2026 Election Mitigation Plan - Election Fairness Institute

Date: July 22, 2026
Subject: Proposed DHS/CISA Operational Guidance for the November Federal Election – 2026

Bottom Line

Given President Trump’s recent revelation that our elections are insecure and subject to manipulation, quick action is necessary. The recently declassified documents highlight the problems with electronic voting machines. That, coupled with the political realities on the ground and time constraints before the November Mid-Term elections, we propose the immediate adoption of this 100-Day Risk Mitigation Election Plan (RMEP). The immediate national-security objective should not be to replace every piece of election equipment before November. It is to enhance the security of the vote by reducing the chances and consequences of any electronic manipulation, component failures, compromises, misconfigurations, or malware that could produce an incorrect result.

The simplest operational model for elections is:

Voters hand-mark a pre-printed paper ballot.
Tabulators are used to execute the first count on election night.
Humans execute a follow-on independent hand count of ballots.
The election is reconciled before certification.

With 100 days remaining until November 3, DHS and CISA should concentrate on six achievable measures:

Transition the general electorate away from ballot-marking devices (BMD) to hand-marked paper ballots wherever operationally possible.
Utilize existing tabulators for speed during the initial “unofficial” election night count. For security reasons, tabulators shall only be used after the polls close on election night.
Mandate strict ballot chain of custody throughout the election process.
Implement the “Bank-Teller” method: an independent human count before certification. Insisting that the official count can only be certified after a full hand-count of every ballot.
Establish paper poll books with a signature line beside each voter’s name as a resilient check-in and participation record.
Create and fund a rapid local election-worker recruitment and training program specifically for ballot counting.

The strategy is simple: to quickly employ a commonsense process that is both simple and easy to administer, minimizing the risk that electronic voting machines currently pose to our election process.

I. The National-Security Problem

CISA’s own technical findings establish that election security cannot rest exclusively on assumptions that equipment is certified, patched, isolated, or “air-gapped.”

Its assessments identified persistent software vulnerabilities, difficulties applying security updates, legacy components, weak network segmentation, inadequate identity controls, remote-access pathways, and circumstances in which theoretical network isolation did not reflect actual connectivity.

That creates a straightforward critical-infrastructure risk-management problem:

If the electronic systems cannot all be replaced or independently proven secure before November, the operational process must be designed so that an electronic compromise cannot silently determine the certified outcome.

CISA already describes itself as the lead federal agency for national election security and provides state and local officials with election risk-assessment tools, cybersecurity services, exercises, and technical assistance.

The following RMEP should therefore be issued as near-term critical-infrastructure risk-mitigation guidance with local implementation pathways.

II. Control One: Hand-Marked Paper Ballots

National Objective

There are approximately 3,144 counties in the U.S. Approximately 2,200 of them currently use some form of hand-marked paper ballots. The objective is for all counties to use preprinted, human-readable, hand-marked paper ballots as the default voting method for the general electorate. This means that approximately 900 counties will need to immediately terminate the use of BMDs. The immediate transition will force these counties to conform with the hand-marked paper-ballot mandate.

For 2026, the existing tabulators will remain in service. Accessible ballot-marking equipment remains available as required for voters who need an accessible method of voting.

County Implementation Pathway

DHS/CISA should classify every county according to the following:

GREEN — Already Predominantly Hand-Marked Paper
No major conversion needed.

YELLOW — Uses BMDs Broadly and Will Transition to Preprinted Hand-Marked Paper Ballots Using Existing Tabulation Equipment
These should be the highest-value rapid conversions. The county generally needs:

Ballot printing.
Pens.
Privacy booths.
Revised poll-worker procedures.

It keeps the same tabulators.

RED — County Reports That It Cannot Transition to Hand-Marked Paper Ballots Using Its Existing Tabulation Equipment

A RED classification should not be treated as a final technical determination. It should trigger immediate CISA follow-up and independent verification.

