Malign Influence During the 2022 US Midterm Elections

Editor’s Note: To read the entire analysis with footnotes, click here to download the report as a PDF.

This report establishes a baseline and forward-looking assessment of potential malign influence against the 2022 United States (US) midterm elections from primary nation-state adversaries Russia, China, and Iran. It also assesses disruptive influence and election security threats from US domestic extremists. This report will be of most interest to US federal, state, and local government officials, election security practitioners, journalists, other related industry professionals, and US citizens seeking a preliminary assessment of both the nation-state and domestic malign influence threats to the 2022 US midterm election cycle.

Executive Summary

As noted by the US Intelligence Community’s declassified March 2021 assessment of foreign threats to the 2020 US election cycle, it is not uncommon for foreign governments and nation-state actors to attempt to influence the political landscape and policies of other countries, particularly adversaries or perceived adversaries. In our view, this observation has not changed. Rather, in 2022, such behavior has likely only intensified against the backdrop of conventional and hybrid warfare in Ukraine, broad international ramifications of said conflict, lingering effects of a global pandemic, and a broadening distrust in traditional democratic institutions.

Russian influence capabilities have very likely deteriorated as a result of the nation’s war against Ukraine. However, the Russian government likely views US electoral interference and voter influence as an appropriate response to the US’s defensive military support of Ukraine and the international isolation of Russia’s economy. Russian influence networks are almost certainly attempting to manipulate US public opinion by sowing discord around divisive US political and societal affairs as well as Americans’ overall confidence in US institutions.

China’s state-sponsored influencers are almost certainly conducting malign influence operations targeting English and Chinese speaking US audiences with divisive political multimedia content on social media. This recent activity signifies a shift in tactics from previous US elections, where China’s influencers were less active in attempts to influence US voters. Furthermore, Recorded Future believes that China’s “wolf warrior” influencers are very likely to continue their narrative campaign on democracy, an effort to position China as a more responsible global leader than its Western democratic counterparts. Meanwhile, China is likely to conduct malign interference efforts against congressional candidates and members who are outspoken opponents of the Chinese Communist Party (CCP) and who support policies that will negatively affect China, as has already been observed in 1 instance.

The magnitude of Iran’s malign influence operations against the US midterm elections will likely be affected by progress on renewing the Joint Comprehensive Plan of Action (JCPOA; Iran nuclear deal) prior to November 8, 2022. At a minimum, we expect Iran to conduct limited malign influence activities focused on increasing US domestic polarization. Finally, US domestic extremists, fringe sources, and prominent individuals are very likely to engage in malign influence efforts to undermine various elements of the US midterm elections, such as challenging the veracity and integrity of free and fair elections, and especially the infrastructure used to conduct elections, through the use of misinformation and disinformation.

Key Judgments

• Russian-directed influence operations are almost certainly attempting to manipulate US public opinion by sowing discord with regard to US political and societal affairs as well as Americans’ overall confidence in US democratic institutions. For example, we are almost certain that known networks associated with the Russian Internet Research Agency (IRA, Lakhta Internet Research, LIR) are engaging in covert malign influence on a subset of the US population.
• The war in Ukraine has very likely imposed significant costs on the strength, capabilities, and reach of both overt and covert Russian influence networks. Despite this, we believe that influence operations at the coordination and direction of Russian intelligence services almost certainly remain an innovative, resourceful, and ultimately a formidable challenge to US election integrity and the democratic process.
• China’s state-sponsored influencers, such as “wolf warrior” diplomats, political pundits, and inauthentic accounts are almost certainly conducting malign influence operations targeting English and Chinese speaking US audiences with divisive political content on social media. This recent activity signifies a shift in tactics from previous US elections, where China’s influencers were less active in attempts to influence US voters.
• We believe that China’s malign interference activities, including harassment, surveillance, and physical threats, will likely target congressional candidates and members who are outspoken opponents of the CCP and legislators who support policies that will negatively affect China. Observed attempts by China to directly interfere in the US midterm elections thus far are limited to a single reported incident targeting a Chinese dissident who was running for a New York congressional seat.
• Iran’s malign influence against the US midterm elections will likely be conducted at a scale and scope to support a favorable Iranian outcome to ongoing negotiations surrounding the renewal of the JCPOA, while maintaining long-term efforts to increase US domestic social polarization in order to erode trust and confidence in the US democratic system.
• Ongoing legal scandals concerning high-profile partisan figures are very likely to galvanize domestic extremist groups in undermining the legitimacy of the US midterm elections, with narratives designed to cast doubt on local, state, and federal electoral processes. Domestic security authorities warn that such narratives have the potential to result in acts of violence and/or physical intimidation of election officials, poll workers, and candidates.

Russia

The Russian government likely views electoral interference and voter influence ahead of the US midterm elections as an appropriate response to the US’s defensive military support to Ukraine and to US participation in unprecedented international sanctions that have isolated Russia and heavily damaged its economy. Further, malign influence against the US midterm elections, consistent with interference in previous election cycles, remains 1 of many methods the Kremlin will likely employ as part of a persistent attempt to undermine and embarrass the US on the world stage. Interfering in the democratic electoral process of sovereign and democratic nations is consistent with the Russian government’s desire to fracture and degrade the US-led, post-World War II, international rules-based order in hope of replacing it with their vision of a multipolar world where Russia is a key player.

