prepared to exploit opportunities after the polls close than in previous cycles.
Post-Election Day Information Operations Highly Likely
Foreign adversaries will almost certainly conduct information operations after voting ends to create uncertainty and undermine the legitimacy of the election process. They probably will be quick to create false narratives or amplify content they think will create confusion and friction about the election process, as they did after the presidential election in 2020, including the breach of the US Capitol. Influence actors will almost certainly post and amplify claims of election irregularities, particularly if the electoral results are a counter to their preferred outcomes, judging from their pre-election day activity in the present and prior cycles. These activities probably would be designed to undermine faith in US democracy, and could have ramifications for the post-election processes. ...
- A foreign actor could use AI-generated materials to amplify doubts about the election’s fair conduct, such as false images of election officials taking part in activities to undermine the vote. Russia has generated AI content related to the election across all four mediums we are following—text, images, audio, and video—though the degree to which this content has been released and spread online varies. Iranian actors have used AI to help generate social media posts and write spurious news articles for websites posing as real news sites.
- Moscow and Tehran may also see an opportunity to continue pushing content favoring their preferred outcome. For instance, Russian influence actors have pushed negative messaging about Vice President Harris and publicly alleged conspiracy theories about her elevation to the top of the ticket. Iranian cyber actors may try to publish content denigrating former President Trump.
...
We assess foreign actors are positioned to use cyber operations and espionage to sow doubt about the integrity of the election and collect data, judging from cyber actors’ prior activities. In particular, actors might seek to disrupt or alter public-facing state government and news websites to promote confusion about election results; claim they have interfered in the election, even if false, to undermine trust in the election; and acquire publicly available voter registration data and nonpublic information on local election officials, which they can leverage in future cyber or influence operations.
...
As of August 2023, Islamic Revolutionary Guard Corps (IRGC) [REDACTED] actors were aware of unspecified information on US voters in 27 unnamed states available for download on a leak website, which, if acquired, could be used to target voters with disinformation—as in 2020, when Iranian cyber actors used data on more than 100,000 voters for its operation impersonating the Proud Boys. As of February, IRGC [REDACTED] cyber actors had accessed a network domain associated with a US state government’s division of elections and probably obtained data on voter registration and on whether or not some of the registered individuals voted.
...
Potential for Physical Threats and Cyberattacks After Election Day
Foreign actors also have the capacity to stoke protests, take violent actions, and conduct cyberattacks against some election infrastructure, and probably will decide whether to use such tactics based on their perception of the election outcome and domestic US reaction. In general, we expect foreign actors will be more likely to consider these tactics if they perceive they will resonate with the domestic population and they can maintain plausible deniability; we are closely monitoring for indications of a shift toward these actions.
Physical Threats and Violence Iran and Russia are probably willing to at least consider tactics that could foment or contribute to violent protests, and may threaten, or amplify threats of, physical violence in the post-Election Day timeframe. [REDACTED] efforts by Iran to assassinate former President Trump and other former US officials, which are likely to persist after voting ends, regardless of the projected outcome.
- Foreign adversaries that have demonstrated a willingness to encourage participation in non-election-related, First Amendment-protected protests may extend this practice to any potential violent protests in the post-election period to further widen domestic divides. In January, a GRU unit sought to recruit a probably unwitting US person to organize protests in the United States. In May and June, Iran’s Ministry of Intelligence and Security (MOIS) encouraged a US person via social media, including by offering to send money for travel, to attend a pro-Palestinian protest in Washington, DC.
- Iran could use cyber-enabled influence operations that lead to physical threats, including doxing and leaking of sensitive information. In mid-December 2020, IRGC [REDACTED] cyber actors were almost certainly responsible for the creation of a website containing death threats against US election officials. [REDACTED] The Iranian actors also published personally identifiable information about US federal and state officials to try to incite violence.
Cyberattacks Against Election Infrastructure
We assess that some US adversaries—at a minimum China, Iran, and Russia or Russian-affiliated actors—have the technical capability to access some US election-related networks and systems. That said, we assess foreign actors will probably refrain from disruptive attacks that seek to alter vote counts because they almost certainly would not be able to tangibly impact the outcome of the federal election without detection; such activity would carry a risk of retaliation, and there is no indication they attempted such attacks during the past two election cycles.