Federal election-security architecture narrows under sustained capacity cuts and trust erosion

Summary

The information-sharing architecture the Cybersecurity and Infrastructure Security Agency built with state election authorities and voting-machine vendors between 2018 and January 2025 has undergone a structural alteration since President Donald Trump’s January 2025 return to office, according to multiple former CISA employees and outside specialists ProPublica consulted.
Administrative notices within weeks of the inauguration, layoffs under the Department of Government Efficiency, and a 2027 budget proposal that ProPublica reported would cut agency funding by $700 million have reduced CISA’s workforce by roughly one-third, per the outlet’s reporting.
The administration’s July 16 declassification of state-supplied intelligence materials — which specialists quoted by ProPublica described as closing the cooperative channel from the states’ side — left state authorities substituting their own resources for some federal functions while other services, including foreign-intelligence support, “cannot be replicated at the state level.”
CISA’s 13-page security plan for the 2026 election, published September 24, arrived after the Labor Day planning window in which CISA’s state-level preparation had previously been completed, Maine Secretary of State Shenna Bellows told ProPublica, characterizing the document as “too little, too late.”

The information-sharing arrangement that the Cybersecurity and Infrastructure Security Agency built between 2018 and January 2025 with state election authorities and voting-machine vendors has, under a combination of capacity reductions enacted within weeks of President Donald Trump’s return to office and a July 16 declassification of state-supplied intelligence materials, undergone a structural alteration that multiple former CISA employees and outside specialists told ProPublica leaves federal credibility on election integrity now depending on arrangements whose restoration is gated by the same trust current federal behavior is described as eroding. State election officials told the outlet they proceeded through 2026 midterm planning without federal assistance and without an explanation for the absence. CISA published its 13-page security plan on September 24 — a date Maine Secretary of State Shenna Bellows described to ProPublica as past the Labor Day preparation window, characterizing the document as “too little, too late.” The reporting establishes a structural feature that the rest of this analysis develops: the federal side of the architecture is described as operationally absent from the planning cycle that uses it, and the trust repair that would be required to rebuild it operates on the multi-year cooperation horizon in which the original architecture was assembled.

What the architecture has become

Two former administration officials told ProPublica that political appointees at DHS asked CISA to procure a voting machine, examine it, and report findings to the White House, with the unusual condition that the agency not notify the manufacturer if it uncovered vulnerabilities. One of the former officials quoted by ProPublica said the proposition unsettled CISA career employees whose mission is to defend election infrastructure: “My thought was they could keep it in their back pocket to invalidate any [election] results they don’t like,” the former official said. “This goes against everything CISA represents.” Career staff told the appointees the operation was infeasible, in part because personnel capable of pulling it off had been laid off under DOGE, and the appointees eventually stopped pressing the agency. ProPublica reported the request was never acted on but “illustrates how the Trump administration has tried to use the agency for its own ends while draining it of resources for one of its critical missions: protecting the nation’s voting systems.”

The post-cut CISA, the outlet found, has been described as effectively absent from midterm planning. State election authorities told ProPublica the agency provided “no assistance — and no explanation for its absence — during the critical planning stages in 2025 and through mid-September 2026.” Arizona Secretary of State Adrian Fontes told ProPublica: “I don’t pay attention to what the president says. I pay attention to what his administration does. And what they’ve done is basically cut us off and left us on our own.” Officials in one large voting jurisdiction told the outlet they had met privately with machine vendors to develop a contingency plan in case the federal government seized their machines or declared them unusable.

In an August video call with state election officials, Nick Andersen — a former cybersecurity adviser to Trump’s White House and former Marine Corps engineer who had joined CISA a year earlier, and who according to the state Republican Party’s website is a district representative for the Republican Party in Virginia — announced that DHS was preparing to release a plan on how the agency would work with states to secure the election, ProPublica reported. The reporting documented state officials on the call as “stunned at what they perceived as a lack of understanding of election planning.” Early voting for the general election was approaching, and states had spent more than a year preparing without federal assistance. Andersen attributed any past lapses to the fall 2025 federal government shutdown, “twirling his pen uncomfortably and sipping from a Monster energy drink,” according to people on the call. “I told him I didn’t trust him,” Fontes told ProPublica. “I did raise my voice a little bit, because I’m frustrated — very frustrated — that they would have the temerity to come in, clear the entire deck of competent professionals, stop supporting the states, eviscerate the coordination efforts that they had and then suddenly come in and say: ‘Oh, we’re from the federal government. We’re here to help.’”

