Countdown to the Midterms: Reexamining Foreign Influence in 2020 Elections
In the months before and after the 2020 election, the U.S. Intelligence Community, the Department of Justice, the Department of Homeland Security, and other agencies conducted extensive evidence collection, analysis, and review of foreign activity. Their central, declassified conclusion was direct: they found “no indications that any foreign actor attempted to alter any technical aspect of the voting process in the 2020 US elections, including voter registration, casting ballots, vote tabulation, or reporting results.”
That conclusion followed years of election security investment, heightened intelligence collection, interagency coordination, and a formal post-election assessment as required by an Executive Order signed by President Trump during his first term in office. The Intelligence Community reviewed information ranging from open-source reporting to highly classified intelligence to assess whether foreign governments attempted to interfere in the technical aspects of the election.
To be clear: Foreign adversaries did conduct operations targeting the U.S. during the 2020 election. These adversaries probed government networks, targeted political campaigns, and carried out widespread influence campaigns to amplify political divisions and undermine public confidence in elections. But the Intelligence Community distinguishes those activities from interference in voting systems themselves. The record reflects aggressive foreign messaging and cyber activity aimed at influence, but not successful efforts to manipulate ballots, voter rolls, or vote counts.
Today, the federal government appears to be reopening questions around foreign involvement and impact in the 2020 election. In late January, the FBI raided the Fulton County, Georgia election offices, and seized ballot material from the 2020 election. The raid itself was extraordinary, made even more unusual by the presence of Director of National Intelligence Tulsi Gabbard. The explanations for her involvement are bizarre — ranging from a charge from the President to the suggestion that she “happened to be present in Atlanta.” Without a stated intelligence purpose, law enforcement authority, or any adequate explanation to the public, a generous interpretation would be to suggest that her involvement is indicative of a counterintelligence purpose relating to those 2020 election materials.
But should claims about the integrity of the 2020 election be revisited or repackaged, or should new claims circulate about foreign adversaries or hacks of election systems in 2020, it is worth anchoring the discussion in the facts that were contemporaneously assessed, declassified, and reported. This piece, part of CDT’s Countdown to the Midterms series, consolidates those findings. It is intended to help election officials and stakeholders quickly respond to renewed or reframed claims with specificity and reference to the established intelligence record.
A State of Readiness
To understand the intelligence community’s 2020 election security findings, it is helpful to recall the posture of the federal government during the 2020 election cycle. In the years following 2016, Russia’s well-documented efforts to influence the election prompted a bipartisan surge of federal resources to ensure election officials had the means they needed to keep US elections secure. For the first time, elections were designated as critical infrastructure. Federal agencies expanded coordination with state and local election officials, increased intelligence collection on foreign threats, and established regular public reporting on foreign influence activity. By 2020, election security had become an institutionalized, interagency mission spanning the intelligence community, the Department of Homeland Security, the Department of Justice, and federal law enforcement, among others. Trump Cabinet officials and federal leaders described the level of effort, accordingly, “In an unprecedented level of coordination, the U.S. government is working with all 50 states and U.S. territories, local officials, and private sector partners to identify threats, broadly share information, and protect the democratic process. We remain firm in our commitment to quickly share timely and actionable information, provide support and services, and to defend against any threats to our democracy.”
Pre-Election Monitoring and Public Warnings
Throughout 2020, federal officials publicly warned that foreign actors were seeking to influence the election. Joint statements from DOS, DOJ, DOD, DHS, ODNI, FBI, NSA, and CISA cautioned that adversaries were spreading propaganda and false information to undermine confidence in democratic processes. These warnings were made in real time, reflecting ongoing intelligence collection and analysis.
In August 2020, the National Counterintelligence and Security Center assessed that “many foreign actors have a preference for who wins the election, which they express through a range of overt and private statements; covert influence efforts are rarer.” It identified China, Russia, and Iran as the primary foreign actors of concern. Specifically, it found that:
Russia was taking steps to denigrate then-candidate Joe Biden and amplify divisions in the United States.
