In the 2024 US elections, foreign disinformation has failed

In an attack earlier this year, Iranian hackers allegedly stole an internal Republican campaign audit document containing information about vice presidential candidate JD Vance. They then attempted to leak this information to the media, presumably to damage the Republican campaign. But the influence campaign failed. The media reported on the Iranian cyberattack rather than the leaked data itself. It was in summer.

As the election approached, experts feared that foreign states would launch new such combined actions in the United States, which would sow confusion. In 2016, the Russians carried out a similar successful hack and leak operation targeting Democratic Party emails. The American authorities and media were overwhelmed.

However, no such spectacular operation has emerged during the 2024 election campaign. John Hultquist is chief analyst at the cybersecurity company Mandiant, now part of Google, and has studied influence operations for years digital and global threats. He has a few theories about why things were different this year.

Editor’s note: This interview has been edited for brevity and clarity.

Mr. Hultquist, the American elections are now over. How significant have been the efforts of foreign states to influence the process through disinformation or cyberattacks?

These measures did not have the same impacts as those observed in previous election years. I suspect this was partly due to preparation, and potentially also because some activities were disrupted. At Mandiant, for example, we track Russian and Iranian groups that we know are responsible, and we have additional protections in place for our customers. We believe that this could have made it more difficult for these actors to operate. Much of this activity is more difficult to accomplish when people are vigilant and attentive.

What kind of contribution have the authorities made?

The government has been more active than ever in immediately recognizing and denouncing these actions. In many cases in the past, it took years for the government to identify operations. There was probably a lot of discomfort with intelligence operations talking publicly about other intelligence operations. This was not a common activity. But much of this activity, for it to be successful, relies on our ignorance. So for the government to immediately call out these things and shine a light on them, I think it’s really hindered their ability to operate effectively.

You and other experts expected more attacks and influence attempts, especially shortly before or on Election Day. But it remains relatively calm.

I think we certainly expected to see some activity that we ultimately didn’t see. Some actors, for example Iranians, are used to carrying out campaigns at the last minute. We haven’t seen that. There may be many different reasons for this, but ultimately it’s good news.

What is the reason? Is it because the defense mechanisms were so well put in place this time? Or have foreign states not even tried?

I think potentially both. These actors are definitely subject to close surveillance. We take action and our peers do so regularly. It’s really difficult to succeed in these circumstances. If you think about it this way, their goal is essentially to be an influencer. And it’s already hard. They are trying to make themselves more known to more people. But at the same time, they try to hide the fact that they are secretly associated with governments or intelligence services. The more exposed they are to the world, the more likely they are to get caught. It’s an ironic problem at the center of their operations. This makes things really difficult.

In the past, Russian and Iranian groups were better able to carry out such operations. Is it because the authorities and security companies were less active then?

In 2016, there was not as much experience in this activity. They simply had a better opportunity. It’s much more difficult now. We constantly see operations that have enormous amounts of resources. They create all these fake accounts and stories and things like that, and then they’re shut down before they’ve really talked to anyone. It has become quite common.

Before the vote, artificial intelligence tools were considered a major threat to influence elections. How important was AI to attackers?

I think we’ve seen some examples of that. But I don’t think it’s the revolutionary capability that many people suspected. The big takeaway here is that AI or content aren’t really where these players are struggling.

What do you mean?

They always knew how to pretend. There are other methods to achieve this, which have been around for a long time. The obstacle has always been more and more exposed to a large number of people. We see many influence operations operating without any follow-up. Actors are active on social media platforms, but what we typically see from many of them is that they fail to break into the mainstream. In some cases, it appears that they have used a third party to amplify their messages, or even whitewash their messages. In these cases, they may have been more successful. But ultimately the lesson is that the big hurdle is breaking into the mainstream. It’s very competitive, and it’s probably never more competitive than in the final days of an election cycle.

In September, U.S. authorities discovered a media company in the United States that had been funded by Russia and had paid right-wing influencers. Is this the procedure you are referring to?

I will say that historically, in many different cases, we’ve seen Russian actors, for example, fail to gain the notoriety or exposure that they’re looking for. They then attempt to push their story through journalists, or, as in 2016, through leak sites and avenues of that nature. This is a pretty standard procedure. In many cases, this may be the only way for them to achieve the desired effect.

But it did not succeed in this election campaign. When Iranian actors leaked an internal Republican document to several media outlets, it did not have the desired effect. Have foreign attempts to influence the US election campaign had any effect?

It is notoriously difficult to measure the impact of this type of operation. But few things have taken on major importance. And even those who did were just a drop in the bucket. It is difficult to imagine the effectiveness of these barely noticed operations.

Was it an exaggeration to pretend in advance that foreign influence operations could be dangerous?

This is a really important element. I think we need to take this seriously. But we must also be careful not to do the work for them. Ultimately, they are trying to sow doubt about an election. If we exaggerate their election threat beyond what is realistic, we may find ourselves being the ones sowing doubt. This could be to their advantage, or even part of their design.

What can we expect between now and Donald Trump’s inauguration in January?

There are several things to consider. I think our main concern would be intelligence operations. A new administration is formed. They will almost certainly have different foreign policies. And foreign intelligence services want insight into these policies. They will exploit their cyberespionage assets to obtain this information. So the game could change, but unfortunately it continues.

Latest articles

Global reporting. Swiss quality journalism.

In an increasingly polarized media market, the NZZ, based in Switzerland, offers a critical and factual outside perspective. We are not in the news business. We provide thoughtful, well-researched stories and analysis that go beyond the headlines to explain relevant events in the United States, Europe and around the world. To carry out this work, NZZ maintains a world-leading network of expert journalists who work closely with our main newsroom in Zurich.

Subscribe to our free newsletter or follow us on TwitterFacebook or WhatsApp.