<<

DECLASSIFIED by DNI Haines on 15 March 2021

UNCLASSIFIED

SECURITY THE CENTRAI

INR SECURITY 1789

NATIONAL INTELLIGENCE COUNCIL

INTELLIGENCE COMMUNITY ASSESSMENT

10 March 2021 ICA2020-00078D

Foreign Threats to the 2020 US Federal

This document is a declassified version of a classified report. The analytic judgments outlined here are identical to those in the classified version , but this declassified document does not include the full supporting and does not discuss specific intelligence reports, sources , or methods .

ThisIntelligenceCommunityAssessmentwaspreparedby theNationalIntelligenceCouncilunderthe auspicesoftheNationalIntelligenceOfficer(NIO)for Cyber. It was drafted by the NationalIntelligenceCounciland CIA, DHS, FBI,INR, and NSA, and coordinatedwith CIA, DHS, FBI, INR, Treasury, andNSA .

UNCLASSIFIED UNCLASSIFIED

Thispage intentionally blank.

UNCLASSIFIED UNCLASSIFIED

Background

This document is a declassified version of a classified report that the Intelligence Community provided to the President, senior Branch officials, and Congressional and intelligence oversight on 07 January 2021. The Intelligence Community rarely can publicly reveal the full extent of its or the specific information on which it bases its analytic conclusions, as doing so could endanger sensitive sources and methods and imperil the Intelligence Community's ability to collect critical foreign intelligence. The analytic judgments outlined below are identical to those in the classified version , but this declassified document does not include the full supporting information and does not discuss specific intelligence reports, sources , or methods.

ScopeNote

This IntelligenceCommunityAssessment(ICA), as requiredby Executive Order(EO 13848( )(a ), addresseskey foreign actors' intentionsandeffortsto influenceorinterferewiththe 2020 USfederalelectionsor to underminepublic confidencein the US electionprocess. Itbuildsonanalysispublishedthroughoutthe electioncycleandprovidedto ExecutiveBranchand Congressionalleaders. ThisICAdoesnotincludean assessmentofthe impactforeignmalign influenceandinterferenceactivitiesmayhavehad on the outcomeofthe 2020election. The USIntelligence Communityis chargedwithmonitoringand assessingthe , capabilities, andactionsof foreign actors; it does notanalyzeUSpoliticalprocessesor actors, electionadministrationorvote tabulationprocesses, or publicopinion.

Pursuant to EO 13848(1)(b) , after receivingthis assessment, the Attorney Generalandthe SecretaryofHomeland Security, inconsultationwiththe headsofany other appropriateFederal, State, or localagencies, will evaluate the impactofanyforeign effortson the securityor integrityofelectioninfrastructureor infrastructurepertaining to a politicalorganization, campaign, or candidateina 2020 USfederal , anddocumenttheevaluationin a report

Pursuant to EO 13848( 3 ) (a ), after reviewingthis assessment andthe report requiredbyEO 13848(1) b ), the Secretary of the Treasury , in consultation with the Secretary of State, the Attorney General, and the Secretary of HomelandSecurity, will impose appropriate sanctions for activities determined to constitute foreign interference in a US election

Definitions

For the purpose ofthis assessment, electioninfluenceincludes overtand covert efforts by foreign or actors acting as agents of, or onbehalfof, foreigngovernmentsintendedto affect directly or indirectly a US election includingcandidates, politicalparties, voters or their preferences, or politicalprocesses. Electioninterference is a subset of electioninfluenceactivitiestargetedat thetechnicalaspects of the election, includingvoter registration, casting and countingballots, or reportingresults.

SourcesofInformation

Indrafting this ICA, we considered intelligence reporting and other information made available to the Intelligence Community as of 31December 2020.

UNCLASSIFIED UNCLASSIFIED

OR OFN DIRECTORINTEL Foreign Threats to the 2020 US Federal Elections THE OF 10 March2021 ICA2020-00078D

Key Judgment 1: We have no indications that any foreign actor attempted to alter any technical aspect of the process inthe 2020 US elections, including voter registration , casting ballots, vote tabulation , or reporting results. We assess that it would be difficult for a foreign actor to manipulate election processes at scale without detection by intelligence collection on the actors themselves , through physical and cyber security monitoring around voting systems across the country , or in post-election audits . The IC identified some successful compromises of state and local networks prior to Election Day—as well as a higher volume of unsuccessful attempts—that we assess were not directed at altering election processes . Some foreign actors, such as Iran and Russia, spread false or inflated claims about alleged compromises ofvoting systems to undermine public confidence in election processes and

results.