Iran was seeking to undermine U.S. democratic institutions and weaken then-President Trump’s reelection prospects.
China had a clear preference against the reelection of President Trump but was weighing whether to take aggressive action.
The number of statements, briefings, and reports is significant for two reasons. First, it demonstrates the posture of the federal government at the time. Agencies were on high alert, monitoring adversaries closely, and were poised to alert election officials and the public of any foreign malfeasance. Second, it shows that the intelligence community was taking significant steps to be transparent about their actions, including collecting intelligence, attributing activity, and sharing findings with state and local officials as well as the public.
As claims about foreign interference in 2020 are rehashed, this level of real-time transparency starkly contradicts assertions that foreign actors successfully penetrated election systems or that the intelligence community concealed evidence at the time.
Beyond monitoring and public warnings, federal agencies were actively bolstering election security in real time throughout the 2020 cycle. Information sharing between intelligence agencies and state and local governments enabled election officials to identify and counter potential threats as they emerged. The Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC) grew to include more than 2,300 state and local election offices. Agencies stood up three operations centers dedicated to coordinating threat monitoring and incident response. More than 7,000 products were developed and distributed, including planning and guidance documents, risk assessments, voluntary information-sharing guidance, public services announcements, and Election Day Emergency Response Guides. Federal agencies and the EI-ISAC also provided physical and cybersecurity assessments for election officials and Albert Sensors and malicious Domain Blocking tools to detect malicious cyber activity to all 50 states and to hundreds of local jurisdictions. And intelligence agencies regularly briefed election officials on emerging threats. The security of the 2020 election was therefore not only assessed after the fact — it was actively supported, reinforced, and defended in real time.
Post-Election Intel Assessment
Following the 2020 election, as directed by President Trump’s Executive Order 13848, the intelligence community reviewed the breadth of information collected, from open source to highly classified, including anything concerning “key foreign actors’ intentions and efforts to influence or interfere with the 2020 US federal elections.”
The bottom line from that declassified Intelligence Community Assessment (ICA) was straightforward: “We have no indications that any foreign actor attempted to alter any technical aspect of the voting process in the 2020 US elections, including voter registration, casting ballots, vote tabulation, or reporting results.” That conclusion was echoed in the joint Department of Justice and Department of Homeland Security report also required under Executive Order 13848, which found no evidence that a foreign government-affiliated “actor prevented voting, changed votes, or disrupted the ability to tally votes or to transmit election results in a timely manner; altered any technical aspect of the voting process; or otherwise compromised the integrity of voter registration information of any ballots cast during 2020 federal elections.”
A country-by-country review of 2020 influence efforts
Foreign activity does not automatically mean the integrity of an election is jeopardized. In 2020, foreign actors did conduct brazen influence operations and common cyber operations; the Intelligence Community assessed, however, that they did not alter voter registration data,intervene in casting or counting of votes, or otherwise determine the outcome of the election. That distinction is sometimes lost or, in the case of election denial movements, intentionally misrepresented.
The August 2020 public statement from the intelligence community summarized above identified Russia, China, and Iran as the primary foreign actors of concern. Each government differed in its objectives, risk tolerance, and tactics. What follows is a structured review of what the U.S. government assessed each country did — and did not do.
Russia
The 2021 ICA assessed that Russian President Vladimir Putin authorized multifaceted influence operations with the intent of “denigrating President Biden and the Democratic Party, supporting former President Trump, undermining public confidence in the electoral process, and exacerbating sociopolitical divisions in the US.” Unlike in 2016, Russia’s efforts in 2020 did not include persistent cyber efforts to access election infrastructure.
