---

Discussion

Omar Seidren:

The distinction matters. The FEC does not run voting machines, maintain state voter-registration files, or count ballots. Its electronic filing system belongs to the transparency layer around an election. On October 26, that layer went offline after an FEC filing officer warned compliance firms that a bad actor was attempting to breach agency systems. Public evidence does not establish whether anyone got in, or whether the shutdown contained a suspected threat before compromise.

Ann Tofado:

Timing made a limited outage politically consequential. This was the final week before the November 3 midterm election, when outside groups were making late advertising decisions and voters were forming impressions. Previously filed reports and much of the FEC search infrastructure remained available, so this was not a total blackout. But the newest spending—the activity most likely to shape the final conversation—was temporarily harder to see.

Sofia Jadler:

Legally, separate the duty to report from the public’s ability to see a report on time. Qualifying independent expenditures generally must be reported within 48 hours before the final 20 days of an election and within 24 hours during the final 19 days, subject to thresholds. These reports can identify the payee, amount, purpose, dissemination date, and candidate supported or opposed.

Red Velhouse:

Omar, what facts would distinguish an attempted intrusion, a successful compromise, and a shutdown triggered by caution?

Omar Seidren:

Investigators would examine authentication and network logs for unauthorized accounts or devices, then look for persistence: new accounts, altered configurations, unusual scheduled tasks, or movement between systems. They would test the integrity of filings, databases, and audit logs. A denial-of-service attempt might overwhelm a public endpoint without exposing data. A precautionary shutdown could mean suspicious behavior was detected and the connection cut before compromise. The website being down is one symptom, not one technical story.

Omar Seidren:

There is also a useful distinction between confidentiality, integrity, and availability. Confidentiality asks whether someone saw information they should not see. Integrity asks whether records were changed. Availability asks whether legitimate users could file and retrieve information when needed. This incident clearly raised an availability problem; the public record does not yet establish a confidentiality or integrity failure. Treating those as interchangeable would make the technical story sound more dramatic, but less accurate.

Ann Tofado:

Those different technical stories would produce different political narratives. If delayed reports later reveal a surge of spending in a close race, one party may say the outage helped its opponent. That is a claim about effect or motive, not proof of who caused the incident. The actors who benefit from an information gap are not automatically the actors who created it.

Sofia Jadler:

Exactly. Attribution requires evidence connecting an actor to the technical activity, not merely a plausible beneficiary. Even a confirmed intrusion would not establish that a campaign coordinated with it. Investigators must keep separate questions separate: who accessed what, whether data changed, who benefited from delayed visibility, and whether anyone directed the attack.

Red Velhouse:

The outage also affected compliance. The FEC reportedly gave filers 24 hours after restoration to submit reports missed during the shutdown without fines. Does that solve the legal problem?

Sofia Jadler:

It may solve part of the compliance problem, but not necessarily the democratic one. The FEC indicated that reports submitted within that window would not be fined, though the treatment of individual filings depends on later guidance and facts. An agency can recognize that a filer could not use a disabled system. What it cannot recreate is the public’s opportunity to evaluate an advertisement before voting or before the news cycle moves on. A later filing may satisfy a formal obligation while arriving too late to inform judgment.

Omar Seidren:

That is why availability is a transparency feature, not merely an information-technology metric. The system returned on October 28 after nearly 41 hours. Recovery restored the electronic filing system, but not necessarily the decision-making moment. If a report arrives after an advertisement has run, the record may be complete while the opportunity to respond has passed.

Ann Tofado:

The information was asymmetric. Campaigns, donors, and advertising groups know what they spent; journalists, rival campaigns, watchdogs, and voters depend on the public pipeline. During an outage, insiders retain operational knowledge while the public loses near-real-time visibility. That does not prove partisan advantage, but it creates unequal conditions just as political spending accelerates. OpenSecrets, cited in reporting, estimated that super political action committees, commonly called super PACs, and dark-money groups averaged more than 50 million dollars a day in the preceding week, with more than 250 million dollars spent on October 20 alone.

Ann Tofado:

The political effect also depends on who can compensate for missing information. A large campaign may have researchers, opposition analysts, and relationships with media outlets; an ordinary voter usually does not. So the outage can widen an existing capacity gap even if every delayed report eventually appears. That is why the question is not simply whether the data were ultimately published, but whether different actors had comparable chances to use it before decisions hardened.

Sofia Jadler:

Late disclosure is not automatically a legal injury. An enforcement analysis would ask what deadline applied, whether the outage caused the delay, whether the filer used the grace period, and what remedy the law permits. A filer blocked from accessing the government’s system is in a stronger position than one that ignored a deadline. But the grace approach does not answer whether the filer made reasonable efforts, had another permitted route, or later omitted or altered information.