CISA should determine precisely why the county believes it cannot make the transition, including:

The exact tabulator make, model, software version, and certified configuration.
The ballot formats currently used.
Whether the existing tabulator is technically capable of scanning voter-marked paper ballots.
Whether the claimed limitation is technical, contractual, procedural, certification-related, or based on vendor guidance.
What configuration, ballot-design, programming, or procedural changes would be necessary to implement hand-marked paper ballots.

Any claim that existing equipment cannot support the transition — including a claim made or supported by an election-system vendor — should be independently verified by CISA before the jurisdiction is determined to be unable to transition.

CISA should provide or retain qualified independent technical experts with election-system experience to evaluate the claimed limitation, review the equipment and documentation, independently assess any vendor position, and identify the fastest workable path to hand-marked paper ballots.

The purpose of the RED classification is therefore not to exempt a jurisdiction from the transition. It is to flag the jurisdiction for immediate technical intervention and problem-solving.

The operating principle should be:

GREEN counties are ready. YELLOW counties transition. RED counties receive immediate technical review until the barrier is independently verified and, wherever possible, resolved.

The RED pathway is intended to ensure that a reported technical or vendor-imposed barrier is investigated rather than simply accepted as a reason that a county cannot transition.

III. Control Two: Paper Poll Books

CISA’s report specifically identifies electronic poll books and voter-registration systems as part of the election technology environment and warns that election systems may be reachable through broader government networks.

Every polling location should therefore have a printed voter list containing:

Voter name | Required voter information | Signature line

The voter signs directly beside his or her name before receiving a ballot, consistent with applicable state law.

Electronic poll books may continue to be used but only in conjunction with a mandated handwritten paper record of all voters that is capable of continuing operations during any potential disruption — e.g., network outages, cyber incidents, equipment failures, database connectivity failures, or electronic poll-book outages.

States that permit Election Day registration or late registration can use supplemental printed lists and existing provisional or same-day registration procedures.

The objective is not to replace the statewide voter-registration database. It is to ensure:

A computer failure cannot stop voter check-in, and a physical record exists showing the number of people who were issued ballots.

That physical participation record then feeds directly into DHS’s existing ballot-reconciliation requirement.

IV. Control Three: Reconcile Before Counting

Before comparing the machine and human results, election officials must first establish that they know what ballots they are counting. Every participating jurisdiction completes a simple reconciliation form consisting of the following:

How many voters participated?
How many ballots were issued?
How many ballots were returned or cast?
How many ballots were spoiled?
How many provisional ballots exist?
How many unused ballots remain?
How many mail and early ballots were accepted?

Any unexplained difference must be investigated. This directly implements the reconciliation requirement DHS has already established for grant recipients.

The rule is:

Account for the ballots before relying on the vote totals.

V. Control Four: The Bank-Teller Method

The current DHS grant requirements establish a minimum manual audit of at least 5% of ballots following federal elections for jurisdictions subject to those funding conditions, while CISA recommends manual examination of paper ballots before certification.

DHS should offer jurisdictions an enhanced, easily understood verification model: the Bank-Teller Method.

A bank teller does not merely trust the computer balance or the machine count. The physical cash and the accounting total must balance. Federal election results should operate on the same basic principle.

Ballot Count One — Machine:
Existing tabulators produce the initial result.

Ballot Count Two — Human:
Election workers independently hand-count the federal contests on the physical paper ballots.

For the 2026 emergency implementation, this can be limited to federal contests, avoiding the burden of manually counting every county, municipal, judicial, and ballot-question contest.

The human counting team should not consider the machine result before completing and signing its count. Only after the independent count is complete are the totals compared.

The two counts are independent not only because they are conducted separately, but because they are conducted using two separate methods: one electronic and one manual. Using a different method for the independent verification count reduces the risk that the same failure mechanism will be repeated in both counts. This follows a basic testing principle: verification should be independent by process and method.

If there is an inconsistency between the two counts, a new counting team recounts the affected precinct or batch. Election officials then determine whether the difference resulted from:

Hand-counting error.
Data-entry error.
An incorrectly constituted ballot batch.
An ambiguous mark.
Ballot adjudication.
Tabulator interpretation.
Another identifiable cause.

