Every Ballot Counts

Tripwire board

Last updated: Thu Oct 29, 2026, ~7:30 pm ET. Updated as news breaks. Status: 🔴 FIRED (it happened) · 🟠 ARMED (the pieces are in place or it is pending) · ⚪ NOT YET (nothing seen). Marks: D document · R reporting · I our inference.

The sequence we’re watching

Foreign-hack claim → federal “who is a real voter” list → ballots held → cyber incident blamed abroad → FBI takes the “investigation” and the evidence → list used to set aside ballots or block certification before Jan 3.

The board

# Tripwire Status Latest evidence
1 Foreign blame for a current hack 🟠 ARMED FEC back up Oct 28 night after ~41 hours offline; cause still undisclosed; CISA and the FBI referred questions to the FEC; no country named (R, Reuters Oct 28-29). FEC e-filing went down Oct 26; staff email: “We have a bad actor attempting to breach FEC systems” (R, Reuters). DHS breach (Oct 28): a hacker calling itself “Department of Peace” published directory and access records for 40,000+ DHS employees (CBP, ICE/HSI, CISA) taken from DHS’s Okta login system around mid-August; DHS says it is “aware of a potential breach” (R, TechCrunch Oct 28). The hacker’s own note reads as domestic protest, not a foreign state. Watch who DHS blames. The predicate is on paper, but the declassified documents themselves don’t say China hacked a state voter system (D, Jul 2026 White House release). They describe voter data China bought (7 states, 2023 report), downloaded from public commercial sites (6 states, Jan 2022 notice), obtained by a blacked-out method (18-state memo; GA and IA), or held on a 2019 list of “likely leaked” data (204.8M records dated 2016). The 2020 minority view the White House now cites found “no reporting” that China tried “to compromise voting infrastructure.” “Breach” first appears in White House and DHS language: the Jul 17 “Setting the Record Straight” page (“this breach in at least 18 states”) and the DHS/CISA voter-registration guide (“China breached multiple state voter registration systems,” no citation; file saved Jul 13, released with the White House package Jul 16). A Jan 15, 2020 intelligence memo warned that a foreign claim to have compromised U.S. voting systems would be “difficult and time-consuming—or impossible—for the US Government to disprove,” and that adversaries could link an exaggerated claim to a real intrusion (D, declassified Mar 16, 2026). The Sept 24 CISA plan names no country. Earlier incident on the record: election-worker software vendor ElectSure compromised Aug 7; Wake County NC poll-worker names and emails exposed, no attribution (R, WRAL Aug 14). X suspended 13,000+ accounts in China, Russia and Iran influence operations aimed at U.S. candidates (R, Oct 14). The 2025–26 Olsen effort aimed to prove a foreign actor “manipulated votes”; none found (R, Reuters Oct 2). Texas (Oct 27): a county GOP sued in the Amarillo federal court (Judge Kacsmaryk, the single judge there) to block certification unless every Texas paper ballot is hand-counted, citing “components manufactured by foreign adversaries”; it alleges no breach (D docket; R content). PHP2Shell: a widely exploited web-software flaw, attribution contested (Korean-speaking/Lazarus per CYFIRMA; Chinese-language indicators per Dream Research; no named actor); Unit 42 retracted its government-intrusion link Oct 25 (D/R); no election link reported.