Key Judgment2: We assessthat RussianPresidentPutinauthorized, anda rangeofRussiangovernment organizationsconducted, influenceoperationsaimedat denigratingPresidentBiden'scandidacyandthe DemocraticParty, supportingformer PresidentTrump, underminingpublicconfidencein the electoralprocess, and exacerbatingsociopoliticaldivisionsinthe US. Unlikein2016, we did not see persistentRussiancyber efforts togainaccessto electioninfrastructure. We havehighconfidenceinour assessment; Russianstate andproxyactors who all servethe Kremlin'sinterestsworked to affectUSpublic perceptionsina consistentmanner. A key elementof Moscow'sstrategythis electioncycle was its use of proxieslinkedto Russianintelligenceto pushinfluence narratives — includingmisleadingorunsubstantiatedallegationsagainstPresidentBiden — USmedia organizations, USofficials, andprominentUS individuals, includingsome closeto formerPresidentTrumpand hisadministration.

Key Judgment3 : We assess thatIrancarriedout a multi-prongedcovertinfluencecampaignintendedtoundercut formerPresidentTrump'sreelectionprospects— though withoutdirectly promotinghisrivals — underminepublic confidenceinthe electoralprocessandUSinstitutions, andsow division and exacerbatesocietaltensions inthe US. Wehavehigh confidencein this assessment. We assess that SupremeLeaderKhameneiauthorizedthe campaign andIran'smilitaryand intelligenceservicesimplementedit usingovert and covert messagingandcyber operations.

Key Judgment 4: We assess that China did not deploy interference efforts and considered but did not deploy influence efforts intended to change the outcome ofthe US Presidential election . We have high confidence in this judgment. China sought stability in its relationship with the United States, did not view either election outcome as advantageous enough for China to risk getting caught meddling, and assessed its traditional influence tools primarily targeted economic measures and — would be sufficient to meet its goal ofshaping US China regardless of the winner . The NIO for Cyber assesses , however, that China did take some steps to try to undermine former President Trump's reelection.

KeyJudgment5: We assess that a rangeofadditionalforeignactors — includingLebaneseHizballah, Cuba, and somestepsto attemptto influencethe election. In general, we assess that they were smallerin scale than the influenceefforts conductedby other actors this election cycle. Cybercriminalsdisruptedsomeelection preparations; wejudge their activitiesprobablywere drivenby financial .

[ i ] UNCLASSIFIED UNCLASSIFIED

Please also see DNI memorandum : Views on Intelligence Community Election Security Analysis, dated January 7, 2021.

UNCLASSIFIED UNCLASSIFIED

OF DIRECTOR NATIONAL Foreign Threats to the 2020 US Federal Elections OF INTEL

NAT 10 March 2021 ICA 2020-00078D

Discussion that such a continuum makes it more difficult for the US to single out and respond to specifically election -focused Foreigngovernments or other foreign actors often try to influence efforts. Finally , as more foreign actors seek to influence the and of other countries. exert influence over US elections, additional actors may They may, for example, for and try to shape increasingly see election -focused influence efforts as an other countries' foreign policies in ways that benefit their acceptable norm of international behavior. political, economic, and military interests. These efforts Greater public and media awareness of influence range alonga spectrum from public statements and foreign assistance efforts, to sanctions and other operations in 2020 compared to past election cycles to some degree. US economic pressure such as boycotts, to covert or probably helped counter them Government public messaging as well as Government clandestine efforts such as covert messaging and and private sector actions probably also disrupted some recruitingagents of influence. When such activities are intended to directly or indirectly affect an election activities. For example , proactive information sharing includingcandidates, politicalparties, voters or their with social media companies facilitated the expeditious review , and in many cases removal, of social media preferences, or political processes — the IC characterizes accounts covertly operated by Russia and Iran . it as election influence. Ifa foreign government, as part Additionally , public disclosure of Russian and Iranian of its election influence efforts, attempts or takes actions efforts and US Government sanctions on some of the to target the technical aspects of elections — including hindered their to voter registration, casting and counting of ballots, and responsible actors probably deniably . reportingofresults, the IC characterizes it as election operate interference. ElectionInterference

