Russian influence operations intensified ahead of Election Day. Officials expect it to continue

A hit-and-run cover-up. Sexual abuse allegations from 27 years ago. An election worker ripping up ballots. Haitian immigrants admitting to voter fraud.

These were some of the stories featured in a series of videos from a Russia-linked disinformation network that laid out serious allegations of fraud and other misdeeds in the 2024 U.S. presidential election’s lead-up.

The U.S. government responded swiftly to these videos’ falsehoods. But experts said the threat of foreign influence operations was unlikely to end after Election Day. 

Former President Donald Trump declared victory early Nov. 6 and Vice President Kamala Harris congratulated him. Cybersecurity and Infrastructure Security Agency Director Jen Easterly said malicious activity had no material effect on election infrastructure security and integrity.

Two Georgia polling places briefly halted voting because of noncredible bomb threats that Secretary of State Brad Raffensperger said were "of Russian origin." The FBI also credited Russian email domains with circulating bomb threats in several states, although the agency did not deem them credible.

Ahead of the election, however, the Office of the Director of National Intelligence, the FBI and the Cybersecurity and Infrastructure Security Agency issued a joint statement saying they expected influence operations from foreign adversaries, particularly Russia, to intensify through and beyond Election Day.

"Russia is the most active threat," the statement said. "Influence actors linked to Russia in particular are manufacturing videos and creating fake articles to undermine the legitimacy of the election, instill fear in voters regarding the election process, and suggest Americans are using violence against each other due to political preferences."

PolitiFact has had a front-row seat as these viral videos dropped in social media feeds, where they have the potential to thrive or die based on individual platforms’ policies against misinformation. The videos generally painted Harris, the Democratic presidential nominee, and her running mate, Minnesota Gov. Tim Walz, in a negative light and implied that the security of U.S. elections is in shambles. 

"Russia cares about this election because of the existential threat they face in Ukraine," Darren Linvill, Clemson University communication professor, told PolitiFact. He said the election disinformation flowed out of Russia’s already established disinformation campaign that aimed to undermine Western support for the war in Ukraine. With Trump, who has expressed admiration for Russia’s prime minister, promising to end the war there in 24 hours, the election’s outcome has long been expected to impact U.S.-Ukraine relations and the war as a whole. 

Melanie Smith, director of research for the Institute for Strategic Dialogue think tank’s U.S. division, said these influence efforts are part of a strategy that extends beyond the election.

"They are invested in undermining institutions in the U.S., as well as the U.S.'s reputation internationally," she told PolitiFact. "Elections tend to just be a flashpoint moment that they put extra (resources) behind, but we need to consider their impact long-term, too."

Here’s a look at our fact checks of falsehoods that stemmed from Russian influence operations.

Falsehoods linked to the Russian campaign ‘Storm-1516’

(Screenshot from X)

Researchers have attributed at least five falsehoods to a Russian campaign dubbed "Storm-1516." Linvill and Patrick Warren, co-directors of the Clemson University research group, Media Forensics Hub said they were the first to identify the disinformation campaign and did so as part of their work studying online deception. Microsoft Threat Analysis Center, an expert group that analyzes nation-state threats, soon named it "Storm-1516." (Microsoft names emerging groups of threat activity using "Storm" and a four-digit number.) 

The Media Forensics Hub tracked at least 52 online narratives between August 2023 and Oct. 3 that they believe stemmed from Storm-1516. In the weeks before Election Day, some took the form of videos that employed actors who recounted wild stories about the candidates and about battleground state voting.

• In clips shared Sept. 4, a woman supposedly named "Alicia Brown" told a fabricated story about a 2011 hit-and-run incident in which she alleged Harris was the driver of a car that struck her. PolitiFact rated that claim Pants on Fire! 

• In another instance, video clips showed someone who claimed to be one of Walz’s former students, accusing the governor of sexual abuse. This video was uploaded days after an X account posted supposed screenshots of documents claiming Walz had "an inappropriate relationship with a minor" during his time as a public school teacher. PolitiFact examined the account’s posts and rated the claim Pants on Fire!

• Another video showed a person opening mail ballots in Bucks County, Pennsylvania, and ripping up those with votes for Trump. PolitiFact found it baseless and rated it Pants on Fire!

• Less than a week before Election Day, a man in a video claimed to be from Haiti and said he would be voting many times for Harris using several driver’s licenses. It received PolitiFact’s Pants on Fire rating, too.

• On Nov. 5, Election Day, a video circulated on social media claiming that two Harris supporters assaulted a Trump voter at a polling place in Wisconsin. PolitiFact also rated it Pants on Fire!

Warren and Linvill wrote that the disinformation campaign is connected to the Russian Foundation to Battle Injustice or R-FBI, a group tied to the Internet Research Agency — the Kremlin-linked organization that the U.S. Justice Department found infiltrated social media platforms in an attempt to interfere in the 2016 U.S. election. 

Storm-1516’s tactics resemble those used by the Internet Research Agency — and the kinds of campaigns that the KGB, Russia’s former secret police and intelligence agency, used during the Cold War to conceal the origins of false or misleading information, Linvill said. 

