DHS appointees urged CISA to secretly hack voting machine, sources say

State officials say CISA vanished from midterm planning

The two former administration officials said the appointees wanted CISA to procure a voting machine, examine it and report the findings to the White House. The directive carried an unusual condition, according to one of the former officials: CISA was told not to alert the machine’s manufacturer if the agency uncovered flaws, a directive that ran counter to CISA’s standard practice. The proposition unsettled career employees at an agency whose mission is to defend election infrastructure. “My thought was they could keep it in their back pocket to invalidate any [election] results they don’t like,” one of the former officials said. “This goes against everything CISA represents.” The career staffers repeatedly told the political appointees that the operation was impossible, in part because the agents capable of pulling it off had been laid off by Elon Musk’s Department of Government Efficiency initiative. The appointees eventually stopped pressing CISA.

Though the request was never acted on, ProPublica reported it illustrates how the Trump administration has tried to use the agency for its own ends while draining it of resources for one of its critical missions: protecting the nation’s voting systems. Trump has repeatedly warned that America’s elections are vulnerable to hacking, in some cases repeating disproven claims, experts ProPublica consulted said, and those same experts said the administration’s actions are undermining the federal government’s role in helping secure them.

Since Trump returned to the White House in January 2025, his administration has laid off or pushed out more than 1,000 CISA employees, shrinking the agency by about one-third. The president’s 2027 budget proposal would cut agency funding by another $700 million, a reduction that could necessitate about 900 additional layoffs. In response, Democratic lawmakers have called for an investigation into CISA’s ability to perform its mission and demanded answers as to why federal funds are not being used to support election security as Congress directed.

When Trump returned to the White House in January 2025, his administration moved quickly to dismantle CISA. Administrative notices went out just a couple of weeks after the inauguration and included the team in charge of dispelling disinformation. Separately, Elon Musk’s Department of Government Efficiency laid off people critical to the agency’s election work, including those who had worked closely with states. The Trump administration also cut funding for the technology that monitored web and election servers, blinding the federal government to breaches it had previously detected. “Those groups couldn’t even order a pizza,” one former senior CISA employee said.

When it came time for states to prepare for the 2026 midterms, CISA had effectively disappeared, several state election officials said. Since Trump signed the CISA Act in 2018, the agency had worked with state authorities and voting machine vendors to help protect election infrastructure from cyberattacks. During Trump’s second term, though, CISA has abandoned much of this work. Several state election authorities said the agency provided them no assistance — and no explanation for its absence — during the critical planning stages in 2025 and through mid-September 2026. “There is a difference between deprioritizing and being nonexistent,” said Ryan Macias, an election technology and cybersecurity expert who has worked as a consultant for CISA. In the period when “the bulk of preparations for the election typically would have been completed,” Macias said, “they were nonexistent. Literally nonexistent.”

Defending elections from hackers was not always part of DHS’s remit. In 2007, hackers broke into the Pentagon and stole terabytes of sensitive data; one intelligence leader later described the digital heist, by an unknown foreign adversary, as an “espionage Pearl Harbor.” Under President George W. Bush, DHS underwent a reorganization that created an office called the National Protection and Programs Directorate, which helped fortify advanced cyber defense systems and important infrastructure, ranging from helping secure events like the Super Bowl to protecting chemical plants. In 2018, Trump signed a bill making the office a stand-alone agency, allowing for more federal funding and transforming it into what amounted to a tech support desk for anything DHS designated “critical infrastructure.” The bill renamed the agency CISA.

Though Trump helped create CISA, he did not much appreciate the work the agency did under its old name to expose the extent of Russia’s meddling in the 2016 presidential election. Russian agents had unleashed a massive disinformation campaign, with a Kremlin-backed troll farm creating thousands of social media accounts posing as Americans and promoting Trump, according to bipartisan reports from the U.S. Senate Select Committee on Intelligence released before the 2020 election. A dozen Russian military agents were indicted for what the Justice Department described as “a sustained effort to hack into the computer networks of the Democratic Congressional Campaign Committee, the Democratic National Committee, and the presidential campaign of Hillary Clinton.” Trump publicly downplayed this interference, but DHS leadership saw the Russia attack as an escalation. In January 2017, before Trump took office, DHS upgraded America’s elections to the status of critical infrastructure.

To carry out its election-security function, CISA needed help from states and voting machine vendors wary about sharing data on weaknesses in voting systems. State officials were also reluctant to cede any role in election preparation to the federal government. Gradually, CISA and state election officials negotiated a fragile trust. “It took years and years of building trust, of talking to election officials, of hiring people with elections experience who could be validators for the work that CISA wanted to do, before they finally built strong working relationships,” said Derek Tisler, election-security counsel at the Brennan Center for Justice, a nonpartisan institute based at New York University School of Law.

