Summary

  • Caitlin Durkovich, a former deputy homeland security adviser for resilience and response on the National Security Council, told a Tuesday Brennan Center for Justice briefing that the hours and days between poll close and final tally sit exposed after federal election-security support withdrew and the Justice Department’s pre-election “quiet period” did not hold.
  • Geoff Hales, former chief of joint cyber defense collaborative partnerships at CISA, documented the withdrawal, stating federal support “pulled back sharply,” with “cybersecurity services… reduced, funding for information sharing environments… cut, the threat briefings about nation-state adversaries that used to occur dozens of times a year are occurring rarely or not at all.”
  • Durkovich framed the window as the operational surface where the administration is “going to use the claim of foreign interference at the end of voting days to either seize equipment or to seize ballots, whether they’re legally justified to do so or not,” because “the administration has lost so many of their attempts to disrupt the normal process in court.”
  • The exposure sits not in vote-counting mechanics — Larry Norden and Hales both said those have hardened through expanded access, state audits, and state-level cyber investment — but in the gap between mechanical completion and political acceptance of a result.

A former National Security Council official warned Tuesday that the interval between the close of polls and a final tally in the November midterms has become a structural gap whose defensive perimeter is thinner than at any point in the recent cycle, after federal election-security coordination receded and the Justice Department’s pre-election “quiet period” did not hold. Caitlin Durkovich, who served as deputy homeland security adviser for resilience and response on the NSC, framed the window as the operational surface on which an administration that has lost in court will land. “I think because the administration has lost so many of their attempts to disrupt the normal process in court, that they are going to use the claim of foreign interference at the end of voting days to either seize equipment or to seize ballots, whether they’re legally justified to do so or not,” Durkovich told a Brennan Center for Justice briefing. “That period, that waiting time, is where doubt begins to surface.”

The exposure documented at the briefing sits not in the mechanics of counting but in the gap between a completed count and political acceptance of a result. Some states complete counts in hours; California’s count extends weeks. Larry Norden, vice-president of the elections and government program at the Brennan Center, stated that control of the US House of Representatives and the Senate may hinge on results in states with delayed counts.

What the briefing framed as exposed

The window’s fragility emerges from the configuration of three balancing mechanisms — court adjudication, federal defensive coordination, and the Justice Department’s pre-election “quiet period” — all of which the briefing documents as degraded in the present cycle. Nassim Nicholas Taleb has characterized such configurations, drawing in part on collaboration with the mathematician Raphael Douady as a quantitative treatment of fragility, as concave under stress: small inputs at the relevant stage produce disproportionately large outputs downstream. The counting window exhibits that profile, with the small inputs consisting of slow counts, ambiguous returns, and unattributed rumors, and the disproportionate outputs consisting of delegitimization and contested control of Congress.

Durkovich’s account is explicit on the dynamic. The counting window is the period during which the count “is then amplified by foreign actors and, frankly, by domestic actors” so that “it starts to cause distrust in the integrity of the process.” The amplification does not depend on the existence of a confirmed foreign operation; the briefing surfaced no such operation. Beth Sanner, a former deputy director of national intelligence who is now director for geopolitics and strategy at International Capital Strategies, stated that “we don’t have any examples of a country trying to interfere in the electoral process, in that technical process… It just didn’t happen. It just didn’t happen in 2020.” The amplification requires only the framing.

Three stress layers operating on the window

The briefing surfaced three structural stressors, each removable by decision rather than by legislation.

The federal defensive drawdown. Hales described a layered withdrawal that occurred independent of any documented decline in the underlying threat landscape: “The federal support that used to be there has pulled back sharply. This means that cybersecurity services have been reduced, funding for information sharing environments have been cut, the threat briefings about nation-state adversaries that used to occur dozens of times a year are occurring rarely or not at all.” The asymmetry — defenses lowered while the stressor landscape has not measurably changed — is the operative datum. What the systems-dynamics literature characterizes as a “Shifting the Burden” archetype applies: the actor removes the federal defensive contribution, the immediate budgetary pressure is relieved, and the underlying capability gap is preserved or widened.

The active DHS non-citizen voter initiative. An anonymous whistleblower told Congress last week that a Department of Homeland Security “unlawful voter initiative” to identify non-citizen voters on state rolls uses “highly questionable data” and may be unlawful. DHS is also pursuing voter-roll lists in states that have not turned them over voluntarily, and the federal government has asked states to retain their 2024 election documentation for later inquiries. The exposure is bidirectional: a federal authority acting on data of disputed quality produces state-level harms not directly redressable through state channels, while state pushback can be characterized as non-cooperation. The seam the initiative operates across is rarely invoked except under precisely the pressures the counting window produces.

The quiet-period deviation. The Department of Justice and FBI normally enter a “quiet period” just ahead of elections to avoid influencing the results; the source article reports “that has not been the case this year.” The norm functioned as a balancing mechanism against the information-environment stressor. Its absence this cycle removes a defensive layer reversible by decision and one that did not require legislation to install.

What hardened, and what didn’t

The briefing surfaced a countervailing observation on the inside of the boundary. Norden stated that “in the history of American elections in some ways, there have never been more options for the way that people can vote, and they are still in place going into this election.” Hales said “election officials across the country have really taken cybersecurity seriously” and that “every state audits its results.”

These elements have benefited from the post-2020 environment — more audits, more voting modalities, more cyber investment — and exhibit the stress-driven reinforcement pattern that Taleb has associated with antifragility: each disruption cycle has produced additions to resilience rather than subtractions from it. The state’s defensive layers, paper records, post-election canvassing, and the audit norm are durable components inside the system’s boundary.