2 FBI/DOJ take an election “investigation” or the evidence: subpoenas, seizures of ballots, machines or voter databases 🔴 FIRED (voter rolls by subpoena) · 🟠 ARMED (ballots/machines) New, Oct 28 (R, Reuters): DOJ and DHS have sent more than 100 subpoenas to election officials in at least a dozen states (CA, MN, PA, MA, TX, KS, GA, WA, NY, CT, UT, MI), covering tens of thousands of voters. At least 44 are grand-jury subpoenas (no judge signs those). Some demand entire local voter rolls (Massachusetts towns: names, addresses, party, birth dates, voting status, voter ID numbers). Washington’s Secretary of State got about 60; California at least 17 (LA, San Diego, Marin, Fresno); Hennepin and Anoka (MN); Philadelphia 4+. Most were sent in the last three months. FBI/CISA alert, Oct 16: “The FBI is responsible for investigating and prosecuting election crimes, specific to foreign influence and interference” (D). Precedent: FBI seized Fulton County election boxes by search warrant, Jan 28 (count reported as 600+; R, Time Oct 28); a judge let it keep them in May (R). HSI and the FBI already run joint voter cases (Hennepin, Ohio planning, NJ) (D, ICE FOIA production). The FBI’s fraud center sends “pre-drafted search warrant affidavits” to a fraud counsel in every U.S. Attorney’s Office (D, FBI Sept 17). Allies urging martial law to seize ballots (R, Time). The written restraint is gone (D/R): DOJ took down its Election Crimes Manual, which said prosecutors “should not seize voting materials until after an election is certified,” and in June 2025 suspended the Justice Manual rule requiring U.S. attorneys to consult the Public Integrity Section on election matters (JM 9-85.210: “suspended while revisions are ongoing”); most Public Integrity lawyers are gone and no Election Day command center was set up as of June (R, KOIN Jun 12; Spotlight PA Jun 2026; senators’ letter Oct 15). Reuters (Oct 2): Stephen Miller pushed to bring in the FBI and potentially seize more machines. Inside the FBI (Oct 28, R, MS NOW, 7 sources): agents fear orders to seize ballots or equipment or to deploy to polls; a current FBI official expects “at least one U.S. attorney and one FBI agent to be willing to sign on to such actions, such as Georgia and Arizona.” The FBI took Arizona’s 2021 “audit” servers and drives by grand-jury subpoena in March (R). LA County (R, AP Oct 29): DOJ subpoenaed three LA election-office employees on Oct 21 to appear Nov 4, the day after the election, with records on noncitizen-voting allegations.
3 Emergency declaration (CISA “significant incident,” national emergency, FBI/CISA joint response group) 🟠 ARMED New (R, Nextgov/Politico Oct 28): at a CISA all-hands Oct 27, Mullin said DHS will hold a post-election “debrief” on changing voting systems to improve voter “trust”; scope not stated. A federal review aimed at “public confidence” fits the 677a test, which counts harm to public confidence (I). Trump told TIME he doesn’t “rule anything out,” including a federal emergency declaration (R, Oct 28). Corsi draft “national emergency” EO on a China predicate (R, WaPo Feb 2026). Nothing declared (⚪ on the act itself). How it would work (D, 6 U.S.C. 677a–677d): the DHS Secretary alone may declare, even if an incident is only “likely to occur imminently,” and harm to “public confidence” counts; CISA then “shall coordinate” with federal law enforcement on their investigations; the declaration must appear in the Federal Register within 72 hours; the notice to Congress names the perpetrator “if known.” A declaration also lets the Defense Secretary call up reserves for up to 365 days (10 U.S.C. 12304(c), not for Insurrection Act duties). Watch the Federal Register.
4 Federal lists of named voters sent to states 🔴 FIRED California: 20,930 names delivered Oct 13 (D, Bartell Decl. #2). The roll was bought from the CA Secretary of State (buyer not named), handed to HSI by a “DHS senior counselor” about Mar 19, and reflects the rolls as of Aug 2025 (D, Dkt. 107-2, 107-3). Washington: 405 names, Oct 26 (R, NBC/WaPo); Washington found U.S. citizens on it (Oct 28, below). DHS says 17,000+ more records are being reviewed “on a rolling basis before the election” (D, Bartell ¶24). Built with LexisNexis Accurint, outside SAVE (D). The U.S. Attorney said DHS “obtained publicly available lists of registered voters in Washington,” which suggests lists exist for other states (R/I, Democracy Docket Oct 28).
