WASHINGTON — U.S. officials have accused Iran of being behind a flurry of threatening but fake emails sent to Democratic voters in Florida and other battleground states in a late-stage effort to sway public opinion and interfere in the presidential election.
Addressed as if from the far-right, pro-Trump Proud Boys group, the fake emails appeared aimed at intimidating voters. John Ratcliffe, the government’s national intelligence director, said the intent was to hurt President Donald Trump in the contest against Democrat Joe Biden, though he did not elaborate on how.
One possibility is the messages may have been intended to align Trump in the minds of voters with the Proud Boys after he was criticized for failing to unequivocally denounce the group during the first presidential debate. Google said in a statement that its spam filters stopped 90 percent of the roughly 25,000 emails sent to Gmail users.
Officials did not lay out specific evidence for how they came to pinpoint Iran, but the activities attributed to Tehran would mark a significant escalation for a country some cybersecurity experts regard as a second-rate player in online espionage. The announcement was made late Wednesday at a hastily called news conference 13 days before the election.
The allegations underscored the U.S. government’s concern about efforts by foreign countries to influence the election by spreading false information meant to suppress voter turnout and undermine American confidence in the vote. Such direct attempts to sway public opinion are more commonly associated with Moscow, which conducted a covert social media campaign in 2016 aimed at sowing discord and is again interfering this year, but the idea that Iran could be responsible suggested that those tactics have been adopted by other nations, too.
The FBI and DHS's cybersecurity agency offered steps Americans can take to counter foreign interference in the upcoming election.
U.S. intelligence officials have repeatedly stated that they consider Russia the primary threat to U.S. election security, and Ratcliffe said Russia had also obtained voter data for potential mischief.
“These actions are desperate attempts by desperate adversaries,” said Ratcliffe, who, along with FBI Director Christopher Wray, insisted that the U.S. would impose costs on any foreign countries that interfere in the 2020 U.S. election and that the integrity of the vote remains sound.
“You should be confident that your vote counts,” Wray said. “Early, unverified claims to the contrary should be viewed with a healthy dose of skepticism.”
While the two officials called out both Russia and Iran for having obtained voter registration information, such data is easily accessible for many states, including Florida. There was no allegation that either country had hacked a database for it or had altered any election-related data.
Iran also distributed a video that falsely suggested voters could cast fraudulent ballots from overseas, Ratcliffe said. Google said it “removed a video file on YouTube that had fewer than 30 views and terminated the associated Google accounts.”
Wray and Ratcliffe did not describe the emails or video linked to Iran, but officials familiar with the matter said the U.S. had linked Tehran to messages that Democratic voters in multiple states, including Alaska and Florida, have received. The emails warned recipients that “we will come after you” if they didn’t vote for Trump. Security researchers said the Proud Boys sender address used by the spammers was “a flag of convenience.” The true origin of the emails was obscured by servers abroad that the authors hijacked to send the emails.
Bennett Ragan, the campaign manager of Florida statehouse candidate Kayser Enneking, said he got two of the emails and knew about 10 other people in Gainesville who also received them. Bennett said the home address included in the personalized email he received was not current so he figured the data on him was acquired from the 2018 primary election voter roll.
It would not be the first time that the Trump administration has said Tehran is working against the Republican president. An intelligence assessment released in August said: “Iran seeks to undermine U.S. democratic institutions, President Trump, and to divide the country in advance of the 2020 elections.”
A spokesman for Iran’s mission to the United Nations, Alireza Miryousefi, denied Tehran had anything to do with the alleged voter intimidation.
“Unlike the U.S., Iran does not interfere in other country’s elections,” Miryousefi wrote on Twitter. “The world has been witnessing U.S.' own desperate public attempts to question the outcome of its own elections at the highest level.”
Iran’s Foreign Ministry summoned the Swiss ambassador on Thursday over the allegations. The Swiss Embassy has overseen America’s interests in Tehran since the aftermath of the 1979 hostage crisis.
“The Islamic Republic of Iran, while rejecting the allegations and the fake reports, again emphasizes that there’s no difference for Tehran which candidate goes to the White House,” the ministry said in a statement.
Trump, speaking at a rally Wednesday night in North Carolina, made no reference to the announcement, but he repeated a familiar campaign assertion that Iran is opposed to his reelection. He promised that if he wins another term he will swiftly reach a new accord with Iran over its nuclear program.
House Speaker Nancy Pelosi and Rep. Adam Schiff, the Democratic chairman of the House intelligence committee, said the “disturbing” threats cut to the heart of the right to vote.
“We cannot allow voter intimidation or interference efforts, either foreign or domestic, to silence voters' voices and take away that right,” they said in a statement.
While state-backed Russian hackers are known to have infiltrated U.S. election infrastructure in 2016, there is no evidence that Iran has ever done so, and it was not clear how officials were able to identify Iran so quickly.
The operation represented something of a departure in cyber-ops for Iran, which sought for the first time on record to undermine voter confidence. Iran’s previous operations have been mostly propaganda and espionage.
A top cyberthreat analyst, John Hultquist of FireEye, said the striking development marked “a fundamental shift in our understanding of Iran’s willingness to interfere in the democratic process. While many of their operations have been focused on promoting propaganda in pursuit of Iran’s interests, this incident is clearly aimed at undermining voter confidence.”
Bajak reported from Boston. Associated Press writers Christina A. Cassidy in Atlanta; Michael Balsamo, Colleen Long and Zeke Miller in Washington; Amir Vahdat in Tehran, Iran; and Jon Gambrell in Dubai, United Arab Emirates, contributed.