How the architecture was assembled

The arrangement ProPublica describes did not begin at CISA. After hackers broke into the Pentagon in 2007 and stole terabytes of sensitive data, an intelligence leader later described the intrusion, by an unknown foreign adversary, as “an espionage Pearl Harbor.” Under President George W. Bush, DHS reorganized to create the National Protection and Programs Directorate, which helped fortify advanced cyber-defense systems and infrastructure ranging from Super Bowl security to chemical-plant protection. In 2018, Trump signed the CISA Act making the office a stand-alone agency with its own funding stream — a body ProPublica described as a tech-support desk for whatever DHS designated “critical infrastructure.”

To carry out its election-security function, CISA needed the cooperation of states and vendors reluctant to share data on weaknesses in voting systems, while state officials were also reluctant to cede any role in election preparation to the federal government. Derek Tisler, election-security counsel at the Brennan Center for Justice, a nonpartisan institute based at New York University School of Law, told ProPublica that trust-building “took years and years of building trust, of talking to election officials, of hiring people with elections experience who could be validators for the work that CISA wanted to do, before they finally built strong working relationships.”

Under Director Chris Krebs, ProPublica reported, CISA hosted penetration tests against state systems, ran tabletop exercises simulating election catastrophes, offered regular secret-level briefings to secretaries of state, and paid for sensor technology monitoring election networks for malicious activity. State partners shared data ranging from routine spambots to more serious threats; if Virginia caught unusual activity, other states could be alerted. Ryan Macias, an election technology and cybersecurity expert who has consulted for CISA, told ProPublica that under that architecture “the staffing was there, the expertise was there, the visibility was there, the funding was there.” Russia, the reporting noted, had run a disinformation campaign ahead of the 2016 presidential election in which, according to bipartisan reports from the U.S. Senate Select Committee on Intelligence released before the 2020 vote, a Kremlin-backed troll farm created thousands of social-media accounts posing as Americans while the Justice Department indicted a dozen Russian military agents for intrusions on Democratic party and Hillary Clinton campaign networks. In January 2017, before Trump took office, DHS upgraded America’s elections to the status of critical infrastructure.

When Trump refused to concede to Joe Biden in 2020, claiming the vote had been rigged, CISA became a key component of the guardrails that ultimately led to the election results being certified. The agency, in a statement co-signed by secretaries of state and voting-machine vendors, vouched for the election’s integrity as “the most secure in American history.” When Krebs publicly rebutted claims amplified by the White House as “unsubstantiated” or “technically incoherent,” Trump fired him over Twitter. CISA, along with the FBI, convinced then-Attorney General Bill Barr that the conspiracy theories embraced by the president could be explained by human error, not systemic fraud or hacking.

What has been altered since January 2025

Since the January 2025 inauguration, ProPublica reported, the administration has laid off or pushed out more than 1,000 CISA employees — roughly one-third of the agency — through administrative notices within two weeks of the inauguration that included the team charged with dispelling disinformation, separately through DOGE layoffs of personnel who had worked closely with states, and through cuts to funding for technology that had monitored web and election servers, which the outlet described as having “blinded the federal government to breaches it had previously detected.” One former senior CISA employee quoted by ProPublica said of the affected teams: “Those groups couldn’t even order a pizza.” The president’s 2027 budget proposal, the outlet reported, would cut agency funding by an additional $700 million, with about 900 additional layoffs estimated. In response, Democratic lawmakers have called for an investigation into CISA’s ability to perform its mission and demanded answers as to why federal funds are not being used to support election security as Congress directed.

David Becker, founder of the nonpartisan Center for Election Innovation and Research, told ProPublica: “What happened in the second Trump administration is from almost day one — I mean, literally the first two months — they took all that was built up by Trump 1 and just decimated it.” Caitlin Durkovich, a former DHS assistant secretary for infrastructure protection and co-founder of the cybersecurity firm Civira Partners, told the outlet: “We worked so hard to build that trusted relationship. I don’t know how you put it back together.”

