Nothing in the public record suggests that a foreign government is poised to carry out an election-altering operation this upcoming November. U.S. officials told the New York Times in September that the intelligence community has found no evidence of attempts to compromise the voting process through attacks on voting machinery. The foreign activity reported so far involves online influence operations, including fabricated videos, primarily by Russian actors.
These actions resemble those documented in previous election cycles, but the capacity to conduct such operations is expanding. Advances in artificial intelligence are lowering technical and financial barriers that once made sophisticated influence operations largely the province of capable states and well-resourced organizations, allowing a wider range of foreign actors to conduct them.
The United States appears capable of detecting and assessing the kinds of foreign activity it has confronted in past elections. It is less certain that the election-security system can adapt at the same pace as foreign capabilities expand, potentially to include attacks on the mechanics of an election itself.
Public reporting to date suggests the United States will get through November despite continued foreign efforts to influence the election. The danger lies in treating such an outcome as evidence that the system is prepared for what follows. November matters not simply as another election, but as the starting point for a race the United States may already be losing.
This does not discount the prospect of interference originating within the United States, including through the exercise of government power, in November or thereafter. Those threats raise a different set of legal and constitutional questions best reserved for a separate discussion.
What the Public Record Shows
The 2016 presidential election brought foreign interference in U.S. elections to widespread public attention. The threat itself was not new. Russia and other foreign actors had sought to influence American politics before then, but the 2016 election marked a significant escalation in the scale, scope, and methods of foreign interference.
During the 2016 campaign season, Russian actors stole and released political information, ran covert influence operations, and probed state election systems. The Senate Intelligence Committee later found that Russian-linked cyber actors targeted election infrastructure in numerous states and, in a small number of cases, gained access to voter-registration databases. However, its bipartisan review released in 2019 found “no evidence that any votes were changed or that any voting machines were manipulated.” The committee also concluded that Russian activity was “part of a larger campaign to prepare to undermine confidence in the voting process.”
That pattern continued. In September 2018, President Trump issued Executive Order 13848, establishing a formal process for assessing foreign interference after federal elections. The first assessment under that order, following the 2018 midterms, identified influence activities by Russia, China, and Iran, but found no evidence that election infrastructure had been compromised in a way that prevented voting, changed vote counts, or disrupted tallying.
Congress expanded the reporting requirements in 2019, requiring the intelligence community to assess foreign threats and vulnerabilities in state election systems before federal elections and update that assessment closer to Election Day.
In March 2021, the intelligence community concluded that Russia sought to influence the 2020 election through covert influence operations, once again aimed at shaping public perceptions and undermining confidence in the electoral process. The assessment also attributed to Iranian hackers intimidating emails sent to swing-state voters falsely claiming to be from the far-right group the Proud Boys, while China considered but did not deploy influence efforts intended to change the outcome of the presidential election. The assessment found no indications that a foreign actor tried to alter any technical aspect of the voting process, from voter registration to ballot casting, tabulation, and reporting of results.
The 2022 midterms showed the field of actors widening. The intelligence community reported that the scale and scope of foreign activity exceeded what it had detected in 2018 and involved a broader range of actors. Russia, China, and Iran mounted the most significant efforts, while Cuba and several other countries engaged in smaller and more narrowly targeted activity. The assessment also found that foreign actors generally favored influence operations over attempts to interfere with election infrastructure, which were more difficult and carried greater risk.
By 2024, the public warning cycle had accelerated. An October 2024 National Intelligence Council assessment noted Russian and Iranian influence activity during the campaign, including Russian election-related content across text, images, audio, and video and Iranian efforts to denigrate former President Trump. The assessment also warned that China, Iran, and Russia were better prepared to exploit the period after voting ended through information operations and other efforts to sow confusion.
The 2026 reporting so far reflects the same operational focus on shaping perceptions. One notable difference is that the intelligence community’s 2026 Annual Threat Assessment issued in March omitted U.S. election influence and interference entirely. A year earlier, the 2025 assessment explicitly warned that Russia viewed influence operations targeting U.S. elections as advantageous and expected Moscow’s influence activity to increase in sophistication and volume. It also described Chinese and Russian use of AI-enabled influence tools.
That omission in the 2026 Annual Threat Assessment did not mean collection had stopped. In April 2026, Army Gen. Joshua Rudd, the head of the National Security Agency (NSA) and U.S. Cyber Command, told Congress that foreign adversaries could be expected to try to interfere in the midterms. By September, classified U.S. intelligence assessments reportedly concluded that Moscow had authorized another digital influence campaign, while researchers tied AI-generated fake videos targeting competitive Senate races to a Kremlin-linked network. According to the same reporting, China is focused on individual races where U.S. policy toward Beijing is at issue, while Iran is operating at a smaller scale.
