ON SECURITY
The Corporate Risk From the U.S. Midterm Elections
Simmering domestic political grievances, rhetorical incitement and the influence of foreign actors mean that targeted attacks, isolated civil disturbances and malicious cyber activity are three of the largest corporate security risks to safety and operations in the run-up and immediately following the U.S. midterm elections in November. In the wake of federal authorities' Aug. 8 search of former President Donald Trump's Mar-a-Lago residence, extensive media reports have emerged regarding a spike in violent online rhetoric threatening retaliation. Although not released publicly, the FBI and Department of Homeland Security on Aug. 12 reportedly jointly issued an internal intelligence memo warning of heightened threats to "law enforcement, court, and government personnel," including some that are "specific in identifying proposed targets, tactics, or weaponry." As many observers had already warned, the FBI-DHS memo also reportedly specifically noted that the midterm elections could be "an additional flashpoint" for violence.
- Violent incidents linked to the Mar-a-Lago search have already occurred. Most notably, on Aug. 11 a man armed with an AR-style rifle and a nail gun attempted to breach the FBI's Cincinnati field office, but fled to a nearby cornfield where police later killed him after a six-hour standoff. The man posted on Trump-backed social media platform Truth Social that he wanted to kill federal agents, encouraged others to do the same, and even posted a message as he attempted his incursion into the FBI field office.
- On Aug. 12, police arrested a Pennsylvania man for a string of extremely violent posts on Gab, a social media platform popular with far-right extremists used to coordinate their activities before the Capitol riot on Jan. 6, 2021, threatening FBI agents.
- The FBI-DHS memo reportedly warned of many other online threats, including a threat "to place a so-called dirty bomb in front of FBI Headquarters;" repeated calls for "civil war," "armed rebellion" and similar violent threats; and many threats against specific individuals, which in some cases have included personal identifiable information like home addresses and family members' names as additional targets for violence.
- Numerous reports also have emerged of threatening rhetoric on more mainstream social media platforms like Twitter, on cable television and radio shows, and via public statements by high-profile groups or individuals, including national political leaders. For example, former Trump official Steve Bannon has made numerous online posts and public statements using the word "war" to describe a necessary response to the FBI search.
- While right-wing extremists have received far more attention given their apparent greater threat potential, authorities have also voiced concern about left-wing extremists — especially given the recent Supreme Court recent reversal of Roe v. Wade, which could motivate them to carry out physical attacks and other disruptive activities directed at politicians, judges, anti-abortion interest groups or others they hold responsible.
Taking advantage of persistent political grievances, the rhetorical incitement in recent weeks portends a lowering threshold for violence that foreign threat actors are also likely to exploit as the midterm elections near. Driven largely by the proliferation of various baseless conspiracy theories alleging widespread fraud in the November 2020 elections, many polls have indicated that between two-thirds and three-quarters (and in some cases more) of Republicans do not believe that President Joe Biden was legitimately elected. Scores of candidates who either outright deny or have questioned the results of Biden's election are on the ballot this fall, helping to harden resistance to Biden's legitimacy and to expand 2020 election denial narratives. The violent language following the FBI's Mar-a-Lago search has tapped into these grievances, as there is already a receptive audience predisposed to view Trump as a victim and to see various alleged opponents like the FBI as irredeemably belligerent and biased, thus necessitating what is portrayed as a justified response. The risk will increase if authorities — especially at the federal level, but also potentially in another jurisdiction — charge Trump with any one of potentially multiple crimes. While it is nearly impossible to draw clear causation between violent rhetoric and violent action, significant research has shown how language that is repeated, especially within so-called "echo chambers" (such as online forums or narrow media environments), can normalize ideas and influence the behavior of some individuals. These societal divisions and an environment of inflammatory rhetoric will provide fertile ground for a range of foreign threat actors, including nation-states like Russia and cybercrime groups, to amplify partisan sentiments, spread dis- and mis-information, and stoke real-world unrest.
- Matching the findings of other organizations, Economist/YouGov polling since the November 2020 elections has consistently found that upward of 70% of Republicans do not think Biden was legitimately elected. As of Aug. 15, a review by The Washington Post found that more than half of Republican victors in primary elections so far have repeated false claims about the past presidential election, suggesting that the issue will prominently feature in many campaigns and media coverage in the coming months.
- Multiple surveys have found that a significant minority (up to 25% in some cases) of U.S. voters feel that politically motivated violence can be justified in certain cases. Even acknowledging that such findings may be largely overstated and that only a small number of people may actually act on such views, that still leaves thousands of people — such as the Cincinnati gunman — who may be predisposed to take violent action on their own or in small groups, especially when they also have personal grievances. Notably, these risks exist not merely on the far-right but also on the far-left.