Two additional federal actions described by ProPublica sit in the same posture as the DHS-appointee proposal. According to a fall 2025 memo Missouri election officials produced, Justice Department official Andrew McCoy Warner — described in the reporting as a prominent 2020 election conspiracy theorist — called several clerks asking for access to voting machines. Then-Director of National Intelligence Tulsi Gabbard led an operation in Puerto Rico to seize election machines; the private contractor hired to examine them, Mojave Research Inc., failed to find evidence supporting the claims, after which the federal government stopped renewing its contract, the company’s CEO later told reporters. A spokesperson for the Office of the Director of National Intelligence said in August the contractor’s work had ceased because it had completed its contract. Gabbard told Congress in March that the seizure came at the request of an assistant U.S. attorney in Puerto Rico.

ProPublica also documented two CISA-internal incidents that alarmed state election authorities. Earlier in 2026, Politico reported, acting CISA Director Madhu Gottumukkala had uploaded records to ChatGPT despite a DHS prohibition on employees using the program; a CISA spokesperson told Politico that Gottumukkala had been permitted to use the technology on a “short-term and limited” basis. Independent journalist Brian Krebs reported in May that CISA had published private data — including passwords, cloud keys, and other information — on its public GitHub page, in a folder labeled “Private-CISA”; a CISA spokesperson told Krebs there was no indication that sensitive data was compromised.

White House spokesperson Lauren Bis, in an emailed statement to ProPublica, defended the administration’s handling of election security by saying “President Trump has done more than any other President to ensure we have free and fair elections,” and characterized the declassification as “exactly the sort of transparency news organizations should applaud,” adding that the speech had been fact-checked “by the agencies whose evidence was released and did not mischaracterize any information.” DHS and CISA did not respond to interview requests or to a detailed list of questions, ProPublica reported.

The declassification episode

The administration’s July 16 address and the records the administration released to support it, ProPublica reported, “broke long-held trust.” The material included raw information states had shared with CISA that was supposed to remain private, including “a log of communications from Election Day 2020 detailing activity being monitored in several states.” Geoff Hale, formerly of CISA’s elections team from the agency’s inception until last year and now at the Center for Democracy & Technology, told ProPublica the release “betrayed the trust of all partners who were willing to share information at the time.” A former high-ranking federal cybersecurity official who now advises state governments on national security was more categorical: “They’ve violated the entire premise of that information-sharing relationship. There’s no fucking way [state governments are] ever going to give any information to CISA. And it’s unclear if they ever will in the future.”

In the speech itself, Trump mocked CISA’s defense of the 2020 election, calling the agency’s statement that the contest was “the most secure in American history” a “very pat line” concocted as part of a deep-state cover-up. The reporting documented reception-near-Mount-Rushmore attendee reaction at the evening of July 16 as anxiety that Trump would declare a national emergency, then a “collective” shift “as reports on the speech began rolling in”; attendees characterized Trump’s claims as “unsubstantiated and outlandish” and “examined ad nauseam” and “roundly debunked.” Quinn Raymond, co-founder of VoteShield, a nonprofit that works with states to help monitor voter registration data, who was at the event, told ProPublica: “Everyone just sort of guffawed and put their phones away and went to the bar.”

How the situation is being framed

ProPublica’s reporting admits at least four framings, each anchored on the record.

A national-security framing treats the situation as a federal capability problem. ProPublica documented state election authorities receiving “no assistance and no explanation” through mid-September 2026; the September 24 plan arrived after primary planning had been completed; Bellows called the timing “too little, too late.”

A federal-state relations framing treats the situation as a trust collapse between levels of government, with information sharing as the binding constraint. ProPublica cited Democratic lawmakers’ calls for an investigation and demands for accountability on federally appropriated election-security funds; the framing’s anchor is Fontes’s “cut us off and left us on our own” statement.

A historical-genealogy framing treats the situation as the latest phase in a longer pattern in which election administration has been drawn into executive-branch conflict over the 2020 result. The genealogy ProPublica documented runs from the 2007 Pentagon intrusion through the 2018 enactment of the CISA Act, the January 2017 designation of elections as critical infrastructure, the bipartisan Senate Select Committee on Intelligence reports on 2016 Russian activity, the Justice Department indictment of a dozen Russian military agents, the 2020 CISA statement, Krebs’s firing over Twitter, and the CISA/FBI effort that convinced then-Attorney General Bill Barr that the theories embraced by the president could be explained by human error. Becker’s “decimated it” statement anchors this framing.

