An Iranian cyber group was responsible for the targeting of U.S. election websites, the voter intimidation emails sent to potential voters, and the dissemination of election-related disinformation on voter fraud through a propaganda video this month, according to the Department of Homeland Security and the FBI.
DHS’s Cybersecurity and Infrastructure Security Agency and the bureau issued a joint cybersecurity advisory related to an Iranian “advanced persistent threat” hacker organization just a few days before Tuesday’s presidential election, saying the U.S. analysis indicated that the Iranians had also “scanned state websites, to include state election websites” in late September and that it was also observed “attempting to exploit websites to obtain copies of voter registration data” in September and October. CISA and the FBI confirmed that the Iranian hackers “successfully obtained voter registration data in at least one state” and that “a review of the records that were copied and obtained reveals the information was used in the propaganda video.”
An FBI FLASH Alert also noted that Iranian cyber actors “are likely intent on influencing and interfering with the U.S. elections to sow discord among voters and undermine public confidence in the US electoral process” and “are creating fictitious media sites and spoofing legitimate media sites to spread anti-American propaganda and misinformation about voter suppression.” The FBI said that the Iranians “had taken specific actions to influence public opinion relating to the 2020 U.S. Presidential Election” and advised that the Iranian-backed propaganda video that has circulated online “is almost certainly intended to make U.S. voter information and the voting process appear insecure and susceptible to fraud.”
There is no indication that the Iranian hackers have changed any votes or that they have the ability to interfere with any tallies.
The notices by the DHS and the FBI about Iran come just over a week after Director of National Intelligence John Ratcliffe and FBI Director Christopher Wray held a surprise press conference last week warning that Russia and Iran had gained access to U.S. voter registration information.
Ratcliffe announced that “we have confirmed that some voter registration information has been obtained by Iran and separately by Russia” and that “this data can be used by foreign actors to communicate false information to registered voters that they hope will cause confusion, sow chaos, and undermine your confidence in American democracy.” Wray stressed voters should be confident that their votes would count.
William Evanina, the director of the National Counterintelligence and Security Center, stressed this week that “we’re very confident that our adversaries will not be able to manipulate any votes or change any votes at scale.”
“We’re trying to identify if the data taken by Russian and Iran was also available publicly. But right now, all we know is both nations took voter data registration information from places that were election-related infrastructure,” Evanina said Thursday.
After the announcement by Ratcliffe and Wray, the State Department and the Treasury Department leveled new sanctions against the Islamic Revolutionary Guard Corps and other Iranian groups that the U.S. said are involved in 2020 election interference.
Last week, the Miami Herald reported that intimidating emails claiming to be from the right-wing Proud Boys group, but were apparently from the Iranians instead, had been sent to hundreds of voters in numerous counties in Florida, seemingly targeting Democrats. The emails said, in part, that “you will vote for Trump on Election Day, or we will come after you.” The DNI’s office said this week it would brief the Republican and Democratic lawmakers representing the Florida counties most targeted.
House Speaker Nancy Pelosi was one of many Democrats to criticize Ratcliffe’s statements on Iran, saying that “Russia is the villain here, from what we have seen in the public domain. Iran is a bad actor but in no way equivalent.”
“We have already seen Iran sending spoofed emails designed to intimidate voters, incite social unrest, and damage President Trump,” Ratcliffe said last week, adding that “we have not seen the same actions from Russia.”
Evanina said Thursday that “the Iranians truly believe that the United States government is trying to enact regime change, so, logically, they are anti this administration.”
“The Iranians follow U.S. politics closely and saw the last debate where the Proud Boys were an issue and saw an opportunity here to manufacture blowback on Trump by creating a narrative that violent Trump supporters are sending out threatening emails,” a senior intelligence official told the Washington Examiner last week.
Evanina released the Intelligence Community’s assessment on foreign election meddling in early August, warning that Russia is “using a range of measures to primarily denigrate” former Vice President Joe Biden, including that Ukrainian lawmaker Andrii Derkach “is spreading claims about corruption — including through publicizing leaked phone calls — to undermine” the 2020 Democratic nominee. The same statement also said China “prefers” that Trump not win reelection and is “expanding its influence efforts ahead of November 2020.” Evanina also said Iran “seeks to undermine” Trump’s presidency.
Robert Mueller’s special counsel report concluded that Russia interfered in the 2016 election in a “sweeping and systematic fashion,” but it “did not establish that members of the Trump campaign conspired or coordinated with the Russian government.”
