40 days to midterms, election officials say new US cyber plan comes too
late
[September 25, 2026]
By ALI SWENSON
NEW YORK (AP) — The nation’s cybersecurity agency on Thursday released
an election infrastructure security plan 40 days before November’s
midterms, laying out potential threats to election systems and listing
services it would offer to election officials to protect the vote.
Election officials said the plan is both inadequate and belated after
the administration gutted the agency’s election security work last year,
prompting the officials to pay for private services to ensure they were
prepared for the upcoming elections.
“For them to come in five weeks before the election, yeah, nice effort,”
said Nevada's Democratic Secretary of State Cisco Aguilar, who added
that he would have liked to see the federal government provide more
funding for cybersecurity, rather than Nevada taxpayers having to pay
for it.
Homeland Security Secretary Markwayne Mullin had originally promised to
release the plan by mid-August as part of the Trump administration's
move to kickstart election security assistance after a hiatus. He
announced the plan at the same time he threatened election officials for
not cooperating with the administration's preferred methods to hunt down
noncitizen voting, a phenomenon that research shows is extremely rare.
The U.S. Cybersecurity and Infrastructure Security Agency, which is
housed under the Department of Homeland Security, has since its founding
in 2018 helped warn state and local election officials about potential
threats from foreign governments.
But CISA, as it’s known, was largely absent from that role in last
year’s elections after the Trump administration dismantled much of its
role in election security. The administration cut some 1,000 employees
from CISA and slashed $10 million from two cybersecurity initiatives,
including one dedicated to helping state and local election officials.
CISA has also gone the entirety of Trump’s second term without a
Senate-confirmed director, instead cycling through a series of acting
leaders.
Plan refers to ‘consistent’ support that many election officials say
has been lacking
The 13-page document released Thursday warns of various threats to
election security, including software vulnerabilities, hacks of voter
registration databases, insider threats and physical security incidents,
such as bomb threats that targeted several polling locations in the 2024
elections.
But it affirms that many longstanding election practices can address
such threats and says the agency’s goal is “to ensure the American
people can trust voting systems and know that physical safety measures
will be in place when they go to their assigned polling locations to
cast their votes.”
It states that DHS has “consistently supported CISA’s delivery of
cybersecurity and physical security services to election officials,”
something numerous election officials around the country have said isn't
true.
Multiple secretaries of state told The Associated Press that services
previously provided by CISA, such as live tabletop exercises and
penetration tests to evaluate security of their systems, were not
available in the lead-up to this year's midterms.
Minnesota Secretary of State Scott Simon, a Democrat, said in August
that his office expects to spend roughly $250,000 on private vendors to
conduct penetration testing, which can expose security vulnerabilities
and recommend actionable fixes.
Shenna Bellows, the Democratic secretary of state in Maine, told the AP
the same month that communications with CISA had been “sporadic and
irregular, to say the least.” She said it would be helpful if the Trump
administration could restore intelligence briefings that used to be
granted to election officials about threats from foreign adversaries,
but noted that trust with federal officials had been broken with the
cuts to the agency.
Thursday's plan doesn't mention any specific 2026 threats from
adversaries like Russia, Iran or China, all of whom have sought to
meddle in U.S. elections — either directly through hacking or indirectly
through influence campaigns.
Kris Warner, the Republican secretary of state in West Virginia, said
Thursday that some of CISA’s assistance to his state had been continual
throughout the Trump administration, including no-cost reviews of its
public-facing websites for cybersecurity issues.
[to top of second column]
|
A voter casts a ballot on the first day of early voting in Minnesota
at the Elections & Voter Services building, Friday, Sept. 18, 2026,
in Minneapolis. (AP Photo/Ellen Schmidt)
Warner acknowledged CISA had cut back under the Trump administration
but said he views the agency “as a resource and not as a service
provider” and said his office had last year hired a departing CISA
election security adviser who has helped fill any gaps that may
exist.
Report follows August call between CISA and election officials
In early August, two CISA officials — acting director Nick Anderson
and assistant director for integrated operations Jim Harrell —
joined a National Association of Secretaries of State call attended
by a bipartisan group of secretaries of state, according to several
election administrators.
The call grew tense when Arizona's Democratic Secretary of State
Adrian Fontes voiced his concerns about the withdrawal of federal
resources.
Fontes told the AP at the time that he told the CISA officials he
didn’t trust them. He said it seemed to him the officials were there
“to cover their butts.”
“They even acknowledged on the call that it was too late for them to
do anything for 2026,” he said.
Simon said the officials appeared interested in rebuilding
relationships and previewing their future plans, which he
appreciated. But he said the effort at goodwill came later than
election officials needed.
“Secretaries of state have already moved on and sought other
partners and other resources for the services that CISA has
retreated from over the last year and a half,” Simon said.
In Michigan, a voting rights group has tried to fill the gap
In Michigan, where mail ballots have already been sent out for
the Nov. 3 elections, Deputy Secretary of State Aghogho Edevbie said
the state’s relationship with CISA has been “nonexistent” this year
despite working together closely in previous election cycles.
“If the federal government wants to be helpful, they can’t do so at
the 11th hour,” the Democrat said.
Ashiya Brown, the Michigan state director of the voting rights group
All Voting Is Local, agreed. She noted the new plan says CISA has 10
regional directors to support election administrators but still
doesn't answer her biggest question.
“Does CISA still have the people and capacity to provide that
support when clerks need it?” she asked. “I’m glad CISA has put
forward a plan, but what matters now is whether the support
described in it reaches local election officials before November.”
CISA has been hiring on its website for new positions, Brown said,
but it's unclear whether they are all staffed yet.
Meanwhile, Brown, a former security official with the Michigan
Department of State, said her group has hired former CISA employees
to help provide training and other support to election clerks and
fill the gap.
Edevbie said even without collaboration with CISA, he is confident
the state’s elections are secure.
“We are always prepared to defend our elections and to ensure that
every voter who is eligible to cast a ballot can do so here in
Michigan,” he said.
___
Associated Press writers Jessica Hill in Las Vegas and Jacqueline
GaNun in Lansing, Michigan, contributed to this report.
All contents © copyright 2026 Associated Press. All rights reserved
 |
