How to Steal an Election

President Trump’s desire to meddle in the midterms would be the country’s worst-kept secret—if it were a secret at all. Fears about interference aren’t new; they’ve persisted since at least Jan. 2, 2021, when President Trump asked Georgia Secretary of State Brad Raffensperger to “find 11,780 votes,” and U.S. trust in elections has generally been low for decades. But the misgivings are current: This winter, the president filled democracy advocates with equal parts concern and confusion by urging the GOP to “nationalize the voting.” And elected leaders are still worried. “I remain gravely concerned that the president or his allies may try to interfere in the election,” Sen. Mark Warner (D-Va.) recently told MSNOW.

But what would meddling actually look like? And what can be done about it?

The STEEL Working Group, a joint project between the German Marshall Fund and the Lawfare Institute, the non-profit organization that publishes Lawfare, spent the past year mapping out the possibility of interference in the election—identifying and categorizing the risks, evaluating the degree and the likelihood of the threat, and considering what countermeasures democracy-defenders may deploy.

The group found that any strategy to meddle in the election cannot be understood as a master plan concocted in a smoke-filled room to steal the election in one fell swoop. Instead, the threats are scattered and usually asynchronous, and each could be carried out by one or more of a diverse array of actors—government officials at the federal, state, or local levels; foreign actors; non-state actors. These election-meddling strategies often complement each other, but usually by coincidence. They tend to be uncoordinated. 

STEEL—short for Strategic Threats to Elections and Electoral Legitimacy—convened to map out what the threats to the midterms are and how they interact with each other. The group brought together people from a variety of professions and perspectives: a former judge advocate general, a former Republican Defense Department appointee, a disinformation guru, a voting rights expert, and others. 

This cross-cutting expertise allowed the group to assess what is, in the end, a cross-cutting problem. Some election-meddling strategies could involve the military or armed officers physically interfering at election sites. Others involve the minutia of administering elections. Still others involve sowing distrust in the legitimacy of elections or their outcome. And there are more. The group’s first task was to name and classify this range of strategies.

Next was evaluating those strategies to determine the risks they posed. An accurate assessment required taking into account not only the likelihood of a given type of strategy, but also the degree of harm it would precipitate—that is, its direct and indirect consequences. It also required considering how these strategies could interact—intentionally or not, by design or not—in a manner that affects the severity of the risk. 

Finally, the group considered what could be done about all of this: How and where defenders of election integrity might prepare in advance of elections, what they can do on Election Day itself, and how they can respond if things go wrong.

Over the last couple of months, our work has proved prescient, at least at times. Various actors have attempted to implement the strategies we identified: The Justice Department, for instance, has sent multiple letters to state and local officials threatening criminal prosecution or informing them of “ongoing investigations” over noncitizens voting in their elections; it has also brought lawsuits in both California and Alaska demanding, respectively, the setting aside of some mail-in ballots and the delayed certification of the senatorial election.  And there continue to be hints that some actors are considering, or even planning, interference in the election. Other threats we’ve contemplated would not materialize until the day of the election. Others, we hope, will never come to pass.

There is some good news: We concluded that despite the many ways in which someone—or, more likely, several someones—might interfere in the midterms, it will still be difficult to actually change the outcomes. But we also found that if multiple strategies are implemented, the likelihood of successful interference increases. And even if none of the elections’ outcomes are changed, there is still a significant risk that these actions could sow confusion or feed conspiracies or otherwise affect the public’s faith in the elections’ integrity. 

The other good news is that for every strategy, there’s multiple countermeasures, although it may not reduce the risk or harm entirely. Assessing what threats were most likely and most dangerous also allowed us to draw up a list of the most effective ways to fight back. Some of these have already been implemented; others require concerted effort and careful coordination to fill the gaps. We shared the analysis with congressional staffers leading election integrity efforts, non-profits in the voter protection and national security space, and philanthropic funders looking to prioritize election integrity efforts.

The Strategies

News stories and even academic analyses of threats to the midterms typically focus on the risks individually: What if ICE shows up on the streets on election day? What if the administration alleges noncitizen voting to challenge the results of a contest that doesn’t go the GOP’s way? 

Some of these threats complement each other, but indirectly: For instance, intimidating local election officials into resigning close to Nov. 3 could result in a chaotic scene at the polls, which a governor or secretary of state could use to justify delaying the certification of the election on the grounds that the results are unreliable. 

We looked at every threat we considered within the realm of reasonability and contemplated how they might interact, to come up with six scenarios that we believed could play out before, during and after Nov. 3. It was impossible to portray these scenarios linearly; decision points along the way yielded different next steps, and different end results. We may not have captured every possible iteration, but we endeavored to map at least the most plausible routes interference actors might take.

