When Americans went to vote on November 3, 2026, the security of the election did not rest on a single system, a single agency or a single safeguard. It rested on a layered set of defences built up over several election cycles: paper records that can be checked, audits that test the count, authentication rules for officials and vendors, and warnings issued in advance about the tricks most likely to be tried. In the weeks before the midterms, the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency, known as CISA, issued a series of public warnings that described those tricks in unusually specific terms. After the election, one criminal case illustrated a different kind of threat altogether: not a hacker breaking into a system, but a stream of threatening letters sent to the people who run elections. This article brings those two stories together, and it is careful about a third point: as of the time it was prepared, no federal agency had published a formal post-election after-action assessment of the 2026 vote, and this article does not invent one.
That caution matters because older warnings are easy to mistake for new ones. Searches for this story returned statements from CISA and others dating from 2020 and 2022, and those statements describe earlier election cycles, not the 2026 midterms. They are not used here as evidence about 2026. What follows is built only on warnings and actions documented for the 2026 cycle, plus a prosecution announced during election week, plus the counting and certification process that is still running. Where a claim is an allegation rather than a proven fact, it is labelled as such.
2026 Election Security Warnings: AI Phishing, Deepfakes and Smishing
On October 16, 2026, the FBI and CISA issued a joint public service announcement, catalogued as IC3 alert I-101626-PSA, warning election officials, candidates and campaigns about a cluster of related threats. The first was AI-enhanced phishing and its text-message cousin, smishing, in which fraudulent emails or messages are designed to trick a recipient into revealing login credentials or clicking a malicious link. The advisory stressed that artificial intelligence has made such messages more convincing, because it can mimic a colleague’s writing style, generate plausible-looking documents and tailor a message to its target. The second threat was deepfake audio and video impersonation, in which synthetic media is used to make it appear that a known person said or did something they did not. The third was credential theft more broadly: once an attacker holds a legitimate official’s login, they can move inside systems that would otherwise be closed to them.
What the advisory did not say is just as important as what it did. It did not report a confirmed breach of a voting system. It did not say that a voter database had been compromised. It did not say that any result had been altered. A warning about a technique is not a finding that the technique succeeded, and readers should resist any summary that turns the October advisory into a claim that votes were changed. The advisory’s purpose, as with similar advisories in past cycles, was preventive: to make officials, campaigns and vendors harder to fool before voting began, rather than to announce an incident after the fact.
The same advisory noted a surge in phishing attempts against election officials over the previous two election cycles, and a rise in malicious messaging delivered through encrypted chat applications over the past year. Officials are attractive targets for a practical reason: they hold access to voter-registration data and to confidential campaign material, and a single compromised account can open doors that a direct attack on a voting machine cannot. That is why the defences recommended by federal agencies emphasise phishing-resistant authentication, such as hardware security keys, careful verification of unexpected messages, and rapid reporting of suspicious contacts, rather than relying on any one person to spot every fake.
Fraud Warnings and the Insider-Threat Factsheet
A day before the joint advisory, on October 15, 2026, the FBI issued a separate alert about election-themed fraud aimed at the public. The schemes it described were familiar in form but tailored to an election year: fake candidate solicitations asking for donations that never reach a campaign, bogus political-action-committee appeals, merchandise that is paid for and never arrives, and appeals designed to harvest personal data that can be used for later fraud. These schemes do not change votes, but they exploit trust in the election itself, and they can leave victims less willing to trust legitimate appeals and official communications. The alert’s message was practical: verify a solicitation through a campaign’s or committee’s own published channels before giving money or personal information.
A third document, an October 2026 joint factsheet from the Department of Homeland Security’s intelligence office, CISA, the FBI and the Election Assistance Commission, addressed a different risk: the insider threat. Not every threat comes from outside. Staff, vendors and volunteers who already hold legitimate access can misuse it, whether through carelessness, coercion or intent. The factsheet covered screening and access controls for the 2026 cycle, including limiting access to what each person actually needs, logging and reviewing that access, and having clear procedures for removing access when someone leaves a role. For election offices, many of which rely on temporary workers and outside vendors during a busy cycle, those controls are part of the ordinary machinery of a secure election, not a sign that a particular insider incident had occurred.
Together, the three documents describe a security picture that is broader than the image of a hacker attacking a ballot box. The vote itself is protected by paper trails and audits in most jurisdictions. The people and communications around the vote are protected, or left exposed, by how well phishing, fraud and insider access are managed. That is why federal agencies spent October talking about emails, messages and staffing procedures rather than only about voting equipment. An election can be undermined without a single vote being changed, if officials are impersonated, if voters are defrauded in a candidate’s name, or if public trust in the process is damaged by a convincing fake.