In2020, the ICtrackeda broaderarray offoreign We have no indications that any foreign actorstaking toinfluenceUSelectionsthanin actor attempted to interfere in the 2020 US elections by past electioncycles, a developmentthatmaybe altering any technical aspect of the voting process , explainedby severalfactors. First, increasedICfocus including voter registration , ballot casting, vote on this issuemayhaveuncovereda higherpercentageof . We assess that it would efforts. Second, moreactorsmayview influence tabulation , or reporting results be difficult for a foreign actor to manipulate election operationsas importanttoolsfor projectingpower abroad The growthof internetandsocialmedia use processes at scale without detection by intelligence meansforeignactorsare moreableto reachUS collection on the actors themselves , through physical and cyber security monitoring around voting systems across audiencesdirectly, whilethe tools for doingso are post -election audits of electronic becomingmoreaccessible. Third, someforeignactors the country, or in results and paper backups. We identified some successful mayperceiveinfluenceactivitiesaroundUS electionsas continuationsofbroad, ongoingeffortsratherthan compromises of state and networks prior to Election Day. We assess these intrusions were speciallydemarcatedcampaigns. They mayalso perceive

[ 1 ] UNCLASSIFIED UNCLASSIFIED

NIC NATIONALINTELLIGENCECOUNCIL parts ofbroader campaigns targeting US networks and the consistency of themes in Russia's influence efforts not directed at the election. Some foreign actors , such as across the various influence actors and throughout the Iran and Russia, spread false or inflated claims about campaign , as well as in Russian leaders ' assessments of alleged compromises of voting systems to try to the candidates. A key element of Moscow's strategy undermine public confidence inelection processes and this election cycle was its use ofpeople linked to results. Russian intelligence to launder influence narratives including misleading or unsubstantiated allegations Overthe courseofthe electioncycle, the IC, other US against President Biden — through US media agencies, andstate and localofficialsalsoidentified organizations , US officials, and prominent US thousandsofreconnaissanceor low -level, unsuccessful individuals, some of whom were close to former attemptsto gain accessto countyor stategovernment President Trump and his administration . networks. Suchefforts are commonandwe have no indicationsthey were aimedat interferinginthe election. Kremlin DirectionofInfluenceActivity

Some of these government networks hosted, We assess that President Putin and other senior amonga variety of other governmentprocesses, Russian officials were aware of and probably directed election-relatedelementslikevoter registration Russia's influence operations against the 2020 US databases or state electionresultsreporting Presidential election. For example , we assess that Putin websites. We haveno indicationsthat these had purview over the activities of Andriy Derkach , a activitiesalteredany electionprocessesor data . Ukrainian legislator who played a prominent role in Russia's election influence activities . Derkach has ties to Defensive measures such as firewalls, up-to -date Russian officials as well as Russia's intelligence services. patching , cybersecurity training for government personnel, and separation of election -specific Other senior officials also participated in Russia's systems from other computer networks probably election influence efforts — including senior helped to thwart thousands of compromise national security and intelligence officials who we attempts . Such measures probably also would have assess would not act without receiving at least helped prevent the network intrusions we detected . Putin's tacit approval.

Russia'sEffortsto Influence2020 Election, Actors, Methods, andOperations ExacerbateDivisionsin US We assess that Russia's intelligenceservices, Ukraine We assess that President Putin and the Russian state linkedindividualswith ties to Russianintelligenceand authorized and conducted influence operations against their networks, and Russianstate media, trolls, and the 2020 US presidential election aimed at denigrating onlineproxiesengagedinactivitiestargetingthe2020 President Biden and the Democratic Party, supporting US presidentialelection. The primaryeffort the IC former President Trump, undermining public uncoveredrevolvedarounda narrative — that Russian confidence in the electoral process , and exacerbating actorsbeganspreadingas early as 2014 sociopolitical divisions in the US . Unlike in2016 , we corrupt ties between President Biden, his family, and did not see persistent Russian cyber efforts to gain other USofficialsand Ukraine. Russian intelligence access to election infrastructure . We have high servicesreliedon Ukraine-linkedproxiesand these confidence in these judgments because a range of proxies' networks— includingtheir US contacts — Russian state and proxy actors who all serve the spreadthis narrative to give Moscowplausible Kremlin's interests worked to affect US public deniability oftheir involvement. We assess that the goals . We also have high confidence because of ofthis effort went beyondthe US presidentialcampaign

