Photo by: STRF/STAR MAX/IPx 2020 10/22/20 Threatening emails have been received by Democratic voters insiting they vote for…
Threatening emails were received by Democratic voters insisting they vote for Donald Trump, allegedly from The Proud Boys. The U.S government has concluded that Iran and Russia had obtained voter data and were behind the threats.

WASHINGTON - Some of the data Iran used to unleash a deluge of emails designed to intimidate U.S. voters just weeks before the country’s presidential election came directly from one state’s voter registration database.

U.S. officials confirmed the finding late Friday in an alert issued by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA), which has been coordinating U.S. election security efforts.

The alert said Iranian hackers targeting websites belonging to various U.S. states, including state election websites, “successfully obtained voter registration data in at least one state” by exploiting what it described as website misconfigurations.

That data was then used as part of an Iranian campaign last week to intimidate voters in at least four states, including Arizona, Alaska, Pennsylvania and Florida.

The “spoofed” emails were designed to make it look as though they had come from the Proud Boys, a far-right group that has rallied behind President Donald Trump.

The text of the emails warned voters, “You will vote for Trump on Election Day or we will come after you.”

According to the latest alert, the hacked voter registration information was also featured in a video disseminated by Iran implying that some voters might be prone to casting fraudulent ballots.

Just 27 hours

Iran’s foreign ministry last week rejected the U.S. accusations as “baseless,” and summoned the Swiss ambassador, who represents U.S. interests in Iran because the two countries do not have diplomatic relations.

However, Cyberscoop, a publication that focuses on cybersecurity, cited U.S. officials Friday as saying the Iranian hackers targeted websites in 10 different states.

Despite Iran’s initial success in penetrating a key database, it took U.S. intelligence officials just 27 hours to trace the emails and the video back to Tehran, sharing the information with U.S. states ahead of a public announcement featuring Director of National Intelligence John Ratcliffe and FBI Director Christopher Wray.

Ratcliffe described the Iranian operation as a “desperate” attempt to sow chaos and confusion, adding that when it came to the video, “any claims about such allegedly fraudulent ballots are not true.”

U.S. security and intelligence officials Friday said they remain confident that the upcoming election, set for November 3, will be the most secure in modern history. Officials said that despite the data breach, voting infrastructure in all 50 states remains resilient, with up to 95% of states now having systems in place to ensure there is a paper record of every vote cast.

Still, they expressed concern that the U.S. could see a surge in attacks on election-related systems as the nation gets closer to Tuesday’s vote, noting Tehran has been aggressively flexing new capabilities.

"We wouldn't be surprised to see more website defacements," CISA Director Christopher Krebs told reporters earlier Friday, calling it, “a tried-and-true tactic of the Iranians."

He said Iran has also been known to use distributed denial of service attacks (DDoS), which block access to websites by overwhelming the server hosting the site with internet traffic.

'Iran's capabilities are growing'

Researchers, though, caution against overplaying Iran’s cyber capabilities just based on the intimidation emails and the video.

“It was a combination of the kinds of tools that spammers use to get out lots of messages, along with a pretty ham-fisted attempt at trying to get some of the narrative around this traction on social media,” John Scott-Railton, a senior researcher with The Citizen Lab at the University of Toronto's Munk School, told VOA after the initial salvo.

“What it felt like was a group that could do certain things well but didn't necessarily have a great idea about how to do some of the more nuanced, sort of culturally sensitive things that go into doing a disinformation campaign,” he said.

But Scott-Railton also said that could change.

“Iran's capabilities are growing and they're learning. And each tango with this kind of thing results in an evolution and maybe an improvement for the next time around,” he said.

In the meantime, U.S. officials are bracing for more, whether from Iran or from Russia, which also has managed to access voter registration databases, though intelligence and election officials now describe what the Russians got as products based on the data, and not the data itself.

Other U.S. adversaries might also try to build on what they perceive as a sense of vulnerability.

“I would expect claims from any number of actors that maybe they’ve been able to manipulate [data or websites],” Krebs said, though he warned in many cases the claims will far exceed their actual capabilities.

What Happens Next?

What It Means to Become President-Elect in the US

In the United States, Democrat Joe Biden is being called the president-elect.

President-elect is a descriptive term not an official office. As such, Biden has no power in the government, and he would not until he is inaugurated at noon on January 20, 2021.

American news networks, which track all of the vote counting, determined on November 7 that Biden’s lead had become insurmountable in Pennsylvania, putting him over the 270 electoral votes needed to be president. Within minutes of determining his lead was mathematically assured, they projected him as the winner.

That is why news organizations, including VOA, are calling Biden the "projected winner."

Sometimes, in the case of particularly close elections, when news networks make this call, the other candidate does not concede victory. President Donald Trump has not done so, alleging voter fraud without substantial evidence and vowing to fight on. The president’s position has left Washington lawmakers divided, with Republicans backing a legal inquiry into allegations of vote fraud, even as they celebrate other congressional lawmakers who won their races.

When will the dispute be resolved?

The U.S. election won’t be officially certified for weeks. In the meantime, court challenges and state recounts could occur.

So far, the Trump administration has not provided evidence for any fraud that could overturn the result, but there is still time for more legal challenges.

Once states have certified the vote, pledged electors then cast their votes in the Electoral College in mid-December. Congress then certifies the overall Electoral College result in early January, about two weeks before Inauguration Day.