US cybersecurity agency releases election infrastructure plan 40 days before midterms

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an election infrastructure security plan 40 days before the November midterms. The 13-page document, released by Homeland Security Secretary Markwayne Mullin, outlines potential threats to election systems and details services CISA will offer to election officials to safeguard the vote.

Mullin emphasized the importance of election security being tantamount to national security, stating, "This plan, which will be implemented in full, is crucial to the security, freeness and fairness of choosing the leaders of our country."

The plan warns of various threats, including software vulnerabilities, hacks of voter registration databases, insider threats, and physical security incidents like bomb threats at polling locations. However, it acknowledges that many longstanding election practices can address these risks and aims to ensure the American public trusts voting systems and recognizes physical safety measures will be in place during voting.

CISA, housed under the Department of Homeland Security, has historically assisted state and local election officials with cybersecurity and physical security services. However, the Trump administration significantly reduced CISA's budget and personnel, leading to a dismantling of its election security role. In the lead-up to the 2024 midterm elections, numerous state election officials reported that CISA's services, such as live tabletop exercises and penetration tests, were unavailable.

Minnesota Secretary of State Scott Simon noted that his office is spending around $250,000 on private vendors for penetration testing, which can identify and address security vulnerabilities.

The new CISA plan assigns support responsibilities to 10 "regional directors," a shift from the agency's past structure with state and regional advisers. David Becker, executive director of the Centre for Election Innovation and Research, described the new structure as a positive step but potentially performative, given the states' reliance on alternative resources.