THE GREAT
DISTRACTION?

Why a Mauritian is asking questions about American democracy

I write as a concerned Mauritian, not as an American voter, party representative or government official. The United States remains central to the political, economic, technological and security architecture of the Western world. Its democratic institutions affect international stability, the rule of law, financial markets, alliances and public confidence in representative government.

What happens to American democracy does not remain inside American borders. The 2026 midterms have unfolded amid several distinct developments: attacks and probing of election-related services, criminal infrastructure that can disguise the origin of internet traffic, foreign-linked cyber operations against US critical infrastructure, a disruption to federal campaign-finance filings, and documented attempts by political organisations to influence third-party candidacies.

These developments are not proof of a single conspiracy. They are a set of independently documented risks and incidents that deserve to be examined together where the evidence permits.

1. America does not count its votes through one national computer

US elections are administered through state and local systems. Ballot tabulation, county reporting, state Election Night Reporting (ENR), public results websites, canvass and certification are separate functions. A public website outage is not automatically a tabulation compromise.

The US Election Assistance Commission explains that ENR systems collect, aggregate and publish unofficial election results. The Commission also states that there are no federal standards governing ENR system design, security and setup; each state may use its own process and technology.

This fragmented architecture makes state-by-state mapping essential. It also makes it important to distinguish the system that tabulates ballots from the system that displays results to the public.

2. Election Day: incidents, different explanations, and missing logs

Washington State — ballot-box map targeted

Washington Secretary of State Steve Hobbs told KIRO 7 that officials stopped a cyberattack targeting the state's ballot-box location map. The state described a sharp increase in traffic that temporarily took the page down; the map was restored. The public reporting does not establish that county-to-state results transfers, tabulation systems or vote totals were compromised.

Colorado — public results website affected

Colorado's public Election Night Reporting page intermittently displayed a processing message and later required CAPTCHA verification. The Secretary of State's office said the incident did not affect county uploads, reporting processes or ballot returns. The office initially said it was not a cyberattack; it later relayed the vendor's explanation that unusually high automated traffic from third-party election-results scraping entities had affected several vendors and jurisdictions. Other local reporting described a denial-of-service attack against the vendor. The cause and the vendor's underlying telemetry should be made public.

Cross-office probing and login attempts

Nextgov/FCW reported that an election office observed unsuccessful probing of online services and that an agency involved in elections faced repeated attempts to guess login credentials from one internet address. After the address was flagged, several other election offices reportedly said they had seen malicious traffic from the same address. The reported attempts did not succeed.

The same reporting described five unusual traffic spikes on a ballot drop-box locator page. Traffic reportedly declined after a CAPTCHA was introduced. Crucially, the Election Infrastructure Information Sharing and Analysis Center had received no reports of foreign influence operations by 9:30 p.m. Eastern on Election Day. That is important counter-evidence and belongs in any honest account.

3. Residential proxy networks: the hidden origin problem

On 12 March 2026, the FBI published a FLASH advisory on AVrecon malware and the SocksEscort residential proxy service. The FBI said compromised home and small-business routers and other internet-connected devices had been used as residential proxies. The Justice Department and IRS described the service as offering access to about 369,000 different IP addresses since 2020; around 8,000 infected routers were listed in the application in February 2026, including approximately 2,500 in the United States.

A residential proxy allows a remote operator to route traffic through a victim's ordinary internet connection. To a target service, the request may appear to come from a household or small business rather than the operator. The FBI says such networks can help malicious actors conceal their true IP address and location, bypass common filters and conduct activity such as password spraying.

This creates a legitimate election-security question: could compromised residential or business connections have been used to disguise attempts against election-related services? The capability is established. A connection to the reported 2026 election incidents is not established.

Investigators must not confuse FBI-published command-and-control servers with proxy exit IPs. They must also avoid treating an IP geolocation as proof of a household, person or operator. Time-specific exit lists, original service logs and lawful ISP records would be required to test a match.

4. Foreign cyber operations and the wider threat environment

On 26 August 2026, the US Department of Justice and FBI announced court-authorised domain seizures targeting QScan and QTRouter, platforms they attributed to a China state-sponsored group identified as QTFY. According to the government, QScan and QTRouter used compromised internet-connected devices, commercial proxy devices and leased servers to build an obfuscation network that could make intrusion traffic appear to originate outside China—including from networks close to targeted organisations.

The DOJ said QTFY's targets included NASA, the Federal Reserve, the Department of Energy, the Department of Justice and other sensitive US networks. This is significant evidence that state-linked actors can use distributed and proxy infrastructure to obscure the origin of cyber activity.

But the DOJ announcement does not establish that QTFY attacked US election systems or that it was connected to the November 3 incidents. That connection would require incident-specific indicators and forensic evidence.

The FBI and EPA also warned in 2026 of malicious cyber actors targeting internet-facing programmable logic controllers at water and wastewater utilities in at least seven states, with some operational disruption reported. Again, this is evidence of a wider critical-infrastructure threat environment, not evidence of an election attack.

