Election officials say trust with CISA is broken — and may not come back

This article was originally published by Votebeat, a nonprofit news organization covering local election administration and voting access.

When the U.S. Department of Homeland Security first declared in January 2017 that election systems were “critical infrastructure,” alarmed state election officials pushed back quickly and loudly, fearing the move could lead to a federal takeover of elections.

DHS’s designation came during the final days of the Obama administration, as federal officials scrambled to respond to evidence of Russian interference with the 2016 election.

Denise Merrill, a Connecticut Democrat who was then president of the National Association of Secretaries of State, helped lead the opposition.

“The U.S. Department of Homeland Security has no authority to interfere with elections, even in the name of national security,” NASS said in a February 2017 bipartisan resolution urging the new administration to rescind the designation.

But the designation stuck and, Merrill said, something unexpected happened. As President Donald Trump’s first term progressed, states began to buy in. The designation elevated elections into a national security category that brought federal cybersecurity resources and intelligence sharing on threats. It also meant closer coordination between agencies, states, and the federal government that states couldn’t replicate on their own.

Officials at DHS’s cyber arm, the Cybersecurity and Infrastructure Security Agency, created in 2018, emphasized that states remained in control, and over time, election officials came to trust the partnership enough not only to accept help, but to defend it publicly.

Now, Merrill and others say, that trust is gone — perhaps for good.

Election officials, private election vendors, and security experts describe a dual breakdown: renewed alarm that the Trump administration is seeking tighter federal control over elections, and a simultaneous retreat by CISA from the hands-on support states had come to depend on.

“It took us years,” she said in a recent interview with Votebeat. “It’s like so many things that are being torn down — it will take us generations to replace it, if at all.”

With federal support receding, states are improvising. A coordinated national communication system once run through CISA has been replaced by a patchwork of informal phone calls, email lists, and association meetings. Some information still flows through a nonprofit tied to the critical infrastructure designation, but only for election offices and associations that pay for membership.

Election offices in places like California have turned to state agencies for cybersecurity and other services, trading CISA’s standardized approach for looser, less uniform processes. In some states, like Pennsylvania, budgets have been stretched to pay for scans and assessments from private companies or nonprofits; in others, gaps remain.

In an email, a CISA spokesman said that CISA has now “refocused on its core mission” and continues to provide “the most capable and timely threat intelligence, expertise and resources” election officials need. The spokesperson did not immediately respond when asked which services the agency still provides.

“Any claims that CISA is not communicating with our state and local partners is false,” said the spokesperson. “However, CISA will not be functioning the way it was during the Biden Administration when it was performing duties outside of its statutory authority – to include electioneering and censorship.”

‘Critical Infrastructure’: From Backlash To Buy-In

The backlash to the “critical infrastructure” designation in 2017 was bipartisan and swift. NASS warned that it was “legally and historically unprecedented” and raised concerns about federal authority and control. State officials worried the designation could open the door to new mandates, reporting requirements, or federal involvement in polling place security.

A document from the U.S. Election Assistance Commission cataloged dozens of unresolved questions from election administrators nationwide, including whether DHS would have a greater role in administering elections or dictating physical security standards.

DHS and CISA officials tried to calm the fears. Chris Krebs, CISA’s first director, and Matt Masterson, then the agency’s top election security official, emphasized that the federal role would be voluntary, responsive, and driven by state needs.

CISA showed up — repeatedly — at conferences, trainings, and briefings, positioning itself as a convener rather than a regulator. It brought private companies like Microsoft and Facebook directly to election officials to share intelligence about foreign interference. It offered cybersecurity scans, simulations to game out responses to potential threats, and physical security assessments, all on request.

Matt Crane, now executive director of the Colorado County Clerks Association, was the clerk in Arapahoe County when DHS first adopted the critical infrastructure designation for elections. He said he was initially concerned that CISA would go too far. What won him over, he said, were the boundaries Krebs and Masterson set.

“They did a great job drawing clear lines in the sand,” Crane said. By the time his term ended, his views had shifted so dramatically that he went to work for CISA as a contractor, helping counties access its services.

By late 2018, participation in federal election security programs had grown rapidly. All 50 states joined the Election Infrastructure Information Sharing and Analysis Center, or EI-ISAC, and CISA became embedded in election planning nationwide.

A State-Federal Partnership Unravels

That model appears to have broken down.

Weeks into Trump’s second term, NASS warned his homeland security secretary, Kristi Noem, that the federal election security partnership built since 2017 was unraveling, and highlighting the role played by federal support for the EI-ISAC, which the group said, helps election officials defend against “sophisticated cyber threat actors including nation-state and cybercriminal groups.”