A cross-domain analogical framing treats the situation as analogous to other instances of institutional capacity destruction — applied cautiously, since the underlying mechanism of a mission-statutory agency whose technical work comes into conflict with the political environment of its executive recurs across sectors.

The framings diverge on which dynamic each treats as binding. They converge on a single observation the outlet attributed to specialists: the state described is one from which recovery is technically possible but practically difficult, and the binding resource is the one that takes longest to rebuild.

The structural dynamics the reporting identifies

Three reinforcing loops organized the prior architecture, according to multiple former officials ProPublica cited. Each loop is now described as operating in the opposite direction or as degraded.

A trust-sharing loop: state willingness to share data → federal threat detection → visible value to states → continued sharing. A capacity-value loop: agency capacity → effective service → political support → sustained capacity. An intelligence-distribution loop: classified intelligence at CISA → regular secret-level briefings to secretaries of state → state action on warnings → reduced successful attacks → political case for the program.

The declassification, ProPublica reported, closed the information-distribution loop from the state side. The Trump-era reductions acted on the capacity stock. The capacity-value loop now reinforces in the negative direction: cuts reduce service, reduced service weakens the political case for restoration, the weakened political case permits further cuts. The proposed $700 million reduction sits inside that dynamic.

A weak balancing feedback — election proximity normally generating pressure to re-engage state partners — arrived late relative to the planning cycle. State planning cycles run more than a year out from an election. The information flows on which election-security work depends — sensor telemetry, foreign-intelligence reporting, vendor vulnerability disclosures — operate on the same multi-year cooperative horizon. Tisler told ProPublica that trust-building “took years and years.” Durkovich told the outlet: “We worked so hard to build that trusted relationship. I don’t know how you put it back together.” A recently departed CISA official told ProPublica that attempting to do the agency’s typical election work now would be futile — “That ship has sailed.”

Macias drew the operational distinction quoted by ProPublica: “There is a difference between deprioritizing and being nonexistent. … they were nonexistent. Literally nonexistent.”

Four reinforcing dynamics can also be read from the reporting, operating at different speeds.

A capacity-loss dynamic on a months-to-quarter timescale has been in motion since early 2025. A trust-erosion dynamic on a slower pace, years rather than months, does not reverse rapidly. A shifting-the-burden dynamic transfers functions formerly performed federally to state governments and private vendors, weakening the case for restored federal capability — the dynamic Durkovich’s quote expresses. An information-asymmetry escalation dynamic operates through the administration releasing state-federal shared material while states withhold further material from the agency, with the asymmetry as the dynamic’s mechanism.

What happens next on the trajectories the reporting supports

On the capacity trajectory, the agency has shrunk by roughly one-third since January 2025; the 2027 budget proposal would extend the cuts and could necessitate an additional 900 layoffs, ProPublica reported. On the trust trajectory, a former federal cybersecurity official quoted by ProPublica said state governments’ willingness to share with CISA is gone and that its restoration is uncertain. On the operational consequence, state planning has proceeded through mid-September 2026 without CISA assistance; the September 24 plan, ProPublica reported, “calls for ‘leveraging collaborative partnerships’ with states the agency has effectively abandoned since Trump took office,” and described the document as arriving on the post-Labor Day side of the preparation window in which CISA’s previous work had been completed. The 13-page plan describes CISA as having “recommitted to its statutory mission and remains resolute in strengthening the security of elections.” On state substitution, several state leaders have used their own resources to pay for sensor technology; some services, including intelligence on foreign actors, “cannot be replicated at the state level.” Specialists consulted by ProPublica expressed concern that the 2026 election would be publicly characterized as hacked if Republicans did not win in November.