Malign Political Influence Activity

Russian influence networks (including state-controlled media, known covert intelligence outlets, and known propaganda and disinformation amplifiers) are almost certainly attempting to manipulate US public opinion by sowing discord around divisive US political and societal affairs as well as Americans’ overall confidence in US institutions. Among these activities, Russian propaganda networks are almost certainly going to continue to amplify fringe, extremist, and controversial US-domestic voices as part of the Russian government’s overall influence strategy. In addition, covert Russian sources are likely to continue to seek out unwitting US citizens to launder mis-, dis-, and malinformation in alignment with Russian propaganda objectives. These activities include the commissioning of divisive images and memes, article publications, and the planning, funding, and facilitating of physical demonstrations by provoking potential violence among different societal groups and fringe actors, consistent with recent and historic malign influence activities.

Specific areas of emphasis that have been observed to date include the following, which are likely to be amplified by Russian state media networks, covert media sources, amplifiers, and malign actors online and in person:

• Exploit ongoing US economic uncertainty in areas such as fuel prices and inflation.
• Stoke internal division across several key societal issues that are likely to be a focal point for voters, including LGBTQ+ and minority equity and equality rights, education, abortion and reproductive rights, secessionism, and first and second amendment rights.
• Stir distrust toward the integrity of election infrastructure and voting systems, and challenge the legitimacy of democratically elected leadership.

Renewed Influence by IRA-Associated NAEBC

We are almost certain that personas linked with the Internet Research Agency (IRA)-associated Newsroom for American and European Based Citizens (NAEBC) are coordinating renewed attempts to engage in malign influence targeting US conservative audiences ahead of the 2022 US midterm elections via alternative social media platforms. In 2020, the Federal Bureau of Investigation (FBI) reportedly assessed NAEBC to be an organization run by individuals associated with the Russian IRA. While active, NAEBC masqueraded as a far-right news publication targeting similar audiences on Gab and exploited US-based freelance journalists to contribute to its divisive messaging efforts, most likely without their knowledge of the campaign’s intent. According to Reuters, such writers were purportedly paid between $50 and $75 USD per article.

• “Nora Berka”, a known NAEBC inauthentic persona, has reemerged on Gab after a year-long absence. Since restarting the account on August 23, 2022, Nora Berka has actively posted and reshared content related to the war in Ukraine, Western defensive support of Ukraine, US politics and the US economy, and the integrity of US elections. In almost all cases, Nora Berka maintains a highly negative stance toward the policies of US President Joe Biden, with a clear preference for former President Donald Trump as well as sitting Republican US Representatives and candidates for state offices (notably Kari Lake, candidate for governor of Arizona). Comments posted by the persona further maintain that the result of the 2020 election was fraudulent. Occasionally Nora Berka publishes original content, but we have found that the account also often recycles or reshares content published elsewhere, including on conservative news sources and social media.

Figure 1: Examples of content shared by the NAEBC persona Nora Berka on Gab in September 2022 (Source: Gab)

• Between mid-2021 and early 2022, we tracked PaulPedhoven, an account registered on the far-right forum patriots[.]win (formerly thedonald[.]win), who we assess is almost certainly linked to influence actors associated with the NAEBC following initial coverage of the persona from Graphika in June 2021. While active, the account was a highly prolific forum member posting politically divisive cartoons that garnered thousands of engagements per post. Per our data, the PaulPedhoven persona went dormant in January 2022. On September 14, 2022, however, our data indicated that the persona reemerged on patriots[.]win, resharing content critical of the Biden administration’s economic policies and the safety of COVID-19 vaccines.
• In August 2021, another account handler almost certainly associated with the NAEBC network, highlighted in Graphika’s analysis, established a presence on the far right-favorited social media platform Gettr using the handle @SchmitzOfficial. We note that the name of the account, “Schmitz Cartoons”, reflected cartoons penned with the name “Schmitz” and shared by PaulPedhoven and other known NAEBC personas, including “Alex Duncan” on Gab. Between August and December 2021, “Alex Duncan” also rebranded their Gab profile to “Schmitz Cartoons”. Both Gettr and Gab accounts ceased operations in December 2021 and remain inactive as of September 2022. During its time on Gettr, Schmitz Cartoons garnered over 1,500 followers on the platform.
• A September 2022 assessment by Mandiant on mid-2022 posting activity from known NAEBC personas “Niels Holst” and “Alan Krupka”, originally identified by Graphika in 2020, supports our assessment that this network supports our assessment that this network has restarted its operations in an effort to conduct malign influence activity ahead of the US midterm elections.

