Alerts & Warnings in 2026 Elections
This recording is not on YouTube. It plays from the DEF CON media server; the button opens the file there.
Where
Voting Village
DEF CON 34
Duration
32 min
Explains how the reduced federal role in election security is changing threat sharing, and how volunteer and private groups are filling the gap.
Summary
The panel opens with the 2020 election, when foreign actors sent threatening emails to voters in several states, posing as a far-right group. The same campaign included a video showing a stolen voter file, a weakly exposed voter lookup application in Alaska, and a spike in downloads of a military absentee ballot form. Each signal looked small on its own. Federal agencies combined them, attributed the activity within about a day, and briefed election officials and the public quickly. The speakers present that pipeline as a success that depended on trusted relationships between federal agencies and local election offices.
Since then, the panelists say, that federal capacity has shrunk. Jurisdictions that once relied on free federal assessments and scans have built their own testing, response plans, and vendor contracts, but they can no longer learn from incidents happening elsewhere. A volunteer coalition formed in 2025 now issues alerts, guidance, and referrals. Voting system vendors have kept a coordinating council running, and election groups are trying to route vulnerability reports to the right local offices.
In audience questions, the panelists addressed audits and certification, pointing to reconciliation, hand counts, and public certification steps. Their advice to researchers is to build local relationships with election offices before disclosing findings, and to join as poll workers or auditors to see the process firsthand.
Materials
Related talks
ICS Village·26 min
Joe Slowik
Reviews the December 2025 attack on Polish generation assets and compares it with Volt Typhoon, Sandworm and hacktivist activity against the electric sector.
Recon Village·24 min
Eli Woodward
Maps the infrastructure behind Cl0p's exploitation campaigns, from hosting and ASN reuse to reconnaissance that preceded some attacks by years.
Recon Village·41 min
Niko Dekens
Explains how reliance on AI erodes OSINT analysts' critical thinking, with real cases of fake imagery and mistranslation and four habits to keep conclusions defensible.