The resolution is documented before certification. The principle is:

Two independent counts of the same physical evidence, conducted using two different counting methods.

For jurisdictions subject to DHS/FEMA grant conditions requiring a 5% manual audit, DHS/FEMA should expressly determine that completion of the Bank-Teller Method — a documented independent hand count of every ballot for the applicable federal contests before certification — satisfies and exceeds the 5% manual audit condition.

DHS/FEMA should issue specific implementation guidance establishing how jurisdictions adopting the Bank-Teller Method demonstrate compliance. At a minimum, that guidance should require documentation showing:

The ballot population included in the hand count.
The federal contests counted.
The identity of the counting teams.
The signed independent tally records.
The corresponding tabulator results.
Any discrepancies identified.
The steps taken to investigate and resolve those discrepancies.
Certification that the independent hand count was completed before certification of the election results.

VI. Make the Hand Count Simple

There is no need to create a complicated statistical or administrative process — the KISS principle applies: count locally, count in parallel, count only the federal contests under this emergency framework. The physical layout depends on many factors, but a typical counting table consists of four people:

Ballot Handler/Caller: Controls the physical ballots and announces the vote.
Tally Recorder A: Records the count independently.
Tally Recorder B: Maintains a second independent tally.
Verifier: Observes the process and confirms batch completion.

The record consists of tally sheets (A & B), which must agree before the batch is closed. Then both are signed.

Instead of one enormous central counting operation, hundreds or thousands of local teams at the precinct level can count simultaneously.

Different-sized counties will need to adjust the physical counting method based on factors such as ballot volume, available personnel, facility size, ballot length, and the number of counting teams that can operate simultaneously. However, any locally adjusted method should maintain the core Bank-Teller Method controls, including an independent manual count, separation from the machine count, dual verification of tally records, documented chain of custody, and a process for resolving discrepancies before certification.

Each county should verify that its proposed counting method is a sound and workable process through a timed mock-count exercise before Election Day.

VII. Control Five: Election Worker Surge

The biggest logistical requirement is personnel. The solution is to create a separate category of worker: count-only election workers.

They do not need to work a 12- or 14-hour Election Day shift. They report when counting begins. They receive focused training on:

Ballot handling.
Reading voter marks.
Tally procedures.
Chain of custody.
Disputed ballots.
Documentation.

This dramatically expands the available worker pool.

County Election Worker Reserve

Every county establishes: primary counting teams plus 20% reserve personnel.

Recruitment is conducted locally under state law, but DHS/CISA should provide a national turnkey package containing:

Recruitment advertisements.
Job descriptions.
Training videos.
Printable manuals.
Standardized tally sheets.
Mock-count exercises.
Supervisor checklists.

CISA already provides state and local partners with election-security exercises and field assistance through its regional personnel, making that existing infrastructure a logical delivery mechanism for the training and readiness program.

DHS/FEMA should also immediately issue written guidance identifying which election-security implementation, training, exercise, cybersecurity, equipment, printing, and personnel expenses qualify under available federal funding programs.

VIII. Parallel Cybersecurity Lockdown

The paper transition does not eliminate the need to protect the electronic systems that remain.

Based directly on CISA’s findings, every participating jurisdiction should receive a short Election System Lockdown Checklist:

Remove unnecessary remote access.
Verify actual network paths rather than assuming equipment is air-gapped.
Separate election systems from general county enterprise networks wherever possible.
Use unique administrative accounts and strong authentication.
Document every device and transfer medium entering the election environment.
Properly configure, enable, and validate relevant system, security, and network logging before election operations begin. Verify that appropriate events are being captured and that logging configurations are functioning as intended.
Preserve relevant system and security logs through certification.
Establish an immediate CISA escalation channel for suspected compromise.

This directly addresses CISA’s findings that election systems have sometimes been reachable through shared authentication, legacy network configurations, remote-management tools, vendor support paths, and other indirect connections.

