After Russia targeted the 2016 presidential election,Footnote ¹ U.S. government authorities repeatedly warned about the prospects of foreign interference in and influence on the 2020 election. Throughout the fall of 2020, government officials and private companies took a number of actions to address threats to the election, including issuing public warnings, imposing sanctions, and taking down foreign government-linked accounts. In a declassified report released in March 2021, the intelligence community concluded that although Russia and Iran carried out influence operations to affect the election, there are “no indications that any foreign actor attempted to alter any technical aspect of the voting process in the 2020 US elections, including voter registration, casting ballots, vote tabulation, or reporting results.”Footnote ² In December 2020, however, U.S. cybersecurity firm FireEye disclosed that it suffered a breach by a nation-state sponsored actor, and numerous U.S. government agencies soon revealed that they too had been breached in intrusions widely attributed to Russia.

In 2016, Russia conducted sustained operations targeting the election, including hacking into the Democratic National Committee (DNC) computer networks, providing over 20,000 DNC emails to WikiLeaks for release, and leveraging social media for influence operations.Footnote ³ Although the DNC hack was revealed in June 2016, the U.S. government did not publicly attribute the malicious cyber activity to Russia until October.Footnote ⁴ Social media companies too were heavily criticized for failing to recognize and respond to Russian influence operations on their platforms.Footnote ⁵

In 2020, the federal government assumed a more proactive stance, taking a number of public actions before the election both to inform the public and disrupt potential operations. In doing so, it focused on potential threats from several countries. On July 24, 2020, the Office of the Director of National Intelligence (ODNI) issued a warning about potential election-related operations:

Democratic congressional leaders, however, criticized the ODNI release on the grounds that it created “a false sense of equivalence to the actions of foreign adversaries by listing three countries of unequal intent, motivation and capability together” and “fails to fully delineate the goal, nature, scope and capacity to influence our election, information the American people must have as we go into November.”Footnote ⁷

In response, ODNI provided more detailed analysis of Chinese, Russian, and Iranian motivations on August 7, asserting “that China prefers that President Trump—whom Beijing sees as unpredictable—does not win reelection,” “Russia is using a range of measures to primarily denigrate former Vice President Biden and what it sees as an anti-Russia ‘establishment,’” and “Iran seeks to undermine U.S. democratic institutions” and President Trump and “to divide the country in advance of the 2020 elections.”Footnote ⁸ A January 2021 report by the ODNI Analytical Ombudsman noted that some intelligence analysts considered the July and August statements and others “a ‘gross misrepresentation’ of established [Intelligence Community] views,”Footnote ⁹ in part because of the Trump administration's emphasis on Chinese influence operations and attempts to deemphasize the threat posed by Russia.Footnote ¹⁰

Some public warnings did categorize Russia as the primary threat. In September, Federal Bureau of Investigation (FBI) Director Christopher Wray told the House Homeland Security Committee “[w]e certainly have seen very active—very active—efforts by the Russians to influence our election in 2020 … to both sow divisiveness and discord, and … primarily to denigrate Vice President Biden in what the Russians see as a kind of an anti-Russian establishment.”Footnote ¹¹ In October, the Cybersecurity and Infrastructure Agency (CISA) and the FBI issued a joint advisory warning about “Russian state-sponsored advanced persistent threat (APT) actor activity targeting various U.S. state, local, territorial, and tribal (SLTT) government networks, as well as aviation networks.”Footnote ¹² The warning noted that since the activity was “directed at SLTT government networks, there may be some risk to elections information housed on” such networks, but that “the FBI and CISA have no evidence to date that integrity of elections data has been compromised.”Footnote ¹³

In addition to public warnings, the United States issued sanctions against individuals and entities involved in election interference. On September 10, the U.S. Treasury Department sanctioned Andrii Derkach, “a Member of the Ukrainian parliament, [who] has been an active Russian agent for over a decade … [and who] waged a covert influence campaign centered on cultivating false and unsubstantiated narratives concerning U.S. officials in the upcoming 2020 Presidential Election.”Footnote ¹⁴ On September 23, Treasury also sanctioned individuals and entities tied to Yevgeniy Prigozhin, the financier behind the Russian troll factory, Internet Research Agency,Footnote ¹⁵ which organized an influence campaign in 2016 to denigrate then-presidential candidate Hillary Clinton.Footnote ¹⁶ The Treasury Department explained that the sanctions “build[] on the U.S. government's efforts to promote accountability for the Russian government's intelligence organizations, including the Federal Security Service (FSB), for perpetrating an array of destabilizing activities such as conducting malicious cyber activities and interfering in elections, by further targeting networks supporting their activities.”Footnote ¹⁷

