On the eve of the November 3 midterm elections, the federal system built to warn state and local election officials about threats to voting is under unusual strain. Interviews with nearly a dozen election security experts, reported by CNN on November 1, describe the channels for passing on information about foreign threats as weaker than at any point since the 2016 election. The concern is not that a single attack has been confirmed against the 2026 vote. It is that, if something does happen on or around Election Day, the people running polling places and counting ballots may hear about it later, less clearly, or through a channel they do not yet trust.
That distinction matters. American elections are run by states and counties, not by Washington. The federal government’s role, in the model developed after 2016, has been to spot national-level dangers, such as a foreign influence operation or a cyber intrusion attempt, and to pass usable warnings down to the thousands of local offices that actually administer voting. When that link works, a local official does not have to guess whether a strange email, a software glitch or a threatening message is part of a wider pattern. When it weakens, each office is left to judge on its own, and rumours can fill the gap faster than verified information.
The timing makes the gap harder to ignore. More than 53 million ballots had already been cast early by the weekend before Election Day, according to the University of Florida Election Lab figures reported across the weekend. Polls open across the country on Tuesday, November 3, and the count will then begin in every state, under different rules and on different timetables. Election Day itself is therefore the moment when clear, trusted communication matters most, not least because results in close races may not be final on Tuesday night.
What election officials say has changed since 2016
The system that officials compare today with 2016 and 2020 was built, in large part, by the Cybersecurity and Infrastructure Security Agency, known as CISA, inside the Department of Homeland Security. CISA was created in 2018, and during the first Trump administration it took a central role in defending elections, including warning election officials during the 2020 vote about foreign influence operations. In later cycles, it ran a coordination centre that carried threat information to election officials and took reports back from them on Election Day itself.
According to the CNN reporting, that machinery has been hollowed out during the second Trump administration. The agency’s election-security work was scaled back in 2025, security experts have warned, and recent attempts to rebuild it have had limited effect, according to people who work in elections and spoke to CNN. The result, as several of those sources described it, is a practical problem as much as a political one: in many cases, election officials no longer know who to contact in the federal government when a cyber or physical incident occurs.
One episode illustrates the difficulty. In mid-October, a classified briefing for election officials, described as the first since the 2024 presidential election cycle, was marred by technical difficulties, with federal officials unable to get the video call to work, according to people familiar with the matter. A failed briefing does not by itself prove that a threat was missed. But for officials preparing for a national election, a briefing that cannot even connect becomes a symbol of a wider loss of reliability, and it leaves them less sure that the next warning will arrive in usable form.
Trust is the other half of the problem. The same reporting describes election administrators across the country as sceptical of the administration’s political motivations, in part because of its pursuit of election-fraud claims and its willingness to intervene in state-run elections. That scepticism cuts across party lines in the accounts given to CNN: one source said they did not know a single election official, Democrat or Republican, who was actively sharing cybersecurity information with federal officials this time around. If that assessment is even broadly right, it means the federal warning system is weakened not only by staffing and technical problems, but by a breakdown in the working relationship on which it depends.
Inside the 2026 midterm election security plan
The administration’s formal answer to these worries is a 13-page document published on September 24: the 2026 Election Infrastructure Security Plan. It was ordered in July by Homeland Security Secretary Markwayne Mullin, who had originally said it would be published by mid-August. The plan gives state, local, tribal and territorial election offices a framework for dealing with threats to voter registration systems, election equipment and polling locations, and it lists federal services those offices can request at no cost.
Among the threats the plan names are vulnerability exploitation, in which attackers use known software flaws to gain access through enterprise networks and then move sideways inside a system; attacks on voter registration databases; insider threats from the large temporary workforce that elections rely on; and physical incidents, including bomb threats against election offices and polling places, which were not theoretical in recent cycles. The plan’s recommendations are deliberately practical: use paper ballots that voters can review, so that a software failure or manipulation can be caught; conduct post-election audits by hand; keep ballots in bipartisan teams of two; allow observers during counting; and maintain chain-of-custody procedures.
The plan also promises coordination through 10 regional directors serving as election security advisers, alongside services such as risk and vulnerability assessments, ongoing network monitoring, threat-information sharing and technical assistance. Its central message, in the words quoted from the document, is that continued vigilance, adaptability and transparency will be essential to protect the foundations of the constitutional republic and maintain public trust in elections. On paper, that is a conventional and broadly supported programme, and it draws on practices that election officials of both parties have used for years.
What the plan does not do is equally telling. It does not name specific 2026 threats from Russia, Iran or China, a restraint that stands in contrast to other messages from the administration. In a separate letter released on August 27, Secretary Mullin warned that components of many voting machines used in the United States are manufactured in China, arguing that parts made by foreign adversaries introduce serious security risks. That warning, about supply chains rather than a specific attack, shows how the debate has widened: from whether a particular system can be hacked, to whether the hardware inside it can be trusted at all. Election officials, for their part, have long stressed that voting machines are not connected to the internet in the way that office computers are, and that paper records and audits are the backstop if a machine is questioned.
Where the gaps remain before November 3
Three gaps stand out in the reporting from the final days before the election. The first concerns the Election Infrastructure Information Sharing and Analysis Center, known as EI-ISAC, which previously helped circulate threat information among election offices. CISA terminated federally funded activities supporting the centre as part of cost-saving efforts, and the centre was not specifically mentioned in the new security plan. On September 3, Senator Alex Padilla and Representative Joe Morelle, both Democrats, published an open letter demanding that the administration immediately restore funding to EI-ISAC ahead of the midterms. The administration has not, in the reporting available, restored that funding on the terms the letter sought.