[ 2 ] UNCLASSIFIED UNCLASSIFIED

NIC NATIONAL INTELLIGENCECOUNCIL to includereducingthe Trump administration'ssupport We assess that Russia's cyber units gathered for Ukraine. As the USpresidentialelectionneared, information to inform Kremlin decision -making about Moscowplaced increasingemphasison underminingthe the election and Moscow's broader foreign policy candidate it saw as most detrimentalto its global interests. Through these operations, Russia probably interests. We have no evidencesuggestingthe Ukrainian gathered at least some information itcould have released Governmentwas involvedin any of these efforts. in influence operations. We assess Russia did not make persistent efforts to access election infrastructure, such as A networkofUkraine- linkedindividuals— those made by Russian intelligence during the last US including Russian influence agent Konstantin presidential election. Kilimnik who were also connected to the Russian Federal Security Service (FSB) took steps Forexample, shortly afterthe 2018 midterm throughout the election cycle to damage US ties to elections, Russianintelligencecyber actors Ukraine, denigrate President Biden and his attemptedto hack organizationsprimarily affiliated candidacy, and benefit former President Trump's withthe DemocraticParty. Separately, the GRU prospects for reelection . We assess this network unsuccessfullytargetedUS politicalactorsin2019 also sought to discredit the Obama administration and 2020; this activityalignedwith the tactics of a by emphasizing accusations of corruption by US largerintelligence-gatheringcampaign. officials, and to falsely blame Ukraine for interfering in the US presidential election . In late2019, GRUcyber actors conducteda phishingcampaignagainst subsidiariesof Burisma • Derkach, , and their associates sought to holdings, likely in an attempt to gather information use prominent US persons and media conduits to relatedto PresidentBiden'sfamily and Burisma . launder their narratives to US officials and audiences . These Russian proxies met with and Wejudge that Russian cyber operations that provided materials to Trump administration -linked targetedandcompromisedUS stateand local US persons to advocate for formal investigations ; governmentnetworksin 2020 including hired a US firm to petition US officials ; and exfiltratingsomevoter data were probablynot attempted to make contact with several senior US election-focusedandinsteadpartofa broader officials. They also made contact with established campaigntargetingdozens of US andglobal US media figures and helped produce a entities documentary that aired on a US television network in late January 2020 . Throughoutthe electioncycle, Russia's online influenceactors sought to affect USpublic perceptions As part ofhis planto securethe reelectionof ofthe candidates, as well as advanceMoscow'slong formerPresidentTrump, Derkachpubliclyreleased standinggoals ofunderminingconfidence inUS audio recordingsfour in 2020 inattemptsto electionprocessesand increasingsociopolitical implicatePresidentBidenand other current or divisionsamongthe Americanpeople. During the formerUS Governmentofficialsinallegedly presidentialprimariesand datingback to 2019, these corruptactivitiesrelatedto Ukraine. Derkachalso backedcandidatesfrom both major USpolitical workedto initiatelegalproceedingsin Ukraineand partiesthat Moscow viewed as outsiders, while later the USrelatedto these allegations. Former claimingthat election fraud helpedwhat they called Ukrainianofficialsassociatedwith Derkachsought " establishment candidates. Throughoutthe election, to promotesimilarclaimsthroughoutlate2019and Russia'sonline influenceactors sought to amplify 2020, includingthroughdirect outreachto senior mistrustin the electoralprocessby denigratingmail-in US Governmentofficials.

[ 3 ] UNCLASSIFIED UNCLASSIFIED

NIC NATIONAL INTELLIGENCE COUNCIL ballots, highlightingalleged irregularities, and accusing Iranian General Qasem Soleimani in January the Democratic Party of voter fraud. 2020 at odds with Russia's preferences.

