Elections & Democracy

Election Security & Foreign Interference

1796— present

The problem is 230 years old. The defense was nine, and most of it is gone.

Foreign governments have tried to shape American elections since 1796. What changed in 2016 is that one of them went at the machinery instead of the audience — scanning election networks in what DHS assessed was probably all 50 states and breaching a voter registration database holding 14 million records. Every investigation since has found the same two things: the attempts are real and continuous, and no vote tally has been shown to be altered. This covers the difference between interference and influence, the 230-year arc of foreign meddling, what each cycle since 2016 actually produced, the federal apparatus assembled after 2016 and taken apart between December 2024 and August 2025, and the genuine argument over whether a network-defense agency should ever have been in the business of judging claims.

States scanned in 2016

DHS assessed the scanning probably reached all 50; 21 were notified as targets (Senate Intelligence, 2019)

Vote tallies altered by a foreign actor

none found

Senate Intelligence found no evidence and said its insight was limited; the 2021 assessment found no indication of an attempt

Election security appropriation

$380m → $45m

FY2018 to FY2026, seven rounds totaling $1.07bn, with $0 in FY2019 and FY2021 (CRS, EAC)

Federal funding for the EI-ISAC

since March 2025 · about $10m a year before that, free to 3,500+ member jurisdictions

State-linked networks removed by Meta

39 · 31 · 11

Russia, Iran, China — cumulative since 2017 (Meta adversarial threat reporting, 2024)

Two different things with one name

The intelligence community draws a line most coverage does not. Interference means going at the technical machinery — registration files, ballot casting, counting, reporting results. Influence means going at the voters: propaganda, forged material, fake accounts, money. The two need different defenses and have entirely different track records. Every published U.S. assessment since 2016 says the same pair of things — that the influence operations are real, continuous and run by at least three governments, and that no attempt to alter an actual tally has been found.

Interference — the machinery

Hard to do at scale and easy to detect after the fact, because American elections are run by more than 10,000 separate local jurisdictions on equipment that is mostly not networked, and because 98.7% of registered voters use equipment that leaves a paper record. There is no central system to compromise. That is an accident of federalism rather than a design decision, and it is the single largest reason the machinery has held.

Influence — the audience

Cheap, deniable, and it does not require touching anything. The objective named in both the 2017 and 2021 assessments is to undermine public confidence in the process, which can be achieved entirely with claims about a compromise that never happened. An operation that convinces a country its count was stolen has done its work without going near a scanner.

The attack surface, and what is actually on it

Listed in rough order of exposure. The pattern worth noticing: the parts reachable from the internet are the parts that do not hold votes, and the part that holds votes is the part that is not reachable.

Voter registration databases

Exposed · Online by design

Statewide, internet-facing, and the one thing an attacker demonstrably reached in 2016. Corrupting a registration list does not change a vote; it turns voters away or forces provisional ballots.

Electronic poll books

Exposed · Networked in most places

The check-in laptop. A failure here creates lines and provisional ballots rather than altered totals, which is why the paper backup list is the standard mitigation.

Election night reporting websites

Exposed · Public web servers

Unofficial numbers on a public site. Defacing one changes nothing about the count and everything about what the country believes for an evening.

Officials' email and accounts

Exposed · Phishing target

The GRU's spear-phishing in 2016 reached at least one Florida county network through a vendor. Credentials are the cheapest way in and the hardest to keep out.

Vendors and the supply chain

Concentrated · Concentrated

A small number of companies build, program and service equipment across thousands of jurisdictions, which makes them a single point of leverage.

Ballot scanners and tabulators

Air-gapped · Not networked

Kept off the internet, sealed, tested before and after, and — in all but a fraction of jurisdictions — backed by a paper record that can be counted without them.

How to read the null

“No evidence that vote tallies were altered” is the most quoted sentence in this subject and the most misused, in both directions. The Senate Intelligence Committee wrote it and then wrote, in the same breath, that its own insight and the intelligence community’s was limited — and one member’s additional views argued the missing data meant the finding should carry little weight. It is a finding about what investigation turned up, not a guarantee about what happened. Treating it as proof of a clean system overstates it; treating it as a cover-up ignores that a second assessment, under a different administration, looked again and found no indication of an attempt.