Tactics Used:
Influence operations through intelligence services, intermediaries, and proxies:
A Russia-directed influence operation used Ukrainian intermediaries and Russian intelligence proxies. In September 2020, the US Treasury Department designated Andrii Derkach as an “active Russian agent for over a decade” with “close connections with the Russian Intelligence Services,” and stated that from at least late 2019 through mid-2020 he ran a covert influence campaign built around false and unsubstantiated narratives about U.S. officials and the 2020 election. Treasury further assessed that Derkach released edited audio tapes and other unsupported information to discredit U.S. officials and almost certainly targeted U.S. voters, prominent U.S. persons, and government officials through U.S. platforms, English-language materials, and pro-Russian lobbyists in the United States.
In April 2021, Treasury expanded these designations and identified Konstantin Kilimnik as a “known Russian Intelligence Services agent” who conducted influence operations in the 2020 election on their behalf, including promoting the narrative that Ukraine, rather than Russia, interfered in U.S. elections. Treasury designated Kilimnik for foreign interference in the 2020 U.S. presidential election.
Russian state media, trolls, and online proxies:
Following the 2016 elections, Russian online influence activities did not stop. This tool of influence routinely shifted to topics understood to benefit or align with Russian government priorities. As attention shifted to the 2020 election cycle “Russia’s online influence actors sought to affect US public perceptions of the candidates, as well as advance Moscow’s long-standing goals of undermining confidence in US election processes and increasing sociopolitical divisions among the American people.” The US Intelligence Community, found that Russian online influence actors “sought to amplify mistrust in the electoral process by denigrating mail-in ballots, highlighting alleged irregularities, and accusing the Democratic Party of voter fraud.”
Tactics Not Used:
The Intelligence Community found no evidence that Russia altered voter registration data, cast fraudulent ballots, changed vote tabulation, or disrupted election reporting systems in 2020. Specifically, the ICA stated that Russian campaigns targeting critical infrastructure did not “materially affect the integrity of voter data, the ability to vote, the tabulation of votes, or the timely transmission of election results.”
Relevance to 2020 Fraud claims:
Russia’s activities were designed to influence public opinion and erode trust, not manipulate ballots or vote counts. The documented operations do not support claims that Russian actors determined or altered the outcome of the 2020 election.
China
The intelligence community assessed that China considered influence efforts during the 2020 election cycle but did not deploy interference operations aimed at altering election infrastructure or outcomes.
China was consistently treated as a major foreign influence concern, and the intelligence community was well postured to alert on activities that might threaten to interfere with or influence the election.
Across the election cycle, the intelligence community described China’s decision whether or not to initiate a plan as dependent on the risk of getting caught. In the August 2020 National Counterintelligence and Security Center statement, the intelligence community reflected that, while China has a preferred outcome of the election, “China will continue to weigh the risks and benefits of aggressive action.”
Following the election, the declassified ICA reflected that “China did not deploy interference efforts and considered but did not deploy influence efforts intended to change the outcome of the US presidential election.” The decision to not conduct election related operations was the result of a risk calculus: “China was probably concerned the United States would use accusations of election interference to scapegoat China.”
Tactics Used:
Public messaging and official rhetoric:
Chinese officials and state-affiliated media made public statements that were critical of U.S. policies and political leadership, for instance regarding the U.S. response to the COVID-19 pandemic.
Minority assessment of limited influence activity:
The view that China did not act to influence the election was not uniformly held across the Intelligence Community. To that point, the ICA reflected the minority view, held by the National Intelligence Officer for Cyber who reviewed the same body of intelligence and assessed that “through social media and official public statements and media” China took “at least some steps to undermine former President Trump’s reelection chances.” The NIO for Cyber agreed that the Intelligence Community has “no information suggesting China tried to interfere with election processes.” It is a strength of the analytic process that dissenting views and analysis across the same body of intelligence are reflected.
Assessing A Specific Claim: Counterfeit Driver’s Licenses and Mail Ballots
In June 2025, FBI Director Kash Patel declassified an unsubstantiated tip that was reported to the FBI in August 2020 claiming that China produced and exported fraudulent US Drivers Licenses (allegedly developed via user data from TikTok) to Chinese students and sympathizers in the United States “in order to create tens of thousands of fraudulent mail-in votes” for Joe Biden. The records that were declassified allege that the tip was recalled and not fully pursued. The FBI shared records and correspondence from the tip with Senator Chuck Grassley, Chairman of the Senate Select Committee on Intelligence.