The Martin Case: Threat Letters and White Powder, Charged as Allegations
On November 2, 2026, the FBI arrested Robin Patrick Martin, aged 67, of Oklahoma City. On November 3, Election Day itself, the Justice Department charged him with conveying false and misleading information and hoaxes and with mailing threatening communications. Prosecutors allege that he sent more than 700 mailings, including white-powder letters, to election officials in all 50 states, members of Congress, pollsters and media outlets, across the 2024 and 2026 election cycles. Powder tested so far was found to be harmless yeast or flour. Martin appeared before a federal magistrate on November 3, was temporarily detained, and faces a preliminary hearing on November 9, 2026. The Oklahoma election board had alerted the FBI after receiving a powder letter on October 13.
Every element of that paragraph after the fact of the arrest and the charges must be read as allegation, not as proven fact. Martin is presumed innocent unless proven guilty in court. It is also unconfirmed, on the sources reviewed for this story, whether the charges cover every letter in both the 2024 and 2026 waves or only a subset of them. His motive has not been established in the sources reviewed, and this article does not speculate about it. The distinction between a charge and a conviction is not a technicality here. It is the difference between what prosecutors say they can prove and what a court has found, and it applies to every criminal case reported before trial.
The case matters for election security for a reason that has nothing to do with vote counting. A powder letter, even one containing flour, forces an office to evacuate, call hazardous-materials responders, and pause its work while the substance is tested. Repeated across many states, that disruption can delay the processing of ballots, frighten staff and volunteers, and discourage people from serving as election workers. Election officials have described that chilling effect in past cycles, and it is one reason that threats against election workers are treated by federal prosecutors as a distinct problem from ordinary political disagreement. The Martin charges, if proven, would describe a campaign of intimidation aimed at the people who administer elections, not an attempt to alter a tally through a computer system.
Two Different Disputes That Must Not Be Confused
Readers following election security after the midterms need to keep two disputes separate, because they point in opposite directions and involve different actors. The first is threats against election workers, illustrated by the Martin case: private threats and hoaxes directed at officials, which federal agencies investigate and prosecute. The second is federal pressure on election workers, illustrated by a temporary restraining order issued on October 30, 2026, by United States District Judge Trina Thompson of the Northern District of California. That order bars the Justice Department and the Department of Homeland Security from demanding that election officials purge rolls, refuse or segregate ballots, or halt processing, and from threatening prosecution for non-compliance, through November 16, 2026, while the case is appealed to the Ninth Circuit.
The background to the Thompson order was a series of letters from the administration to 29 states and Washington, D.C., demanding election records and warning of investigations. The administration argued that federal oversight and voter-eligibility enforcement were legitimate. Election officials, unions and civil-rights groups argued that the demands intruded on state-run elections and threatened lawful counting. The order temporarily restrained the federal demands; it did not decide the underlying merits, and its fate on appeal remains open. Keeping the two stories distinct matters because a reader who merges them could conclude, wrongly, that the same federal action both protected and threatened election workers, or that a prosecution of a private threat-maker settles the separate legal question of how far federal agencies may go in demanding state records. USN previously reported on concerns inside the FBI about election-day orders, a related debate about the limits of federal involvement that predates the Thompson order.
What Has Not Been Assessed Yet, and What Happens Next
The counting and certification process that follows an election is itself part of election security, and it is still running. Officials are tabulating ballots, canvassing results and conducting audits, and state certification follows through November and December. The new Congress does not convene until January 3, 2027. During that period, the most reliable information about the count comes from county and state election offices and from the official canvass, not from social-media claims about a single precinct or a single batch of ballots.
What has not happened, as of the preparation of this article, is a formal federal after-action assessment of the 2026 election. No CISA or FBI statement dated after Election Day was found in the sources reviewed that assessed whether the threats warned about in October materialised, were blocked, or affected any count. That absence should not be read in either direction. It does not prove that an attack succeeded, and it does not prove that none was attempted. It means only that the formal assessment, if one is published, has not yet appeared, and that any article claiming to summarise it would be inventing a source. When such an assessment does appear, the questions to ask of it will be specific: which threats were observed, whether any system was compromised, whether any vote count was affected, and what mitigations worked.
Until then, the after-action picture for 2026 rests on what is documented: detailed pre-election warnings about phishing, deepfakes, fraud and insider access; a prosecution alleging a large-scale threat-letter campaign against election officials; a court order temporarily restraining federal pressure on those same officials; and a counting process protected by paper records and audits. That is a substantial record, but it is not a verdict on the election as a whole. The verdict on the count will come from certification, state by state, and the verdict on the threats will come from the courts and from any future agency assessment that is actually published, not from speculation in the days after voting.
Sources
USN reviewed reporting from multiple outlets for this story. Read more from Windows Forum, The Express Tribune and Law Commentary.