5 Demands to hold or set aside ballots 🔴 FIRED (demands) · 🟠 ARMED (court order) Washington said no, Oct 28 (R, Spokesman-Review): Hobbs wrote that “many of the persons on your list are United States citizens,” that holding the ballots would “likely be unlawful” without individualized proof, and that many listed people aren’t registered or are inactive. The U.S. Attorney’s office will “decide next steps” (a California-style suit is possible). DOJ is going back to the Ninth Circuit: Essayli, Oct 28: “We filed our Notice of Appeal and will immediately seek an emergency order from the Ninth Circuit,” with Solicitor General approval (R); no emergency motion seen yet as of Oct 29 morning. Carter (C.D. Cal.) denied DOJ’s TRO Oct 28 (D, ECF 149): DOJ likely lacks standing and a cause of action; segregating listed ballots would likely violate the NVRA 90-day bar (“a ballot segregated, in effect, would be a ballot removed”), the VRA and the Civil Rights Act; “The Court cannot conclude that Plaintiff’s process is credible”; the emergency was “solely due to its own neglect”; “these threats must stop.” DOJ appealed the same day (D, ECF 152). Voter groups are intervenors (D, ECF 148). LA County’s motion to dismiss is set for Oct 30, 8:30 am (D, ECF 68). LA County certifies by Dec 3, the state by Dec 11 (D). Oct 29 (D, ECF 159): Carter appointed special master Daniel B. Garrie, set an expedited hearing for Nov 13, 10 a.m., and ordered witness lists by Nov 6 on “the reliability of the October List and the methodology Plaintiff used to produce it.” DOJ filed a new emergency motion in the Ninth Circuit (No. 26-7231) asking for relief by Oct 30 (R).
6 Criminal threats against election officials who count 🔴 FIRED DOJ letters to every California county (Oct 16/23); Essayli in court: officials who knowingly process a noncitizen’s ballot could face criminal liability (R). Carter’s Oct 28 order confirms letters went to “every county in California” and says “these threats must stop” (D, ECF 149). The grand-jury subpoenas to local officials (row 2) add pressure on the same offices (I).
7 Bounty and tip programs feeding federal cases 🔴 FIRED Trump, Oct 26: $1M reward for voter-fraud tips leading to “arrest and conviction” (R, ABC). Fraud-whistleblower program the week before: Trump says 1% with no cap and that he decides who is “deserving” (R, Oct 20); DOJ’s written terms differ (R). No tipline named; the FBI alert routes election-crime reports to FBI/IC3 (D).
8 Armed federal agents near polls 🔴 FIRED once · 🟠 ARMED New sworn limit, narrow (R, Oct 28): DOJ Voting Section acting chief Eric Neff declared in the NAACP FOIA suit that “There will be no Federal Bureau of Investigation or U.S. Immigration and Customs Enforcement employees, much less agents, serving as monitors.” This covers DOJ’s monitors only, not ICE/HSI operations or the FBI otherwise. Masked Border Patrol stop at a Key Largo early-voting site, Oct 20 (R). Trump won’t rule out ICE at polls (R, Time). At least three suits to keep ICE away (R). Nine-state injunction on DHS election field operations in effect since Oct 23 and expiring when polls close Nov 3 (D, CNA v. Mullin); DOJ appealed Oct 26 and asked for a stay Oct 27 (D, docket); no stay ruling seen. FBI Director Patel on agents at polling places (Sept, Senate Judiciary): “I don’t know that we can’t legally do it” (R, via MS NOW).