Figure 2: Examples of content shared by NAEBC personas Schmitz Cartoons on Gettr (Top) and PaulPedhoven on Patriots[.]win (Bottom) (Source: Gettr and Patriots[.]win)

Targeting of the Russian and Eastern European Diaspora in the US

Members of the Russian and Eastern European diaspora in the US are increasingly likely to be a target of malign influence before the November midterms. In the event of specific targeting against this demographic, we would expect to see instances of discouraging eligible voters from participating in the election and using specifically targeted mis-, dis-, and malinformation provoking animosity toward the US and other demographics. This can manifest as threats of violence or harassment and intimidation tactics that utilize multilingual Russian speakers to launder malign government-directed influence narratives.

• In a recent interview with Sputnik News Russia, 1 employee of the pro-Russian troll network Cyber Front Z called for efforts to reach members of the Russian diaspora, embrace Russian nationalism, and unite under the Russian flag. The interviewee cited a “whole, ready-made diaspora, who is ready to carry out our intentions and show by their own example what the ‘Russian world’ really is”, adding that, “it is necessary to work in concert with them, and of course it is necessary to support them and direct additional finances to them”.
• News Front, a publication under the direction of the Russian Federal Security Service (FSB), published an article in April 2022 calling for Russians living abroad to “return to Russia”, citing “unprecedented” Russophobia and “the cultivation of hatred for people — for Russians in the broadest sense of the word” that has “become completely open and widespread”, and claiming that Russians abroad are viewed as “inferior”.
• A recent RT documentary published on Odysee titled “Russophobia: History of Hate” claims that “modern Russophobia seems linked to US policy”, and suggested that increased allegations of discrimination against ethnic Russians abroad is the fallout for what is viewed by Russia as an intervention in Ukraine.
• The Russian Main Intelligence Directorate’s (GRU’s) 72nd Main Intelligence Information Center (GRITs, aka Military Unit 54777) reportedly maintains several front organizations specializing in appealing to Russian diaspora audiences, such as the Institute of the Russian Diaspora, World Coordinating Council of Russian Compatriots Living Abroad, and the Foundation for Supporting and Protecting the Rights of Compatriots Living Abroad. In specific influence operations targeting members of the Russian diaspora, we would expect Russian intelligence services to utilize these existing entities, rather than attempt to establish new organizations with poor name recognition.

Figure 3: (Left) An RT interview with political analyst Dmitry Babich on “Russophobia: History of Hate”, in which Babich alludes to the US and US policy as sources of discrimination against ethnic Russians; (Right) In June 2022, FSB-directed outlet Southfront published an article referencing a “deep crisis” and “extreme” divisions in the US that purportedly provoke near-future Texas secessionist movements, saying that “the die is cast” (Source: Odysee and Southfront)

Cyber-Enabled Influence Operations

In our assessment of the 2022 election cycle, we have not observed evidence of successful Russian cyber-enabled influence operations (such as hack-and-leak or hack-and-fake campaigns) to the degree of impact in 2016 on the Democratic National Committee (DNC) and Democratic Congressional Campaign Committee (DCCC). We assess that Russian nation-state threat actors are very likely keen on probing and potentially accessing the infrastructure of political and governmental organizations for purposes of cyber espionage and cyber-enabled influence activities. In the event of a successful intrusion as part of a hack-and-leak effort, responsible Russian threat actors, presumably from Russian intelligence services, would likely wait to disseminate materials from the incident until the election draws closer in hope of having maximum impact (such as an October surprise).

Impact of Russia’s War Against Ukraine

Russia’s war against Ukraine has very likely imposed significant limits on the strength, capabilities, and reach of both overt and covert Russian influence networks. Despite this, we believe that influence operations at the coordination and direction of Russian intelligence services almost certainly remain an innovative, resourceful, and ultimately a formidable challenge to US election integrity and the democratic process.

• Since the start of the war in Ukraine, it is very likely that military intelligence influence networks were forced to shift priorities, including engaging in defensive attempts to counter Western news and influence, maintain control of domestic news and media war coverage, and both monitor and control discussion of the war within Russia. Reallocating resources to meet these domestic information challenges is likely impeding Russia’s ability to coordinate and successfully carry out offensive information operations internationally.
• Within Russian military intelligence and state security services, significant personnel changes likely resulting from high turnover, coupled with micromanagement from most senior levels of leadership and heavy battlefield casualties (material and personnel), very likely impede Russia’s regularly strong capability to conduct meaningful and effective information operations.
• The banning and “deplatforming” of Russian state-controlled media, as well as known covert publication sources in Western social media platforms, have almost certainly degraded Russia’s ability to infiltrate foreign audiences in the US. Since the start of the war in Ukraine, RT America, for example, ceased operations in March 2022 and popular social media companies have ceased to show or otherwise “demoted” content from accounts linked to Russian state media. In response, Russian state-sponsored media sources have migrated to “alternative” social media platforms, which results in far fewer viewers but provides an opportunity to microtarget individuals with political and ideological beliefs aligned with the missions of these alternative sources.
• Furthermore, we have found that Russian state media, with a clear goal of reaching both Latin American and European audiences, are in the process of diversifying existing infrastructure in the likely hope of circumventing social media bans and improving online engagement with local target audiences. For example, Russian state media are diversifying existing infrastructure through the registration of alternative website domains — website “mirrors” — and are increasingly using country code Top Level Domains (ccTLDs) within existing infrastructure.
• As existing Russian influence networks are already hindered by many of the above points, it is increasingly likely that propaganda and disinformation networks will rely more than ever on amplifying existing, rather than simply creating, divisive content and voices within the US.

