List of 2020 election meddlers includes Cuba, Saudi Arabia and North Korea, US intelligence official says

Cuba, Saudi Arabia, and North Korea are working to influence U.S. elections by running information operations, according to the top counterintelligence official in the Trump administration.

All three seek to sow discord as Election Day looms, according to Bill Evanina, the Director of the National Counterintelligence and Security Center at the Office of the Director of National Intelligence. He did not specify the nature and duration of the operations.

“I believe we’re going to have a lot of things that occur in the next 70 days that are going to impact and influence those issues, from nation-state threat actors, whether it be Iran, China, and obviously Russia. We have other countries getting in the nexus because they think it works,” Evanina said during a U.S. Chamber of Commerce virtual event Wednesday. “They want to be able to provide their optics for discord in the United States … countries like Cuba, and North Korea, and Saudi Arabia.”

Russia sought to interfere in U.S. presidential election in 2016 with influence operations and hacking efforts aimed at breaching voter databases, some of which were successful, according to the Senate Intelligence Committee’s bipartisan examination of the scheme and the Special Counsel’s investigation. But this year, the threat of foreign influence is expanding — Iran and China, too, have set their sights on the 2020 U.S. presidential election, according to the U.S. intelligence community.

And while the ODNI announced earlier this month the goals and motivations of Russia, China and Iran, that statement — which also came from Evanina — left out Cuban, Saudi Arabian and North Korean disinformation.

The information operations

Evanina indicated that the new players’ capabilities may not be as formidable as those of Russia, China and Iran. Their interests also may not be as broad, he said.

“We have a lot of countries that are playing the game, but they’re not rising to the level of the big three,” Evanina said.

A pro-Cuban network of social media accounts has mentioned the election recently, but it’s not particularly active, Lee Foster a senior manager of information operations analysis at FireEye’s Mandiant Threat Intelligence, told CyberScoop. In years past, pro-Cuban networks of fake Twitter and Facebook accounts have also circulated on social media platforms, according to The Miami Herald and Cuban dissident Guillermo Fariñas.

Earlier this year, North Korean actors were targeting news organizations to try spreading disinformation, according to Google’s Threat Analysis Group.

Saudi Arabian disinformation efforts have historically worked to amplify messages critical of the governments of Qatar, Iran and Turkey, and have in recent years focused on denying the Saudi crown prince was involved in the killing of American journalist Jamal Khashoggi, said Simin Kargar, a human rights lawyer and researcher at the Atlantic Council’s DFRLab. (The CIA has assessed the crown prince likely ordered Khashoggi’s murder.)

Recently, the kingdom’s efforts have become a little stealthier following social media takedowns of Saudi networks, which “may have instigated a revision of tactics on the part of the Saudis to obscure attribution in new ways,” Kargar told CyberScoop.

The ODNI and the joint National Security Agency-Cyber Command Election Security Group declined to elaborate on Evanina’s comments.

Election Day and beyond

Evanina said he is also concerned about cyberattacks, including ransomware campaigns, that may seek to target networks and machines critical to running U.S. elections.

“I’ve said this in classified briefings and I’ll say it to you now. I’m worried about Election Day, on. I’m worried about ransomware attacks, I’m worried about cyberattacks, I’m worried about the inability of people to vote because of cyber penetrations and ransomware,” Evanina said.

In particular, the U.S. intelligence community has recently observed nation-state hackers conducting “surveillance” operations on infrastructure that isn’t directly related to running elections, but which could impact the way Election Day plays out, according to Evanina. It isn’t clear if the U.S. intelligence community has concerns about Russia trying to manipulate vote tallies, but Evanina pointed to Russia’s efforts to manipulate how the count was reported to the public in Ukraine’s 2014 presidential election.

“We’ve seen recently a lot of surveillance of nation-state actors surveilling different parts of infrastructure that are not necessarily germane to elections but could considerably have an impact on election come Election Day,” Evanina said. “We’ve seen the Russians in 2014 change the results in Election Night in Ukraine.”

Over the last several years the Trump administration has cultivated a new set of response options it can tap if there are efforts to interfere in U.S. elections, including a new sanctions regime specifically tailored to election interference as well as new policies that allow the U.S. government more leeway in deploying cyber-operations against foreign adversaries.

John Bolton, who served as national security adviser when the Trump administration created the policies, said Tuesday he thinks the U.S. should also use offensive cyber-operations to try to impose significant costs on foreign governments that may want to interfere in U.S. politics.