Four forward scenarios sit on the substrate. A trend-extrapolation scenario in which state planning proceeds without federal assistance, the September 24 plan has limited operational effect on primaries already under way, the 2027 budget proposal extends the cuts, and specialists expect continued erosion absent intervention. An orthogonal-driver scenario in which an external event — a successful intrusion into a state system, or a foreign-disclosure event — forces re-engagement independent of administrative preferences; ProPublica’s reporting did not specify such an event. A discontinuity scenario in which a national-emergency declaration or other extraordinary action is directed at voting equipment; ProPublica reported that some of the president’s allies had urged such a declaration months before July 16 as a pretext to seize voting machines, that the July 16 speech did not take that step, and that attendees near Mount Rushmore characterized the speech’s claims as “unsubstantiated and outlandish” and “examined ad nauseam” and “roundly debunked.” A reversal scenario in which congressional action, a future administration, or litigation partially restores CISA’s election-security posture; ProPublica reported Democratic lawmakers’ calls for investigation and demands for answers, and the reporting did not document Republican-side proposals for restoration.

Two principal forward paths can be distinguished by which dynamic proves dominant. Where capacity-value dynamics govern, state authorities develop replacement sensor coverage and intelligence substitutes over the planning horizon, federal disengagement becomes structurally stable, and the federal absence is a manageable condition; the observable signature is a 2026 election cycle in which federal silence carries no visible cost and state substitutes function. Where trust-sharing dynamics govern, the trust deficit locks the federal government out of any future dispute-resolution role, leaving CISA with diminished standing to weigh in on contested outcomes regardless of which party prevails; the observable signature is a federal posture under test in which any attempted authoritative intervention encounters the credibility constraint the declassification and capacity cuts established. Both converge on a single structural feature: federal credibility on election integrity now depends on information-sharing arrangements whose restoration is gated by the same trust current federal behavior is described as eroding.

The stabilizing mechanism the framing tension implies

Defending election infrastructure from foreign adversaries requires sustained cooperation among federal agencies, state authorities, and vendors; investigating claims of fraud requires access to the same systems and data those cooperation arrangements were designed to protect. Each function depends on the other’s cooperation; each action taken under one frame can be read by the other side as a violation of its premise. For the tension to be tractable, a stabilizing feedback would have to exist — a mechanism that authorizes federal investigation access to election systems only under conditions that preserve state cooperation (judicial process, agreed state-federal protocols, an inspector-general structure independent of the political appointees conducting the access).

The cooperation arrangements prior officials describe — penetration tests negotiated with states, tabletop exercises run with state officials, sensor data shared under agreed confidentiality — describe prior instances of such a stabilizing mechanism, not a current one. The Puerto Rico seizure, the Warner calls, and the DHS-appointee proposal to procure and secretly examine a voting machine without notifying the vendor each operate outside any state-coordinated framework the prior architecture recognized as stabilizing. Whether each constitutes legitimate oversight or an action that erodes the trust architecture is itself a question on which state and federal actors now disagree as a matter of first premise.

Three readings adjacent to the source reporting

The reporting does not document these as named frames, but three complementary readings sit adjacent to the substrate’s account.

Trust as a public good: jointly consumed by state, vendor, and federal actors, non-rival among them but vulnerable to unilateral defection. The declassification converts a shared resource to a unilateral one, with the irreversibility that conversion carries. Principal-agent hazard: CISA acting as agent for federal security interests while state authorities hold the principals whose cooperation the function requires; the agent’s incentives are described as favoring federal political preferences over the principals’ trust threshold, with the principals’ only exit being refusal to share. Unilateral confidence-restoration moves: releasing documentation, convening a consultative body, ceding specific authorities back to states would each be required to reverse the dynamic; the reporting describes none such move, and the September 24 plan reads, by Bellows’s account, as arriving on the planning timeline that pre-Labor Day preparation would have required rather than the timeline restoration would require.

Specialists’ accounts converge on a single point: the architecture in its prior form took years to build, operated on the same multi-year horizon election planning requires, and is described by Macias, Tisler, Durkovich, Hale, and Fontes as not substitutable in its information-sharing function by state-level substitutes for the foreign-intelligence component in particular. Whether the trust architecture can be rebuilt before it is required again depends on choices that the current administration’s actions, per the specialists ProPublica consulted, are described as moving away from rather than toward.

Analytical techniques used in this piece

This analysis applies the methods below. Each links to a short, plain-English explainer you can read and reuse.

Systems Dynamics (Structural): Maps a system’s structure — stocks, flows, and the architecture that shapes its behavior.
Wicked Futures: Explores a long-horizon, deeply entangled future with no clean resolution.
Wicked Problems: Treats a problem as wicked — no stopping rule, no clean test of success, every attempt consequential.