The U.S. Spies Who Sound the Alarm About Election Interference

Voters have a limited number of ways to learn about the illicit attempts of foreign powers to manipulate them. One way is for private companies—Microsoft is currently the most active—to publish research about suspicious social-media content or cybercrimes that appear to be state-sponsored. Brandt described such civilian-identified plots as “caught in the wild.” But private companies can never speak with the authority of the government, and, without subpoenas or spies, they also lack the same breadth of information. Watts, a former F.B.I. special agent, told me that the government is “the ultimate source of confirmation on attribution and actors.” A deepfake that Microsoft spots “may be the tip of the iceberg,” he continued, and U.S. intelligence officials “can understand it at a much deeper level.” Then, there is what he called “a chicken-and-egg problem” facing private companies. The government asks them to shut their platforms to malicious foreign trolls, but the companies “are waiting for the state to tell them who those accounts are.”

Criminal prosecutions are another way that covert foreign plots targeting an election can be exposed. Since the appointment of the special counsel Robert Mueller to investigate the Kremlin’s gambit in 2016, federal indictments have consistently provided the most detailed, and therefore potent, accounts of such influence operations. This past summer, news reports about a hacking of the e-mail accounts of Roger Stone, a former Trump adviser, evidently prompted prosecutors in Washington, D.C., to file an indictment against three Iranians. They were charged with dozens of hacking attacks during a five-year period, almost all of them against Americans involved in national security or foreign affairs. The U.S. government had been watching these Iranians for at least four years; the indictment cites evidence that, in each of those years, two of the operatives repeatedly visited a Tehran address linked to the crimes. On June 27, 2024, according to the indictment, the Iranians e-mailed two Biden campaign officials a stolen copy of materials that Trump had used to prepare for that night’s Presidential debate. (The Iranians presciently warned that, if Biden lost the debate, the Democrats “will have to replace” him.) There’s no evidence, however, that the recipients read the e-mails; Biden flailed in any case. A subsequent attempt to give journalists stolen vetting materials about Trump’s running mate, J. D. Vance, also found no takers. The Times reported its editors had concluded that “publication was likely to serve the interests of the attackers.”

Other legal findings, also unsealed in September, described a sweeping Russian operation that was years in the making. An affidavit by an F.B.I. investigator quoted notes from meetings held at the Kremlin by a top aide to Putin as early as April, 2022. The aide had hired three Russian contractors to conduct a covert online propaganda campaign to weaken global support for Ukraine’s attempt to repel Russia’s invasion. In 2023, one of the contractors submitted a more detailed proposal, called the Good Old U.S.A. Project, to sway the 2024 election in America. The proposal asserted that an isolationist view of the Ukraine war had become a “centerpiece” of the Presidential race; Russia must therefore “put a maximum effort to ensure that the Republican point of view (first and foremost the opinion of Trump’s supporters) wins over the U.S. public opinion.” (The names of the parties and candidates were redacted in the filing.) The proposal’s authors saw an opportunity in “the high level of polarization of American society,” which had created an “information situation” that “differs dramatically from that in all other Western countries.”

The Good Old U.S.A. Project envisaged setting up hundreds of fake online accounts, including eighteen seemingly apolitical “sleeper” groups on multiple social-media platforms across six swing states; “at the right moment,” they would “distribute bogus stories disguised as newsworthy events.” (Kremlin documents included in the filing describe Twitter as the most hospitable “mass platform,” although a partially redacted sentence suggests that the Russians liked Trump’s Truth Social even more.) To avoid detection, the Russians planned to disseminate misinformation by inserting comments or replies into authentic message threads; these comments would include links directing users to sites showcasing more elaborate propaganda. The Russians also set out to secretly promote real American influencers who supported “ending the war in Ukraine” and were “ready to get involved in the promotion of the project narratives.”

In March, two of the Russian contractors were sanctioned by the Treasury Department for their role in the operation. In July, U.S. prosecutors, after receiving a tip from another government agency, seized nearly a thousand X accounts allegedly tied to a Russian “bot farm” that used A.I. “to create fictitious social media profiles,” evidently as part of the same scheme. Finally, in September, the government shut down thirty-two Web sites that disguised Kremlin propaganda as content from news organizations such as Fox News and the Washington Post. At the same time, prosecutors charged two Russian spies with conspiring to pay ten million dollars to a group of conservative American influencers. Although the unsealed indictment redacted the names, other details indicated that the Russians worked through a Nashville startup called Tenet Media. According to the indictment, in recent months the Russians had posted nearly nine hundred video clips of their own propaganda directly to Tenet social-media feeds. Until the indictment was unsealed, American viewers had no way of knowing that the Kremlin was behind this.

But U.S. intelligence agencies definitely did, just as they plainly knew about the disguised Web sites. Details from the indictments make clear that federal prosecutors were aware of the underlying schemes for months or longer before informing voters. Of course, educating voters about foreign plots is not the primary responsibility of law enforcement, which moves at its own methodical pace. Subpoenas must be obtained to legally acquire information that other agencies might have learned through spycraft; it takes time to squeeze conspirators to testify against one another, and to lock down conclusive evidence before unsealing charges. Law-enforcement agencies may also want to delay an indictment so that they can arrest suspects before they can flee—although, in the recent election-influence cases, the three Iranians and two Russians indicted were already far out of reach.

