Midterm Early Voting Cyberattack: Where Is Secretary Mullin and Homeland Security?
The Federal Election Commission’s electronic filing system was shut down for nearly 41 hours following a reported cyberattack during early voting. The central question is not merely which campaign spending disclosures were delayed. It is what the attacker reached, or attempted to reach, inside a federal agency’s systems.[reuters][reuters]
The FEC’s own warning was direct:
“We have a bad actor attempting to breach FEC systems. As a result, we’ve had to temporarily shut down our web facing services.”[reuters]
That warning came from an FEC electronic filings officer in an email reviewed by Reuters.[reuters]
The filing system was the service taken offline. But was the attempted intrusion confined to that service, or did it extend into servers, credentials, records, or connected systems? What have investigators established, and what remains unknown?
This is about access, and the American people deserve answers.
CISA operates under the Department of Homeland Security, led by U.S. Secretary of Homeland Security Markwayne Mullin. Its federal cybersecurity responsibilities make its response a central issue. Yet the reporting reviewed here provides no substantive public briefing from Mullin explaining CISA’s involvement, the scope of the incident, or the evidence supporting containment.[reuters][dhs]
Reuters reported:
“The Cybersecurity and Infrastructure Security Agency and the FBI both referred questions to the FEC.”[reuters]
Referring questions back to the FEC does not explain CISA’s response. Secretary Mullin, when did your agency become involved? What assistance did it provide? Where does the investigation stand?
Trump’s confrontation with CISA did not begin today. Following the 2020 election, Trump challenged its election security assessment and fired Director Christopher Krebs. That confrontation occurred during Trump’s first administration, before Biden took office.[reuters]
The left leaning Brennan Center for Justice’s April 2019 paper, “Fixing the FEC: An Agenda for Reform,” called for restructuring the FEC and strengthening campaign finance enforcement.[allsides][brennancenter]
Americans got the political drama of “Russiagate” and Stormy Daniels, both with documented campaign finance connections, while the proposed restructuring of the FEC never happened.[fec][fec][fec]
Later, during the Biden administration, separate litigation challenged government involvement in social media moderation. In October 2023, an appeals court preliminarily found that CISA had likely violated the First Amendment by significantly encouraging platforms’ moderation decisions. That was a lower court ruling against CISA, not merely a political accusation. The Supreme Court subsequently reversed on standing without deciding the constitutional merits.[law.justia][supremecourt]
This history makes it essential that Secretary Mullin come before the press and explain exactly where the investigation stands.
Kyle Sandy, cybersecurity director at IT security firm Logically, offered this assessment to Reuters:
“It tells me the FEC detected something they couldn’t immediately scope and chose a known outage over an unknown risk.”[reuters]
That was an outside expert’s assessment, not an investigative finding. But it puts the central question squarely before Mullin: what did investigators establish about that unknown risk?
The reported 41 hours measures the shutdown. It does not establish how long an attacker may have been present or whether unauthorized access occurred. Officials must explain whether the attempt succeeded and the evidence supporting their answer.[reuters][reuters]
Restoring service is not the same as demonstrating containment.
Tell Americans when the suspicious activity began. State when CISA was notified. Explain whether the attacker accessed servers, accounts, credentials, or internal networks.
Identify what information, if any, was viewed, copied, altered, or deleted. Explain whether connected systems were examined. Show the basis for restoring service.
State which reports and congressional notifications were required. Confirm when they were submitted. Tell the public whether President Trump has been briefed and what risks remain unresolved.
Where is the public incident account? If the investigation remains open, where is the status briefing?
Neither party gets a pass. Congress should demand the incident timeline, relevant security assessments, and an explanation of unresolved vulnerabilities. A restored filing system is not a substitute for oversight.
U.S. Secretary of Homeland Security Markwayne Mullin should stand before the press, explain his department’s response, and answer questions. President Trump should demand a direct briefing and an assessment of any national security implications before certification.
If Mullin failed to escalate the incident, obtain answers, or fulfill his responsibilities, Trump should fire him.