- Multiple countries, most notably Russia and Iran, have a history of seeking to directly interfere in U.S. elections by stoking partisan divides and inciting real-world unrest. The midterm elections may make a particularly tempting target for Russian information warfare because of the Kremlin's strong incentives to interfere in U.S. politics amid the ongoing war in Ukraine in a bid to elect less hawkish policymakers or at least distract the United States from foreign policy priorities by forcing it to focus on domestic problems.
Despite these underlying drivers for violence, the nature of the midterm elections, divisions among potential threat actors and preemptive protections by relevant third parties constrain the potential for coordinated and widespread violence. Unlike the November 2024 general elections, when Trump may again be the Republican presidential candidate, the midterm elections appear to lack a single event of national significance that could stir up anything akin to the Capitol siege. Moreover, despite high-profile media coverage of certain races and the potential for higher turnout in the wake of the reversal of Roe, voter participation in midterm elections is generally lower, as many people are less invested in the outcome compared to a presidential campaign. Meanwhile, for all the online calls for violence, right-wing extremists have been beset by internal divisions (over tactics, targets, timelines for action and other points) and mutual suspicion of undercover police officers in their midst. These challenges have prevented them from effectively coordinating any sort of large-scale disruptive, let alone violent, activity. To this end, law enforcement agencies at all levels of government have stepped up efforts to counter politically motivated violence, and more proactively deployed to prevent violence at potential flashpoints like public rallies. Furthermore, while still very much imperfect, social media and technology companies have put more attention on — and strengthened their abilities to remove — violent content and related dis- and mis-information.
- Far-right demonstrators called off a planned Aug. 14 protest outside of FBI headquarters in Washington after numerous individuals in online forums expressed concern that it was a trap set by law enforcement. In the past year and a half, similar fears of law enforcement infiltration have deterred or significantly limited turnout at similar protests, including the poorly attended Sept. 18, 2021, Justice for J6 rally outside the Capitol.
- Various federal agencies have been preparing for threats linked to the midterm elections. For example, the Cybersecurity and Infrastructure Security Agency has been providing resources to state and local election officials and recently convened a three-day tabletop exercise to prepare for a range of polling threats. Meanwhile, since its creation last year, the Department of Justice's Election Threats Task Force has reviewed more than 1,000 threats against election officials resulting in multiple investigations and a growing number of legal charges, most recently in mid-August against an Arizona man.
This threat landscape, which will intensify in the days surrounding the midterm elections, suggests that targeted attacks, sporadic civil disturbances and various cyberthreats are the most likely corporate security risks. While a wide range of other threats — such as heightened personal safety concerns for election and law enforcement officials, threats to polling places and other government buildings, and the potential for mass shootings that are at least in part politically motivated — exist, these do not necessarily present direct corporate security threats, even though they contribute to an elevated threat environment in which organizations and their personnel may be harmed. By contrast, the following threats are more likely to directly threaten employee safety and business continuity, and will become more likely if authorities take further legal action against Trump. Given the constraints on large coordinated group activity, lone actors or small groups are more likely to drive the first two threats, whereas foreign online threat actors are more likely to drive the third one.
- Targeted attacks: While election and government personnel and buildings face even greater risks, the diverse array of political grievances and threats mean that private organizations are by no means immune from targeted violence, especially if they are in any way linked to political activity, even if falsely or only tangentially. For instance, Dominion Voting Systems employees faced threats in the wake of the November 2020 elections after conspiracy theories fraudulently claimed its machines had been used to transfer votes from Trump to Biden. Similarly, threats to multiple social media and technology companies circulated online after they took steps to remove right-wing extremist content and users from their platforms following the Capitol riot. These examples suggest that private organizations' personnel or property may be similarly targeted for politically motivated violence, especially if they are portrayed as somehow linked to alleged election-related schemes or depicted as politically biased. Potential targeting ranges from lower level vandalism or harassment to lethal attacks. Notably, as seen during protests against mask and vaccine mandates, frontline personnel and publicly accessible property are at particular risk for retaliation against corporate policies. There may also be aggrieved employees who represent potential insider threats for violence targeted at their co-workers or against leadership. Though overall, right-wing extremists have expressed the clearest grievances, these scenarios could also include left-wing extremists.