"What they are doing now is different than what they did in recent election cycles, but not that different from what Russia has done historically," Linvill told PolitiFact in an email. In 2016 and 2020, he said, Russians used fake troll accounts, attempting to engage and sow discord in certain communities.

As part of a 1983 campaign known as Operation Infektion, for example, a KGB-created Indian newspaper published a fake letter titled "AIDS may Invade India" that falsely claimed AIDS originated from a Maryland research facility.

Fast-forward to 2024 and it’s easier than ever to quickly disseminate fabricated stories to wide audiences — and video is especially effective, as platforms prioritize the medium and it is easily reshared and reposted without any attribution. 

"With digital technologies (everything from email and automatic payments systems to AI) that whole process is done in a couple of days by a handful of people," Linvill said.  

(Screenshot from archived KBSF-tv.com website)

Here are what Linvill and Smith say are some of Storm-1516’s tactics:

• Reliance on fake news websites: The supposed hit-and-run story came from a news organization named "KBSF San Francisco News" that further research showed didn’t exist.

• Use of actors: Although the use of artificial intelligence is a growing trend in the spread of dis- and misinformation generally, Storm-1516 employs a simpler approach in these videos. The Bucks County video, the fake hit-and-run testimony, the video that purported to show Haitians with plans to vote multiple times and the supposed testimony of the former Walz student all relied on what appeared to be actors. Linvill said his team has found evidence that Storm-1516 has a record of employing West African actors.

• Paying influencers: An X account called "AlphaFox" initially shared the voting video with the supposed Haitians. The person behind that account — an American man who resides in Massachusetts — told CNN that a pro-Kremlin propagandist paid him $100 to post it. He did so without fact-checking any of the video’s claims, CNN reported. The offer came from Russian propagandist Simeon Boikov, who had paid him roughly 10 other times also, CNN reported. Warren and Linvill found that Boikov plays a prominent role in Storm-1516’s distribution network.

"It’s not possible to tell whether campaigns like these make a tangible difference to the way people vote, but we do know that operations like Storm-1516 further muddied the information environment in the weeks leading up to Election Day by introducing and amplifying false narratives," Smith said.

In 2024, the U.S. intelligence community upped its efforts to counter Russian disinformation by "quickly and directly" identifying it as soon as they saw it, Linvill said.

A day after the video claims emerged about Bucks County and Haitians voting, the agencies released joint statements to dispute them.

"We have prioritized transparency with the American people and call out when our foreign adversaries are targeting our elections process and our elections infrastructure in their influence campaigns," CISA Senior Advisor to the Director Cait Conley said in a Nov. 5 press call. "And we remain postured to continue to do so."

But recent history shows these videos thrive on X, even after federal agencies cast light on their tactics. 

X is the "platform of choice" for foreign malign actors because of its "reportedly weak threat intelligence team, the platform's libertarian approach, and even small changes like hiding ‘like’ accounts," Alperovitch Institute for Cybersecurity Studies founding Director Thomas Rid wrote in a Nov. 2 X thread. 

Since billionaire Elon Musk bought the platform formerly known as Twitter in 2022, the safeguards that were in place to protect users from misinformation deteriorated or were removed, empowering bad actors to spread falsehoods and conspiracies. Such platform changes included removing the free account verification process in favor of a paid blue check program.

"The platforms are best positioned to take action, but unfortunately have pulled back from their responsibilities," Linvill said. "This is especially true of X, which has taken a disappointing (hands-off) approach since Musk's purchase of the platform."

On Nov. 5, CBS News reported, X suspended multiple accounts that shared videos attributed to Storm-1516; X did not confirm why.

Overall, Linvill thinks Russian influence played "only a marginal role" in the election outcome, and it was "one of 1,000 factors that decided the campaign in favor of President Trump."

In a Nov. 7 email to PolitiFact, he said, "All of Russia's work in the final days was about undermining the results and setting up doubt should Trump lose, which was ultimately moot."

But it doesn’t end there. Linvill said that after Election Day, he has observed more Russian activity that shows the influence actors’ priorities. "It’s all about Ukraine," he said. He attributed to Storm-1516 a Nov. 6 X video that supposedly showed Ukrainians shooting and burning a dummy with a Trump shirt and red hat. "Donald need to clean that mess up and stop sending them tax money," the caption read, apparently urging Trump to stop aid to Ukraine.

When asked about the intelligence community’s outlook beyond Election Day and whether its earlier statements still hold, Tess Hyre, a CISA spokesperson, told PolitiFact to refer to the Nov. 4 joint statement. 

Lauren Frost, spokesperson for the Office of the Director of National Intelligence, referred PolitiFact to its Oct. 22 analysis, which said the intelligence community expects foreign actors to continue influence activities until the inauguration, aiming to delegitimize U.S. democracy. The FBI did not respond.

"Expect to see more of this," Linvill said in a Nov. 7 X post. "Like any good lobbying campaign they want this issue at the top of Trump's agenda."

PolitiFact Researcher Caryn Baird contributed to this report.