Political appointees at the Department of Homeland Security asked CISA to secretly acquire and hack a voting machine, according to a new ProPublica investigation. The findings were intended for the White House, and CISA staff were reportedly instructed not to notify the manufacturer of any vulnerabilities discovered.
Citing two former administration officials, ProPublica reported that CISA employees resisted the request, which was ultimately abandoned.
State election officials reported losing federal cybersecurity assistance, including threat intelligence, vulnerability assessments and network monitoring support, ahead of the November midterms.
CISA released its 2026 election security plan on September 24, although several officials said it arrived too late for much of their election preparation. The White House defended its election security record.
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“From an offensive security perspective, examining voting machines for vulnerabilities is not inherently unusual. Independent security testing is an important part of protecting critical infrastructure. The concern raised by this reporting is not the testing itself, but the reported lack of transparency and the instruction to withhold potential findings from the manufacturer.
“There is a fundamental difference between discovering a vulnerability and reducing the risk it represents. Even when technical evidence is overwhelming, economic tradeoffs, operational pressures, and institutional biases can influence how organizations interpret findings and prioritize remediation. Those realities do not disappear simply because the evidence is compelling.
“One way to navigate these challenges is through a complete security lifecycle: discover the weakness, validate it with evidence, assess its impact, remediate it, and independently verify that the fix works. I often think of this as moving beyond finding vulnerabilities to finding proof and fixing the underlying risk.
“The broader concern is the reported reduction in information sharing and security coordination. Election security depends on more than voting machines. It requires continuous assessment, threat intelligence, monitoring, and cooperation across multiple organizations. Cybersecurity is not simply about proving something can be hacked. Given enough time and resources, that is often the easy part. The real challenge is ensuring that evidence leads to informed decisions, measurable improvements, and demonstrable risk reduction. Otherwise, we’re just getting better at documenting problems we haven’t solved.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“Government agencies identifying vulnerabilities and conducting vulnerability research is fairly normal. That happens. What makes this strange is that, apparently, there was a specific request from the White House.
“I don’t know what the context was or why that request was made, but it does look weird. A White House request for this particular research is unusual enough to raise questions.
“This is one of those stories we need to watch as more information comes out. Government vulnerability research itself isn’t surprising. The circumstances around this request are definitely peculiar. Curiouser and curiouser.”
ㅤ
Josh Marpet, Senior Product Security Consultant, Finite State:
“Security Testing of voting machines is an important aspect of the security around the entire election process. Done properly, it’s openly reported on, in collaboration with the manufacturer, in order to improve the security of the voting process.
“As the minority inspector of voting for my district, I am intimately acquainted with the security around the voting machines. I remain incredibly impressed with how well the process protects against any irregularities. Dual control of the electronic record, the paper tabulator record, and the actual paper ballots themselves, is maintained all the way through the process. Every document is cross-referenced to other documents with unique id’s, at all times. In order to taint that process, you’d either have to falsify an identity, which gains you at most, 1 vote, or subvert multiple people in the voting process, which, since there are people from all parties working together, and poll inspectors watching at most to all times, nearly impossible to perform. When it gets up to the county collection point, it’s out of my hands, but others with my background have studied it at that point, such as my friends, Harri Hursti or Matt Blaze. They have explained it with terms similar to mine. Dual control, oversight, and paper records retained for forensic accounting of votes.ㅤ
“Kudos to the CISA employees who resisted the request.”
ㅤ
Jeremiah Fowler, Researcher, Black Hills Information Security:
“There are few things more decisive than politics, elections, and the security of voting machines. If researchers or government agencies were to discover a vulnerability and intentionally withhold that information from the manufacturer or election officials, the potential security risks would remain unresolved and leave those machines vulnerable. Election security should be focused on protecting the integrity of the voting process, regardless of political party. Federal cybersecurity assistance is vital as not all states and localities have the same budgets or resources to protect their election systems. Any disruptions to threat intelligence sharing, vulnerability assessments, and network monitoring are deeply concerning. Unfortunately, we usually do not realize the value of investing in cybersecurity until after a critical incident.
“Simply hacking a voting machine is not as easy as it sounds and many voting systems are designed to operate offline. The real potential risk in my view is in the broader election infrastructure that could include interconnected devices, election management systems, and reporting hardware that could have internet access. In the 2020 election independent election security researchers identified more than 35 voting systems connected to the internet across 11 states and Washington, D.C. The investigation also reported that a main supplier of voting equipment and election-management technology acknowledged that approximately 14,000 voting tabulators were equipped with online modems and had been in use nationwide. It was proof that some election equipment had network connectivity despite assurances to the public that voting systems were disconnected from the internet. All we can do is hope those systems have been updated or replaced.”
Kudos to the CISA for rejecting this request. But having said that, I have so many problems with the fact that someone wanted an election machine hacked is a huge problem. This really should ring alarm bells about the status of democracy in America.