Figure 4: A sampling of mentions referencing articles and links to alternative Sputnik News web domains since February 24, 2022. Beginning on the week of August 1, 2022, local and regional Sputnik News social media accounts that align with these domains’ respective ccTLDs began using these domains exclusively. (Source: Recorded Future)

China

China’s state-sponsored influencers, such as “wolf warrior” diplomats, state media journalists, political pundits, and inauthentic accounts, are actively conducting malign influence operations targeting English and Chinese-speaking US audiences with divisive political content on social media. The content is derived from authentic news and interviews, but amplifies divisive political themes that are sensitive to US voters. This recent activity signifies a shift in tactics from previous US elections, where China’s influencers were less active in attempts to influence US voters. Furthermore, Recorded Future believes that China’s wolf warriors are very likely to continue their narrative campaign on democracy, highlighting perceived weaknesses and divisions with US democracy and suggesting that China’s “whole-process democracy” is a more holistic model of democratic governance. Finally, we believe that the CCP is likely to attempt to manipulate US state, local, and business leaders to support Beijing-friendly policies and advance CCP geopolitical interests through political donations, incentives, and coercion stemming from malign cyber intrusions operations.

We believe that China’s malign interference activities, including harassment, surveillance, and physical threats, will likely target congressional candidates and members who are outspoken opponents of the CCP, support policies that will negatively affect China, or have anti-China platforms. This is even more likely if the targets are of Chinese heritage or have lived in China before. As of the time of this writing, Recorded Future has identified only 1 known instance of this type of interference.

Malign Political Influence Activity on Social Media

China’s state-sponsored influencers are almost certainly conducting malign influence operations targeting US voters with divisive political themes in an attempt to further divide American voters over key political issues in the US midterm elections. China likely views electoral interference and voter influence ahead of the US midterm elections as an appropriate response to the US’s perceived interference with Taiwan. In August 2022, US House Speaker Nancy Pelosi and a congressional delegation visited Taiwan, which China’s Ministry of Foreign Affairs (MoFA) strongly condemned and attributed to the further breakdown in relations between the US and China. While the majority of US-related propaganda targeting congressional candidates is directly critical of Pelosi and her Taiwan visit, Recorded Future discovered a notable influence campaign by China’s influencers targeting English and Chinese speaking audiences in Western social media amplifying divisive political issues in the US.

China Shifts Tactics to Target US Audiences on Social Media with Divisive Political Content

In September 2022, Recorded Future discovered a malign political influence campaign conducted by China’s state-sponsored influencers targeting English and Chinese language audiences across several mainstream social media platforms including Facebook, Instagram, Tiktok, Douyin, YouTube, and others. Videos, memes, images, news stories, interviews, and multimedia montages are being shared by influencers across platforms using hashtags and English and Chinese language closed captions. Many of the videos are also accompanied by questions that prompt audiences to participate in discussion and post responses. Recorded Future found that the majority of the comments and responses to the videos are populated by likely inauthentic accounts sharing anti-US and anti-West sentiment, criticism of US politicians, and debate over highly divisive political topics. Many of these appear to criticize both the Republican and Democrat parties and promote extreme views on both sides.

A single video program called Pacific Dialogue (对话太平洋) serves as the main source of the multimedia content being shared in this campaign. Pacific Dialogue began in 2017 as a short video series launched by Beijing Weekly (北京周报社), an English language weekly managed by the China Foreign Languages ​​Publishing Administration (CFLPA; 中国外文出版发行事业局). The CFLPA, also known as China International Communications Group (CICG, 中国国际传播集团) and China International Publishing Group (CIPG; 中国国际出版集团), is managed by the CCP Central Committee’s Propaganda Department.

Figure 5: Pacific Dialogue’s Douyin account is the central repository for over 600 propaganda videos featuring Westerners criticizing the US (Source: Douyin)

Pacific Dialogue’s account on Douyin, China’s version of Tiktok, appears to be a central repository for over 600 videos, which are then shared by Chinese officials, diplomats, and media pundits to TikTok, YouTube, Facebook, Instagram, Weibo, and other social media with English and simplified Chinese language captions and scripts. The Pacific Dialogue media features several narrative themes including criticism of the US government, foreign policy, political actors, economic policies, sanctions, and society. Most of the videos are compilations of news segments, talk shows, interviews, and photos discussing US political wedge issues, criticizing the US system of governance, and likely aiming to make the US and its politicians look bad.