Several of these scenarios will be familiar to almost anyone who regularly reads the news. Few attentive Americans, for example, haven’t at least contemplated the possibility of troops at the polls. Others have earned less attention over the past several months—but that doesn’t necessarily mean they’re less pernicious. After identifying the strategies, we followed every threat from its start point to its end point and matched potential countermeasures at every possible step, which allowed us not only to evaluate how likely it was a strategy would be attempted but also how likely it was to succeed.

Deploy & Obstruct

In this scenario, federal, state, or local forces are deployed at or near polling places to interfere with the election as it is conducted or before ballots are completely counted. 

This strategy would likely begin with a pretext that makes the deployment look at least plausibly legal, to contend with the various prohibitions against using the military for law enforcement as well as the federal government bringing troops or armed men to election sites. This pretext could range from alleged foreign interference with voting systems, to alleged fraud, to an alleged physical threat at the polls or in the vicinity of them.

The next step would be deployment, but exactly who would deploy citing what authority would vary depending on the chosen pretext. Perhaps federal law enforcement would arrive at polling places claiming that doing so was necessary either for an ongoing investigation or for ensuring public safety. Perhaps the federal military would do the same, warning of an imminent attack on the election that they must prevent. Or perhaps either of those entities would allege a separate but geographically proximate purpose for their presence at the polls—from immigration enforcement to a terror attack. There’s also the possibility that a state governor would seek to deploy the National Guard for a similar purpose, or that county or municipal actors, including sheriffs, could draw on their own resources.

What precisely the ensuing obstruction would look like also depends. But the possibilities extend from blocked access to or closure of polling places to the disabling of specific equipment to the seizure of ballots, either during or after the election. The ultimate impact could be voter suppression, with the targeted populations unable to submit their ballots—which would also pave the way to a fairness challenge to the results. Or, in the event of a seizure or the compromise of the secure sites where votes are cast and counted, the ballot chain of custody could be broken. This, too, could render the results unconfirmable.

Certification Block

A local election certification official refuses to certify the final tally in their jurisdiction or a chief election official of a state blocks the issuance of the certificate of election to prevent duly elected officials from being seated in Congress.

This strategy would also likely start with disinformation—a pattern in our analysis. A false narrative would have to center on the unreliability of the election results, so possibilities include claims of foreign interference, illegal voting by non-citizens or falsified ballots.

Relying on one of these pretexts, states’ chief election officials would have a few options. They could delay the issuance of a duly processed certificate of election without a valid reason, pending additional process such as an investigation or even a recount. They could deny the certificate altogether. Or they could issue the certificate to a candidate other than the lawful winner. Local election officials could similarly ignore their ministerial, non-discretionary duties to certify races and instead delay or deny their signoff.

The worst-case result here is a candidate being unable to take their seat in Congress on Jan. 3, 2027. A challenger wrongly awarded a certificate could even attempt to be sworn in instead. But if these efforts fail—as they should, under the law—the doubt and discord the episode would generate could do damage of its own, creating chaos in the election environment that opens up room for the implementation of other strategies.

Intimidate & Threaten (Non-State)

Non-state intimidate election officials, workers or candidates to weaken the functionality or perceived legitimacy of the election​. 

Disinformation helps this strategy along, too, when accusations of partisanship or corruption among election workers combine with larger-scale narratives about fraud to encourage private citizens to do something about it. These actors, maybe as individuals but probably as groups, can—and do—dox, SWAT (a term used for falsely reporting an emergency to send a heavily armed tactical team to someone’s residence), stalk, and otherwise harass election workers or officials before election day. On election day, they could make physical threats to polling sites or even conduct cyber attacks to cause website outages and other malfunctions. Armed or threatening “poll watchers” could simply station themselves at polling sites either under observer laws or in violation of them, depending on the jurisdiction and behavior.

Pre-election day interventions could lead to workers or officials resigning, or candidates dropping out of races late in the season. Day-of meddling could lead to limited voter access or intimidation, or, in the case of cyber interference, delayed processes. Any of these efforts could cause chaos that could lead to contests about the fairness of the result; even just the loss of seasoned workers’ know-how can hurt. But the likelier outcome is merely, again, degraded public trust that could enhance the effectiveness of other strategies aimed at affecting results more directly.

Intimidate & Threaten (Federal)

Federal actors intimidate election officials, workers, or candidates to weaken the functionality and perceived legitimacy of the election​.

Using the tried and not-so-true pretexts of massive amounts of noncitizens voting or fraud by election officials, the federal government could criminally investigate election officials and election-related civil society groups, as it has repeatedly threatened to do; demand access to voting equipment or databases or other process changes; or install federal monitors at voting sites who could aggressively question voters or elevate specious concerns about election integrity.

