US cybersecurity agency releases election infrastructure plan 40 days before midterms

NEW YORK (AP) — The nation’s cybersecurity agency on Thursday released an election infrastructure security plan 40 days before November’s midterms , laying out potential threats to election systems and listing services it would offer to election officials to protect the vote.

The plan, which Homeland Security Secretary Markwayne Mullin had originally promised to release by mid-August, comes as the Trump administration has been trying to kickstart efforts to help states protect voting systems. Election officials have argued that such efforts are too little, too late after the administration gutted the agency’s election security work last year, prompting the officials to pay for private services to ensure they were prepared for the upcoming elections.

“Election security is national security,” Mullin said in a statement Thursday. “This plan, which will be implemented in full, is crucial to the security, freeness, and fairness of choosing the leaders of our country.”

The document warns of various threats to election security, including software vulnerabilities, hacks of voter registration databases, insider threats and physical security incidents, such as bomb threats that targeted several polling locations in the 2024 elections.

But it notes that many longstanding election practices can address such threats and says the agency's goal is “to ensure the American people can trust voting systems and know that physical safety measures will be in place when they go to their assigned polling locations to cast their votes.”

The U.S. Cybersecurity and Infrastructure Security Agency, which is housed under the Department of Homeland Security, has since its founding in 2018 helped warn state and local election officials about potential threats from foreign governments.

But CISA, as it’s known, was largely absent from that role in last year’s elections after the Trump administration dismantled much of its role on election security. The administration cut some 1,000 employees from CISA and slashed $10 million from two cybersecurity initiatives, including one dedicated to helping state and local election officials.

CISA has also gone the entirety of Trump’s second term without a Senate-confirmed director , instead cycling through a series of acting leaders.

The 13-page document released Thursday says DHS has “consistently supported CISA’s delivery of cybersecurity and physical security services to election officials,” and that such services are provided at no cost to state and local election officials at their request.

Numerous state election officials around the country have told The Associated Press otherwise, noting that services historically provided by CISA, such as live tabletop exercises and penetration tests to evaluate security of their systems, were not available in the lead-up to this year's midterm elections.

Minnesota Secretary of State Scott Simon, a Democrat, said in August that his office expects to spend roughly $250,000 on private vendors to conduct penetration testing, which can expose security vulnerabilities and recommend actionable fixes.

Shenna Bellows, the Democratic secretary of state in Maine, told the AP the same month that communications with CISA had been “sporadic and irregular, to say the least.”

She said it would be helpful if the Trump administration could restore intelligence briefings that used to be granted to election officials about threats from foreign adversaries, but noted that trust with federal officials had been broken with the cuts to the agency.

The new document explains that CISA's support to election officials is led by 10 “regional directors,” a structure that strays from how CISA had operated in the past, said David Becker, executive director of the Center for Election Innovation and Research. In the past, there were state and regional advisers, he said.

Becker said the new report was a positive step, but perhaps a performative one given that states have already turned to other resources.

“The reality is that no state, red or blue, is relying upon the federal government for this assistance at this point,” he said.

In early August, two CISA officials – acting director Nick Anderson and assistant director for integrated operations Jim Harrell – joined a National Association of Secretaries of State call attended by a bipartisan group of secretaries of state, according to several election administrators.

Simon said the officials appeared interested in rebuilding relationships and previewing their future plans, which he appreciated. But he said the effort at goodwill came later than election officials needed.

“I would say it’s a pretty low bar for them to win the expectations battle because secretaries of state have already moved on and sought other partners and other resources for the services that CISA has retreated from over the last year and a half,” Simon said.

At one point in the call, Arizona's Democratic Secretary of State Adrian Fontes voiced concerns about the withdrawal of federal resources.

Fontes told the AP at the time that he told the CISA officials he didn’t trust them. He said it seemed to him the officials were there “to cover their butts.”

“They even acknowledged on the call that it was too late for them to do anything for 2026,” he said.

Still, he said, he’s confident that November’s elections will be secure.

“We’re going to have a good election whether or not we have a partner in CISA or the Department of Homeland Security,” he said.