IX. 100-Day Implementation

Days 1–7 — Identify and Assess

Classify all counties by color code (Green, Yellow, or Red).
Every county reports: ballot type, tabulator type, BMD usage, paper ballot compatibility, electronic poll-book usage, estimated voters, and available election workers.
Immediately escalate all RED jurisdictions for technical review to determine the specific claimed barrier to transition, independently verify that barrier, and establish a remediation pathway.
Immediately assess existing ballot chain-of-custody procedures and identify any weaknesses that require changes to SOPs, forms, personnel procedures, or physical controls.
Immediately assess network exposure, remote-access pathways, network segmentation, and current logging configurations.
Verify tabulator compatibility and the requirements for transitioning from BMD-generated ballots to preprinted hand-marked paper ballots.

Days 8–30 — Build the Local Plan and Begin Remediation

Each county receives a one-page implementation plan covering:

Paper ballots.
Poll books.
Reconciliation.
Bank-Teller Method.
Worker requirements.
Cybersecurity controls.

Yellow jurisdictions receive transition assistance. RED jurisdictions receive immediate priority technical review and intervention, and continuous technical support until the claimed barrier is resolved or independently determined to be technically or legally unavoidable.

At the same time, counties should begin correcting identified technical and procedural weaknesses rather than waiting until testing is complete. This work should proceed simultaneously and include:

Required changes to chain-of-custody procedures and SOPs.
Tabulator and hand-marked paper ballot configuration requirements.
Network exposure and segmentation issues.
Remote-access controls.
Logging configuration and validation.
Any other cybersecurity controls requiring technical changes or additional implementation time.

Days 31–60 — Recruit and Test

Every county conducts a timed mock count using its actual November ballot.

Note: This determines the real number of counting teams needed. Do not rely on a national estimate — measure it locally.

The exercise should test the complete process:

Check in → Sign → Vote on paper → Tabulate → Reconcile → Hand count → Compare

The exercise should also verify that the chain-of-custody procedures, tabulator configuration, cybersecurity controls, and logging procedures identified during the first 30 days have been properly implemented and operate as intended.

Days 61–85 — Fix Failures

Correct failures or weaknesses identified during testing, including:

Worker shortages.
Ballot supply problems.
Counting bottlenecks.
Poll-book issues.
Chain-of-custody process failures identified during testing.
Remaining network or cybersecurity weaknesses identified during testing.
Any remaining tabulator or ballot configuration issues identified during testing.

Any RED jurisdiction that has not resolved its transition barrier should remain under active technical review and receive an identified contingency or remediation plan before the final implementation period.

Retest corrected processes where necessary to confirm that the remediation is effective.

Days 86–100 — Lock and Deploy

Complete:

Final worker assignments.
Final training.
Paper ballot production.
Poll-book production and supplements.
Counting locations.
Chain-of-custody supplies.
Cybersecurity configuration verification.
Incident-response contacts.

No unnecessary system or process changes should occur in the final period.

X. Contingency and Priority Framework

The 100-day timeline requires a clear plan for jurisdictions that encounter legal, technical, logistical, or operational barriers before Election Day. The objective is to ensure that difficulty implementing one part of the RMEP does not prevent a jurisdiction from implementing the remaining risk-mitigation measures.

Each control should therefore be treated independently and implemented to the fullest extent possible.

Priority One — Hand-Marked Paper Ballots

The highest priority is transitioning the general electorate from BMDs to preprinted, human-readable, hand-marked paper ballots.

If a county reports that it cannot make the transition using its existing equipment, the county should immediately be classified RED and receive CISA technical review and intervention.

A reported technical, certification, contractual, or vendor-related barrier should not automatically exempt the jurisdiction from the transition. The claimed barrier should be independently verified and a remediation pathway identified wherever possible.

Priority Two — Ballot Reconciliation and Chain of Custody

Regardless of the voting equipment being used, every jurisdiction should implement strict ballot accounting and documented chain-of-custody procedures. Jurisdictions should be able to account for:

The number of voters who participated.
The number of ballots issued.
The number of ballots cast or returned.
Spoiled ballots.
Provisional ballots.
Unused ballots.
Accepted mail and early ballots.