Moreover, on October 19, the U.S. Department of Justice unsealed indictments against six Russian military officials for hacking incidents including attacks against Ukraine's power grid, deployment of the NotPetya malware, and “hack-and-leak efforts” targeting the 2017 French elections.Footnote ¹⁸ According to reports, officials indicated that the “indictment was not a specific warning to Moscow to avoid interfering in this year's election, [but] serve[d] as a ‘general’ warning that such activities are not deniable.”Footnote ¹⁹

The U.S. actions were not confined to Russia. In late October, voters in Alaska and Florida received threatening “emails claim[ing] to be from … the Proud Boys, but evidence … mounted that they in fact were the work of another, hidden actor.”Footnote ²⁰ In “the fastest-ever public disclosure of such intelligence by the United States,”Footnote ²¹ the United States accused Iran of responsibility for the emails on October 21.Footnote ²² The next day the Treasury Department sanctioned Iranian government-linked entities, including Iran's Islamic Revolutionary Guard Corps “for having directly or indirectly engaged in, sponsored, concealed, or otherwise been complicit in foreign interference in the 2020 U.S. presidential election.”Footnote ²³

In addition to the public actions by civilian agencies, U.S. Cyber Command also conducted election-related cyber operations. In an interview, Lieutenant General Charles L. Moore Jr., the deputy commander of Cyber Command, explained that “[d]efending the election is now a persistent and ongoing campaign for Cyber Command.”Footnote ²⁴ In the two years preceding the election, Cyber Command sent teams overseas to “find[] foreign hacking groups before the election … [and] identify not only Russian tactics but also those of China and Iran.”Footnote ²⁵ Cyber Command reportedly took actions to “interfere with the operations of” a Russian hacking group and to “take down, at least temporarily, the Iranian hacking group tied to Tehran's Islamic Revolutionary Guards Corps.”Footnote ²⁶ In congressional testimony in March 2021, General Paul M. Nakasone, the commander of U.S. Cyber Command, confirmed that Cyber Command “conducted more than two dozen operations to get ahead of foreign threats before they interfered with or influenced our elections in 2020.”Footnote ²⁷

In addition to the U.S. governmental efforts, U.S. technology and social media companies also stepped up to respond to operations aimed at the election. In September, Microsoft reported on cyberattacks “targeting people and organizations involved in the upcoming presidential election, including unsuccessful attacks on people associated with both the Trump and Biden campaigns.”Footnote ²⁸ Microsoft noted that a Russian hacking group “responsible for the attacks on the Democratic presidential campaign in 2016” had “attacked more than 200 organizations including political campaigns, advocacy groups, parties and political consultants.”Footnote ²⁹ Microsoft further explained that an Iranian hacking group, whose infrastructure Microsoft had seized pursuant to court orders, “continued to attack the personal accounts of people associated with” the Trump campaign.Footnote ³⁰ Finally, the company noted that Chinese actors “appear[] to have indirectly and unsuccessfully targeted the Joe Biden for President campaign through non-campaign email accounts belonging to people affiliated with the campaign” and “also targeted at least one prominent individual formerly associated with the Trump Administration.”Footnote ³¹

Throughout the fall, social media companies publicized their efforts to thwart foreign influence operations. In 2019, Facebook CEO Mark Zuckerberg acknowledged some of his company's earlier failures to curb the spread of disinformation and noted “[w]e've gone from being on our back foot to proactively identifying clusters of fake accounts and taking them down.”Footnote ³² In September and October 2020, Facebook issued statements detailing numerous networks and associated accounts, pages, and groups that it removed from both Facebook and Instagram.Footnote ³³ Twitter also undertook policy changes ahead of the election to curb foreign and domestic disinformation,Footnote ³⁴ and it suspended and banned foreign accounts for “platform manipulation.”Footnote ³⁵

Finally, in October, Cyber Command and Microsoft, working simultaneously, but not in collaboration, conducted operations to disrupt “the TrickBot botnet, an army of at least 1 million hijacked computers run by Russian-speaking criminals” amid concern that it could be used to deliver ransomware to election-related systems.Footnote ³⁶ Cyber Command reportedly hacked TrickBot's command and control servers and temporarily cut off access to thousands of affected computers.Footnote ³⁷ In parallel, Microsoft obtained an injunction from a federal court allowing it to seize Trickbot infrastructure and disable some of the botnet's operations.Footnote ³⁸