- Isolated civil disturbances: Even if widespread violent unrest is less likely due to limits on coordinated group activity and a more proactive law enforcement posture, there will be an ongoing risk of disruptive protest activities that could escalate to at least larger disturbances (like looting and unruly street protests) in more confined areas. Even if not directly targeting organizations, these will present personal safety and business continuity risks, especially in urban areas. Potential flashpoints include clashes between protesters and counterprotesters (and secondarily between protesters and police) and localized attempts to storm and/or take over certain areas. These risks will be greatest in places with close or contested races, especially in battleground states like Arizona and Georgia, where there are a particularly high number of Republican candidates who question or outright deny the November 2020 election results. But regardless of where they occur, civil disturbances that last for even only a brief time — especially when they feature both far-right and far-left protesters who conduct tit-for-tat actions — can threaten employee safety, harm property and/or disrupt normal business operations. Furthermore, resulting security deployments to quell unrest can lengthen the time of disruptions by at least temporarily preventing access to certain areas or enforcing other local restrictions.
- Myriad cyberthreats: Nation-states, cybercriminals and hacktivists are all likely to view the midterm elections as a prime opportunity to pursue their varied goals as they seek to take advantage of political polarization and ongoing calls for violence. While they may at times use similar tactics or pursue complementary agendas, their past activity suggests countries will be more focused on spreading dis- and mis-information, cybercrime groups will seek ways to profit and hacktivists will aim to cause reputational harm. Not only are these threat vectors likely to amplify the two aforementioned risks — for example, nation-state efforts to amplify and spread false information may help provoke violent attacks or unrest — but also organizations themselves may be directly targeted. For instance, cybercriminals are all but certain to conduct election-related phishing scams to get into corporate networks to facilitate ransomware attacks, while hacktivists will be incentivized to carry out hack-and-leak or doxxing campaigns against corporate targets. Notably, politically sympathetic insiders may help some of these operations, especially as various cyber threat actors are increasingly seeking to recruit within organizations.
While the aforementioned threats are the most likely direct corporate security risks, there are also multiple lower likelihood but higher impact scenarios to consider in contingency planning. These scenarios do not include the possibility that domestic right-wing extremist groups could overcome internal divisions and mutual suspicions in order to carry out more coordinated attacks. Doing so would pose greater threats to personal safety and business operations, as violence would likely be more widespread and impactful. This could be via attacks on public spaces that could involve more sophisticated weaponry and tactics, especially if militia groups are involved. The following scenarios, however, are separate from this possibility.
- Major foreign or domestic terrorist attack: An attack, especially one that causes mass casualties, on or surrounding election day would not only present an immediate threat to public safety, but also pose various knock-on consequences that could pose secondary threats. These include undermining the legitimacy of the polls (for instance, if the attack leads to extremely low turnout that results in a surprising outcome) or causing broader unrest (for example, if right-wing extremist groups publicly mobilize in response to a jihadist attack). In this scenario, an overtly political domestic terrorist attack — be it from the far-right or far-left — would likely raise greater disruptive risks because it would inevitably stoke partisan recriminations with unpredictable consequences.
- High-profile assassination: The killing of a leading government official, a major politician or a similarly influential political figure could cause political instability (potentially generating protests and security deployments in response) and also lead to calls for vengeance that trigger a violent reaction or social unrest. As an example, if the California man arrested June 8 for plotting to kill Supreme Court Justice Brett Kavanaugh over his anti-abortion and pro-gun stances — an example highlighting the potential for left-wing extremism, especially regarding these issues — had succeeded in his attack, it could have triggered calls by right-wing extremists for violent retaliation.
- Anti-government standoff: As authorities continue to scrutinize the activities of various right-wing groups, there is a risk that an operation to disrupt one (something eminently possible before the midterm elections if law enforcement officials believe the group is plotting violence) leads to a protracted standoff. In such a scenario, sympathetic individuals may come to see members of the group as martyrs and inspire copycats to take action elsewhere in response to perceived government overreach. This risk would grow should law enforcement kill any group members, which would trigger calls for retaliation.
- Widely heeded call for protests: Should a losing candidate refuse to concede and call on supporters to take the streets, there would be a higher risk of disruptive, longer and potentially violent demonstrations. This threat would be greater if the candidate ran for a high-profile office (such as the U.S. House or Senate, or a state governorship) — thus generating much greater attention — and also if he/she alleges federal interference in state and local polls, thereby exploiting underlying anti-government sentiments. A similar situation specifically involving Trump could emerge if authorities formally charge him, which would fuel calls from him and his supporters to demonstrate publicly. As seen in the Capitol riot, such a scenario can quickly escalate, even if it begins peacefully.