These investigations, assuming they’re purely pretextual, wouldn’t cause candidates to become ineligible. But they could persuade innocent candidates to drop out of the race. Otherwise, false allegations may simply sway voters’ opinions. Demands for access or process changes, including ones that make federal funding contingent upon compliance, were a greater concern these midterms before most of them fell flat in court: The federal government won’t, for instance, be able to force states to remove voters en masse after verifying their rolls against the SAVE database, though states who wish to comply can carry out more individualized removals even during the pre-Election Day quiet period. These federal efforts could also activate state-led efforts discussed in this piece.

There is also, again, the risk that the administration or others will invoke states’ failure to implement policies it said were necessary to secure the vote as an excuse for implementing other strategies—or as a means to make their success more likely.

Litigate & Contest

Bring legal challenges to election or election management to affect the outcome of election or build legitimacy for other efforts​.

This strategy relies on two distinct ways of shaping the litigation environment: One involves lodging lawsuits ahead of the election, some of them “zombie lawsuits” that are filed too close to the contest to address an alleged violation directly but can be revived afterwards and others geared toward acquiring data that may later prove useful. The other way involves setting up future challenges for success. Tighter election rules—such as onerous registration and ID requirements—could simply be viewed as prudent policy. But they can also be taken advantage of, by those who use the existence of more and more complicated restrictions as a basis for lodging frivolous lawsuits alleging that the rules were violated. Similarly, would-be challengers may build an evidentiary record ahead of time through public records requests, administrative complaints, audits and more—searching for a pretext for a complaint.

The litigation itself could take several forms. A litigant could seek a declaratory judgment that an election procedure or action violated applicable laws. They could request injunctive relief on an emergency basis to stop the counting of votes or certification of a contest before the first was complete or the second occurred. They could ask a court to compel, via mandamus, an election official or government body to perform an action such as conducting a recount or they could directly challenge the validity of a result after the fact. 

The underlying legal theories, tenuous as they may seem, could range from assertions of fraud or foreign interference to assertions that officials had failed to comply with statutory requirements such as proper signature verification or voter-roll maintenance. Challengers could also allege that the rules used for the election were themselves unconstitutional or contrary to federal law. Flagging unlawful activity, of course, isn’t election inference. Alleging unlawful activity where none exists and requesting relief that hurts election integrity more than it helps, however, is election interference.

Consider the Department of Justice’s recent lawsuit in Alaska—which according to New York Times reporting is based on a kernel of truth (operatives aligned with the Democratic candidate, Mary Peltola, recruited a man with a similar name to the Republican candidate, Dan Sullivan, to run in the race for U.S. Senate), but in which the federal government asked for an extraordinary and legally dubious remedy (delaying the certification of the race). A district judge has recognized the absurdity by dismissing the case, but the risk is apparent.

And, of course, once more, the very existence of litigation could provide “evidence” for the broader argument that elections cannot be trusted.

State-Led Intervention

State-level leadership—such as the legislature, election board, or even secretary of state—replaces or supersedes local administration to undermine the election’s results.

This strategy, predicated on the same disinformation efforts as those above but with the possible addition of narratives about inefficiency, negligence, and partisanship at the county and municipal levels, could begin with state legislatures passing an election integrity law empowering a state election board or another body essentially to “take over” underperforming county election boards. Once empowered, a state election board could run a performance review or otherwise make statutory findings that would suspend a county board and appoint a temporary superintendent to run elections in its place. 

A state legislature or another state body or official could also hold hearings or launch a special investigation questioning election administration—after which it could take operational control of a county board found to have failed in its duties to administer the election accurately and effectively. This body could alter aspects of administration from ballot processing and recounts to staffing, site locations and observer access. (Precisely what is within the realm of possibility depends on state law; our analysis was modeled on events in Fulton County, Ga.)

A secretary of state could also usurp counties’ control over elections by ordering large-scale removals from voter rolls close to election day. Systematic purges within the “quiet period” leading up to that date are prohibited by law, but the striking of individual voters are permitted—leaving space to locate definitional loopholes. Similarly, states could modify their election processes close to voting time. 

Any of these efforts could end in uncertainty and delay, reducing confidence in the election and elections overall. At worst, altered procedures, especially if misapplied in the confusion, could lead to large-scale ballot exclusion as well as open the door to legal challenges over election administration.

