Election Officials Face Foreign Threats With the Weakest Federal Pipeline Since 2016

American election administration is entering the 2026 midterm cycle with a structural handicap that has no precedent in the modern threat-sharing era: the federal pipeline that once carried foreign interference intelligence to state and local officials has narrowed to its weakest point since 2016.

Reporting based on interviews with nearly a dozen election security experts describes a system in which U.S. intelligence agencies continue to track Russian, Chinese and Iranian influence operations, yet the channels for delivering those findings to the county clerks and secretaries of state who actually run elections have been curtailed by program cuts and institutional distrust.

The deterioration is not merely budgetary. It is relational. The Department of Homeland Security's late attempt to stand up an online threat-intelligence platform is regarded by practitioners as markedly less credible than the arrangements it replaces, and a mid-October classified briefing for election officials—the first since the 2024 presidential cycle—was disrupted by technical failures that broke a video call before being rescheduled.

Such episodes matter because election security depends less on raw intelligence than on the speed and confidence with which warnings travel from analysts to the people operating voting equipment.

What follows examines the mechanics of that breakdown, the specific threat environment officials now confront, and the improvised substitutes emerging at the state and local level. The analysis draws on named expert testimony, comparative evidence from the past four federal elections, and the operational record of the Cybersecurity and Infrastructure Security Agency, or CISA, the DHS component that has anchored federal election security work since 2018.

TL;DR Election officials preparing for foreign interference now receive less federal threat information than at any point since 2016, following cuts to election-security programs and the erosion of trust in CISA. Experts including Ryan Macias and David Becker describe a broken relationship between election administrators and federal agencies, a new DHS information-sharing tool of doubtful credibility, and a threat landscape compounded by AI-amplified disinformation. Officials are filling the gap themselves, but without the coordination center model that defined the 2018–2022 cycles.

The Architecture of Federal Election Threat-Sharing and Its Erosion

Federal election security has always rested on a voluntary bargain: CISA supplies threat intelligence, incident response support and physical security assessments, while state and local jurisdictions retain constitutional authority over their own elections. That bargain produced measurable results.

During the 2020 cycle, CISA's coordination center exchanged threat information with election officials in near real time and collected incident reports throughout Election Day, creating a two-way channel that experts now describe as functionally dormant.

The Coordination Center Model That Once Anchored Trust

The coordination center was never a command structure; it was a switchboard. CISA analysts monitored foreign influence operations, translated classified findings into unclassified warnings usable by local officials, and routed reports from counties back to federal partners.

Its value lay in predictability—officials knew whom to call, what to expect, and how quickly a response would arrive during a cyber or physical incident.

Ryan Macias, a longtime election security expert and former CISA consultant, frames the current condition bluntly: the relationship between election officials and the federal government has broken down. Many administrators, he notes, no longer know whom to contact when an incident occurs. That is an operational failure with direct consequences for response time, evidence preservation and public confidence.

David Becker, a former Justice Department attorney who co-founded the Center for Election Innovation and Research, draws the contrast with unusual precision. He states he knows no election official—Democrat or Republican—actively sharing cybersecurity information with federal agencies this time around, a departure from the previous four federal elections.

Bipartisan participation was the channel's defining feature, and its absence removes the redundancy that once made warnings credible.

The erosion therefore compounds itself. Fewer officials share data, so federal products grow thinner; thinner products invite further disengagement; and the coordination center's institutional memory degrades with each cycle in which it is not exercised. Rebuilding that trust would require sustained, predictable engagement rather than a single platform launch.

The New DHS Platform and the Credibility Deficit

CISA has launched what a spokesperson describes as an information-sharing tool, with authorized federal, state and local government partners granted access daily upon request. The agency declined to answer how many election officials have actually used the platform.

That silence is itself diagnostic: adoption data would be the simplest evidence of relevance, and its absence suggests the numbers are unflattering.

Multiple sources characterize the platform as unlikely to gain the trust or reach of prior arrangements. Credibility in threat-sharing is earned through track record—timely warnings, accurate attribution, protected sources—and a newly built portal inherits none of that history. Officials who once received tailored briefings now face a self-service interface with unclear provenance.

The mid-October classified briefing illustrates the same pattern. Convened as the first such session since the 2024 presidential cycle, it was disrupted by technical problems that prevented a video call from functioning, then rescheduled and held without those issues. A single glitch is minor; a first-contact failure after a two-year gap signals institutional rust.

Compounding the technical friction is motive uncertainty. The administration's emphasis on election-fraud claims and its willingness to intervene in state-run elections have made many administrators skeptical of federal intentions. When the entity supplying threat intelligence is also perceived as a potential political actor, warnings require independent corroboration that no longer exists.

