In an attack earlier this year, Iranian hackers allegedly stole a Republican campaign white paper containing information about vice presidential candidate J.D. Vance. They then tried to leak this information to the media, presumably to damage the Republican campaign. But the influence campaign failed. Media Report on Iran’s cyber attack rather than the leaked data itself. That was in the summer.

Experts feared that, as the elections approached, foreign states would launch additional such combined actions in the United States, causing confusion. In 2016, the Russians successfully conducted a similar hack-and-leak operation targeting Democratic Party emails. Officials and media in the US were overwhelmed.

However, such a magnificent operation did not emerge during the 2024 election period. John Hultquist is a principal analyst at cybersecurity firm Mandiant, now part of Google, and has been working on digital influence operations and global threats for years. He has some theories about why the situation is different this year.

Editor’s note: This interview has been edited for brevity and clarity.

Mr. Hultquist, the US elections are now complete. How meaningful were the efforts of foreign states to influence the process through disinformation or cyber attacks?

These did not have the same effects we saw in previous election years. I suspect some of this is due to preparations and potentially disruption to some activities. At Mandiant, for example, we monitor Russian and Iranian groups we know are responsible and implement additional protections for our customers. We think this may have made it even more difficult for these actors to work. It is more difficult to perform much of this activity when people are awake and searching.

What contribution did the authorities make?

The government was more active than ever in immediately recognizing and calling out these actions. In many cases in the past it would take years for the government to go in and determine operations. There was probably a lot of discomfort when it came to intelligence operations being talked about publicly about other intelligence operations. This was not a common activity. However, the success of most of this activity depends on our ignorance. So for the government to immediately call out these things and shine a light on them, I think it’s really hindered their ability to operate effectively.

You and other experts expected there might be more attacks and influence attempts, especially shortly before or on Election Day. But it remained relatively quiet.

I think we were definitely expecting to see some activity that we didn’t end up seeing. There are actors who have a history of running campaigns at the last moment, some Iranian actors for example. We did not see this. There may be many different reasons for this, but ultimately this is good news.

What is the reason for this? Is it because the defense mechanisms are very well established this time? Or didn’t foreign states try?

I think potentially both. These actors are definitely under a lot of scrutiny. We take action, and our peers regularly take action against them. It is really difficult to be successful under these conditions. If you think about it this way, what they actually aim to do is to be impressive. And this is already difficult. They are trying to reach more people. But they also try to hide the fact that they are secretly linked to governments or intelligence agencies. The more open they are to the world, the greater their risk of being caught. This is the ironic problem at the heart of their operations. This makes it really difficult.

In the past, Russian and Iranian groups were better able to carry out such operations. Was this because authorities and security companies were less active back then?

There was not much experience with this activity in 2016. They just had a better opportunity. It’s much, much harder now. We see operations all the time with enormous amounts of resources. They spun all these fake accounts and stories and things like that and then they get shut down before they can actually talk to anyone. This has become quite common.

Before the vote, AI tools were seen as a major threat to influence the election. How important was artificial intelligence for attackers?

I think we’ve seen a few examples of this. But I don’t think he is the game-changing talent that many suspect him to be. The biggest lesson to be learned here is that the field these actors are fighting against is not actually artificial intelligence or content.

What do you want to say?

They always managed to fake things. There are other long-established methods of doing this. Disability has always caused many people to suffer. We see many influence operations operating without any follower. Actors are active on social media platforms but what we generally see with most of them is that they fail to break into the mainstream. There are some cases where they appear to use a third party to publicize their message and even launder their message. In these situations, they may be more successful. But in the end, the lesson here is that the big hurdle is breaking towards the mainstream. This is a very competitive situation, and it will probably never be more competitive than in the final days of the election cycle.

In September, American authorities uncovered a Russian-financed media company in the United States that was paying off right-wing influencers. Is this the procedure you are talking about?

I will say that historically we have seen in many different cases, for example, Russian actors not getting the fame or exposure they were looking for. They then try to get their stories out through journalists or, as in 2016, through leak sites and so on. This is a pretty standard procedure. In many cases, this may be the only way to create the impact they are looking for.

However, this was not successful in this election campaign. This did not have the desired effect when Iranian actors leaked internal Republican documents to various media outlets. Have foreign attempts to influence the US election campaign had any impact?

It is known that it is quite difficult to measure the impact of such operations. But there aren’t many things that gain great importance. And even those who did were a drop in the bucket. It is difficult to imagine how effective these little-noticed operations are.

Was it an exaggeration to claim in advance that foreign influence operations could be dangerous?

This is a really important part of the job. I think we need to take this seriously. However, we must be careful not to do their job for them. After all, they are trying to sow seeds of doubt about the election. If we exaggerate their threats to the election beyond realism, we may find that they are the ones sowing doubts. This may be to their benefit, or even part of their design.

What can we expect between now and Donald Trump’s inauguration in January?

There are a few things to consider. I think our main concern will be intelligence operations. A new administration is forming. They will almost certainly have different foreign policies. And foreign intelligence services want information about these policies. They will leverage their cyber espionage assets to gain this insight. So the game may change, but unfortunately it still continues.

latest articles

Global reporting. Journalism of Swiss quality.

In today’s increasingly polarized media market, Switzerland-based NZZ offers a critical and fact-based outside perspective. We are not in the breaking news business. We deliver thoughtful, well-researched stories and analysis that go behind the headlines to explain relevant events in the US, Europe and around the world. To produce this work, NZZ builds an industry-leading network of specialist reporters around the world, working closely with our main newsroom in Zurich.

Sign up for us free newsletter or follow us excitement, Facebook or WhatsApp.