July 29, 2026

From foam-filled exhaust pipes to hacked water utilities: a new ISD tool maps how Russia, China and Iran are interfering in democracies and gives researchers, policymakers and journalists the evidence to track it.

Foreign interference is not new, but it is constantly evolving. Over the past decade, Russia, China and Iran have deployed an ever-expanding set of hybrid tactics to erode trust in democratic institutions and widen social divisions across Europe and North America. Elections remain frequent targets, but the threat reaches far beyond them, from cyberattacks on critical infrastructure to sabotage, arson and assassination plots carried out on Western soil.  

To capture this reality, ISD is launching the Authoritarian Interference Tracker (AIT), a tool that catalogues interference operations by Russia, China and Iran across five incident types: cyber operations, kinetic operations, information operations, malign finance, and political and civic subversion. Building on a database created by the Alliance for Securing Democracy—which merged with ISD in January—this new version adds activity linked to Iran, a redesigned interface, and new features for identifying trends across countries and incident types. The tracker documents more than 290 incidents that took place in 2022 or after.  

“The rate of authoritarian hybrid attack and interference in liberal democracies has risen significantly these last years,” said ISD co-founder and CEO Sasha Havlicek. “ISD is committed to detecting and exposing this activity as a basis for more effective deterrence and response. I am excited to be releasing this important resource serving the sector, to be further developed and grown with input from the expert and policy community over time.” 

“Critically, the Authoritarian Interference Tracker surfaces how interconnected the hybrid tactics of foreign interference truly are,” said ISD-US Managing Director for Transatlantic Policy and Programming David Salvo. “Information operations can reinforce cyber and kinetic operations to undermine democratic politics and civil society, and much of this activity is resourced through malign finance. Showcasing this interconnectivity can help policymakers conceptualize how to break down their own silos within government to address and counter this malign activity.” 

At the 2026 Munich Security Conference, ISD launched a “policy sprint” initiative to develop a new doctrine for hybrid deterrence and a realistic roadmap for raising the costs and blunting the impact of authoritarian efforts to undermine liberal democracies — exactly the type of malign activity the Authoritarian Interference Tracker captures.  

Examples of what can be found using the AIT:

• Russia remains the predominant threat actor across all incident types, with 188 documented incidents since 2022 — but Iran is intensifying fast, logging 18 incidents in the first half of 2026 alone. 
• Foreign actors are increasingly targeting energy and water systems with disruptive cyberattacks, including a group linked to Russian military intelligence that burst pipes and cut supply to hundreds of homes outside Copenhagen. 
• Russia and Iran are escalating on-the-ground kinetic attacks — from vandalism to arson and assassination plots — with documented Russian operations jumping from two in 2022 to close to 60 since the start of 2024. 
• Both states increasingly rely on disposable agents and criminal syndicates, recruited on platforms like Telegram and paid in cryptocurrency, with financial gain rather than ideology the most common motivation. 
• China’s most aggressive interference centers on transnational repression of diaspora communities and critics abroad, from illegal overseas “police stations” to AI-generated explicit deepfakes of a Canada-based critic of Beijing. 

You can explore the Authoritarian Interference Tracker here. If your newsroom or organization is interested in being trained on the tracker, has any questions, or would like to speak with the tracker’s authors, please contact [email protected].