U.S. officials have consistently asserted that foreign government operations did not compromise the security of the 2020 election.Footnote ³⁹ The intelligence community report released in March 2021 provides more details on the nature of foreign governments’ actions. The report distinguishes between “election interference,” defined as “activities targeted at the technical aspects of the election, including voter registration, casting and counting ballots, or reporting results,” and a broader category of “election influence,” which includes efforts by foreign governments or their proxies “intended to affect directly or indirectly a US election—including candidates, political parties, voters or their preferences, or political processes.”Footnote ⁴⁰ While the report concludes that the intelligence community has “no indications any foreign actor attempted” election interference, it details influence operations by Russia and Iran tied to both countries’ leaders.Footnote ⁴¹ With respect to Russia, the report states:

The report notes that Iran's actions were “more aggressive than in past election cycles” and asserts that “Supreme Leader Ali Khamenei probably authorized Iran's influence campaign.”Footnote ⁴³ The report concludes with “high confidence that Iran carried out an influence campaign … intended to undercut the reelection prospects of former President Trump and to further its longstanding objectives of exacerbating divisions in the US, creating confusion, and undermining the legitimacy of US elections and institutions.”Footnote ⁴⁴

Contrary to some government statements in the runup to the election, the report concludes that “China did not deploy interference efforts and considered but did not deploy influence efforts intended to change the outcome of the US presidential election,” noting that “Beijing's risk calculus … was informed by China's preference for stability in the bilateral relationship, their probable judgment that attempting to influence the election could do lasting damage to US-China ties, and belief that the election of either candidate would present opportunities and challenges for China.”Footnote ⁴⁵

An accompanying report by the Departments of Justice and Homeland Security similarly concluded that those agencies lack evidence that “any foreign government-affiliated actor prevented voting, changed votes, or disrupted the ability to tally votes or to transmit election results in a timely manner; altered any technical aspects of the voting process; or otherwise compromised the integrity of voter registration information of any ballots cast during 2020 federal elections.”Footnote ⁴⁶ The report rejects as “not credible” “multiple public claims that one or more foreign governments—including Venezuela, Cuba, or China—owned, directed, or controlled election infrastructure,” or manipulated such infrastructure or vote counts.Footnote ⁴⁷

Although the United States avoided foreign interference in the 2020 election, media interviews with government officials since the election suggest that “the government's emphasis on election defense, while critical in 2020, may have diverted resources and attention from long-brewing problems like protecting the ‘supply chain’ of software.”Footnote ⁴⁸ On December 8, the cybersecurity firm FireEye announced that it had been compromised by a state-sponsored actor,Footnote ⁴⁹ but it quickly became clear that the incident was far broader. Traced to malicious code inserted into network management software from a company called SolarWinds,Footnote ⁵⁰ the breach also compromised numerous government agencies, including the Departments of Treasury, State, Commerce, Labor, Agriculture, Homeland Security, Justice, and Energy (specifically, the National Nuclear Security Administration, which is responsible for the U.S. nuclear weapons stockpile), parts of the Pentagon, the National Institute of Health, and the U.S. federal courts, as well as around one hundred companies.Footnote ⁵¹ The “scale of potential access far exceeded the number of known compromises,” however, suggesting that more breaches could be uncovered.Footnote ⁵² In a joint statement on January 5, the FBI, CISA, ODNI, and National Security Agency (NSA) indicated the intrusion was “likely Russian in origin … [and] was, and continues to be, an intelligence gathering effort.”Footnote ⁵³

President Biden has tasked the intelligence community with providing a “full assessment of the SolarWinds cyber breach,” among other things.Footnote ⁵⁴ Deputy National Security Adviser for Cyber and Emerging Technology Anne Neuberger is “overseeing the response” to the SolarWinds breach.Footnote ⁵⁵ In a February press briefing, Neuberger explained that, while coordinating with the private sector, the government is “working to expel the adversary, … working to … improve the cybersecurity of federal networks, and … also carefully thinking through how we respond.”Footnote ⁵⁶ Neuberger noted, “This isn't the only case of malicious cyber activity of likely Russian origin, either for us or for our allies and partners. So as we contemplate future response options, we're considering holistically what those activities were.”Footnote ⁵⁷