Iran, Russia agents plot postelection violence; protests intended to widen divides

U.S. intelligence officials said Tuesday that Iranian and Russian operatives may be considering influence operations intended to incite violence in America after all the ballots have been cast on Election Day.

Intelligence officials declassified an assessment of foreign adversaries’ dirty tricks and said Iran, Russia and China have the technical capability to access some U.S. election networks.

The declassified National Intelligence Council memo revealed that American spy agencies have detected foreign efforts to stoke protests.

“Foreign adversaries that have demonstrated a willingness to encourage participation in non-election-related, First Amendment-protected protests may extend this practice to any potential violent protests in the post-election period to further widen domestic divides,” the memo said.

The memo said a Russian GRU military intelligence unit “sought to recruit a probably unwitting U.S. person to organize protests in the United States” in January.

Intelligence officials also determined that the Iranian Ministry of Intelligence and Security (MOIS) encouraged a U.S. national to attend a pro-Palestinian demonstration in Washington and offered to send funds for money and travel.

Officials at the Office of the Director of National Intelligence (ODNI) told reporters that foreign adversaries have identified the transition period between Election Day and Inauguration Day as especially vulnerable to foreign operations.

In an election security update on Tuesday, the intelligence community said the spy agencies were “increasingly confident” that Russian actors were considering and have started implementing efforts timed for the days before and after voting closes on Nov. 5.

“Some of these influence efforts are aimed at inciting violence and calling into question the validity of democracy as a political system regardless of who wins,” an intelligence official told reporters. “Others are aimed at amplifying false information and conspiracies that may exacerbate post-election tensions in the United States.”

Intelligence officials are also closely monitoring foreign adversaries’ plans to stir chaos before Election Day.

“We assess that some U.S. adversaries — at a minimum China, Iran, and Russia or Russian-affiliated actors — have the technical capability to access some U.S. election-related networks and systems,” the declassified memo said. “That said, we assess foreign actors will probably refrain from disruptive attacks that seek to alter vote counts because they almost certainly would not be able to tangibly impact the outcome of the federal election without detection; such activity would carry a risk of retaliation, and there is no indication they attempted such attacks during the past two election cycles.”

After redactions under a section labeled “Cyberattacks against election infrastructure,” the memo said the pro-Russian hacker group Killnet 2.0 signaled its intent to interfere in the U.S. election in a February post that has since been deleted.

The memo did not identify where Killnet deleted its announcement, but the group published a list of U.S. targets for cyberattacks in 2022 on the Telegram platform. At that time, the hackers flooded airport websites with traffic, disrupting the visibility of the public-facing websites but not altering the airports’ function.

ODNI officials say Russia is pursuing measures to denigrate Democratic vice presidential nominee Tim Walz. The officials’ election security update says a review of electronic content alleging Mr. Walz had engaged in criminal activity earlier in his career showed indications that it was the product of Russian influence activity and tactics.

Intelligence officials have previously attributed a hack-and-leak operation aimed at Donald Trump’s Republican presidential campaign to Iran.

The National Intelligence Council memo said Iran “could use cyber-enabled influence operations that lead to physical threats, including doxxing and leaking of sensitive information.”

“In mid-December 2020, [Iran’s Islamic Revolutionary Guard Corps] [redacted] cyber actors were almost certainly responsible for the creation of a website containing death threats against U.S. election officials, [redacted],” the memo said. “The Iranian actors also published personally identifiable information about U.S. federal and state officials to try to incite violence.”

The intelligence community said foreign adversaries may work to disrupt the peaceful transition of power to the next president. U.S. officials assess that the adversaries would look to disparage America’s political system and incite protesters by building on information operations started earlier in the election cycle.

The U.S. intelligence community’s plan to stop the hostile foreign interventions involves additional warnings exposing foreign adversaries’ plans to disrupt America’s political system.

“A multi-pronged approach that includes direct warnings to adversaries, public messaging to Americans that pre-bunks or debunks false narratives, and proactive communication between local officials and law enforcement has the best chance of thwarting foreign influence efforts after the election,” the declassified memo said. “U.S. adversaries’ longstanding interest in undermining American democracy suggests it will be difficult to dissuade them from engaging during the post-election period.”