The Kremlin -linked influence organization Project LIR, whichprobablyreceivestaskingand strategic Lakhta and its Lakhta Internet Re arch (LIR ) troll direction from the Kremlin , pushed stories farm commonly referred to by its former moniker supporting former President Trump and Internet Research Agency ( IRA ) denigrating President Biden after he became the controversial domestic issues. LIR used social presumptive nominee in April. media personas, news websites, and US persons to deliver tailored content to subsets of the US Evaluating Moscow's Calculus on the 2020 population . LIR established short - lived troll farms Election that used unwitting third -country nationals in We assess that Russianleaders viewed President Ghana , Mexico , and Nigeria to propagate these US -focused narratives, probably in response to Biden'spotentialelection as disadvantageousto efforts by US companies and enforcement to Russianinterests and that this drove their efforts to shut down LIR-associated personas . underminehis candidacy. We have high confidence in this assessment. • Russianstate media, trolls, and online proxies, including those directed by Russian intelligence , Russian officials and state media frequently published disparaging content about President attackedPresidentBidenfor his leadingrole in the Biden, his family, and the Democratic Party, and Obama administration'sUkrainepolicy andhis heavily amplified related content circulating in US supportfor the anti-PutinoppositioninRussia, media , including stories centered on his son. These suggestingthe Kremlinviews himas partof a influence actors frequently sought out US reflexivelyanti-RussiaUS foreignpolicy contributors to increase their reach into US establishment. Putinprobablyalso considers audiences. In addition to election -related content, PresidentBidenmoreapt to echo the of these online influence actors also promoted American exceptionalism, which he andother conspiratorial narratives about the COVID - 19 Kremlinleadershaveoftenpubliclycriticizedas pandemic, made allegations of social media problematicanddangerous censorship , and highlighted US divisions Moscow'srange ofinfluenceactorsuniformly surrounding protests about racial justice . workedto denigratePresidentBidenafterhis Russian online influence actors generally promoted entranceintothe race. Throughoutthe primaries former President Trump and his commentary , andgeneralelectioncampaign, Russianinfluence including repeating his political messaging on the agentsrepeatedlyspread unsubstantiatedor election results; the presidential campaign ; debates ; misleadingclaimsaboutPresidentBidenandhis the impeachment inquiry; and , as the election family'sallegedwrongdoingrelatedto Ukraine. By neared , US domestic crises. Influence actors contrast, duringthe DemocraticprimariesRussian sometimes sought to discourage US left-leaning onlineinfluenceactorspromotedcandidatesthat audiences from voting by suggesting that neither Moscowviewedas outside what it perceivesto be candidate was a preferable option. At the same an anti-Russiapoliticalestablishment. , Russian criticized former President Even after the election, Russianonline influence Trump or his administration when they pursued actorscontinuedto promote foreign policies — such as the targeted killing of narrativesquestioning the electionresults and disparagingPresidentBiden

4 ] UNCLASSIFIED UNCLASSIFIED

NIC NATIONAL INTELLIGENCE COUNCIL

and the DemocraticParty. These effortsparallel andthat sucheffortsare endemic to geostrategic plansMoscowhadinplacein to discredita competition. potentialincomingClinton administration, but which it scrappedafter former PresidentTrump's Russianofficialsprobablyalso assess that victory continuedinfluenceoperationsagainstthe United Statespose a manageablerisk to Russia'simage in We assess Russian leaders preferred that former Washington US-Russiarelations are President Trump win reelection despite perceiving alreadyextremelypoor . some ofhis administration's policies as anti-Russia . We have high confidence in this assessment based in Iran's Influence Campaign Designed to part on the Kremlin's public comments about him and Undercut Former President Trump's the consistency and volume of anti- Biden messaging we Reelection , Sow Discord detected from Russian online influence actors . We assess withhigh confidence that Irancarried out As the electionneared, Kremlinofficialstook some an influence campaign during the 2020 US election steps to preparefor a Bidenadministration, probably season intendedto undercutthe reelectionprospects of becausetheybelievedformerPresidentTrump's former President Trump and to further its prospectsfor re - electionhad diminished. longstandingobjectives ofexacerbatingdivisions in the US, creating confusion, and underminingthe Putin — while praising former President Trump legitimacy of US elections and institutions. We did not personally during an interview in October — noted identifyIranengaging in any election interference that President Biden appeared willing to extend the activities, as defined inthis assessment. Tehran's New START Treaty (NST) or negotiate a new efforts were aimed at denigrating former President strategic offensive reduction treaty . The comments Trump, not actively promotinghis rivals. We assess that were consistent with Russian officials' view that a Tehran designed its campaign to attempt to influence US potential Biden administration would be more policy toward Iran, distract US leaders with domestic open to arms control negotiations. issues, and to amplify messages sympathetic to the Iranian regime. Iran's efforts in 2020 especially its e Moscow almost certainly views meddling in US mails to individual US voters and efforts to spread elections as an equitable response to perceived allegations of voter fraud were more aggressivethan in actions by Washington and an opportunity to both past election cycles. undermine US global standing and influence US decision -making. We assess that Moscow will We assess that Tehran'sefforts to attempt to continue election influence efforts to further its influence the outcomeofthe 2020 US election and longstanding goal of weakening Washington because Iranian officials' preferencethat formerPresident the Kremlin has long deemed that a weakened United Trump not be reelectedwere driven inpartby a States would be less likely to pursue assertive foreign perceptionthat the regimefaced acute threats from and security policies abroad and more open to the US geopolitical bargains with Russia . Iran's election influence efforts were primarily Russian officials are probably willing to accept focused on sowingdiscordin the UnitedStates and some risk in conducting influence operations exacerbatingsocietaltensions— includingby targeting the US — including against US or amplifyingsocial mediacontentthat elections they believe Washington criticizedformer PresidentTrump probably meddles similarly in Russia and other countries becausethey believedthat this advancedIran's

