CISA’s 2026 Election Infrastructure Security Plan Is a Warning, Not a Reassurance

The federal government’s own election-security plan identifies vulnerabilities in voter-registration systems, election software, vendor access, and election infrastructure. Nebraska should respond with greater verification, transparency, and state control.

CISA’s newly released 2026 Election Infrastructure Security Plan should get the attention of every election official in Nebraska.

The plan reports that hackers have attempted to breach statewide voter-registration systems in all 50 states, with confirmed success in at least 20. CISA specifically identifies statewide voter-registration databases as attractive targets for foreign adversaries.

That is not a theoretical risk. Voter-registration databases are critical election infrastructure.

CISA identifies additional vulnerabilities as well. Election-related software can contain vulnerabilities requiring remediation. Certification requirements can complicate timely security updates. Vendor transparency concerning vulnerabilities and patch status can be inconsistent. And election infrastructure can sometimes be reachable through broader government networks, creating opportunities for an attacker who compromises one system to move laterally toward another.

CISA also identifies another risk that deserves more attention: insiders.

Its definition extends beyond election employees. CISA specifically identifies contractors and vendors as potential “third party insiders” because their authorized access to systems or sensitive information can extend the trust boundary beyond the election office. It also discusses the possibility of foreign adversaries attempting to exploit insider access.

That should lead Nebraska to ask some straightforward questions:

Who has access to our election infrastructure? What hardware is inside it? What software is running? What communications capabilities exist? Who can access those capabilities? And can Nebraska independently prove that the computerized result matches the ballots cast by Nebraska voters?

Nebraska Already Has the Most Important Safeguard: Paper

Nebraska is already a paper-ballot state.

The Secretary of State says ballots cast by mail or at polling places are paper ballots and that those ballots are secured and fed into tabulation machines for counting. The state uses ES&S optical scanners; according to the Secretary of State, DS200s provide precinct-level tabulation in roughly one-fifth of Nebraska counties, while larger counties centrally count ballots using DS450 or DS850 equipment.

That means Nebraska does not need to reinvent its election system to create an independently verifiable record.

We already have one.

The question is whether we are taking full advantage of it.

CISA recommends paper ballots precisely because they provide transparency, auditability, and resilience against software failures or manipulation. CISA then recommends manual post-election audits of those paper ballots before final results are certified.

Nebraska already conducts post-election audits, but the current process samples selected precincts and races rather than manually verifying every contest statewide. The Secretary of State says general-election audits currently select 10% of precincts, with at least one in every county, and hand-count one federal, one state, and one local race in the selected precincts.

I believe we can build on that foundation.

Trust, But Independently Verify

Nebraska’s Secretary of State currently states that its tabulation machines are stand-alone equipment that are not connected to the internet or any other network, including for transmitting election results.

As Secretary of State, I would not simply assume that is true because a vendor or government document says so.

I would verify it.

Evidence submitted in litigation involving Michigan election equipment documented an ES&S DS200 configuration containing cellular communications hardware. That does not establish that Nebraska’s DS200s contain or use the same hardware or configuration.

It establishes why we should know.

Nebraska should maintain a verified inventory of the hardware, firmware, software, communications components, network capabilities and configurations actually deployed in our election equipment. Any communications hardware that is unnecessary to conduct Nebraska elections should be physically absent or disabled in a manner that can be independently verified.

If our machines are truly isolated, we should be able to demonstrate that.

If our paper ballots match the computerized count, we should be able to demonstrate that too.

Trust should never substitute for verification.

Three Principles for Nebraska

If I am elected Secretary of State, three principles will guide my approach.

First, the paper ballot marked by the voter should remain the authoritative evidence of voter intent.

Electronic tabulators can provide speed and convenience. But Nebraska’s ability to establish the result of an election should never depend exclusively upon software.

I will pursue stronger manual verification of Nebraska’s paper ballots before certification so that the computerized count can be independently checked against the physical record created by Nebraska voters.

Second, Nebraska must know and control who has privileged access to its election infrastructure.

CISA recommends role-based, least-privilege access, comprehensive audit logs documenting who changed what and when, and separation between public-facing systems and master voter-registration databases.

I will pursue strict controls over vendor and contractor access and a policy prohibiting foreign nationals or foreign-controlled entities from privileged access to Nebraska’s voter-registration, election-management, ballot-processing or tabulation systems.

That is my proposed policy standard. It is not a claim that CISA found foreign-controlled vendors operating Nebraska’s tabulators today.

Third, Nebraska election officials, not private consultants, should administer Nebraska elections.

Vendors may manufacture equipment, print ballots, provide maintenance, or perform narrowly defined technical services under strict contracts, documented access controls, chain-of-custody requirements, and public accountability.

Government cannot outsource its ultimate responsibility for an election. CISA itself says state and local election officials have the primary responsibility for protecting election infrastructure. That responsibility should come with meaningful control.

Nebraska Elections Must Remain Nebraska’s Responsibility

CISA can provide threat intelligence and technical expertise. Vendors can provide equipment and specialized services.

Nebraska must control its voter records, its ballots, its election systems, and its ability to independently verify the count.

That is what genuine decentralization should mean.

Technology can assist Nebraska elections. It should never become indispensable to establishing the truth of an election. We already have paper ballots. We already have local election officials. We already have the physical evidence necessary to verify our results.

Let's use it.

Nebraska elections must remain Nebraska’s responsibility. That is the responsibility of the Secretary of State, and it is one I intend to take seriously.