CISA voting machine hack — AI-generated photo of a voting machine and laptop in an election office

ProPublica: Trump DHS Appointees Ordered CISA to Secretly Hack a Voting Machine and Send Findings to the White House

by

The CISA voting machine hack request landed on career staffers’ desks like a grenade. Early in President Donald Trump’s second term, political appointees at the Department of Homeland Security asked the nation’s top election cybersecurity agency to secretly acquire a voting machine, break into it, and send the findings straight to the White House — without telling the machine’s manufacturer what was found.

According to a ProPublica investigation reported this week, two former administration officials with direct knowledge described a request that stunned CISA’s career workforce. The Cybersecurity and Infrastructure Security Agency exists to protect election systems from hackers. This time it was asked to become the hackers — and to hide its findings from the company that would need to fix them.

The CISA voting machine hack plan never went forward and was ultimately dropped. But the reason it died may be the most revealing part of the story: staffers told the appointees the job was impossible, in part because the specialists who could have pulled it off had just been laid off in Elon Musk’s Department of Government Efficiency purge. With 13 days until the November 3 midterms, the episode exposes an agency guarding America’s elections that has been hollowed out from within — more than 1,000 employees pushed out, another $700 million in cuts proposed — even as the administration faces mounting accusations of politicizing election security.

Contents

What ProPublica Reported: Inside the CISA Voting Machine Hack Request

A few months into Trump’s second term, political appointees at the Department of Homeland Security approached the Cybersecurity and Infrastructure Security Agency with a directive that was simple on its face and explosive in its implications: procure a voting machine, examine its vulnerabilities, and report the findings so they could be handed to the White House.

ProPublica’s reporting, based on interviews with two former administration officials, lays out the request in stark terms. CISA was to acquire a voting machine covertly, hack it, and send the results to the White House — while deliberately not alerting the equipment manufacturer to any vulnerabilities discovered. That last detail is what turned a strange request into a scandal.

CISA’s entire operating model is built on the opposite behavior. When the agency finds a flaw in critical infrastructure — election systems included — it notifies the vendor through what cybersecurity professionals call coordinated disclosure, so the weakness can be patched before attackers exploit it. The CISA voting machine hack request inverted that model: find the cracks, keep quiet about them, and deliver the results to political appointees.

The reporting does not claim the hack was ever carried out. It was not. And ProPublica’s investigation, according to follow-up coverage, did not establish that officials had used — or planned to use — any discovered vulnerabilities to overturn election results. But the fear among the people who received the CISA voting machine hack request was exactly that.

5 Facts to Know About the CISA Voting Machine Hack

Here is the CISA voting machine hack story broken down into its five most important facts:

  1. The ask came from DHS political appointees. The directive did not originate with CISA’s career cybersecurity experts. It came from political appointees installed at the Department of Homeland Security early in Trump’s second term, directed at career staff who had no idea such a request was coming.
  2. The manufacturer was to be kept in the dark. Career staff were specifically instructed not to notify the voting machine company of any vulnerabilities found. That runs directly against CISA’s standard practice — the agency’s job is to find flaws and tell vendors so they get fixed, not to stockpile them.
  3. Career officials feared political misuse. “My thought was they could keep it in their back pocket to invalidate any results they don’t like,” one former official with knowledge of the CISA voting machine hack request told ProPublica. “This goes against everything CISA represents.”
  4. The operation never happened. CISA employees repeatedly told the appointees the request was unfeasible — and one reason it was unfeasible was that the specialists capable of conducting such an operation had just been laid off by Elon Musk’s Department of Government Efficiency. Eventually, the appointees stopped pressing.
  5. The administration did not respond. According to ProPublica, neither DHS nor CISA answered interview requests or detailed questions about the CISA voting machine hack request. The White House referred specific questions about CISA back to DHS — which said nothing.

Why Career Staff Were Alarmed by the CISA Voting Machine Hack

To understand the alarm, consider what CISA is: the federal lead coordinator for election security — the people states call when they fear foreign hackers might target their voting systems.

The agency built to protect elections was being asked to find the cracks and keep quiet about them. Career staffers thought the request looked like preparation work for contesting an election result. An undisclosed catalog of voting-machine weaknesses would be a weapon — not for fixing systems, but potentially for challenging the results those systems produce.

That distinction is what made the “back pocket” fear so pointed. There is nothing wrong with security researchers probing voting machines in the open — researchers at DEF CON’s Voting Village do it in public every year. What made the CISA voting machine hack request different was the secrecy: a pipeline of vulnerabilities flowing to the White House while the manufacturer stayed blind.

The alarm has only grown in the two weeks before the midterms. MS NOW’s Nicolle Wallace discussed the findings with ProPublica reporter Andy Mannix and election attorney Marc Elias on Deadline: White House. StateLineDaily readers will recognize the pattern: it echoes the DOJ poll-monitor push the NAACP sued to block and the federal voter-fraud arrests in California covered here earlier this week.

The Stunning Irony: DOGE Fired the People Who Could Have Done It

The CISA voting machine hack plan died for a reason that would be darkly comic if the stakes were not so high: the people who could have carried it out had just been fired. When career staff told the DHS appointees the request was unfeasible, one stated reason was personnel — the agents with the skills to covertly acquire and test a voting machine were gone, laid off in the sweeping staff cuts led by Elon Musk’s Department of Government Efficiency.

Consider the sequence. First, the DOGE initiative gutted the agency’s cyber workforce. Then, political appointees asked the gutted agency to perform a sensitive covert hacking operation. Then, the agency explained the operation was impossible because of the gutting. The appointees dropped the matter. It is a perfect closed loop: the administration asked CISA to do something reckless, and the only thing that stopped it was the damage the administration itself had already inflicted on the agency.