9 Certification attacks 🔴 FIRED (Alaska suit) · 🟠 ARMED Trump, Oct 28: Peltola “should be prosecuted criminally,” and “She shouldn’t be allowed to run”; Blanche on Fox: the spoiler recruitment “should be illegal,” pointing to DOJ’s civil suit (R, WaPo/Yahoo). DOJ sued Alaska to block certification of the Senate race if Sullivan loses (D/R); intervenors admitted and motions to dismiss accepted (D, ECF 35). Blanche: won’t rule out DOJ intervening in “some doomsday scenario” (R, Fox Oct 22). Trump implied Minnesota’s Senate result can’t be trusted if the Republican loses (R, Time). Alaska (Oct 29, R): DOJ amended its complaint to add an “obstacle preemption” theory for holding certification; AP reports new grand-jury subpoenas there. Texas (Oct 27): statewide hand-count-before-certification suit before Judge Kacsmaryk (row 1).
10 Candidates targeted (citizenship, prosecution, removal) 🟠 ARMED Omar warrant still open (R, MPR Oct 28): U.S. Attorney Pirro opposes unsealing because the warrant “hasn’t been fully executed” and DOJ “expects that the warrant will be fully executed in short order.” Expect more action against Omar before Jan 3. No charges yet. HSI searched her D.C. home Oct 12; phone seized, relatives subpoenaed (R, AP). Trump, Oct 23: she “will not be legally allowed to be a member” (D, video). Peltola (Oct 28): Trump calls for her criminal prosecution and says she shouldn’t be allowed to run (R; see row 9). Watch for a House qualifications challenge before Jan 3.
11 New data powers switching on 🟠 ARMED State Department passport records open to “federal government verification platforms” for voter eligibility; outside routine uses take effect Nov 23 (D, 91 FR 66906). SAVE revived by the Supreme Court Sept 25 (D). CISA’s first Palantir and Databricks buys, Sept 2026 (D). Treasury tip-system Privacy Act exemptions take effect Nov 5 (D).
12 Oversight blinded 🔴 FIRED Required pre-election intelligence reports to Congress (120/60/30 days) not delivered; Foreign Malign Influence Center cut; CISA staff cut (R, CBS, Warner/Himes). Classified threat briefing for election officials postponed Oct 15 for “technical difficulties” (R, CNN).
13 Insurrection Act, Guard or reserve call-up ⚪ NOT YET Gen. Caine: military has “no plan” to deploy to polls (R, Time). Watch for any order, and for a significant-incident declaration, which by itself unlocks involuntary reserve call-ups (D, 10 U.S.C. 12304(c)).
14 DOJ won’t pledge not to seize ballots before certification 🟠 ARMED (due today, Oct 29) Sens. Padilla, Durbin and Whitehouse asked AG Blanche (cc FBI Director Patel) on Oct 15 to commit that DOJ, FBI and Marshals will not remove ballots, materials or equipment from state custody before certification, and to disclose any seizure plans. Answer due Oct 29 (D, letter). No answer seen as of ~10 am ET Oct 29. DOJ’s Oct 28 sworn statement about monitors (row 8) does not address seizure. No answer, or a hedged one, is a signal.
15 Enforcement surge on “noncitizen voting” 🔴 FIRED Reuters, Oct 28: 147 people charged under the “voting by aliens” statute since January 2025, 102 since September; 100+ subpoenas (row 2) (R). DOJ: “literally thousands” under investigation (Dhillon); DOJ has sued 30 states + D.C. for rolls, 26 dismissed (R, Newsweek Oct 19).

Also watching (smaller signals that would tell us a step is coming)

Key dates

Oct 29 DOJ answer due to senators on ballot seizure · Oct 30 (8:30 am PT) LA County motion to dismiss (now folded into the Nov 13 hearing) · Nov 4 LA election staff subpoena return date · Nov 6 witness lists on the California list’s reliability · Nov 13 (10 am PT) US v. California hearing with special master · Nov 2 (5 p.m.) DOJ answers due to Morelle/Padilla · Nov 3 Election Day · Nov 5 Treasury tip-system exemptions take effect · Nov 18-19 APEC (Trump-Xi) · Nov 23 passport routine uses take effect · Dec 3 LA County certifies; Dec 11 California certifies · ~Dec 18 DNI post-election foreign-interference assessment due (EO 13848 §1(a); the AG/DHS report follows within 45 days, ~Feb 1, but can come earlier) · Jan 3 House seated.

What would mean “it’s being switched on” (call people the same hour)

Sources (newest first)