Early in President Trump's second term, political appointees at the Department of Homeland Security asked CISA, the federal cybersecurity agency, to secretly acquire a voting machine, hack it, and tell no one but the White House what it found.
ProPublica reported the request, citing two former administration officials with knowledge of it. CISA's standard practice is to tell a manufacturer when it finds a flaw so the company can fix it. The appointees explicitly asked the agency not to. CISA staff told them the request could not be fulfilled, which the former officials tied to the agency's job cuts.
One former official told ProPublica: "My thought was they could keep it in their back pocket to invalidate any [election] results they don't like." That is one person's reading of motive, not a documented plan, and no evidence has been reported that the findings were ever used. White House spokeswoman Lauren Bis responded that "President Trump has done more than any other President to ensure we have free and fair elections."
The disclosure norm exists for a practical reason. A flaw known to only one party stays open on every machine of that model, for anyone else who finds it. Keeping such a bug quiet may suit an intelligence operation, but it is the opposite of what an election-security agency is for.
That agency is much smaller now. CISA has been responsible for helping protect election infrastructure since 2018. It has cut 1,000 jobs, about one third of its workforce, since the start of the second term, and most of its senior leadership has resigned or been fired. Funding cuts in 2027 are likely to remove another 900 jobs. A former high-ranking federal cybersecurity official told ProPublica the administration had "violated the entire premise of that information-sharing relationship."
States are acting accordingly. Arizona Secretary of State Adrian Fontes said the administration has "basically cut us off and left us on our own." With the November midterms close, the question is whether states will route sensitive security information through CISA at all.