Why Information-Sharing Collapsed Faster Than Intelligence Collection

Collection and dissemination are separable functions, and the 2026 divergence between them is instructive. U.S. intelligence agencies continue tracking influence efforts by Russia, China and Iran; the analytic output exists.

What has degraded is the last mile—the translation of classified findings into unclassified, actionable guidance delivered to the officials who operate voter registration systems and tabulation equipment.

That last mile is labor-intensive and trust-dependent. It requires cleared liaisons who understand county-level constraints, standing relationships built across cycles, and a distribution mechanism officials already monitor. Cuts to federal programs removed the personnel; the trust breakdown removed the willingness to use whatever remained. Neither factor alone would have produced the current condition.

Comparative evidence sharpens the point. During 2020, CISA issued public warnings about foreign influence operations that election officials could cite and act upon. In 2026, the equivalent public-facing cadence has thinned, and the private channel that once supplemented it is, by expert account, effectively closed. Officials are left with open-source monitoring and peer networks.

The asymmetry favors adversaries. Foreign influence operations require only amplification of existing doubt; defenders require coordination to counter it. Every reduction in federal communication lowers the cost of disinformation and raises the cost of rebuttal, a ratio that compounds across the weeks preceding an election.

The 2026 Threat Environment: AI Amplification Meets Institutional Uncertainty

Sources describe a threat environment defined by two converging pressures: foreign disinformation amplified by artificial intelligence, and a federal government less predictable and reliable than in past elections. The first pressure is technological and measurable; the second is institutional and harder to quantify, yet experts weight it heavily because predictability is what makes defensive coordination possible at all.

AI-Amplified Disinformation and the Compression of Response Time

Generative models have collapsed the cost of producing persuasive synthetic content. A fabricated audio clip or video segment that once required production capacity can now be generated in minutes and distributed across platforms before election offices issue a correction. The defensive window between publication and rebuttal has narrowed from days to hours, sometimes less.

This compression interacts directly with the communication breakdown. When federal agencies supplied rapid attribution and context, local officials could respond within the window. Without that input, they must independently verify claims about their own equipment and procedures—a task for which most offices lack dedicated staff, forensic tools or platform relationships.

The threat is not hypothetical in expert framing. One former CISA official states plainly that foreign adversaries have not stepped back from U.S. elections. The same official describes the federal government as having abandoned election officials, who remain worried about interference while receiving no information from federal sources and filling the gap themselves.

Quantifying the gap is difficult because no public metric tracks federal-to-local threat communications. What can be measured is participation: Becker's assessment that no official he knows is actively sharing cybersecurity information with federal agencies implies a participation rate near zero among the practitioners best positioned to detect incidents early.

Political Distrust as an Operational Variable

Distrust is usually treated as a political sentiment; in election administration it functions as an operational variable. Officials who question federal motives must weigh the risk that shared information could be repurposed politically against the benefit of timely warning. When that calculation turns negative, the rational choice is silence—and silence degrades collective defense.

The administration's focus on election-fraud claims has intensified this calculus. Election administrators who face public scrutiny of their procedures have little incentive to volunteer incident data to an agency whose parent department is perceived as aligned with those claims. The result is a channel that is technically open but socially closed.

Bipartisan participation was the coordination center's quiet safeguard. When both Republican and Democratic officials used the same channel, warnings carried cross-partisan credibility and could not be dismissed as factional. Becker's observation that this participation has vanished removes that safeguard precisely when contested results are most likely.

Rebuilding requires more than outreach. It requires visible independence, consistent messaging across cycles, and protection for officials who report incidents. None of these can be established in the weeks before an election; all of them were eroded over months of program cuts and rhetorical conflict.

What Local Officials Are Doing to Fill the Gap

With federal input diminished, election officials are improvising. Peer networks among county administrators, state-level fusion centers, and informal relationships with academic and nonprofit security researchers have absorbed part of the load. These substitutes are valuable but uneven, depending on local budgets, staff expertise and pre-existing professional ties.

The improvisation has a structural limit. Local offices can share what they observe, but they cannot replicate foreign intelligence collection or national-level attribution. A county clerk can warn neighboring jurisdictions about a phishing campaign; only federal agencies can assess whether that campaign originates from a state-linked actor with a broader targeting plan.

Resource asymmetry compounds the problem. Large jurisdictions employ dedicated security staff; small and rural offices often rely on a single administrator who also manages voter registration, equipment logistics and public communication. The gap left by federal withdrawal is therefore widest where capacity is thinnest, a familiar pattern in election administration.