Prosecutors also work under their own deadlines. Justice Department policy precludes the agency from taking any public actions in the sixty days before an election which might affect the outcome—including filing indictments that expose a foreign adversary’s backing of a candidate. Prosecutors appear to have kept working on the Russia indictments in secrecy as long as they could. They were unsealed on September 4th, on the eve of the sixty-day deadline. Still, Brandt told me that, whatever the timing constraints, the Justice Department can “go much farther than we can” when releasing information. “That is how you end up making public multiple internal Russian planning documents, which is something the intelligence community could never release.”

For voters, the Russia and Iran indictments also raise questions about what else the government knows. Both filings offer keyhole views of major influence operations that surely were not limited to a few inconsequential hacks and to the staff of a small Tennessee media company. Watts, of Microsoft, told me that the government is cracking down on covert Russian influence operations more aggressively than it did before the 2020 election, when there were no such indictments; prosecutors have gone after a “sizable chunk of the Russian efforts we have noted.” But he said that law enforcement had not yet taken any visible action against two other Russian online networks that Microsoft had spotted meddling in the election. The company calls those two networks Storm-1516 (which pushed the staged video falsely accusing Harris of a hit-and-run) and Storm-1679 (which pushed a viral video showing a fake New York billboard that hyped false claims about Harris).

Representative Jim Himes, of Connecticut, the ranking Democrat on the House Intelligence Committee, told me he was “quite certain” that the foreign corruption of Tenet Media was not an isolated incident: “We are going to find out there are other cases where some cutout says, ‘Hey, I’ve got five million dollars for you to promote that Fauci is a Bolshevik,’ or whatever, and the answer is ‘Yeah, give me that five million!’ ”

Hearing directly from the U.S. intelligence agencies is the third way Americans can learn about foreign efforts to manipulate our elections. This election season, the Foreign Malign Influence Center has scheduled periodic “updates” to address the torrent of questions from journalists about such plots. For the spy services, one official told me, this level of public disclosure “is like standing there naked compared to what we have done in the past.” The agencies, always zealous about protecting their sources and methods, prefer to talk as little as possible, and as vaguely as possible. The resulting updates, typically about five hundred words each, are exasperatingly abstract. Speaking as the “intelligence community,” or I.C., an update from early October noted:

A range of foreign actors continue to try to influence U.S. elections as we approach November. These activities include broad efforts aimed at undermining trust in U.S. democratic processes and exacerbating divisions in our society, while also seeking to shape voter preferences toward specific candidates. Our assessments about the activities and goals of Russia, Iran, and China are unchanged from earlier election security updates. On the presidential race, the IC continues to assess that Russia prefers the Former President and Iran prefers the Vice President; China is not seeking to influence the Presidential election.

The center also holds hour-long conference calls with journalists, but the officials on the calls limit their answers to the contents of the written updates.

The opacity of such intelligence assessments, whether to journalists or to lawmakers, inevitably opens opportunities for political spin. In 2019, intelligence officials appointed a career spy named Shelby Pierson to the new post of election-threats executive. Her job was to coördinate the analysis of foreign interference or influence operations. After Pierson briefed the bipartisan leaders of the congressional intelligence committees, people on Capitol Hill leaked that she had said the Kremlin once again preferred Trump. The President exploded in anger, tried to get Pierson fired, and attempted to stop the briefings.

She survived. But Trump then appointed two new directors of National Intelligence, both of whom downplayed the Russian threat. The first was the former ambassador Ric Grenell, who served as temporary acting director. Under Grenell’s tenure, a declassified update provided to the committees declared that the intelligence community “has not concluded” that the Kremlin was aiding either Trump or Biden, “nor have we concluded that the Russians will definitely choose to try to do so in 2020.”

John Ratcliffe, a Republican congressman and a former prosecutor, took over as director in May, 2020. He played up supposed intelligence about a major plot by China instead of Russia. Shortly before the election that fall, Ratcliffe was asked in an interview on Fox News whether China opposed Trump. Ratcliffe replied that he could not “get into a whole lot of details” in an unclassified setting, but did say that China was “using a massive and sophisticated influence campaign that dwarfs anything that any other country is doing.”

Democrats complained that the Trump appointees were twisting the conclusions of the career analysts, but the classified nature of the reports left no way to settle the dispute. Then, on January 6, 2021, the spy agencies’ “analytic ombudsman” released a report saying that, in the final year of the Trump Administration, intelligence about foreign efforts to influence the election had been “delayed, distorted, or obstructed” for “political reasons,” and that career analysts viewed some of the public statements issued under Grenell and Ratcliffe as a “gross misrepresentation” of the agencies’ assessments of the Russian and Chinese operations. (Grenell told me that the ombudsman’s report had relied on liberal partisans inside the intelligence agencies; Ratcliffe defended his statements about China as a dissenting view based on his own analysis.) Two months after Biden took office, a declassified version of the agencies’ post-election assessment stated that several arms of the Russian government had, in fact, carried out influence operations “supporting former President Trump” and that the Russians had also been spreading misinformation denigrating Biden for at least six years. A headline in the assessment declared, “China Did Not Attempt to Influence Presidential Election Outcome.”