5 ] UNCLASSIFIED UNCLASSIFIED

NIC NATIONAL INTELLIGENCE COUNCIL

longstandingobjectivesandundercuttheprospects for the former President'sreelectionwithout Post -Election Activity provokingretaliation. We assess that Irancontinuesto useinfluence Actors, Methods, and Operations operationsinattemptsto inflamedomestictensions inthe US. Forexample, inmid-December2020, We assess that Supreme Leader Ali Khamenei Iraniancyber actorswere almostcertainly probably authorized Iran's influence campaign and responsiblefor the creationof a websitecontaining that it was a whole of government effort , judging from deaththreatsagainstUSelectionofficials. the involvement of multiple Iranian Government elements. We have high confidence in this assessment. We assess Iran is also seekingto exploitthe post-electionenvironmentto collect Iranfocused its social media and propagandaon intelligence. perceivedvulnerabilitiesin the UnitedStates, includingthe responseto the COVID- 19 pandemic, economic recession, and civil unrest.

Duringthis election cycle Iranincreasedthe volume We assess that Iranian actors did not attempt to andaggressivenessofits cyber- enabledinfluence manipulate or attack any election infrastructure . efforts againstthe UnitedStatescomparedto past electioninfluenceefforts. This includedefforts to send In early 2020 Iranian cyber actors exploited a knownvulnerabilityto compromiseUSentities threateninge-mailstoAmericancitizens and to amplify associatedwith concernsaboutvoter fraudinthe election. electioninfrastructureas a partofa broadtargetingeffortacrossmultiplesectors

. worldwide. Given thebreadthandnumberofthe Ina highlytargetedoperation Iraniancyber actors sent threatening, spoofedemailspurportingto be targets, wejudgethat Irandidnotspecifically from the ProudBoysgroupto Democraticvotersin intendto usethe resultsofthis effortas partofits multipleUSstates, demandingthat the individuals electioninfluencecampaign. changetheirpartyaffiliationandvoteto reelect We assessthat Iranprimarilyreliedon cybertoolsand formerPresidentTrump. The sameactorsalso methodsto conductitscovertoperationsbecausethey producedanddisseminateda videointendingto demonstrateallegedvoter fraud. are lowcost, deniable, scalable, anddo notdepend on physicalaccessto the UnitedStates. Iraniancyber Since early 2020, Iranian actors created social actorswho focusedon influenceoperationstargetingthe mediaaccountsthat targetedthe UnitedStatesand electionadaptedtheir activitiesandcontentbasedon publishedover 1,000piecesofonlinecontenton politicaldevelopmentsandblendedcyber intrusionswith the UnitedStates, thoughUSsocialmedia online influenceoperations. companiessubsequentlyremovedmany. Tehran expandedthe numberofits inauthenticsocial As partof their influence operations, Iraniancyber actorssoughtto exploitvulnerabilitieson US mediaaccountsto at least severalthousandand states' electionwebsites, as well as newswebsite boostedthe activityofexistingaccounts, some of whichdatedbackto 2012. contentmanagementsystems.

Iraniancyber actors sent spearphishingemails to currentandformersenior officials and membersof politicalcampaigns, almostcertainlywiththe

[ 6 ] UNCLASSIFIED UNCLASSIFIED

NIC NATIONALINTELLIGENCECOUNCIL

intent to gain derogatory information or accesses preference for stability in the bilateral relationship, for follow on operations. their probable judgment that attempting to influence the electioncould do lastingdamage to US- China ties, ChinaDidNotAttemptto Influence andbelief that the election of either candidate would PresidentialElectionOutcome present opportunities and challenges for China.