The second gap is the new information-sharing platform itself. According to CNN, the Department of Homeland Security has scrambled in recent weeks to stand up an online platform to share threat intelligence, but people familiar with the matter said it does not carry anything like the credibility with election officials that past channels enjoyed. A CISA spokesperson told CNN on Friday that the agency had launched an information-sharing tool and that authorised federal, state and local partners are granted access daily upon request. The agency did not answer CNN’s questions about how many election officials had actually accessed the platform. That unanswered question is, in effect, the test of the new system: a tool that exists but is not widely used cannot replace a network that officials trusted and checked.
The third gap is the simplest to state and the hardest to fix quickly: basic cybersecurity hygiene. The security plan itself notes that state and local election offices frequently struggle with vulnerability remediation, partly because of outdated certification regimes and inconsistent transparency from election system vendors. In other words, even with perfect federal warnings, many small offices face the ordinary problems of old software, limited staff and tight budgets. Federal help is voluntary, and it depends on offices asking for it and having the capacity to act on what they receive.
Foreign influence efforts are being tracked, officials say
None of this means that foreign actors are absent from the 2026 campaign. United States intelligence officials are tracking familiar efforts by Russia, China and Iran to influence American voters, according to the CNN reporting. Those efforts, as described in past cycles, have typically involved propaganda, fake accounts, hacked or leaked material and attempts to amplify division, rather than direct alteration of vote counts. The reporting does not, in the material available, attribute a specific 2026 operation to a specific country, and USN is not doing so here either.
The distinction between influencing voters and changing votes is central to how election security is judged. Influencing what people think is hard to stop completely in an open information environment, and it does not require touching a voting machine. Changing a recorded vote, by contrast, would have to overcome paper ballots, audits and decentralised counting in thousands of jurisdictions. That is why the security plan’s emphasis on paper records matters: even if an influence campaign succeeds in shaping opinion, it does not by itself change the count, and even if a system is probed, a paper trail gives officials something independent to check.
What officials fear most, on this account, is not a single dramatic hack but a foggier outcome: a contested claim, a threatening message, a local disruption or a misleading video that spreads faster than an official correction. In that scenario, the weakness is not the ballot box itself but the information environment around it, and the federal role is to give local officials verified facts quickly enough to answer rumours before they harden into belief.
What has not changed: states run the election
It is worth stating plainly what the federal debate does not change. States and counties still run polling places, maintain voter rolls, issue and count ballots, and certify results. Federal monitors and observers are a separate matter from CISA’s cyber and threat-sharing work. USN has previously reported that the Justice Department is sending federal observers to polls, and on the department’s statement about which federal personnel will and will not serve as poll monitors. Readers following those separate questions can find that background in USN’s earlier coverage: Justice Department says FBI and ICE staff will not serve as midterm poll monitors (https://usnbreaking.com/justice-department-says-fbi-and-ice-staff-will-not-serve-as-midterm-poll-monitors/) and Inside the FBI agents’ worry they could be ordered to seize ballots on Election Day (https://usnbreaking.com/inside-the-fbi-agents-worry-they-could-be-ordered-to-seize-ballots-on-election-day/).
Those stories concern personnel at polling places and legal disputes over ballots and records. The CISA story concerns something quieter and more technical: whether a warning about a cyber threat, a fake website or a physical threat reaches the right local official in time. Both stories feed the same public question, whether voters can trust the process, but they involve different agencies, different rules and different remedies, and they should not be confused.
Local officials, in their own guidance, have consistently urged voters to rely on their local election office for authoritative information about where and how to vote, and to be wary of unverified claims about results before counting is complete. That advice holds whatever the state of federal threat-sharing: a voter’s polling place, hours and ballot rules are set locally, and a national headline about a threat does not change an individual voter’s deadline or location.
What to watch on November 3
On Tuesday, November 3, the test of the system will be practical rather than theoretical. Election officials will be watching for several things at once: whether any polling place faces a physical disruption or threat; whether any voter registration system or results-reporting website shows signs of interference; whether misleading claims about closed polls, changed locations or early results spread online; and whether, when something does happen, a trusted correction follows quickly.
A CISA spokesperson told CNN that the agency remains fully equipped and prepared to address national security cyber threats, and that it provides voluntary help to state and local officials and vendors upon request. That assurance, and the scepticism of election officials quoted in the same reporting, cannot both be fully resolved before Election Day. The vote itself will provide the first real measure of which assessment was closer: a quiet day with quick, credible corrections would suggest the rebuilt channels were enough; a day in which local officials report confusion about whom to call, or in which rumours outrun corrections, would suggest they were not.
Either way, the longer question will outlast Tuesday night. The 2026 experience is already shaping the debate about what federal election security should look like after the midterms: whether EI-ISAC funding is restored, whether the new sharing platform earns the trust of local officials, and whether the next Congress, whatever its composition, treats election infrastructure as a standing investment rather than a last-minute scramble. Voters will decide control of Congress on November 3. What they cannot decide, in a single ballot, is whether the machinery that warns officials about threats to the next election will be in better shape when that election arrives.
Sources
USN reviewed reporting from multiple outlets for this story. Read more from CNN (https://www.cnn.com/2026/11/01/politics/election-threats-federal-preparations?cid=external-feeds_iluminar_meta), Infosecurity Magazine (https://www.infosecurity-magazine.com/news/cisa-election-security-midterms/) and The Crosswire Daily (https://thecrosswiredaily.com/elections/cisa-unveils-midterm-security-plan/).