Under Director Chris Krebs, CISA hosted penetration testing in which its agents would try to hack into a state’s system to locate weaknesses that could then be patched, ran tabletop exercises simulating potential catastrophes around elections, offered regular secret-level briefings to secretaries of state to share federal intelligence, and paid for sensor technology that looked for potential malicious online activity on election networks. The consortium of state partners shared data ranging from routine spambots to more serious threats; if Virginia caught unusual activity in its system, other states could be alerted to be vigilant. “The staffing was there, the expertise was there, the visibility was there, the funding was there,” Macias said.

While CISA had prepared for attacks from foreign governments or lone-wolf hackers, few at the agency had expected the threat to elections to come from inside the White House. When Trump refused to concede to Joe Biden in 2020, claiming the vote had been rigged, CISA became a key component of the guardrails that ultimately led to the election results being certified. The agency, in a statement co-signed by secretaries of state and voting machine vendors, vouched for the election’s integrity, calling it “the most secure in American history.” When Krebs publicly rebutted claims amplified by the White House as “unsubstantiated” or “technically incoherent,” Trump fired him over Twitter. As Congress prepared to vote on certifying the election results, members of CISA, along with the FBI, convinced then-Attorney General Bill Barr that the conspiracy theories embraced by the president could be explained by human error, not systemic fraud or hacking.

Several current and former CISA employees and state election officials described an agency that had become significantly less equipped to help states fight legitimate cyber threats. State leaders said they had used their own resources to shore up gaps left by CISA, paying for sensor technology that can detect unusual activity in election networks, for example. Some services, like intelligence on foreign actors, cannot be replicated at the state level. Some of the people ProPublica interviewed said they were worried that Trump and his allies continue to ratchet up rhetoric about voting security, particularly about threats to voting machines. Officials in one large voting jurisdiction told ProPublica they had met privately with machine vendors to develop a contingency plan in case the federal government seized their machines or declared them unusable. In recent months, in reviving debunked theories about the 2020 election, the Trump administration has declassified troves of records, including sensitive material that state officials had provided to CISA. Some state officials told ProPublica they feared that what was left of the agency had been compromised by a conspiracy-obsessed presidential administration. Some state authorities said they no longer trusted the administration enough to share information with CISA. “They’ve violated the entire premise of that information-sharing relationship,” a former high-ranking federal cybersecurity official who now advises state governments on national security told ProPublica. “There’s no fucking way [state governments are] ever going to give any information to CISA. And it’s unclear if they ever will in the future.”

Arizona Secretary of State Adrian Fontes was blunt. “I don’t pay attention to what the president says. I pay attention to what his administration does,” he said. “And what they’ve done is basically cut us off and left us on our own.” White House spokesperson Lauren Bis defended the administration’s handling of election security in an emailed statement, saying that “President Trump has done more than any other President to ensure we have free and fair elections.” Bis referred specific questions about CISA’s handling of elections to DHS. DHS and CISA did not respond to interview requests or to a detailed list of questions.

On the evening of July 16, in the Black Hills of South Dakota, dozens of election officials and their staffs gathered for a reception near Mount Rushmore. It was the third night of an annual conference for secretaries of state, drawing participants from red and blue states. At about 8 p.m., a wave of discomfort swept through the crowd as attendees glanced frequently at their phones, according to people at the event. Trump was about to address the nation on election security. Some at the reception worried he would declare a national emergency, as his allies had urged him to do months earlier, and use it as a pretext to direct the government to seize voting machines. Then reports on the speech began rolling in and the mood shifted. The claims Trump was making were unsubstantiated and outlandish; many had been examined ad nauseam, including by those at the reception, and roundly debunked. The collective anxiety melted away as many saw the speech as another attempt to revive disproved theories. “Everyone just sort of guffawed and put their phones away and went to the bar,” recalled Quinn Raymond, co-founder of VoteShield, a nonprofit that works with states to help monitor voter registration data, who was at the event.

If the speech itself made little headway, the records the administration released to support it broke long-held trust. The material included raw information states had shared with CISA that was supposed to remain private, such as a log of communications from Election Day 2020 detailing activity being monitored in several states. “It betrayed the trust of all partners who were willing to share information at the time,” said Geoff Hale, who worked on CISA’s elections team from the agency’s inception until last year and now specializes in election security at the Center for Democracy & Technology. Bis denied that the administration broke any agreements, calling the release “exactly the sort of transparency news organizations should applaud” and saying the speech had been fact-checked “by the agencies whose evidence was released and did not mischaracterize any information.” In the speech itself, Trump mocked CISA’s defense of the 2020 election, calling the agency’s statement that the contest was “the most secure in American history” a “very pat line” concocted as part of a deep-state cover-up. One former career CISA employee described being crestfallen at the Trump administration’s erosion of all they had accomplished.

