• China's latest efforts to influence the outcome of U.S. elections is shifting away from the presidential race and toward state and local candidates.
• "Russia, China, and Iran are largely looking to sow discord in the U.S., but China is probably the most strategic of the three," said the former executive director of the Cybersecurity and Infrastructure Security Agency.
• Local and state elections have become prime targets for Chinese interference because they receive far less scrutiny than national races, making it easier for China's influence campaigns to fly under the radar.

With the U.S. presidential election fast approaching, U.S. intelligence officials have issued a stark warning: China's latest efforts to influence the outcome is shifting away from the presidential race and toward state and local candidates.

This new focus is part of a broader strategy by Beijing to build relationships with officials who could eventually advance China's interests. With Washington largely opposed to its agenda, Beijing is seizing opportunities at the local level, where it believes it has a more profound impact.

"Russia, China, and Iran are largely looking to sow discord in the U.S., but China is probably the most strategic of the three, where they've got long-term goals in terms of trying to cultivate a political ecosystem more favorable to their overall policies," said Brandon Wales, vice president of cybersecurity strategy at SentinelOne and former executive director of the Cybersecurity and Infrastructure Security Agency (CISA). "Russia and Iran, they're really all about chaos."

Local and state elections have become prime targets for Chinese interference because they receive far less scrutiny than national races, making it easier for China's influence campaigns to fly under the radar. While national attention tends to focus on China's cyberthreats to critical infrastructure, economic espionage, or its aggressive diplomacy, the more insidious threats come from its efforts to shape the U.S. political ecosystem by cultivating relationships with local politicians.

"There is a need for more national awareness of how aggressive the Chinese efforts are to shape the U.S. political environment," said Wales. "Chinese efforts have not received the same level of focus, and that creates long-term problems for us."

Disinformation is one of China's primary tools to influence U.S. elections, with the aim of creating a fragmented political environment that weakens both national resilience and cybersecurity efforts. "These operations are often subtle, planting stories or memes that spark debate and controversy, with the goal of distracting from international matters and reducing U.S. influence abroad," said Javad Abed, professor of information systems at Johns Hopkins Carey Business School.

"These actors most likely judge that amplifying controversial issues and rhetoric that seeks to divide Americans can serve their interests by making the U.S. and its democratic system look weak and by keeping the U.S. government distracted with internal issues instead of pushing back on their hostile behavior globally," said U.S. intelligence officials during a recent election security briefing.

One example of China's influence operations is its use of disinformation campaigns designed to exploit divisive issues such as immigration, racial justice, and economic inequality. Abed explained that China uses online platforms to circulate misleading narratives about U.S. border challenges or social justice movements, such as the George Floyd protests. By manipulating public discourse, experts said China seeks to amplify discord on sensitive topics while diverting attention from international matters.

In August, Microsoft highlighted in its Threat Intelligence Report one of China's influence campaigns known as Taizi Flood, in which hundreds of fake accounts were deployed to pose as real protestors during pro-Palestinian protests at U.S. universities. These actors spread inflammatory messages that fueled tensions and increased divisions across political lines. By imitating legitimate activists, the Taizi Flood campaign escalated unrest, making it difficult for Americans to discern the truth.

Another notable Chinese-led operation is Spamouflage, or Dragonbridge, which has been active since at least 2017. This campaign leverages thousands of fake accounts on more than 50 platforms to infiltrate political conversations in the U.S., spreading propaganda and divisive messages while discrediting politicians. Spamouflage's ability to penetrate local and national dialogues highlights the scale of China's long-term influence strategy.

Alphabet, Meta, Microsoft and false information

Alphabet, Meta, and Microsoft have faced increasing pressure to address the spread of false information on their platforms. In a recent Senate Select Committee on Intelligence hearing, Alphabet president Kent Walker revealed that the company has more than 500 analysts and researchers tracking between 270 and 300 foreign cyberattack groups. Despite these efforts, controlling the full scope of foreign influence operations remains a daunting challenge. Chairman of the Senate Intelligence Committee Mark Warner voiced concerns over Congress's failure to implement new regulations to prevent AI-generated disinformation from proliferating as the election approaches.

John Cohen, executive director of the Program for Countering Hybrid Threats at the Center for Internet Security, warns that these disinformation campaigns often have real-world consequences, such as swatting calls, bomb threats, and intimidation tactics aimed at election officials.

"We've seen these informational operations used in conjunction with demonstrations to encourage acts of violence and to have people begin targeting election officials and government officials," said Cohen.

As AI-generated misinformation becomes increasingly difficult to distinguish from reality, Cohen expressed concern about its impact on public trust in the election process. "Cyber threat actors can use AI to more rapidly develop attack techniques, and at computer speeds modify those attack techniques to circumvent security measures," he said.

"I've been working in law enforcement and homeland security for over 40 years now, but what concerns me the most is when I look at the threat actors that are out there, they are adapting their attack techniques at internet speed," Cohen said. "Our investigative activities and threat-mitigation activities still are operating at analog speed. We are not adapting rapidly enough to match what's being done by the threat actors, and that has to change."

Mitigating cybersecurity risk on Election Day

To address these growing threats, Cohen said local and state election officials must take proactive steps to secure their election infrastructure, ensuring that endpoint detection systems are up to date and that officials are prepared to respond to cyber threats quickly.

"They must think through the different types of physical world and cyber incidents they may confront in the leadup to and on Election Day," said Cohen. "Develop plans to protect against those threats should they occur, and make sure there are good lines of communication between election officials, emergency managers, law enforcement, and the cybersecurity leads for each jurisdiction."

Wales also highlighted the importance of state and local election officials participating in national information-sharing initiatives, such as the Election Infrastructure Information Sharing and Analysis Center and the Multi-State Information Sharing and Analysis Center. These programs provide real-time threat intelligence and help local officials better respond to emerging threats, ensuring that election systems remain secure.

Ultimately, Wales stressed that the responsibility for mitigating disinformation lies not only with officials but also with the American public. "We need everyone to think before they retweet, because it can be very damaging," he said.