The volume of engagements (likes, comments, shares) with the content varies by platform. Douyin and Tiktok represent the largest volumes of engagements, ranging from hundreds of likes to hundreds of thousands of likes per video. The most popular video segments feature celebrities, talk shows, and presentations that amplify China’s criticism of the US. For example, a press conference of an NBA basketball coach emotionally appealing to Republican lawmakers to pass gun control laws; a speech by a professor at the University of Chicago blaming the West for inciting the invasion of Ukraine; US Senator Bernie Sanders recalling instances when the US allegedly took part in overthrowing foreign governments for the US’ interest; and Stephen Colbert interviewing Tulsi Gabbard about China and Russia possibly filling gaps in global policing if the US withdraws.

Figure 6: Pacific Dialogue on Tiktok increasingly features politically divisive themes, accompanied by hashtags for easy searching and tracking (Source: Tiktok)

Beyond the Pacific Dialogue content, China’s influencers have been sharing other content on topics that are sensitive to US voters in the midterm elections and are likely being amplified to further divide Americans on key domestic and foreign issues. Examples of these narratives include:

• The fall of the US dollar
• US economic decline
• US providing assistance to Ukraine
• Conflicts within the Republican party over Donald Trump’s role and future
• US treatment of refugees
• US treatment of immigrants
• Decline of US influence in the world
• Racial injustice and police brutality
• Gun laws and mass shootings
• Abortion laws
• The threat of fascism in the current US political climate
• Homelessness in the US
• Over 1 million COVID-19 deaths in the US
• Suggesting that the UK and US are decoupling
• Christian nationalism
• January 6 and domestic extremism
• Racism and the history of slavery
• History of involvement in wars overseas
• US-China technological decoupling

Criticism of US Congress and Retaliation to Pelosi’s Visit

The CCP prioritizes protecting its own interests, including territorial sovereignty and claims to Taiwan. The highest volume of recent Chinese propaganda pertains to tensions with the US over House Speaker Nancy Pelosi’s August 2022 visit to Taiwan. Recorded Future noted a sharp increase in mentions of Nancy Pelosi in Chinese overt influence sources in the days following the Taiwan visit, which have since nearly returned to pre-visit levels. Throughout 2022, Recorded Future has observed low level chatter from Chinese overt influence accounts related to US congress members (Figure 7). Those instances addressed specific congress members such as Andre Carson for his criticism of CCP policies and Tammy Duckworth for her official visit to Taiwan.

Figure 7: A sample of mentions of US Congress members or candidates in China’s overt influence accounts from August 2021 to September 2022 (Source: Recorded Future)

In early August 2022, when US House Speaker Nancy Pelosi took an official delegation to Taiwan, Chinese influencers dramatically increased criticism and threats of Pelosi in social media and state news media.

Figure 8: A timeline of mentions of “Nancy Pelosi” in China’s overt influence accounts surrounding her visit to Taiwan on August 2, 2022 (Source: Hamilton Dashboard)

Criticism included calling the visit “unnecessary”, “provocative”, and “wreckless”, accusing Pelosi of stoking cross-strait tensions and of conducting the trip for personal gain due to her husband’s investments in Taiwanese chip manufacturing company Nvidia. A state-sponsored op-ed piece insists that the US is intentionally stoking tensions between the PRC and Taiwan prior to the US midterm elections in an attempt to appear tough on China and win votes.

Figure 9: A cartoon by Cai Meng depicts Uncle Sam representing the US, remotely controlling Nancy Pelosi to drop fuel on a fire labeled “Taiwan Question” (Source: China Daily)

China’s MoFA repeatedly addressed Pelosi’s Taiwan visit in regularly scheduled press conferences throughout the beginning of August, calling the visit a “a provocation and infringement on China’s sovereignty and territorial integrity”, and accusing it of “distorting, altering, obscuring, and hollowing out the one-China principle”. On August 3, 2022, MoFA spokeswoman Hua Chunying criticized the Taiwan Relations Act, calling it “unilaterally concocted”, also commenting that the US removed key phrasing such as “Taiwan is part of China” from the State Department website. Hua went on to emphasize a series of US actions that have worsened tensions between China and the US: “The US has also brazenly sought to upgrade US-Taiwan exchanges, intensify arms sales to Taiwan and embolden the ‘Taiwan independence’ separatist activities”. In an August 9, 2022 social media post, Hua combined messages to attack Pelosi and US democracy, stating “Is this the kind of democracy #Pelosi has been advocating around the world? Why not show more care about her own people and spend more time in improving her own constituency?” alongside photos of homeless people living on the streets in Nancy Pelosi’s California 12th district. At the time of this writing, the post has over 2,400 likes and over 600 shares.