The asymmetry the briefing documents is between the hardened inside and a thinning outside. The information environment, where domestic and foreign actors operate, sits largely outside the boundary, and the actors operating within it are not under the system’s command. Courts sit at the boundary: inside US institutional structure but operating on case-by-case timing that cannot be commanded. The defensive drawdown documented by Hales operates on the federal coordination that previously bridged inside and outside; its reduction does not redesign the bridge but lightens it.

The judicial guardrail, and its timescale

Ben Hovland, former chair of the Election Assistance Commission, pointed to a recent ruling as one guardrail: the Supreme Court earlier this month upheld a lower-court injunction blocking the Trump administration from using the US Postal Service and the Department of Homeland Security to vet mail-in ballot deliveries. The ruling is a guardrail; it is also a single channel. A different bench composition or a changed jurisdictional rule eliminates it in one move.

Hovland’s framing of the timing constraint is direct. “Every state in the country now has live ballots out,” he said. “That really means the election is here, and it means that needs to be taken into consideration for any court rulings we’re looking at.” The implication, made explicit at the briefing, is that the balancing channel is operating against a clock that may already be partly expired: the in-flight ballot population cannot be recalled to a prior baseline if a court ruling shifts.

Empirical record on the threat frame

Sanner’s statement complicates the rhetorical frame. Her observation that there are no documented examples of foreign technical interference in the US electoral process — and her insistence that “It just didn’t happen… in 2020” — sits in tension with the briefing’s broader threat characterization. The empirical record the briefing cites in support of its most acute threat framing is, on inspection, thin.

The thinness cuts both ways. It makes the technical threat small in expected value, but it means the system’s protective capacity against a novel attempt is harder to assess, because there is no prior incident from which defenders have learned. The mechanism Durkovich described does not require a confirmed foreign operation; it requires only the framing during a counting window in which the count is incomplete.

Loop architecture

The dynamics consistent with the briefing resolve into a small loop set, each operating at its own timescale. A reinforcing loop on the order of days to weeks operates within the counting window itself: perceived anomaly in the count feeds amplification by domestic and foreign actors; that increases doubt; the wider framing latitude invites further anomalies. A second reinforcing loop, on the order of months to a year, operates through the CISA drawdown: federal pullback reduces state-level defensive capacity; the increased successful information-environment intrusion provides further justification for federal pullback. A balancing loop on the order of months to years operates through the courts: executive action feeds litigation; injunction follows; partial restoration of prior state ensues. The recent Supreme Court ruling is the latest link; the loop is real and slow.

An outer loop, operating over years and across cycles, progressively shifts the setpoint of public confidence in the integrity of federal elections. Hovland described the mechanism: the federal government’s claims of illegally registered voters “do not bear up under scrutiny” and, together with the president’s rhetoric alleging fraud without evidence, “back up a narrative of fraud to undermine confidence in the elections.” Groups including the NAACP and the National Urban League remain concerned about the administration’s insistence — without evidence — that the 2026 midterm elections will be illegitimate unless the federal government intervenes.

Lever candidates surfaced at the briefing

Three reversal points surfaced at the briefing, each identified as a departure from prior practice or as a contested move, and each reversible by decision rather than legislation.

The quiet-period deviation requires no federal expenditure and would remove one amplifying surface during the counting window. The federal defensive drawback — adding threat briefings, audit support, or information-sharing capacity back — is the standard addition-of-robustness recommendation, and reinstating the federal election-security coordination Hales described as withdrawn would require reversing current policy direction. The DHS non-citizen voter initiative, characterized by a congressional whistleblower as using “highly questionable data” and potentially unlawful, is the third.

The counting window itself is not removable; it is a structural feature of US election administration, with state count durations ranging from hours to weeks. What is removable is the asymmetry between the size of the window and the size of the defense. Until that asymmetry is narrowed — by restoring the quiet period, by restoring the federal defensive contribution, or by closing the seam on which the rhetorical deployment depends — the response function remains concave, built to absorb the average counting delay and built to fail under the rare large one.

Additional considerations

The briefing’s framing of the window rests on the assumption, made explicit by Norden, that “this is the biggest threat right now.” Norden’s pushback against the impression that voting itself has become harder is itself part of the briefing’s defensive posture: “I think a lot of people may think just because they’re seeing all these headlines being thrown at them that things have changed — that it’s become more difficult to vote.” The voter-facing channel he names — “The earlier they vote, the more secure they can feel that their vote is going to count” — operates on a timescale that overlaps the counting window itself, and its effect depends on voter behavior the system cannot directly control. The channel constrains how concavely the overall system behaves; it is not, on its own, sufficient to neutralize the stressors identified above.

The named opportunity Durkovich identified — that “because the administration has lost so many of their attempts to disrupt the normal process in court,” they will land on the window — is described at the briefing as an expectation, not a documented plan. The structural exposure the briefing surfaces does not require the expectation to materialize for the window to operate as the fragile seam the analysts described; the framing alone, deployed during a delayed count, performs the work the briefing warns against.

Analytical techniques used in this piece

This analysis applies the methods below. Each links to a short, plain-English explainer you can read and reuse.

Fragility / Antifragility Audit
Asks whether a system gains or loses from volatility, shocks, and disorder (Taleb).
Red-Team Advocate
Argues the adversary’s case in full to expose what a plan underrates.
Systems Dynamics (Structural)
Maps a system’s structure — stocks, flows, and the architecture that shapes its behavior.