CISA Under Trump: A Third of the Agency Gone Since the Hack Request

The CISA voting machine hack episode cannot be separated from what has happened to the agency itself. Since Trump returned to the White House, more than 1,000 CISA employees — roughly one-third of the agency’s workforce — have been pushed out or laid off. The administration’s proposed budget would slash CISA’s funding by another $700 million, a cut that could trigger 900 more layoffs.

These are not back-office losses. They include the cyber specialists who work with state election officials to secure voting systems, share threat intelligence, and respond to intrusions. The agency that ran the most closely scrutinized election-defense effort in American history is now a shell of its former self, two weeks before a national election.

That hollowing-out is the context the White House cannot wave away. And the silence from DHS on the hack request has only amplified the criticism: when the agency charged with election security will not say why its political leadership asked it to hack a voting machine in secret, the vacuum fills with the worst interpretations.

CISA’s Playbook: How the Agency Handled Voting-Machine Flaws Before the Hack Request

The most underreported aspect of the CISA voting machine hack story is how far the request departed from the agency’s own playbook. When CISA finds vulnerabilities in election equipment, it uses a documented process called coordinated disclosure: whoever finds a flaw alerts the manufacturer, which fixes it before details go public. That is how CISA has always handled these cases — including a 2022 case involving Dominion voting machine software, where a court-appointed expert’s analysis was channeled through proper disclosure so flaws could be remediated.

The appointees’ request stood that process on its head. Instead of find-it-and-fix-it, it was find-it-and-report-it — to the White House, with the manufacturer cut out. Cybersecurity experts describe coordinated disclosure as the difference between a security agency and an intelligence agency: one hardens systems, the other exploits them.

Watch what comes next: reporting references an upcoming rollout, described as a September 24 plan, that will show whether CISA has gone back to handling machines the way it used to — finding the flaws and warning the manufacturers. How the agency behaves now, 13 days from the midterms, will signal whether the CISA voting machine hack request was an aberration or a preview.

For context on the actual threat picture: officials consulted by Nextgov found no evidence of attempts to compromise voting machines in this cycle, and intelligence assessments point instead to online influence operations attributed to Russia. The machines themselves are not currently under attack. The agency that protects them is under attack from within.

States on Their Own: No CISA Help With 13 Days to the Midterms

Perhaps the most consequential fallout from the CISA voting machine hack revelations is not the request itself but what it reveals about the state of election security with the midterms nearly here. Several state election authorities have said they received no assistance from CISA while preparing for the November 3 vote — a stunning gap given the agency’s statutory role as the federal coordinator for election infrastructure protection.

States are effectively on their own. The federal partner that used to run threat briefings, share intelligence on foreign interference, and deploy technical teams has lost a third of its people and is proposing to cut deeper. The defensive line against Russian influence operations targeting the midterms is thinner than it has been in a decade.

This is the deeper story the CISA voting machine hack request opens up. A single aborted covert operation matters less than the institutional collapse around it. The agency that would have found and fixed the voting-machine vulnerabilities at the heart of the CISA voting machine hack request has been stripped of the people who do that work.

What’s Next

Will Congress investigate the CISA voting machine hack?
Pressure is building over the CISA voting machine hack, but nothing is scheduled. With the House and Senate in the final stretch before November 3, hearings would most likely land after the midterms — and their shape will depend entirely on which party controls the chambers.

Could the request be revived after the midterms?
ProPublica’s reporting says the appointees eventually stopped pressing CISA. But the underlying dynamic — a political leadership interested in voting-machine vulnerabilities delivered outside normal channels — has not been repudiated by anyone in the administration. If the White House staffing shakeups now being discussed for a post-midterm purge materialize, the question of who controls election-security institutions gets sharper, not duller.

What is the September 24 plan?
Reporting references an upcoming rollout that will show whether CISA has returned to its traditional handling of voting machines since the CISA voting machine hack request surfaced — finding flaws and warning manufacturers. How the agency behaves in the next few weeks is the clearest signal of whether the hack request was a one-off.

Are voting machines themselves at risk?
Officials consulted by Nextgov found no evidence of attempts to compromise voting machines in this cycle; intelligence assessments point to Russian online influence operations instead. The immediate threat, experts say, is not to the machines — it is to the agency that protects them. As StateLineDaily’s 2026 midterm predictions coverage shows, prediction markets and polls agree on a volatile final two weeks, and institutional trust is one more variable in play.

Additional Details

Description: ProPublica reports that Trump DHS appointees ordered CISA to secretly acquire and hack a voting machine and report findings to the White House without notifying the manufacturer. Career staff feared the CISA voting machine hack request was a prelude to challenging election results; the plan died partly because DOGE had laid off the specialists who could do it. With 1,000+ CISA employees pushed out and $700 million more in cuts proposed, states say they are getting no federal help 13 days before the November 3 midterms.

Key entities: Cybersecurity and Infrastructure Security Agency (CISA), Department of Homeland Security (DHS), ProPublica, Elon Musk’s Department of Government Efficiency (DOGE), the White House, state election authorities, Nicolle Wallace and MS NOW’s Deadline: White House, election attorney Marc Elias.

Timeline: Early 2025 — the CISA voting machine hack request is made; CISA career staff push back, calling it unfeasible; appointees drop the matter. October 2026 — ProPublica publishes the investigation based on two former officials; MS NOW’s Deadline: White House discusses the findings on October 21. November 3, 2026 — midterm elections, 13 days away.

What to watch: Whether Congress demands answers from DHS after the midterms; the rollout of the reported September 24 CISA plan and whether the agency returns to coordinated disclosure; the proposed $700 million CISA budget cut and the potential 900 additional layoffs; whether states fill the federal gap in the wake of the CISA voting machine hack revelations before November 3.

Leave a Comment