PRC state-sponsored influencers often refer to foreign media when amplifying key narratives. For example, on August 18, Chinese diplomat Zhang Meifang posted a screenshot of an Aljazeera English language video interview with Ambassador Qin Gang, stating that he was “heartened to see many people in US govt not supporting #Pelosi's #Taiwan visit.” On August 12, PRC Ambassador Deng Xijun shared a Jakarta Post piece that he wrote, claiming ''#Pelosi's visit reveals #US true intentions'' and that his article will “help readers know more of #Taiwan question &US [sic] containment of #China by playing ‘'Taiwan card's’”. The same influencers often refer to Chinese state media articles that reinforce China’s stance and accuse the US of spreading disinformation about China. On August 26, the Mission of China to the EU stated “The US has been pushing disinformation to confuse right & wrong & confound black & white, trying to mislead the world about the #Taiwan question”, with a link to an article stating “11 facts about #Pelosi's visit to Taiwan”. The article, written by state-sponsored Xinhuanet, makes 11 statements of China’s stance on the Pelosi visit to Taiwan and outlines the ways in which they believe the US was at fault for the resulting geopolitical escalations.

China’s Narrative War on Democracy Very Likely to Persist through 2022 Elections

China’s top influencers, such as diplomats and “global stringers” (China’s state-sponsored foreign social media influencers), are likely to continue their narrative campaign on democracy as well. In December 2021, Recorded Future reported on a large-scale, China state-sponsored overt influence campaign targeting global audiences with anti-US messages related to democracy and democratic authority. The narrative highlighted perceived weaknesses of US democracy in the aftermath of the January 6 insurrection at the US capitol and suggested that China’s “whole-process democracy” is a more holistic model of democratic governance. Throughout 2022, we have observed sporadic mentions of China’s “#whole-process democracy” in Chinese state-sponsored news outlets and social media accounts. We believe that although this campaign does not target the US’ internal election processes, it is an attempt to undermine American leadership on the global stage.

When coupled with US internal political division over the integrity of elections, this narrative has the potential to be disruptive to elections. We continue to observe “#democracy” trend in social media posts from China’s most fierce critics of American democracy. For example, on September 20, 2022, Zhao Lijian, a spokesperson for MoFA, posted, “What is American #democracy? The majority speaks, but no policymaker listens. #US #Princeton”, quoting a Princeton study without a citation or source to the study itself. An image shared with the social media post says, “Opinions of the bottom 90% of income earners in the US have a statistically near 0 impact on public policy”. These types of social media narratives are very likely aimed at both international and US audiences, the latter of which is losing faith in the US democratic system. A 2021 Pew Research poll revealed that 58% of Americans are unsatisfied with the way US democracy is working. In the same survey, 85% of Americans believe that the US political system either needs major changes (43%) or needs to be completely reformed (42%). Chinese influencers continue to attack US democracy through malign social media influence campaigns in an effort to worsen the divide between Americans. This narrative attack on Western democracy has continued throughout 2022 at a very low volume and will very likely persist during and after the US midterm elections.

Malign Interference Activity

Observed attempts by China to directly interfere in the US midterm elections thus far is limited to a single reported incident targeting a Chinese dissident who was running for a New York congressional seat. In March 2022, the US Department of Justice (DOJ) announced criminal charges against 5 agents of the People’s Republic of China (PRC) for harassment, intimidation, espionage, and threats of violence toward pro-democracy dissidents residing in the US. 1 of the criminal complaints states that an alleged agent of the Ministry of State Security (MSS) named Qiming Lin hired a private investigator (PI) to interfere in the congressional election bid of a 2022 congressional candidate. Yan Xiong, a US Army veteran, Christian pastor, pro-democracy activist, and participant in the 1989 Tiananmen Square protests, was named in open sources as the target. The MSS agent insisted that the PI try to find derogatory information on Yan, manufacture a reputational crisis involving a prostitute, or stage a car accident to “beat him until he cannot run for election”. The criminal complaint indicated that the motivation for the interference was primarily related to combating Chinese dissidents and pro-democracy activists. In this case, Yan was both, which made him a more likely target of PRC counterintelligence.

China's priority is its own economic, political, and technological interests that could be affected by the midterm elections. On July 6, 2022, the US’ National Counterintelligence and Security Center warned that the CCP is trying to manipulate US state, local, and business leaders to support Beijing-friendly policies and advance CCP geopolitical interests, calling China’s actions “deceptive and coercive”. The CCP would almost certainly try to manipulate US political leaders in 3 ways. First, through support for ethnic Chinese participation in Western politics (huaren canzheng, 华人参政), a stated mission of the CCP’s United Front Work Department (UFWD). Second, through monetary donations to China-friendly congressional candidates (to advocate for UFWD programs in universities, protection of pro-China cultural programs, pro-China business deals), candidates that oppose economic decoupling from China, and candidates that are vulnerable to coercion and exploitation. Agents of the PRC have been discovered bankrolling election candidates and political organizations in Australia, the UK, and Canada. And third, unlike Russia, China does not have a reputation for high-profile hack-and-leak operations targeting US election candidates but is more likely to covertly steal sensitive information on candidates through cyber espionage operations, leaving the candidate vulnerable to coercion by the CCP, as they have done in Cambodia and other countries leading up to and following major elections.

Iran

Iran’s malign influence against the US midterm elections will likely be conducted at a scale and scope that supports both a favorable Iranian outcome to ongoing negotiations surrounding the JCPOA and increased US domestic social polarization to erode trust and confidence in the US democratic system.