Foreign Influence & Interference

Foreign actors—Russia, China and Iran the most likely among them—conduct influence operations or interfere with election systems to undermine confidence in the system or disrupt election administration. ​

Foreign influence in previous elections offers a convenient template to predict what could happen this time around. Adversaries tend to amplify divisive narratives in addition to election disinformation, using social media and traditional media to influence not only voters’ choices but also their trust in the system. They may also attempt to access Internet-connected election networks, such as voter registration databases, as well as campaigns’ and candidates’ communications. Covert political influence, including via the illicit funding of candidates, is also a well-documented technique.

Any disinformation seeded by foreign actors tends to spread domestically, though the evidence is mixed on the degree to which it influences voters’ opinions or behavior. The hacking and leaking of sensitive information helps both of those goals along. Disruptions, such as DDoS attacks (or distributed denial-of-service, a type of cyberattack that overwhelms a target with fraudulent traffic) on election websites, have the potential to cause similar chaos—but their more measurable effect could be to delay election processes.

Indeed, in some cases the very knowledge of a foreign actor’s presence, even when the foreign actor hasn’t accomplished anything meaningful, is itself the most damaging result of this strategy. Americans who are told Russia, China, or Iran is meddling in the election may be less likely to believe in the election’s integrity, particularly when they believe that the interference could affect election results. 

The Takeaways

Our focus on following the strategic chain in each of our groups all the way to its conclusion also led us to realize that the number of ways a malicious actor could actually change an election’s results is tightly limited. 

Three threats emerged as the most dangerous in terms of impact: Deploy & Obstruct, Certification Block, and Litigate & Contest. Nonetheless, while these strategies and threats to the election are inextricably linked, such that execution of one may make another easier to pull off. Indeed, sometimes, even if one strategy doesn’t “succeed,” the very fact that it has been tried may make another attempt at interference more likely to prevail. For example, litigation seeking to force states to purge suspected non-citizens from voter rolls may have been rebuffed by the courts so far—but local officials could seize on the concerns about illegal votes that animated those challenges as an excuse not to certify the election. 

Similarly, even when a strategy has no direct effect on the results, it may have an indirect effect merely by contributing to widespread confusion or lack of confidence in the integrity of elections—which helps along almost every one of the threat types we explored.

Aside from impact, we analyzed risk by looking at the likelihood a given strategy would succeed. But identifying the “most likely” states or jurisdictions for election interference proved misleading. In some places, one strategy or even a single component of a strategy may have a high likelihood of success where another strategy seems destined to fall flat. The type of actor carrying out a strategy also matters. Some jurisdictions may be especially vulnerable to intervention by a state or local actor, for instance, whereas another might more reasonably expect to see litigation challenging results brought by the federal government.

We have not publicly disclosed the places that we believe are the highest risk, because we don’t think it’s proper to do the work for bad actors, but we have shared it with specific voter protection groups. Identifying risk is also never perfect; we don’t want to imply that just because a state is not on a list, there is no possibility of intervention. Overall, however, we counsel considering risk as too complicated to quantify with a simple ranking system. Simply declaring that X, Y and Z top areas are the highest risk probably means missing narrower threats in other places.

The Countermeasures

Having examined what election meddling looks like, we were ready to consider what could be done about it. To develop our countermeasures, STEEL walked through every possible step of every scenario we identified to consider the ideal response—whether or not that capability currently existed. We identified 30 core countermeasures, which we grouped into broader categories: information and communication (election knowledge and ability to share it effectively), operations (preparation, training and continuity), legal (analysis and litigation support) and legislative.

Some of these countermeasures were preventive—meaning civil society, state legislatures, election officials or any other entity responsible for carrying it out could and should do so ahead of the election, regardless of what a threat actor does or doesn’t do. Think providing nonpartisan resources to judges on how to assess unprecedented search warrants for ballots or other election materials. Other countermeasures, such as responding rapidly to litigation that wrongly seeks to contest a result, were responsive, but may still require significant preparatory work to have a capable response when the time comes.

Some countermeasures also could and can be implemented at the national level. A central actor, for instance, could evaluate claims about the integrity of the election and provide an authoritative assessment. Others, however, must occur locally: Every county should be prepared to direct voters to an alternate polling place in the event of a physical disruption at their original location. These local capabilities are usually harder to build than the national ones. 

But we found that sometimes an anti-interference job that should be done by a national actor wasn’t being done by anyone at all—because the federal government had previously taken on the work but doesn’t any longer. The Global Engagement Center used to counter foreign propaganda; the Cybersecurity and Infrastructure Agency once helped states secure their election systems against attack. This administration has gutted both—making election interference easier, and responding to it harder. 

* * *

The silver lining is that, when malfeasance doesn’t take the form of a “master plan,” the response to it doesn’t have to, either. Americans from different places, with different perspectives and of different political persuasions all have a part to play in defending our democracy. Many are playing it already.