Any unexplained discrepancy should be investigated and documented before certification. This control does not depend on changing voting equipment and should therefore be implemented in every jurisdiction.

Priority Three — The Bank-Teller Method

Wherever human-readable paper ballots exist, the electronic tabulator should not serve as the sole method of determining the certified result.

The jurisdiction should conduct an independent hand count of the applicable federal contests and compare that result with the electronic count before certification. The two counts should remain independent by both process and method.

If a jurisdiction cannot complete the proposed county-wide counting structure as originally planned, it should adjust staffing, counting locations, batch sizes, or counting schedules while maintaining the core controls of the Bank-Teller Method.

The method may flex. The requirement for an independent second count should not.

Priority Four — Paper Poll-Book Resilience

Every jurisdiction should establish a paper-based voter check-in and participation record capable of continuing operations during an electronic failure or cyber incident.

Where existing state procedures prevent the complete replacement of electronic poll books, a printed backup or parallel paper record should be maintained to the fullest extent permitted.

The objective is to ensure that a failure of an electronic poll-book system does not stop voting and does not eliminate the physical record needed for voter-to-ballot reconciliation.

Priority Five — Cybersecurity Lockdown

Any electronic systems that remain in use should receive immediate risk-reduction measures. At a minimum, jurisdictions should:

Remove unnecessary remote access.
Identify and verify actual network connections.
Improve network segmentation.
Strengthen administrative access controls.
Configure and validate appropriate logging.
Preserve relevant logs.
Control removable media and devices entering the election environment.
Establish an immediate CISA incident-escalation pathway.

These measures should proceed even in jurisdictions that have fully transitioned to hand-marked paper ballots, because voter registration systems, electronic poll books, election management systems, and tabulators may still remain part of the election infrastructure.

If Full Implementation Cannot Be Completed

A jurisdiction that cannot complete every element of the RMEP before Election Day should not abandon the plan. It should implement every control that can be completed and immediately report any unresolved deficiency to the appropriate state election authority and CISA.

The jurisdiction’s readiness status should identify:

What requirement has not been completed.
Why it has not been completed.
Whether the obstacle is technical, legal, logistical, financial, or vendor-related.
What mitigation has been implemented in its place.
What assistance is required from the state, DHS, or CISA.

RED jurisdictions should remain under active technical review until the identified barrier is either resolved or independently determined to be unavoidable for the 2026 election.

The Non-Negotiable Security Floor

Implementation methods may differ based on county size, state law, existing equipment, and available personnel. The security principles should not.

For the 2026 federal election, the minimum objective should be:

Use hand-marked paper wherever operationally possible.
Account for and secure the physical ballots.
Independently verify the electronic count before certification.
Maintain a paper-based record of voter participation.
Reduce and monitor the electronic attack surface that remains.

The purpose of the contingency framework is not to create exceptions. It is to ensure that when one barrier arises, every other available security measure continues forward rather than the entire risk-mitigation effort stopping with it.

XI. What DHS Should Issue Now

DHS does not need another lengthy election-security report. It needs an implementation package. We recommend five immediate deliverables:

Election Infrastructure 2026 Risk Mitigation Advisory: The national-security basis and six operating principles.
BMD-to-Hand-Marked-Paper Transition Guide: A rapid county assessment and implementation checklist.
Bank-Teller Method Manual: No more than 10 pages, with standardized forms.
Paper Poll Book and Reconciliation Guide: Including a simple signature format and contingency procedures.
Election Worker Surge Toolkit: Recruitment, staffing calculator, training, and mock-count materials.

The Core Message

The attached CISA findings establish that complex election software can contain vulnerabilities, patching can be delayed, local networks may not provide the isolation assumed by vendors, and even supposed air gaps cannot simply be taken on faith.

The near-term solution does not have to be complicated.

That gives DHS and CISA a defensible national-security posture for November:

Reduce electronic dependence where it can be reduced now. Isolate the electronics that must remain. Preserve physical evidence. Independently verify the count before the result becomes final.