US Cybersecurity Agency Releases Election Security Plan Weeks Before Midterms
Election officials express concern that the plan is inadequate and arrived too late to address potential threats effectively.
The nation's cybersecurity agency released an election infrastructure security plan on Thursday, just 40 days before the November midterms. The plan outlines potential threats to election systems and details services the Cybersecurity and Infrastructure Security Agency (CISA) will offer to election officials. However, election officials stated that the plan is both inadequate and belated, particularly after CISA's election security work was significantly reduced last year.
Nevada's Democratic Secretary of State Cisco Aguilar noted that the timing of the plan's release, five weeks before the election, was "nice effort" but expressed a desire for more federal funding for cybersecurity, rather than relying on state taxpayers. Homeland Security Secretary Markwayne Mullin had previously promised the plan by mid-August as part of an effort to bolster election security assistance.
CISA, established in 2018, has historically warned state and local election officials about foreign government threats. However, its role in election security was largely diminished under the Trump administration, which cut approximately 1,000 employees from CISA and reduced funding for initiatives supporting election officials. Furthermore, CISA has operated without a Senate-confirmed director throughout the current administration, relying on acting leaders.
The 13-page document released Thursday identifies threats such as software vulnerabilities, hacks of voter registration databases, insider threats, and physical security incidents, including bomb threats that targeted polling locations in previous elections. The agency stated its goal is to ensure public trust in voting systems and the physical safety of polling locations.
Despite CISA's assertion of consistent support for election officials, numerous secretaries of state have reported a lack of previously available services, such as live tabletop exercises and penetration tests. Minnesota Secretary of State Scott Simon indicated his office would spend approximately $250,000 on private vendors for penetration testing. Maine's Democratic Secretary of State Shenna Bellows described communications with CISA as "sporadic and irregular" and expressed a desire for the restoration of intelligence briefings on foreign adversary threats.
The plan does not specifically mention threats from adversaries like Russia, Iran, or China. Kris Warner, the Republican Secretary of State in West Virginia, acknowledged CISA's reduced capacity but views the agency as a resource rather than a direct service provider, noting his office hired a former CISA election security adviser to fill gaps.
In August, CISA officials participated in a call with the National Association of Secretaries of State, where concerns were raised about the withdrawal of federal resources. Arizona's Democratic Secretary of State Adrian Fontes stated he did not trust the officials and believed their appearance was an attempt "to cover their butts," adding that CISA acknowledged it was too late for them to provide meaningful assistance for the upcoming elections.
Other election officials, like Michigan's Deputy Secretary of State Aghogho Edevbie, expressed confidence in their state's election security despite a "nonexistent" relationship with CISA this year. The voting rights group All Voting Is Local noted that while CISA is hiring, it remains unclear if the agency has the capacity to provide timely support to local officials. Edevbie confirmed that Michigan is prepared to defend its elections and ensure eligible voters can cast ballots.