We assess that China did not deploy interference We judge that Chinese officials would work with efforts and considered but did not deploy influence former PresidentTrump ifhe won a second term . efforts intended to change the outcome ofthe US Beijingsince at least 2019 has stressedthe needto presidential election . We have high confidence in this improvebilateralties afterthe election regardlessof judgment China sought stability in its relationship with whowon the United States and did not view either election outcome as being advantageous enough for China to risk Inaddition, China was probablyconcernedthe blowback if caught . Beijing probably believed that its UnitedStates would use accusationsofelection traditional influence tools, primarily targeted economic interferenceto scapegoatChina. Thismayinpart measures and lobbying key individuals and interest accountfor Beijingwaitinguntil 13 Novemberto groups , would be sufficient to achieve its goal of shaping congratulatePresidentBiden. US policy regardless ofwho won the election . We did We assess that Beijing also there is a not identify China attempting to interfere with consensus against China inthe United election infrastructure or provide funding to any bipartisan candidates or parties. States that leaves no prospect for a pro - China administration regardless of the election outcome. The IC assesses that Chinese state media criticism of the Trump administration's policies related to China probably expected that would suffer China and its response to the COVID - 19 pandemic under a second term for former President Trump because remained consistent in the lead-up to the election he and his administration would press for further and was aimed at shaping perceptions of US economic decoupling and challenge China's rise. It policies and bolstering China's global position probably also believed that China in this scenario could increase its international clout because it perceived that rather than to affect the 2020 US election . The some ofthe Trump administration's policies would coverage of the US election , in particular , was limited compared to other topics measured in total alienate US partners. volume of content. Beijingprobablyexpectedthat PresidentBiden Chinahas longsoughtto influenceUS politicsby wouldbe more predictableand eagerto initially deescalatebilateral but would shapingpoliticaland socialenvironmentsto press tensions pose a the long run becausehe US officialsto supportChina'spositionsand greater challengeover wouldbe more perspectives. We didnot, however, see these successfulin mobilizinga global allianceagainstChinaandcriticizingChina's capabilitiesdeployedfor the purposeofshapingthe electoraloutcome. humanrights record.

judgedthat Russia'sefforts to Beijing probably judged risk of interference was Beijingprobably not worth the reward interfere in the 2016 electionsignificantlydamaged Moscow'spositionandrelationshipwiththe We assess that Beijing's risk calculus against UnitedStatesandmay haveworried that influencingthe election was informed by China's Washingtonwoulduncovera Chineseattemptto

[ 7 ] UNCLASSIFIED UNCLASSIFIED

NIC NATIONAL INTELLIGENCE COUNCIL

deploy similar measures to influence or interfere in the election and punish Beijing. some and later increased election influence efforts , especially over the summer of 2020. The Beijingprobably continued to collect intelligence NIO assesses these indications are more persuasive on election-related targets and topics than other information indicating that China decided not to intervene . The NIO further assesses China probably also continued longstanding efforts to that Beijing calibrated its influence efforts to avoid gather information on US voters and public opinion ; blowback political parties , candidates and their staffs ; and senior government officials. We assess Beijing probably sought to use this information to predict electoral outcomes and to inform its efforts to influence US policy toward China Other Actors under either election outcome, as it has during all election cycles since at least 2008 and considers an A range of additionalforeign actors took some steps to acceptable tool of statecraft . attemptto influencetheelection. Ingeneral, we assess thatthey were smaller inscale than those conductedby We assess Beijingdid not interferewithelection Russiaand Iran infrastructure, includingvote tabulationor the transmissionofelectionresults. We assess that HizballahSecretaryGeneralHassan Nasrallahsupportedefforts to undermineformer PresidentTrumpinthe 2020USelection. Nasrallah MinorityView probablysaw this as a low -cost meansto mitigatethe The National Intelligence Officer for Cyber assesses risk ofa regionalconflictwhileLebanonfaces political, that China took at least some steps to undermine financial, andpublichealthcrises. former President Trump's reelection chances, We assess Cuba sought to undermine former President primarily through social media and official public Trump's electoral prospects by pushing anti statements and media . The NIO agrees with the IC's Republican and pro -Democrat narratives to the Latin view that Beijing was primarily focused on American community . Cuban intelligence probably countering anti- China policies, but assesses that conducted some low - level activities in support ofthis some of Beijing's influence efforts were intended to effort at least indirectly affect US candidates , political processes, and voter preferences , meeting the The Venezuelan regime of Nicolas Maduro had an for election influence used in this report. adversarial relationship with the Trump The NIO agrees that we have no information administration and we assess that Maduro had the suggesting China tried to interfere with election intent, though probably not the capability , to try to processes . The NIO has moderate confidence in influence public opinion inthe US against the former these judgments President. We have no information suggesting that the current or former Venezuelan regimes were involved in This view differs from the IC assessment because it attempts to compromise US election infrastructure . gives more weight to indications that Beijing preferred former President Trump's defeat and the Foreign Cybercriminals Disrupted Some Election election ofa more predictable member ofthe Preparation establishment instead, and that Beijing implemented

[ UNCLASSIFIED UNCLASSIFIED

NIC NATIONAL INTELLIGENCECOUNCIL

Profit -motivated cybercriminals disrupted election InOctober, a hacker briefly defaced a presidential preparations in some US states with ransomware campaign website after gaining access probably attacks intended to generate profit. We have no using administrative credentials. indications that these actors sought to use these attacks to alter election functions or data , nor do we have indications that they were acting on behalf of any government .