The extent to which the unsubstantiated tip was specifically investigated by the FBI at the time is not clear; however, the core operational claim, that China was using user data from TikTok to develop fraudulent drivers licenses to enable fraudulent mail-in-ballots, fails on several fronts. First, as the unsubstantiated tip notes “A persons [sic] address information was not a valid field when creating a TikTok account. It was unspecified how China would attain US address data from the application.” Second, election administrative processes have controls which make this approach infeasible to operationalize undetected, whether verifications and validations at the voter registration process, or signature matching at the mail-ballot process. Third, the scheme would have required Chinese college students and other noncitizens to use the fraudulent IDs to register to vote — a serious crime that can result in deportation and which has been consistently disproven as a widespread phenomena by Republican electionofficials, federalcourts, and even reviews conducted by this administration using the SAVE database. Fourth, while there are reports of seizing shipments of fake IDs, the government had “no evidence of voter fraud in relation to these shipments.”
Tactics Not Used:
The Intelligence Community found no evidence that China tried to interfere in election processes, alter voter registration systems, cast ballots, change vote tabulation, or disrupt reporting systems.
Relevance to 2020 Fraud Claims:
The assessed Chinese activity does not support claims of technical interference or outcome manipulation. Allegations involving counterfeit IDs have not been substantiated with evidence of fraudulent registrations, ballots, or altered returns.
Iran
Iran undertook an aggressive cyber-enabled influence campaign around the 2020 election, playing on fear and overt threats to foment distrust. The ICA assessed that Iran had an objective to “undercut the reelection prospects of former President Trump and to further its longstanding objectives of exacerbating divisions in the US.”
Disinformation campaign Targeting Federal Write-in Absentee Ballots (FWABs):
This data was leveraged in the creation of a disinformation video. Set to the tune of Metallica’s “Enter Sandman,” the video purports to depict a Proud Boys effort to use hacked data for thousands of registered voters to submit FWABs. The Administration notified election officials and the public, and it was clear that this FWAB approach, if actually carried out, would be detected and prevented from affecting vote tallies. Ultimately, there was no evidence of fake FWABs being cast.
Direct voter intimidation campaign:
A disinformation video was distributed to policymakers, campaign staff, members of Congress, as well as directly to voters in a scheme to undermine trust in election administration. Again posing as the Proud Boys, Iranian actors sent emails, some containing links to the disinformation video, to tens of thousands of registered Democrats and threatened the recipients with physical injury if they did not change their party affiliation and vote for President Trump.
Attempted media intrusion:
Additionally, presumably to publish content that would amplify and stoke distrust, these Iranian actors targeted the backend content management system of an American media company. On the day after the 2020 U.S. presidential election, these actors attempted to leverage their earlier access to the media company’s content management system by way of stolen credentials. However, Federal law enforcement had notified the media company of the compromised credentials, and the company was able to mitigate the actor’s attempts at unauthorized access.
Post-election intimidation efforts:
Following the election, Iran sought to intimidate election officials and others attempting to defend the election process. In December 2020, the FBI and CISA stated they had “highly credible information” that Iranian cyber actors were almost certainly responsible for a website called “Enemies of the People,” which posted personal information and threats against election officials and federal officials.
Tactics Not Used:
The Intelligence Community found no evidence that Iran altered voter registration data, cast fraudulent ballots, changed vote tabulation, or disrupted election reporting. Specifically, the ICA stated that Iranian campaigns targeting critical infrastructure did not “materially affect the integrity of voter data, the ability to vote, the tabulation of votes, or the timely transmission of election results.”