ISACs are voluntary information-sharing groups within each area designated as critical infrastructure that are meant to help organizations spot and respond to security threats. The elections version was created after the 2017 designation and is run by the nonprofit Center for Internet Security to support election offices specifically, while the Multi-State ISAC, also managed by the group, serves state and local governments more broadly.

Weeks after NASS’s letter, CISA halted roughly $10 million in annual funding for the two information-sharing groups, citing a need to focus on “mission critical areas.” State officials and vendors warned the move would weaken information sharing on threats and slow coordinated responses to cyber and physical threats.

Election technology companies have since begun pulling back from sharing sensitive information with CISA. Votebeat spoke to three technology companies that confirmed this, though none would speak publicly for fear of reprisal. Some fear data on vulnerabilities could be exposed or used against them in a more politicized environment — concerns that echo, but invert, those raised in 2017.

“If you share information, you don’t know if it’s going to stay confidential,” Crane said. “Why would a vendor ever share a vulnerability?”

Gabriel Sterling, the former chief operating officer of Georgia’s secretary of state office and now a Republican candidate for the job, said he has long been skeptical of CISA — particularly its approach to disclosing vulnerabilities.

Even so, Sterling draws a sharp distinction between the current moment and the Krebs-Masterson era. “They focused on what they could do well and how they could make systems more resilient,” he said. “Now, I have no idea what the goal is. I don’t think anyone really understands the mission. I don’t think they even understand the mission.”

The uncertainty has been compounded by a leadership vacuum at CISA. Nearly a year into Trump’s second term, the agency still lacks a Senate-confirmed director after the nomination of Sean Plankey, a longtime security official who has worked at the Department of Energy and the National Security Council, stalled amid bipartisan objections. Trump this week renominated Plankey.

Trump has continued to attack the agency’s past work. He has repeatedly attacked Krebs, the former director, for defending the integrity of the 2020 election, which Trump falsely claims to have won. In early 2025, Trump ordered an investigation into Krebs and the security firm he now owns, apparent retribution for Krebs’ statement that the 2020 election was the “most secure” in U.S. history.

Republicans have also spent years criticizing CISA over its work against election misinformation, arguing the agency overstepped its role by coordinating with state and local officials and social media companies.

This has unfolded alongside a broader shift in how the second Trump administration is approaching elections, said Merrill, who left office in 2022. Justice Department efforts to require states to send full, unredacted voter lists to the federal government — something many states have now done — are, she said, a warning sign that federal involvement in how states run elections could expand far beyond technical support.

“I don’t know how you would ever go back to the federal government just helping states with security — which is obviously a very positive thing to do,” she said.

Looking Toward the Midterms

The November 2025 elections offered an early glimpse of what this new landscape looks like. For the first time in years, CISA did not stand up its Election Day situation room — a centralized hub for monitoring and communicating about threats nationwide.

In December, Gene Dodaro, departing comptroller general of the U.S. Government Accountability Office, warned senators that federal cybersecurity efforts were not receiving enough attention given the potential threat. He expressed concern that CISA can’t provide the assistance state and local election officials had come to expect heading into the midterms.

Paul Lux, chair of EI-ISAC and the supervisor of elections in Okaloosa County, Florida, told Votebeat that a now-membership-based EI-ISAC, run by the nonprofit Center for Internet Security, is working to rebuild communication infrastructure, and hopes to make arrangements with smaller jurisdictions that cannot afford the fees.

It plans to restart the situation room for this year’s primaries using private vendors, “making sure all the nuts and bolts are tightened” before Election Day in November, said Lux.

Some cooperation with the federal government will likely persist, albeit in narrower forms. Ryan Macias, an election security expert who has also contracted for CISA, said that if CISA were to again offer direct services, states could engage selectively — allowing isolated cyber scans or physical security assessments without broadly sharing sensitive vulnerabilities, which would be more like what other critical infrastructure sectors currently do.

Many jurisdictions, he noted, also benefited from years of basic cybersecurity hygiene training and can carry that forward on their own. In Georgia, for example, Sterling said much of the state’s scanning and assessment work flows through the Georgia Emergency Management Agency rather than CISA.

Lux said he believes the federal government is needed, and that another federal agency — one with a more independent leadership body, like the U.S. Election Assistance Commission, which has a bipartisan set of commissioners nominated by congressional leadership — might have more success.

Local and state offices, he said, can’t “be expected to battle malicious foreign actors without the resources and assistance of the federal government.”

Jessica Huseman is Votebeat’s editorial director and is based in Dallas. Contact Jessica at jhuseman@votebeat.org.

Votebeat is a nonprofit news organization covering local election integrity and voting access. Sign up for their newsletters here.