Iran state media has recently increased rhetoric connecting JCPOA negotiations to the US midterm elections, indicating that a Republican victory would have a negative impact on current dialogue. We assess that if JCPOA negotiations trend toward a positive outcome according to Tehran (which includes a deal that guarantees lifting all US sanctions), Iran will likely conduct limited malign influence activities focused on increasing US domestic polarization. However, if Iran perceives that ongoing JCPOA negotiations will result in a deal that does not meet their current demands of lifting US sanctions, Iran will likely conduct broader malign influence operations using the historical tactics, techniques, and procedures (TTPs) discussed below.

The following TTPs have been identified and analyzed by Recorded Future throughout Iran’s historical interference in the 2016 and 2020 elections. Iran very likely retains the operational capability through government organizations and advanced persistent threat actors to utilize the following TTPs and associated tradecraft to interfere in the US midterm elections:

• Cyber-enabled influence operations using social media to incite conflict among US target audiences.
• Direct-messaging US target audiences through inauthentic email and social media accounts to misattribute identity and activity to far-right extremist groups such as The Proud Boys.
• Direct engagement through email and social media to physically threaten US voters, providing an ultimatum to illicit behavior change such as voting for a specific party/individual.
• Seeding disinformation through inauthentic social media accounts and then amplifying the false content through additional inauthentic social media accounts and bots.
• Deception operations using covert social media personas combined with fake documents impersonating news outlets, reporters, and US government officials to generate and then amplify disinformation.
• Establishing unattributable websites using multiple domains and servers to dox US public officials, threaten US election officials, and inspire US target audiences to engage in violent and illegal actions.
• Hashtag manipulation on social media to increase domestic in-fighting.
• Spreading disinformation campaigns about voting machine conspiracy theories to delegitimize US voting integrity as well as threatening voting machine technicians.

In addition to targeting US audiences, Iran will also very likely target Iranian domestic audiences through amplification of anti-US rhetoric from Iranian senior leadership, derogatory articles published by Iranian state media, and the production of anti-US propaganda surrounding the election, while seeking any opportunities to amplify such content to international audiences.

Figure 10: (Left) Front cover of Farheekhtegan, a national Iranian Persian-language newspaper, January 2021 publication with translated title: "Trump left too, like 6 previous US presidents who worked against the Islamic Republic of Iran using different tactics”; (Middle) Cartoon published by Iran’s Tasnim News Agency on January 7, 2021; (Right) Art displayed by the Art Bureau of Iran’s Islamic Ideology Dissemination Organization during an international cartoon exhibition titled “I Can’t Breathe” on June 10, 2020 (Source: farheekhtegan[.]ir, tasnimnews[.]com, mehrnews[.]com)

Domestic Extremists

We assess that US domestic extremist groups, organizations, and prominent individuals are very likely to engage in malign influence efforts to undermine various elements of the US midterm elections during and leading up to November 2022 by proliferating mis-, dis-, and malinformation. These elements include, but are not limited to: public perceptions of electoral integrity in key states/races; trust in persons and/or institutions administering election services (secretary of states’ offices, governors’ offices, voting systems manufacturers, poll workers, and so on); and belief in the effectiveness of peaceful electoral processes. Additionally, some domestic extremists are uniquely motivated to construct, deploy, and amplify electoral/political conspiracies surrounding the US midterm elections in order to sow general civil discord and broader distrust in the authority and legitimacy of the US government.

In February 2022, the Department of Homeland Security (DHS) released a routine advisory report on terrorist threats to the US Homeland. Recognizing the volatility of the US’s hyperpartisan information environment, the bulletin designated mis-, dis-, and malinformation as highly significant threats to the US homeland, particularly due to information disorder’s demonstrated ability to inspire acts of targeted and mass violence against “faith-based institutions, such as churches, synagogues, and mosques; institutions of higher education; racial and religious minorities; government facilities and personnel, including law enforcement and the military; the media; and perceived ideological opponents”. While DHS’s analysis does not explicitly name or describe particular extremist groups, organizations, or individuals, we assess that the following entities (whose ideologies often overlap) are very likely to conduct malign influence operations using the following narratives:

• Anti-government entitie such as the Constitutional Sheriffs and Peace Officers Association (CSPOA) are very likely to spread disinformation about alleged election fraud in 2020 and to construct new fraud narratives in the lead-up to and aftermath of the US midterm elections. The narrative may involve alleged ballot mishandling, ballot trafficking, voting systems malfunctions and tampering, or “vote stealing”, among other accusations. Anti-government groups, particularly self-styled “militias” inspired by accelerationist ideologies, are typically motivated by belief in the illegitimacy or irrevocable corruption of US government institutions, and use malign influence campaigns (conducted through hyperpartisan news sources, alternative social media platforms and internet forums, conference circuits, and physical collective action) in order to foment public distrust with the ultimate goal of weakening or collapsing said institutions. CSPOA, the Oath Keepers, accelerationist groups, and national socialist (neo-Nazi) organizations are frequent culprits using these tactics.
• Anti-law enforcement entities. Anti-law enforcement sentiment has surged among domestic extremists who also support former president Donald Trump following the Federal Bureau of Investigation’s (FBI) search warrant and raid of Trump’s Mar-a-Lago residence, arguing that the raid was politically motivated by the DoJ and the Biden administration to disqualify Trump from a potential 2024 presidential run. Violent anti-law enforcement sentiment has proliferated on message boards such as Patriots[.]win and alternative social media platforms such as Gab and Truth Social, where comments about a new civil war and suggestions to execute FBI agents are now commonplace (see Figure 11). We assess that it’s very likely such narratives will continue to proliferate around the US midterm elections and may trigger additional acts of violence against FBI property and personnel should Trump face politically disqualifying charges as a result of the DoJ’s current investigations.

