US Election Cybersecurity Plan Released 40 Days Before Midterms
Officials criticize the delayed and inadequate federal election security measures.
1Late-stage security plan
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a 13-page election security plan just 40 days before the November midterms. The document outlines potential threats like software vulnerabilities, voter database hacks, and physical security incidents. However, multiple state election officials criticized the timing as too late to implement meaningful protections, with Nevada's Secretary of State calling it a 'nice effort' that should have come sooner with more funding.
2Previous security cuts
During the Trump administration, CISA saw significant reductions in its election security role, including the loss of about 1,000 employees and $10 million cut from cybersecurity initiatives. The agency went without a Senate-confirmed director throughout Trump's second term. These cuts forced state officials to seek private vendors for services like penetration testing, with Minnesota spending approximately $250,000 on such services for this election cycle.
3Broken trust with states
Multiple secretaries of state reported deteriorated relationships with CISA, describing communications as 'sporadic and irregular.' Maine's Secretary of State noted the absence of previously provided intelligence briefings about foreign threats. Arizona's election chief went further, stating he directly told CISA officials he didn't trust them during a tense National Association of Secretaries of State call in August.
4Regional support questions
While the new plan mentions CISA's 10 regional directors, voting rights advocates question whether the agency has sufficient staffing to deliver promised support. Michigan's Deputy Secretary of State described their relationship with CISA as 'nonexistent' this year, despite previous collaboration. A voting rights director noted CISA's hiring efforts but uncertainty about filled positions as elections approach.
5Private sector filling gaps
With federal support lacking, states and organizations have turned to private solutions. Michigan's All Voting Is Local hired former CISA employees to provide training to election clerks. Minnesota and other states contracted private vendors for penetration testing and other security services normally provided by CISA, creating additional costs for state taxpayers rather than federal funding covering these needs.
6Partisan perspectives
Reactions to CISA's plan split along party lines, with West Virginia's Republican Secretary of State praising some continual assistance, while Democratic officials were more critical. The plan's release followed Trump administration moves to restart election security assistance after a hiatus, though it coincided with controversial voter fraud claims about noncitizen voting - a phenomenon research shows is extremely rare.
7Physical security concerns
The security plan addresses both cyber and physical threats, referencing bomb threats that targeted polling locations in 2024. It aims to ensure public trust in voting systems and safety at polling places. However, officials note many states have already implemented their own security measures without waiting for federal guidance, with Michigan's deputy secretary expressing confidence in their election security despite lack of CISA collaboration.
8Implementation challenges
With ballots already being mailed in some states like Michigan, the practical impact of CISA's last-minute plan remains uncertain. Election administrators question whether described support can reach local officials in time. As one voting rights director put it: 'What matters now is whether the support described in it reaches local election officials before November' - suggesting the plan may be more symbolic than operational at this late stage.