Some states have expanded their own intelligence functions, but state-level capacity varies widely and cannot substitute for national collection. The result is a patchwork in which protection depends on geography—an outcome that conflicts with the principle that election security is a national interest regardless of jurisdiction size.

Comparative Lessons From Allied Democracies

Other democracies offer instructive contrasts. The United Kingdom routes election threat intelligence through a dedicated national security structure with standing relationships to local returning officers, while the European Union has developed rapid alert systems for disinformation.

These models share a feature the U.S. system has lost: predictable, apolitical channels that officials use as routine practice.

The comparison is not about centralization. Allied systems preserve local election authority while maintaining national threat communication, precisely the balance CISA once struck. What distinguishes them is continuity—channels that persist across electoral cycles and are insulated from shifts in governing coalitions, so that officials never need to relearn whom to contact.

For the United States, the lesson is that threat-sharing infrastructure is a capital asset requiring maintenance. Cutting programs saves marginal budget dollars but destroys relationships that take years to rebuild.

The 2026 condition is the visible cost of that trade-off, and the next cycle will inherit it unless the channel is deliberately restored.

Restoration would require congressional attention, agency leadership committed to apolitical engagement, and sustained outreach to skeptical local officials. None of these is imminent. In their absence, the practical question for election administrators is how much risk they can absorb with peer networks alone—and whether that margin is sufficient.

Implications for Election Integrity and the Road Ahead

The strategic consequence of the breakdown is a shift in where election security risk accumulates. When federal warning capacity declines, risk migrates to the least-resourced jurisdictions and to the hours immediately following a disinformation event, when verification matters most. That migration is silent; no incident report captures a warning that was never delivered.

Risk Concentration and the Geography of Vulnerability

Risk concentration follows capacity. Jurisdictions with dedicated security staff can substitute open-source monitoring and peer consultation for federal briefings; those without such staff cannot. The divergence produces a national system in which protection depends on local budgets, an outcome inconsistent with the equal-weight principle of American elections.

Timing compounds geography. Disinformation peaks in the final seventy-two hours before voting, precisely when federal support was historically most active. Without that support, local offices must triage between operating polling places and rebutting synthetic content—a trade-off that favors operations and leaves the information environment contested.

The concentration also affects trust in results. If officials cannot verify whether an incident is isolated or part of a coordinated campaign, their public statements will be appropriately cautious—and caution, in a contested information environment, is easily reframed as concealment. Federal context once supplied the confidence that made clear communication possible.

These dynamics suggest that the 2026 cycle will function as a natural experiment in decentralized defense. The outcome will indicate how much protection peer networks and state-level capacity can provide, and at what cost in consistency, speed and public confidence across jurisdictions of differing size.

Institutional Repair: What Would Actually Restore the Channel

Repair is technically straightforward and politically difficult. The components are known: a standing coordination function with named liaisons, unclassified products calibrated for local use, protected reporting channels, and visible bipartisanship in sponsorship. Each element existed before; none requires new technology or legislative invention.

The binding constraint is credibility. Officials must believe that shared information will not be politicized and that reporting an incident will not invite scrutiny of their own procedures. That belief is built through consistent behavior across cycles, not through platform launches or press releases announcing new tools.

Congressional action could codify the channel and insulate it from shifting priorities, but legislation alone cannot manufacture trust. Agency leadership matters more: the tone set by senior officials determines whether local administrators perceive federal partners as neutral technical resources or as political actors with agendas.

Absent repair, the trajectory is clear. Each cycle without a functioning channel widens the gap between national intelligence collection and local defensive capacity, and each widening makes the next restoration more expensive. The 2026 condition is not a temporary dip; it is a structural deficit accumulating interest.

What to Watch Before the Next Federal Election

Several observable indicators will reveal whether the channel recovers. Adoption figures for the CISA portal, if disclosed, would show whether officials are engaging. The frequency and content of public threat warnings would indicate whether unclassified products are being produced.

And the willingness of both parties' officials to speak on record about federal cooperation would signal whether trust is returning.

Absent improvement, watch for state-level substitution. If governors and secretaries of state announce independent intelligence-sharing compacts, that would confirm federal withdrawal and mark a durable shift toward regionalized election security. Such compacts could improve protection in participating states while deepening national inconsistency.

Finally, watch the incident record. A cycle without major foreign interference would not prove the system works; it might simply reflect adversary restraint or luck. The more telling signal is response quality—how quickly officials detect, verify and communicate about incidents when they occur, and whether they had anyone to call.

The evidence assembled here points to a single conclusion. Foreign adversaries have not reduced their interest in American elections, but the federal government has reduced its communication with the officials who defend them. That asymmetry, not any specific intrusion, is the defining election security problem of the 2026 cycle.