Some state election authorities were also alarmed at other signs of what they described as a reckless attitude toward sensitive data collected by CISA. Earlier in 2026, Politico reported that acting CISA Director Madhu Gottumukkala had uploaded records to ChatGPT, despite a DHS prohibition on employees using the program. A CISA spokesperson told Politico that Gottumukkala had been permitted to use the technology on a “short-term and limited” basis. In May, independent journalist Brian Krebs reported that CISA had published private data — including passwords, cloud keys and other information — on its public GitHub page, in a folder labeled “Private-CISA.” A CISA spokesperson told Krebs there was no indication that sensitive data was compromised.

Some state election authorities were also alarmed to see the lengths to which the Trump administration went to legitimize the president’s fixation on the 2020 race. In fall 2025, Missouri election officials produced a memo stating that Andrew McCoy Warner, a Justice Department official and prominent 2020 election conspiracy theorist, had called several clerks asking for access to voting machines. Then-Director of National Intelligence Tulsi Gabbard led an operation in Puerto Rico to seize election machines. The private cybersecurity contractor hired to examine them, Mojave Research Inc., failed to find evidence supporting claims about 2020, after which the federal government became dissatisfied and stopped renewing its contract, the company’s CEO later told reporters. A spokesperson for the Office of the Director of National Intelligence said in August that the contractor’s work had ceased because it had completed its contract. Gabbard told Congress in March that the seizure came at the request of an assistant U.S. attorney in Puerto Rico.

“What happened in the second Trump administration is from almost day one — I mean, literally the first two months — they took all that was built up by Trump 1 and just decimated it,” said David Becker, founder of the nonpartisan Center for Election Innovation and Research. “Election officials lost trust in the federal government.” Caitlin Durkovich, a former DHS assistant secretary for infrastructure protection and co-founder of the cybersecurity firm Civira Partners, told ProPublica: “We worked so hard to build that trusted relationship. I don’t know how you put it back together.”

A few weeks after Trump’s speech, state election officials gathered once more, this time for a video call with Nick Andersen, who had replaced Gottumukkala as acting CISA director. Though the primaries were already under way, this was the first time many had met Andersen, a former cybersecurity adviser to Trump’s White House and former Marine Corps engineer who had joined CISA a year earlier. Andersen is also a district representative for the Republican Party in Virginia, according to the party’s website. In March, he gave a speech to the Fairfax GOP chapter titled “Fighting Democrat Redistricting.” Speaking by video in August, Andersen announced that DHS was preparing to release a plan on how the agency would work with state officials to secure the election, according to five people who were present, some of whom shared notes with ProPublica. State officials on the call were stunned at what they perceived as a lack of understanding of election planning. Some peppered Andersen with questions about where CISA had been when there was still time to make improvements. Early voting for the general election was just around the corner, and the states had spent more than a year preparing without federal assistance. Andersen attributed any past lapses or perceived breaches in trust to the federal government shutdown in fall 2025, twirling his pen uncomfortably and sipping from a Monster energy drink, according to people on the call. “I told him I didn’t trust him,” Fontes recalled in an interview. “I did raise my voice a little bit, because I’m frustrated — very frustrated — that they would have the temerity to come in, clear the entire deck of competent professionals, stop supporting the states, eviscerate the coordination efforts that they had and then suddenly come in and say: ‘Oh, we’re from the federal government. We’re here to help.’”

A recently departed CISA official said attempting to do the agency’s typical election work now would be futile. In previous years, CISA had finished almost all its preparations with the states by Labor Day. “That ship has sailed,” the official said.

CISA published its security plan for the 2026 election on September 24. The 13-page document describes how, over the past two years, CISA has “recommitted to its statutory mission and remains resolute in strengthening the security of elections.” It calls for “leveraging collaborative partnerships” with states the agency has effectively abandoned since Trump took office. Shenna Bellows, Maine’s secretary of state, said she welcomed the plan but was skeptical of the agency’s motivations. “For CISA to promise election officials now, at this point in time, that they are going to be a resource for the 2026 election is too little, too late,” she said.

State officials said their planning would ensure a secure election, even without help from CISA. Yet they and cybersecurity experts worried that Trump would say the election was hacked if Republicans did not win in November.