Other Claims assessed by IC relevant to renewed 2020 criticism:
Claims that foreign governments owned, directed, or controlled election infrastructure: The IC stated that: “We are aware of multiple public claims that one or more foreign governments — including Venezuela, Cuba, or China — owned, directed, or controlled election infrastructure used in the 2020 federal elections; implemented a scheme to manipulate election infrastructure; or tallied, changed, or otherwise manipulated vote counts. Following the election, the Department of Justice, including the FBI, and the Department of Homeland Security, including CISA, investigated the public claims and determined that they are not credible. We have no evidence — not through intelligence collection on the foreign actors themselves, not through physical security and cybersecurity monitoring of voting systems across the country, not through post-election audits, and not through any other means — that a foreign government or other actors compromised election infrastructure to manipulate election results.” The assessment went on to state definitively: “we have no information suggesting that the current or former Venezuelan regimes were involved in attempts to compromise US election infrastructure.”
Probes of cyber networks: The ICA noted that cyber actors associated with several foreign governments probed some state and local government networks, including election-adjacent systems like county government networks, but assessed these were likely part of broader cyber efforts and not directed at election systems and processes.
Reexamining 2020
The Intelligence community’s efforts in 2020 stand as a model for transparency and analytic rigor. The first Trump administration issued consistent public announcements; declassified intelligence to brief officials; mandated formal assessments under Executive Order 13848; directed sanctions in response to foreign activity; and routinely shared information through public reports, social media, and briefings from the podium. As claims about foreign interference in 2020 are rehashed, this level of transparency helps to root the record in evidence.
That transparency strengthens the credibility of the conclusions reached at the time. Those conclusions were also reinforced by additional investigations conducted by federal and state courts through election contests and litigation, by independent academics and conservative think tanks, by election officials across the country who conducted recounts and post-election audits, and even by senior Trump officials including Attorney General Bill Barr. Across these institutions and processes, a consistent finding emerged: there is no evidence that foreign interference altered the technical aspects or outcome of the 2020 election.
If new claims of foreign interference in 2020 emerge, they should meet the same high standard of analytic rigor and transparency. Any new assessment would need to identify previously unavailable intelligence, explain how it materially differs from information already reviewed, and clearly articulate why prior analytic conclusions were incorrect. Absent such evidence, revisiting 2020 risks further undermining confidence in elections and re-litigating claims that were already examined and rejected through established intelligence processes.
Evaluating future claims also requires attention to institutional capacity and circumstance across the intelligence community, DOJ, and DHS. Unfortunately, the capacity of these agencies to conduct such thorough, transparent and trustworthy reviews has been severely impacted this year. As our recent blog on the rapid evolution of election security since 2024 explained, many federal agencies have seen significant cuts to election security staff and portfolios. Entities within the FBI, CISA, ODNI, and the State Department that focused on countering foreign interference have also been scaled back or directed to halt efforts to counter foreign influence. Additional moves by the administration in suborning and hollowing out the National Intelligence Council due to “opposition to Trump” and the firing of senior intelligence leaders at the National SecurityAgency, Defense Intelligence Agency, and the CIA threaten one of the five analytic standards required by Intelligence Community Directive 203, which represent the “core principles of intelligence analysis” for U.S. intelligence agencies: that intelligence community analysis must be made independently of political considerations.
Conclusion
As the Director of National Intelligence apparently delves into reexamining the 2020 elections, the record from 2020 remains the same. Foreign threats were real and the U.S. government devoted substantial intelligence, law enforcement, and election security resources to identify, expose, and respond to those threats. Election officials were able to administer a secure, accessible, informed, and trustworthy election. Ultimately there was no evidence that foreign adversaries were able to alter “any technical aspect of the voting process in the 2020 US elections, including voter registration, casting ballots, vote tabulation, or reporting results.” If officials advance new claims about 2020, they should do so with specificity, evidence, and an explanation of how those claims differ from the contemporaneous findings of the Intelligence Community, DOJ, and DHS. Such claims should also be evaluated in light of indications that politics, not evidence, is driving efforts to re-open a closed debate.