Related
This entry was posted on October 21, 2026 at 3:28 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
DHS officials asked CISA to secretly hack voting machine
Political appointees at the Department of Homeland Security asked CISA to secretly acquire and hack a voting machine, according to a new ProPublica investigation. The findings were intended for the White House, and CISA staff were reportedly instructed not to notify the manufacturer of any vulnerabilities discovered.
Citing two former administration officials, ProPublica reported that CISA employees resisted the request, which was ultimately abandoned.
State election officials reported losing federal cybersecurity assistance, including threat intelligence, vulnerability assessments and network monitoring support, ahead of the November midterms.
CISA released its 2026 election security plan on September 24, although several officials said it arrived too late for much of their election preparation. The White House defended its election security record.
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“From an offensive security perspective, examining voting machines for vulnerabilities is not inherently unusual. Independent security testing is an important part of protecting critical infrastructure. The concern raised by this reporting is not the testing itself, but the reported lack of transparency and the instruction to withhold potential findings from the manufacturer.
“There is a fundamental difference between discovering a vulnerability and reducing the risk it represents. Even when technical evidence is overwhelming, economic tradeoffs, operational pressures, and institutional biases can influence how organizations interpret findings and prioritize remediation. Those realities do not disappear simply because the evidence is compelling.
“One way to navigate these challenges is through a complete security lifecycle: discover the weakness, validate it with evidence, assess its impact, remediate it, and independently verify that the fix works. I often think of this as moving beyond finding vulnerabilities to finding proof and fixing the underlying risk.
“The broader concern is the reported reduction in information sharing and security coordination. Election security depends on more than voting machines. It requires continuous assessment, threat intelligence, monitoring, and cooperation across multiple organizations. Cybersecurity is not simply about proving something can be hacked. Given enough time and resources, that is often the easy part. The real challenge is ensuring that evidence leads to informed decisions, measurable improvements, and demonstrable risk reduction. Otherwise, we’re just getting better at documenting problems we haven’t solved.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“Government agencies identifying vulnerabilities and conducting vulnerability research is fairly normal. That happens. What makes this strange is that, apparently, there was a specific request from the White House.
“I don’t know what the context was or why that request was made, but it does look weird. A White House request for this particular research is unusual enough to raise questions.
“This is one of those stories we need to watch as more information comes out. Government vulnerability research itself isn’t surprising. The circumstances around this request are definitely peculiar. Curiouser and curiouser.”
ㅤ
Josh Marpet, Senior Product Security Consultant, Finite State:
“Security Testing of voting machines is an important aspect of the security around the entire election process. Done properly, it’s openly reported on, in collaboration with the manufacturer, in order to improve the security of the voting process.
“As the minority inspector of voting for my district, I am intimately acquainted with the security around the voting machines. I remain incredibly impressed with how well the process protects against any irregularities. Dual control of the electronic record, the paper tabulator record, and the actual paper ballots themselves, is maintained all the way through the process. Every document is cross-referenced to other documents with unique id’s, at all times. In order to taint that process, you’d either have to falsify an identity, which gains you at most, 1 vote, or subvert multiple people in the voting process, which, since there are people from all parties working together, and poll inspectors watching at most to all times, nearly impossible to perform. When it gets up to the county collection point, it’s out of my hands, but others with my background have studied it at that point, such as my friends, Harri Hursti or Matt Blaze. They have explained it with terms similar to mine. Dual control, oversight, and paper records retained for forensic accounting of votes.ㅤ
“Kudos to the CISA employees who resisted the request.”
ㅤ
Jeremiah Fowler, Researcher, Black Hills Information Security:
“There are few things more decisive than politics, elections, and the security of voting machines. If researchers or government agencies were to discover a vulnerability and intentionally withhold that information from the manufacturer or election officials, the potential security risks would remain unresolved and leave those machines vulnerable. Election security should be focused on protecting the integrity of the voting process, regardless of political party. Federal cybersecurity assistance is vital as not all states and localities have the same budgets or resources to protect their election systems. Any disruptions to threat intelligence sharing, vulnerability assessments, and network monitoring are deeply concerning. Unfortunately, we usually do not realize the value of investing in cybersecurity until after a critical incident.
“Simply hacking a voting machine is not as easy as it sounds and many voting systems are designed to operate offline. The real potential risk in my view is in the broader election infrastructure that could include interconnected devices, election management systems, and reporting hardware that could have internet access. In the 2020 election independent election security researchers identified more than 35 voting systems connected to the internet across 11 states and Washington, D.C. The investigation also reported that a main supplier of voting equipment and election-management technology acknowledged that approximately 14,000 voting tabulators were equipped with online modems and had been in use nationwide. It was proof that some election equipment had network connectivity despite assurances to the public that voting systems were disconnected from the internet. All we can do is hope those systems have been updated or replaced.”
Kudos to the CISA for rejecting this request. But having said that, I have so many problems with the fact that someone wanted an election machine hacked is a huge problem. This really should ring alarm bells about the status of democracy in America.
Share this:
Like this:
Related
This entry was posted on October 21, 2026 at 3:28 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.