Sofia Jadler:

There is a strategic legal choice here as well. The agency can frame the grace period as a narrow accommodation for unavoidable technical failure, preserving the ordinary reporting rule. Or it can create expectations that every outage automatically suspends deadlines. The first approach protects enforceability but may seem unsympathetic; the second offers certainty but could weaken the incentive to maintain reliable emergency procedures. Future complaints may test that boundary through the details of individual filings.

Omar Seidren:

The technical answer should include immutable, tamper-evident logs preserving every submission attempt, timestamp, validation event, and amendment. That lets investigators distinguish “the system was unavailable” from “the report was never prepared” or “the report changed afterward.” Redundancy should cover the function, not just the server: a second filing endpoint, authenticated emergency intake, a read-only feed showing that a filing was attempted, and a public status system explaining which services remain available. Legacy systems make this less glamorous than a product demo, but far more useful.

Ann Tofado:

This is also an institutional problem. The FEC faces rising demand for campaign-finance data alongside staffing and modernization needs. It can keep public searches running and still lack the resilience or personnel to respond smoothly during a crisis. Its lack of a quorum did not cause the outage, but it can slow enforcement decisions, rulemaking, formal findings, and political accountability afterward. That gives Congress an opening to consider funding, backup systems, incident reporting, and whether disclosure systems should be treated as critical election infrastructure.

Sofia Jadler:

Emergency alternatives need legal authorization in advance. If the agency accepts reports by email during an outage, it must establish authentication, timestamps, retention, public access, and protection against spoofed submissions. Otherwise the substitute channel creates a second integrity problem. The stronger legal design is not simply to waive deadlines; it is to define a process that preserves as much of the original disclosure purpose as possible.

Red Velhouse:

What should viewers watch now—for the cybersecurity story and for the disclosure consequences?

Omar Seidren:

Watch for a forensic account of whether unauthorized access occurred; evidence about credentials, since users were required or encouraged to reset passwords; and any indication that filings, audit logs, or notifications were altered. Password resets show that credential security mattered during recovery, but they do not prove compromise. Also watch whether the agency restored one endpoint or improved its ability to fail safely next time.

Ann Tofado:

Watch the backlog and its distribution. How many filings were delayed? Which races and spending categories were involved? Did reports become public before or after voting? Then watch whether both parties push for resilience standards or use the episode mainly as a partisan accusation. That response will show whether leaders see campaign-finance disclosure as shared election infrastructure or merely another political battlefield.

Sofia Jadler:

And watch for formal guidance, complaints, or congressional oversight. The legal questions include how the FEC applies its grace period, whether filers dispute treatment of late reports, and whether evidence of altered data emerges. As of the available public reporting, there is no confirmed stolen information, modified filing, deleted record, or identified attacker. Those are open questions, not conclusions waiting to be announced.

Red Velhouse:

The unresolved issue is not simply whether the FEC system came back online. It is whether the interruption merely delayed paperwork or temporarily weakened the public’s ability to understand who was financing the final days of an election—and whether anyone accessed or altered the system along the way. Watch for forensic findings, the volume and timing of delayed filings, credential-related disclosures, formal FEC guidance, and congressional action on resilience. The ballots were not shown to be affected, but the information surrounding those ballots was put under pressure. Sources and references for this discussion are available with the episode at Factolio.com.

---

Sources and References

These sources supported the factual material used in this discussion. Factolio’s panel discussion is AI-generated from researched evidence and is written in original language.

1. Reuters — Cyberattack concealed political spending by big donors before US midterm elections (NEWS)
2. Reuters — Hacker trying to breach US Federal Election Commission system, email shows (NEWS)
3. The Washington Post — The FEC’s filing system is down a week before the election. The agency won’t say why. (NEWS)
4. Associated Press — The Latest: Trump goes to Texas as his Iran war damages GOP hopes for Congress (NEWS)
5. AOL/The Hill — FEC electronic filing system back online after multiday outage (NEWS)
6. Federal Election Commission — 24 and 48-Hour Reports of independent expenditures for 2026 general election (PRIMARY)
7. Federal Election Commission — Independent expenditures file description (PRIMARY)
8. Federal Election Commission — Reporting independent expenditures on Form 3X (PRIMARY)
9. U.S. Department of Justice and Department of Homeland Security — Joint Report on Foreign Interference Targeting Election Infrastructure or Political Organization, Campaign, or Candidate Infrastructure Related to the 2022 US Federal Elections (PRIMARY)
10. OpenSecrets, cited by Reuters — Campaign-finance spending estimates during the final week before the FEC outage (DATA)
11. Federal Election Commission Office of Inspector General — Management and Performance Challenges Facing the FEC for FY 2026 (PRIMARY)