Sources: DHS officials asked CISA to hack a voting machine to report vulnerabilities to the White House without telling the vendor; the request wasn't acted on

Federal election security guidance from CISA is no longer trustworthy for state election officials.

Political appointees within the Department of Homeland Security (DHS) reportedly asked the Cybersecurity and Infrastructure Security Agency (CISA) to acquire and hack a voting machine. The request, made a few months into President Trump's second term, specified that CISA should not inform the voting machine vendor about any discovered vulnerabilities. This directive shocked CISA career staffers, who viewed it as a potential attempt at political interference. CISA employees reportedly stated the request was impossible, partly due to recent layoffs of personnel capable of such operations. The appointees eventually dropped the request, but the incident highlights concerns about the Trump administration's alleged efforts to politicize CISA and undermine its election security mission. The agency has also reportedly seen significant staff reductions and proposed funding cuts.

The alleged request to hack voting machines without vendor notification represents a disturbing departure from standard cybersecurity practices and signals a potential willingness by political appointees to weaponize vulnerability research for political ends. This incident, coupled with significant staff reductions and proposed budget cuts, suggests a broader pattern of undermining CISA's operational independence and its ability to perform its core functions, potentially leaving critical infrastructure more exposed to genuine threats.

The erosion of trust between CISA and state election officials, driven by declassified sensitive information and a perceived lack of support, could have lasting implications for future election security cooperation. State authorities may become increasingly hesitant to share vital information with federal agencies, forcing them to rely solely on their own resources and potentially creating a fragmented and less effective national cybersecurity posture.