Defense Secretary Pete Hegseth has directed the National Security Agency and other military intelligence and cyber forces to guard US election systems during the November midterms, according to Associated Press reporting carried by the Bozeman Daily Chronicle. The order is real and dated: a memo dated Sept. 22, publicly announced Monday, telling defense intelligence officials to mobilize every resource against foreign meddling. What makes the announcement notable is not the mission itself but who is doing it, and how late in the calendar it arrived.
The mechanism here is not new. Military cybersecurity experts have routinely helped monitor election systems and deter potential hackers since election equipment was designated critical infrastructure in 2017, the AP report notes. What is new is the timing and the context. The announcement came weeks before Election Day on Nov. 3, with early voting already underway, and it follows the administration's dismantling of the civilian agency built for exactly this job.
Why is the military doing a civilian agency's job?
The US Cybersecurity and Infrastructure Security Agency, a Department of Homeland Security division, was created specifically to safeguard election infrastructure. President Donald Trump gutted that agency, the AP report states, and fired its election cybersecurity experts in early 2025. With that civilian capacity removed, the routine military role — NSA and US Cyber Command assistance — becomes the visible federal effort.
Last week, the shrunken CISA released an election infrastructure security plan. It lays out potential threats to election systems and lists services the agency would offer election officials to protect the vote. Whether the agency can still deliver those services is the open question the reporting does not answer.
What does the memo actually say?
Hegseth's memo, dated Sept. 22 and announced Monday, directs defense intelligence officials to mobilize every resource "to defend our election infrastructure from foreign malign influence and ensure that every lawful voter can cast their ballot free from foreign intimidation, coercion, or fear." The language covers two distinct missions at once: defending systems against foreign hackers, and countering foreign influence operations aimed at voters themselves.
That breadth matters. Monitoring networks for intrusion attempts is a technical task with clear boundaries. Countering "malign influence" is a fuzzier mandate, and it is the part drawing scrutiny from election experts and civil rights groups who are watching for signs of meddling in voting or ballot counting by the Trump administration itself, per the AP report.
Why are experts calling it theater?
The short timeline is the crux of the criticism. David Becker, a former Justice Department attorney who leads the nonprofit Center for Election Innovation & Research, said the timing "suggests this is just theater." His fuller argument, as quoted by the AP: if the administration was serious about assisting state and local election officials, it should not have dismantled the federal government's election cybersecurity capacity and fired its experts in early 2025.
Read proportionately, the two positions are not contradictory. NSA and Cyber Command assistance is routine and presumably real. The criticism is that announcing it loudly, weeks before the vote, after removing the standing civilian workforce, substitutes a press event for the capacity that was cut. The evidence in this reporting supports that reading of the sequence; it does not establish what the military effort will achieve on Nov. 3.
What else is shaping the election-security picture?
Two court rulings frame the environment, per the same report. The US Supreme Court blocked an attempt by Trump to restrict mail voting, but it allowed the use of a federal database to check the citizenship of voters. The president continues to push false claims that elections are rife with fraud while trying to interfere with longstanding election procedures, the AP reports.
For readers tracking how governments signal threats and defenses in public documents, our coverage of what public threat assessments can and cannot establish applies here too: a security plan listing threats is a statement of intent, not proof of capability. The broader context sits in our Government News section, and the underlying subject matter in our Security coverage. For related coverage, see What public threat assessments can and cannot establish, per published methods.
What to watch between now and Nov. 3
The memo is dated and public, which makes its commitments checkable. The testable questions are narrow: whether CISA's newly published services actually reach state and local election officials, and whether the military monitoring role stays within its routine, foreign-focused lane. Publicly available sources do not establish how the NSA and Cyber Command effort will be scoped or reported after Election Day. Wartime-style information discipline does not apply here, but election-period claims from any administration deserve the same caution: what is announced and what is delivered are different claims, and only one of them has a date on it so far. We covered a connected angle in What a national defense review actually does, from legal mandate to published doctrine.