Figure 11: Joint mentions of “FBI” and “civil war” across social media and news sources over a 3-month period, spiking at the time of the FBI raid of Mar-a-Lago on August 8-9, 2022 (Source: Recorded Future)

• White Nationalist (WN) entities. Narratives concerning racial demographic change and the persecution of White Americans and politicians have motivated dozens of violent attacks, and they have featured prominently in malign influence campaigns targeting minority racial, cultural, and religious entities. Explicitly WN and WN-affiliated groups such as Patriot Front, Proud Boys, and the Oath Keepers are very likely to continue to spread ideological conspiracies such as the Great Replacement Theory and false and/or misleading studies to suggest anti-White bias in the electoral process. Such narratives reportedly inspired many of those implicated and charged in the January 6, 2021 insurrection at the Capitol and will likely remain potent if recycled in the wake of the US midterm elections.
• Conspiratorial entities. QAnon-inspired conspiracists featured prominently in the January 6th Capitol insurrection and have consistently generated election fraud disinformation since 2016. Once a set of esoteric conspiracies, QAnon’s influence over the perception of electoral integrity and over the belief of dozens of candidates for political office has become a great concern to election administrations and to federal law enforcement. Message boards like 8kun and forums like GreatAwakening[.]win are very likely to play host to midterm-related election disinformation, particularly messaging concerning “deep state” manipulation conspiracies.

Figure 12: Screenshot of conspiratorial election-related posts on prominent QAnon forum, captured August 21, 2022 (Source: GreatAwakening[.]win)

Influence actors in China, Iran, and Russia routinely monitor narratives from the aforementioned entities. While domestic extremists create, disseminate, and proliferate their own narratives and conduct their own malign influence campaigns, Recorded Future stresses the existence of symbiotic relationships between foreign and domestic influence operations and operators. Overt and covert foreign state-controlled media sources both parrot and puppet US domestic extremist narratives in order to forward their own goals of weakening the US democratic process and damaging the US’s reputation on the world stage. Likewise, domestic extremist groups often absorb anti-US, anti-democracy narratives generated by covert foreign media outlets and inauthentic social media accounts commissioned and controlled by adversarial governments, as documented in our previous report, “Russian State-Sponsored Amplification of Bio Lab Disinformation Amid War in Ukraine”.

Outlook

Malign foreign influence operations on US domestic affairs are not a new phenomenon and they do not start/stop with an election cycle. Rather, foreign attempts at influencing US policy and undermining US global standing are, and will almost certainly remain, a critical and persistent national security challenge for years to come. The key motivations for influencing US elections are typically centered around adversaries’ long-term geopolitical interests and furthering their own domestic goals. However, the TTPs employed during influence operations can and do periodically change. In both the 2018 and 2020 US election cycles, we observed a periodic convergence in the TTPs used by foreign nation-states attempting to influence these cycles. This convergence likely demonstrates the ability of adversaries to learn and adapt TTPs proven to be effective to further their own objectives, though this does not necessarily imply coordination.

Russian influence networks tasked with undermining US democratic processes are unlikely to cease after November 8, 2022. As early as immediately after the US midterm elections, and into 2023 and beyond, the Russian government will very likely attempt to plan and execute malign influence aimed at undermining the next 2 years of President Biden’s term in continued retaliation for US support of Ukraine and in constant pursuit of a more multipolar international system. Similarly, Chinese influence operations criticizing Western forms of democracy are likely to continue after the November elections, focusing on perceived flaws in the US election system and in the elected officials, as well as democratic models of governance worldwide.

Iran’s near-term influence efforts leading into the US midterms elections are likely focused primarily on securing a nuclear deal that would ease US sanctions and decrease economic hardships across Iran, while continuing to use its expanding influence network to produce anti-US narratives aimed at slowly eroding confidence in Western democracy. Beyond 2022, Iran is very likely to continue its “Look East Policy” in which US elections provide a target of opportunity for Iran to exploit a great power conflict in an attempt to expand its growing partnerships with China and Russia. Finally, after the US midterm elections, domestic extremists are very likely to continue malign influence efforts against any unfavorable election results by spreading disinformation regarding voting systems, government administrators, candidates, and poll workers, before shifting toward the 2024 US presidential election.