40 days to midterms, election officials say new U.S. cyber plan comes too late
NEW YORK — The nation’s cybersecurity agency on Thursday released an election infrastructure security plan 40 days before November’s midterms, laying out potential threats to election systems and listing services it would offer to election officials to protect the vote.
Election officials said the plan is both inadequate and belated after the administration gutted the agency’s election security work last year, prompting the officials to pay for private services to ensure they were prepared for the upcoming elections.
“For them to come in five weeks before the election, yeah, nice effort,” said Nevada’s Democratic Secretary of State Cisco Aguilar, who added that he would have liked to see the federal government provide more funding for cybersecurity, rather than Nevada taxpayers having to pay for it.
Homeland Security Secretary Markwayne Mullin had originally promised to release the plan by mid-August as part of the Trump administration’s move to kickstart election security assistance after a hiatus. He announced the plan at the same time he threatened election officials for not cooperating with the administration’s preferred methods to hunt down noncitizen voting, a phenomenon that research shows is extremely rare.
The U.S. Cybersecurity and Infrastructure Security Agency, which is housed under the Department of Homeland Security, has since its founding in 2018 helped warn state and local election officials about potential threats from foreign governments.
But CISA, as it’s known, was largely absent from that role in last year’s elections after the Trump administration dismantled much of its role in election security. The administration cut some 1,000 employees from CISA and slashed $10 million from two cybersecurity initiatives, including one dedicated to helping state and local election officials.
CISA has also gone the entirety of Trump’s second term without a Senate-confirmed director, instead cycling through a series of acting leaders.
Plan refers to ‘consistent’ support that many election officials say has been lacking
The 13-page document released Thursday warns of various threats to election security, including software vulnerabilities, hacks of voter registration databases, insider threats and physical security incidents, such as bomb threats that targeted several polling locations in the 2024 elections.
But it affirms that many longstanding election practices can address such threats and says the agency’s goal is “to ensure the American people can trust voting systems and know that physical safety measures will be in place when they go to their assigned polling locations to cast their votes.”
It states that DHS has “consistently supported CISA’s delivery of cybersecurity and physical security services to election officials,” something numerous election officials around the country have said isn’t true.
Multiple secretaries of state told the Associated Press that services previously provided by CISA, such as live tabletop exercises and penetration tests to evaluate security of their systems, were not available in the lead-up to this year’s midterms.
Minnesota Secretary of State Scott Simon, a Democrat, said in August that his office expects to spend roughly $250,000 on private vendors to conduct penetration testing, which can expose security vulnerabilities and recommend actionable fixes.
Shenna Bellows, the Democratic secretary of state in Maine, told the AP the same month that communications with CISA had been “sporadic and irregular, to say the least.” She said it would be helpful if the Trump administration could restore intelligence briefings that used to be granted to election officials about threats from foreign adversaries, but noted that trust with federal officials had been broken with the cuts to the agency.
Thursday’s plan doesn’t mention any specific 2026 threats from adversaries like Russia, Iran or China, all of whom have sought to meddle in U.S. elections — either directly through hacking or indirectly through influence campaigns.
Kris Warner, the Republican secretary of state in West Virginia, said Thursday that some of CISA’s assistance to his state had been continual throughout the Trump administration, including no-cost reviews of its public-facing websites for cybersecurity issues.
Warner acknowledged CISA had cut back under the Trump administration but said he views the agency “as a resource and not as a service provider” and said his office had last year hired a departing CISA election security advisor who has helped fill any gaps that may exist.
Report follows August call between CISA and election officials
In early August, two CISA officials — acting director Nick Anderson and assistant director for integrated operations Jim Harrell — joined a National Assn. of Secretaries of State call attended by a bipartisan group of secretaries of state, according to several election administrators.
The call grew tense when Arizona’s Democratic Secretary of State Adrian Fontes voiced his concerns about the withdrawal of federal resources.
Fontes told the AP at the time that he told the CISA officials he didn’t trust them. He said it seemed to him the officials were there “to cover their butts.”
“They even acknowledged on the call that it was too late for them to do anything for 2026,” he said.
Simon said the officials appeared interested in rebuilding relationships and previewing their future plans, which he appreciated. But he said the effort at goodwill came later than election officials needed.
“Secretaries of state have already moved on and sought other partners and other resources for the services that CISA has retreated from over the last year and a half,” Simon said.
In Michigan, a voting rights group has tried to fill the gap
In Michigan, where mail ballots have already been sent out for the Nov. 3 elections, Deputy Secretary of State Aghogho Edevbie said the state’s relationship with CISA has been “nonexistent” this year despite working together closely in previous election cycles.
“If the federal government wants to be helpful, they can’t do so at the 11th hour,” the Democrat said.
Ashiya Brown, the Michigan state director of the voting rights group All Voting Is Local, agreed. She noted the new plan says CISA has 10 regional directors to support election administrators but still doesn’t answer her biggest question.
“Does CISA still have the people and capacity to provide that support when clerks need it?” she asked. “I’m glad CISA has put forward a plan, but what matters now is whether the support described in it reaches local election officials before November.”
CISA has been hiring on its website for new positions, Brown said, but it’s unclear whether they are all staffed yet.
Meanwhile, Brown, a former security official with the Michigan Department of State, said her group has hired former CISA employees to help provide training and other support to election clerks and fill the gap.
Edevbie said even without collaboration with CISA, he is confident the state’s elections are secure.
“We are always prepared to defend our elections and to ensure that every voter who is eligible to cast a ballot can do so here in Michigan,” he said.
Swenson writes for the Associated Press. AP writers Jessica Hill in Las Vegas and Jacqueline GaNun in Lansing, Mich., contributed to this report.