For example , in late October , probably foreign ransomware actors demanded payment from a New York county after encrypting 300 computers and 22 servers on the network with Ragnarok malware that prevented it from connecting to a statewide voter registration system . County officials directed voters who had applied via email for an absentee ballot to call and verify their ballot application had been received and processed .

We do not knowwhethercybercriminals specifically targeted election -related networks with profit-making schemes or whether their activity reflected a general targeting of state and local government networks that also happen to host election -related processes.

We assess foreigncybercriminalsprobablydid not work to interfereor influencethe US electionson behalfofor at the directionofa nation state. We havelow confidencein this assessment. We assess that somecybercrimegroups probablyoperatewith at least the tacitapprovaloftheir nationstate hosts.

Foreign Hacktivists

The IC tracked a handful of unsuccessful hacktivist attempts to influence or interfere inthe 2020 US elections.

• In November, hackers promoting Turkish nationalist themes breached and defaced a website previously established for a candidate in the US presidential campaign , according to US cybersecurity press.

9 ] UNCLASSIFIED UNCLASSIFIED

EstimativeLanguage Estimative consists of two elements: judgment about the likelihood of developments or events occurring and levels ofconfidence in the sources and analyticreasoning supporting the judgments. Judgments are not intended to implythat we have proofthat shows something to be a fact. Assessments are based on collected information, which is often incomplete or fragmentary, as well as , argumentation and precedents.

Judgments of Likelihood The chart below approximates how judgments of likelihood correlate with percentages. Unless otherwise stated , the Intelligence Community's judgments are not derived via statistical analysis. Phrases such as “we judge ” and " we assess terms such as “ probably and “ likely" analytical assessments .

Almost Vary Almost nochance unlikely Unlikely Roughly even chance Likely likely certainly

20 40 60 80 100

Highly Highly Nearly Remote improbable Improbable Roughly even odds Probable probable

Confidence in our Judgments Confidence levels provide assessments oftimeliness, consistency, and extent of intelligence and open source reporting that supportsjudgements. They also take into account the analyticargumentation, the depth of relevant expertise, the degree to which assumptions underlie analysis, and the scope of information gaps.

We ascribehigh, moderate, or low confidenceto assessments:

Highconfidencegenerally indicatesthat judgments are based onsound analytic argumentationand high consistent reportingfrom multiplesources, includingclandestinely obtaineddocuments clandestine and open source reporting, and in -depth expertise; it also indicatesthat we have few intelligencegaps, have few assumptionsunderlyingthe analytic line, have found potential for deceptionto be low , and have examinedlong-standinganalytic judgements heldby the ICand considered alternatives. For most intelligence topics, it will notbe appropriateto claim highconfidencefor judgements that forecast out a number ofyears. Highconfidence in a judgment does not implythat the assessment is a fact or a certainty suchjudgments mightbe wrong even though we have a higher degree ofcertaintythatthey areaccurate.

Moderateconfidencegenerallymeansthat the informationis crediblysourcedandplausiblebutnotof sufficientqualityor corroboratedsufficientlyto warranta higherlevelofconfidence. Theremay, for example, be informationthat cuts ina differentdirection. We have in -depthexpertiseon the topic, butwe may acknowledgeassumptionsthatunderlieour analysisandsomeinformationgaps; theremaybeminoranalytic differenceswithinthe IC, as wellas moderatepotentialfor deception.

Lowconfidencegenerally means that the information'scredibilityand/ orplausibilityis uncertain; that the inforationis fragmented, dated, or poorly corroborated; orthat reliabilityofthe sources is questionable There may be analytic differenceswithin the IC, severalsignificantinformationgaps, potentialfor deceptionor numerousassumptionsthat must be madeto draw analyticconclusions. Inthe caseoflowconfidence, we are forced to use current data to project out intime, makinga higher levelofconfidenceimpossible.

10 ] UNCLASSIFIED