October reporting adds further evidence of such influence operations. The New York Times reports that threat intelligence company Alethea found that a Russian-backed influence operation was exploiting divisions over Israel to target American voters. X separately announced that it had removed 13,000 accounts linked to influence operations connected to Russia, China, and Iran, which amplified content about US politics targeting candidates and public figures across the political spectrum.
One piece of the public record remains missing. The Office of the Director of National Intelligence (ODNI) has not released, as it has in earlier federal election cycles, the formal declassified assessment of foreign activity in the 2024 election. The intelligence material President Trump declassified in July 2026 did not fill that gap; it largely concerned earlier elections and related foreign capabilities and activity. Democratic senators have criticized the failure to release the 2024 assessment — a gap that Senate Intelligence Committee Vice Chair Mark Warner (D-VA) noted in response to Trump’s July release.
The gap in the public record extends beyond the missing 2024 assessment. At his July confirmation hearing, Director of National Intelligence Jay Clayton acknowledged the intelligence community’s responsibility for addressing foreign interference in U.S. elections. Since taking office, however, he has provided little public account of the threat facing the November election or of how the intelligence community is responding to it. On Oct. 2, Sen. Warner, along with Rep. Jim Himes (D-CT), the ranking Democrat on the House Intelligence Committee, wrote Clayton seeking greater transparency about foreign threats to the midterms. They acknowledged that intelligence officials had briefed Congress on the latest threat assessments, but that several statutorily-required products remained outstanding, and called for the responsible release of unclassified assessments before Election Day.
The record of foreign interference over the last decade provides some reassurance, but only about the threats the United States has already learned to recognize — a less reliable guide to what foreign actors may be capable of doing as the tools available to them change. With the U.S. government likely to face more foreign activity, its preparedness for an evolving threat depends in large part on the system the United States spent years after 2016 building to detect, assess, and respond to foreign election interference.
Whether what remains can keep pace with a maturing threat is the issue that will matter most after November.
What Was Built — and What Has Changed
After Russia’s 2016 operation exposed gaps between intelligence agencies, law enforcement, cybersecurity officials, and the states that actually run elections, the federal government spent the next several years building a system intended to connect those pieces.
The Obama administration in January 2017 designated election infrastructure as critical; the Trump administration created the Cybersecurity and Infrastructure Security Agency (CISA) in 2018 and, through Executive Order 13848, established a recurring process for assessing foreign interference after federal elections. The FBI’s Foreign Influence Task Force and, later, ODNI’s Foreign Malign Influence Center added mechanisms for integrating and responding to foreign influence threats. The center, which Congress authorized in 2019, housed the Election Threats Executive, the intelligence community’s coordinating authority for election security.
The resulting architecture was not a single command structure. Its value lay partly in the relationships connecting intelligence agencies, law enforcement, cybersecurity specialists, state and local election officials, and the private sector. CISA and the federally funded Election Infrastructure Information Sharing and Analysis Center (EI-ISAC), for example, provided election offices with assistance designed not only to detect an operation but also to move information among institutions that held different pieces of the problem.
Much of that connective tissue has changed since 2025. In February 2025, then-Attorney General Pam Bondi disbanded the FBI’s Foreign Influence Task Force as part of a broader shift of Justice Department resources toward cartels and transnational criminal organizations. The administration also curtailed parts of CISA’s election-security work and federal support for the EI-ISAC. CISA lost nearly a third of its staff in early 2025 and has had three acting directors and no confirmed one. Election officials have since reported losing services such as penetration testing, tabletop exercises, and regular threat briefings.
At the State Department, Secretary Marco Rubio closed the Counter Foreign Information Manipulation and Interference office in April 2025, arguing that its work had become entangled with censorship. Four months later, then-Director of National Intelligence Tulsi Gabbard announced an ODNI restructuring that cut ODNI’s workforce by more than 40 percent. She also directed the dismantling of the Foreign Malign Influence Center as a stand-alone organization, reducing its functions and dispersing the remaining work across other parts of the intelligence community. The Cyber Threat Intelligence Integration Center, which served as a hub for sharing and coordinating classified cyber threat intelligence across the intelligence community and civilian agencies, was also eliminated.
Important capabilities do remain. Press reports suggest that the intelligence community continues to collect and assess foreign election threats, including influence activity. CISA still offers election-security resources, and the NSA and U.S. Cyber Command retain capabilities developed during earlier cycles. Federal funding for state election security fell from $55 million in 2024 to $15 million in 2025, then partially restored to $45 million for 2026; however, state and local election officials continue to describe federal support as inadequate.
