Article Read Time
Kentucky Election Security is generally strong. Voting machines are well guarded; county offices should focus this week on the outside companies, email accounts, and related records.
On August 7, a company that trains and registers poll workers for Wake County, North Carolina, told county officials that a hacker had obtained a password the company used to reach county systems. The vendor, ElectSure, had read-only access to precinct officials’ names, email addresses, and assignments, and the county soon cut the company off entirely, according to WRAL. County leaders said the likeliest harm was phishing aimed at those workers, and found no sign that voting machines, ballots, or voter rolls were touched.
That small episode fairly captures where election risk sits as Kentucky heads toward Election Day on November 3. Every Kentucky voter marks a paper ballot, and the equipment that counts those ballots is tested before each election and never connected to the internet, according to the Kentucky Association of Counties. The softer targets are the systems around the count: office email, voter registration records, poll worker lists, and the outside vendors that county clerks trust to run pieces of the work.
The federal safety net has thinned
For most of the last decade, a county clerk could count on free help from Washington. In February 2025, the Department of Homeland Security ended funding for the Election Infrastructure Information Sharing and Analysis Center, a nonprofit hub that passed threat warnings to election offices at no cost. CISA, the federal agency charged with protecting election systems, also pulled back its election staff. In September, Arizona’s secretary of state told an election officials’ briefing that his state has had no federal cyber advisor since March 2025.
That same month, CISA released a new election security plan that names its 10 regional directors as election advisers and offers a free platform for sharing threat information. The plan does not say how many people will do that work, and the administration’s 2027 budget proposal would eliminate the agency’s election security program altogether, according to NextGov. Dean Logan, who runs elections in Los Angeles County, noted that large offices have built their own defenses, while small and mid-sized offices still depend on someone else to warn them.
Kentucky’s clerks fall squarely in that second group. Secretary of State Michael Adams has said counties pay about 85 percent of election costs, according to the Kentucky Lantern. The state formula sends just 25 cents per registered voter and $255 per precinct, figures that have not kept pace with inflation. A clerk in a county of 8,000 people does not have a security team down the hall.
I spent years with InfraGard helping build the channels that let the FBI and private companies warn one another about threats, and those channels only work when the people on each end already know and trust each other. Aaron Blacksberg of the Institute for Responsive Government put the problem plainly this fall: “You can’t flip a switch and turn back on trust.”
Where the vendor risk lives
CISA’s own plan warns that election vendors are uneven about telling customers when their products have flaws or when a fix is available. It also found that attackers who break into an ordinary office computer can often move across the network into election systems, because the two are too often connected. For a county clerk, the practical work before November 3 comes down to a short list.
- Know every vendor that touches election data, from poll book suppliers to ballot printers, and write down exactly what each one can reach.
- Require each vendor, in the contract, to tell you promptly when it suffers a breach or a theft of its software code, as CISA now recommends.
- Turn on multifactor authentication, a second login step beyond a password, for every account, including vendor accounts, and close vendor access the day a contract ends.
- Keep election systems on a separate network from the office’s everyday email and web browsing, so a single bad click at the front counter cannot spread.
- Warn poll workers and seasonal staff this week that their names and email addresses may be targets, and tell them how the clerk’s office will and will not contact them.
What voters can do
Voters also have a role, because one of the likeliest attacks on an election this year is a false message about how, when, or where to vote. A June report from Check Point Software found that many websites registered this year imitate voter information sites, and that web addresses containing the word “vote” climbed between January and early May. Intelligence assessments reported by The New York Times found Russia running covert online efforts to shake confidence in the midterms, though officials said there was no evidence of attempts to tamper with voting machines.
The best defense for a voter is to go straight to the source. Kentucky voters can check their registration through the GoVoteKY portal at elect.ky.gov, confirm their polling place and hours with their county clerk, and note that no-excuse in-person early voting runs October 29 through 31. If you receive a text, email, or phone call claiming a changed polling place, a new deadline, or a problem with your registration, verify it by calling your county clerk at the number listed on the county’s .gov website.
The paper ballot in a Kentucky voter’s hand remains our strongest safeguard, and the next eight days are about ensuring everything built around it holds.
Election season or not, if you have concerns about your office’s security, Commonwealth Sentinel is glad to talk it through with you. Reach us at 502-234-5554, and the conversation comes with no obligation.