Hegseth Orders Cyber Command to Defend 2026 Midterms, Five Weeks Before Election Day

Defense Secretary Pete Hegseth signed a memo on Sept. 22 directing U.S. Cyber Command and the Pentagon's combat support agencies to prioritize "advanced intelligence and cyber capabilities" against foreign interference in the 2026 midterms. The Pentagon made the memo public on Monday, Sept. 28, roughly five weeks before Election Day on Nov. 3, according to CNN's Sean Lyngaas.

The one-page memo is addressed to Gen. Joshua M. Rudd, who leads both Cyber Command and the National Security Agency, along with the directors of the Defense Intelligence Agency and the National Geospatial-Intelligence Agency, according to NextGov. It instructs the Defense Intelligence Enterprise to "mobilize every authorized asset, capability, and partnership" to defend election infrastructure from foreign malign influence, and directs Cyber Command to work with the Department of Homeland Security to counter foreign cyber threats.

"Our Nation's ability to conduct free and fair elections is a steadfast principal of our Democracy," Hegseth wrote, calling it a "no-fail mission." Chief Pentagon spokesman Sean Parnell said the effort would run "in lockstep with federal, state, and local partners."

Rudd, in a statement Monday, described the assignment as work already underway. "U.S. Cyber Command and the National Security Agency are closely partnered to identify and defend against cyber threats to our nation," he said. "The Command and the Agency regularly counter actions by malicious foreign cyber actors including those with the intent to interfere with our democratic process."

What the memo does not say

NextGov reported the directive does not name specific adversaries, does not specify additional staffing or funding, and sets no implementation deadline. It also does not say whether the same model used in prior elections will apply this cycle.

Cyber Command and the NSA have historically run this work through a joint Election Security Group, or ESG, formed after Russia's 2016 interference campaign and active through the 2018, 2020 and 2022 elections. CNN reported that just weeks before the 2024 presidential election, Cyber Command carried out a secret operation disrupting Russian troll networks targeting U.S. voters.

Whether that structure exists for 2026 is unclear. Rudd told lawmakers in April he did not know if the ESG had been stood up for the midterms, according to CNN. Andrew Schoka, who worked at Cyber Command during the 2020 cycle, told CNN that testimony was troubling: "What concerns me is that [Rudd] testified as recently as April that he wasn't sure if an Election Security Group existed at the command. The ESG's work takes months."

The dismantling backdrop

The memo lands against a broader retreat from federal election-security infrastructure since Trump returned to office in 2025. NextGov and CNN both reported the administration dismantled the FBI's Foreign Influence Task Force, reorganized the intelligence community's coordination of that work, and reduced election-security support at the Cybersecurity and Infrastructure Security Agency. At the Office of the Director of National Intelligence, the Foreign Malign Influence Center's responsibilities were shifted elsewhere, with two officials now assigned to coordinate election-threat intelligence, according to NextGov.

CISA released its own election infrastructure security plan last week, according to the Associated Press, coming from Click Orlando and Oregon Public Broadcasting.

David Becker, a former Justice Department attorney who now leads the nonprofit Center for Election Innovation & Research, told the AP the short timeline before Nov. 3, with early voting already underway, "suggests this is just theater." He argued that "if the administration was serious about assisting state and local election officials, they shouldn't have dismantled all of the federal government's election cybersecurity capacity and fired all their experts in early 2025."

A reasonable counterpoint, made by Rudd and Parnell themselves, is that Cyber Command and the NSA never stopped this work. Cybersecurity assistance to election infrastructure has been routine since voting systems were designated critical infrastructure in 2017, and formalizing a September directive does not necessarily mean capability was absent before it. Whether the underlying staffing cuts at CISA and the FBI actually weakened that routine work is a separate, unresolved question the memo itself does not answer.

Separately, Türkiye Today reported, citing a memo first disclosed by Axios, that the directive does not send military personnel to polling places, but noted President Trump has declined to rule out that possibility, a point that drew criticism from Democrats. No other outlet in this set corroborated that specific claim in detail.

The U.S. Supreme Court has blocked one Trump administration attempt to restrict mail voting nationally, per the AP, while separately allowing use of a federal database to check voter citizenship. Neither ruling is addressed in Hegseth's memo.

Whether the Election Security Group will be reconstituted for 2026 in its prior form remains unspecified in the memo itself. NextGov and CNN both flagged this detail as missing. That answer likely won't be clear until Cyber Command's actual posture during the final weeks before Nov. 3 becomes visible.