But federal support that once operated on a standing basis has become fragmented and, in some areas, sharply reduced. CISA’s 2026 Election Infrastructure Security Plan arrived only 40 days before the midterms. The joint NSA-Cyber Command Election Security Group—which pools intelligence and cyber operations against foreign election threats, and in 2022 was stood up early in the year. In late September, Defense Secretary Pete Hegseth directed the U.S. Cyber Command and the defense intelligence agencies to prioritize election defense. Officials have not clarified what role, if any, the Election Security Group would play in the activity Hegseth ordered.
The Election Assistance Commission, which certifies voting systems and administers federal election-security grants to states, has had no commissioners since July, when the president fired its two Democratic members and the remaining Republican commissioner resigned. Career staff can continue existing programs, but the commission cannot adopt new policies or update election guidelines without a quorum. State election officials say federal intelligence sharing and technical assistance have become sporadic, while some states have turned to private vendors and their own resources to replace that support.
The interruption of regular federal engagement became more apparent this month. The New York Times reported that intelligence officials attempted to deliver a classified briefing to state election personnel on Oct. 15, but postponed it after a technical problem prevented a secure connection. The session reportedly would have been the first of its kind in more than two years.
The weakness of the federal election-security system is increasingly at the seams between the capabilities that remain. Intelligence officers can still collect, investigators can pursue leads, and states can secure their own systems. But those capabilities are less useful if information is not fused quickly, responsibility is dispersed, or warnings reach election officials too late to act. The post-2016 architecture was built precisely to prevent those pieces from operating in isolation.
The Post-Election Test
The election next month will provide the first opportunity to see how well this diminished system performs under actual election conditions. But even a relatively uneventful midterm would reveal little about whether the United States is prepared for how much the threat could change before 2028.
The United States will enter the 2028 presidential cycle with a dangerous mismatch: a maturing foreign threat and a diminished system to counter it. States can harden voting systems, conduct audits, use fusion centers, and buy cybersecurity services, but many have room to do more. In April, a Brennan Center survey of 834 local election officials found that 75 percent had received no additional state or local resources to compensate for reductions in federal election-security support.
Governors and state legislatures should not wait for Washington to restore that support. They can provide local election offices with cybersecurity expertise, strengthen coordination with law enforcement and emergency-management agencies, and press Washington for sustained intelligence sharing and technical assistance. With many new governors taking office in January, there is an opportunity to make election resilience a statewide priority well before the 2028 campaign is underway.
But states cannot see the full dimensions of a foreign campaign that crosses state lines or originates overseas. They cannot replace federal intelligence collection, integrate reporting across the intelligence community, or attribute a foreign operation. Those responsibilities remain with the federal government.
Congress has tools to determine how well the federal system still works and to require action where it does not. The immediate task is to ensure that the intelligence community meets the election-security requirements already in law, including the DNI’s post-election assessment due by mid-December. That assessment, together with the reporting Congress receives before the election, should allow lawmakers to compare what the government knew before November with what actually occurred, what intelligence reached state officials, how quickly foreign activity was attributed, and whether functions once performed by dedicated election-security organizations are still being carried out elsewhere.
That is only the beginning. A Congress of either party must also use hearings, classified oversight, and investigative authority to establish what capabilities have been lost and who is now performing them. Restoring those capabilities is certain to be challenging, especially in the short period before the presidential primaries and given the administration’s approach to election security to date. If the administration remains unwilling to rebuild the system, a divided government could leave the United States entering 2028 with the problem clearly identified but only partly addressed.
Congress also has an immediate obligation to address what may become the greatest challenge a rebuilt election security system will have to confront. Earlier this month, Trump put DNI Jay Clayton in charge of a government-wide AI effort that will recommend how Washington should respond to the technology’s risks and opportunities. The mandate is broad enough to encompass foreign election interference but does not identify it as a specific priority. Congress should insist that it become one. The review should assess how AI is changing foreign election operations and what collection, analytic, attribution, and warning capabilities the government will need before the next presidential election.
Congress has less time to act than the calendar suggests. Rebuilding the election-security system would be difficult even if the administration reversed course tomorrow. Offices can be reestablished and responsibilities reassigned relatively quickly. Experienced analysts and operators cannot be replaced on the same timetable, nor can relationships with state officials, collection expertise, or practiced interagency procedures.
And the rebuilding would begin at a time when the intelligence community itself has undergone substantial workforce reductions and organizational disruption, while an internal CIA survey, reported this summer, found growing concern among analysts about political pressure on their work. The problem before 2028 is therefore larger than restoring the organizations dismantled since 2025. Rebuilding their capabilities will require expertise, professional independence, and institutional relationships that the government’s broader disruption of intelligence has put at risk.
The post Foreign Threats to U.S. Elections Are Maturing Faster Than the Defenses to Counter Them appeared first on Just Security.