5. The FEC filing-system cyberattack and the transparency gap

Reuters reported that the Federal Election Commission's electronic filing system was taken offline for nearly 41 hours after a cyberattack in the week before the November 3 midterms. The outage prevented political committees from submitting mandatory 24-hour and 48-hour spending reports during a period of heavy campaign expenditure. The FEC restored the filing system on Wednesday night.

The FEC does not administer elections or count votes. The outage did not prevent people from casting ballots. But the interruption temporarily delayed the public's ability to see some last-minute political spending. Reuters said it could not determine who was responsible or the motive. The FEC had not publicly disclosed a technical postmortem in the reporting reviewed for this article.

Campaign-finance watchdogs and compliance professionals said the timing mattered because last-minute reports can reveal who is financing and spending money in competitive races. The outage is not proof that spending was deliberately concealed. It is a reason to examine whether data was accessed, altered, lost or filed late—and to publish a complete chronology of the incident and recovery.

6. Spoiler candidates, outside spending and bipartisan tactics

The political interference story is not confined to cyber activity. In Alaska, the 2026 Senate contest exposed allegations of candidate recruitment and cross-party spending designed to influence the field. The Washington Post reported that both parties engaged in efforts to shape the contest: Republicans funded efforts promoting nonviable Democratic and Green candidates, while Democrats dropped candidates in an effort to splinter Republican votes.

The same reporting described an allegation that Democratic operatives recruited a candidate with a near-identical name to Republican incumbent Dan Sullivan. Mary Peltola denied knowledge or involvement. The allegation is the subject of state and federal scrutiny; it must not be treated as a finding of guilt.

On November 3, Fox News reported that the Justice Department's Alaska investigation had issued more than 120 subpoenas since the summer and that target and preservation letters had been sent to people connected to the alleged recruitment effort. The report also quoted the US Attorney saying investigators were making no assumption that a crime had been committed. Subpoenas and target letters are investigative steps, not convictions or proof of criminal conduct.

Separately, Axios identified more than 40 third-party candidates in competitive House and Senate races receiving more than $16.5 million in outside super PAC support. The analysis described groups with ties to both major parties and candidates who said they had not requested or known about the support. Some committees were formed shortly before the election, delaying donor disclosure until after Election Day.

FEC records for Fair Deal Alaska show why the underlying filings matter. Its regular report totals through September 30 do not necessarily capture all later 24-hour and 48-hour independent-expenditure filings. Those figures should be reconciled against the full filing record before comparing them with larger totals reported by media outlets.

The relevant question is not which party is more guilty. It is whether campaign finance, candidate recruitment, shared vendors, donor concealment and any prohibited coordination complied with the law. The same evidentiary standard must apply to every party.

7. Federal oversight: election protection must remain independent

Reuters reported in April 2026 that federal agencies had sought voter records, access to voting equipment and investigations into alleged fraud across multiple states. The investigation described requests and lawsuits involving at least eight states and reported that election officials raised legal and privacy concerns. Those actions should be evaluated against statutory authority, court rulings, data-protection obligations and the constitutional role of states in administering elections.

In October, ProPublica reported that political appointees at the Department of Homeland Security had asked CISA personnel to secretly acquire a voting machine, examine it and report findings to the White House. The account was based on two former administration officials with knowledge of the request. ProPublica reported that career staff objected and that the request was not carried out. This is a serious reported allegation about institutional process; it is not evidence that a voting machine was compromised or that vote totals were changed.

Federal election-security support also deserves examination. Axios reported on Election Day that state officials were taking a greater role in protecting their systems amid federal program and staffing changes. The question is whether states had sufficient access to threat intelligence, technical support and incident coordination during the 2026 cycle.

Protecting elections is a legitimate federal responsibility. It must be performed lawfully, transparently and independently of partisan interests. Domestic political actors and government officials must be subject to scrutiny just as foreign actors are.

8. Manifestos, strategy papers and declared intent

Published manifestos, policy programmes, strategy papers, leaked memoranda and public statements can be relevant evidence of what an organisation or political movement says it intends to do. They are not, by themselves, proof that an operational plan exists or was executed.

A rigorous investigation should catalogue each document by author, publication date, provenance and authenticity; distinguish public policy from internal operational instructions; and compare its language with budgets, appointments, contracts, communications, technical activity and actual decisions. A claim of coordination becomes stronger only when a documentary trail connects intent to actors, resources and conduct.

No specific manifesto is treated here as proof of an election operation without that chain of corroboration. The investigation should publish the documents it relies upon, not merely refer to them by insinuation.

9. The hypothesis—and what the evidence does not yet prove

The central hypothesis is that the 2026 election took place within a complex threat environment where domestic political operatives, opaque campaign-finance structures, foreign-linked cyber actors, criminal proxy networks and vulnerable digital services created opportunities for interference, disruption or confusion.

Some underlying capabilities and incidents are established. The possible links between them are not.

• Could there be infrastructure overlap? Compare source IPs, proxy exits, ASNs, domains, hosting providers, malware indicators and timestamps across incidents.
• Could political-finance disruption have obscured activity? Reconcile delayed FEC filings, late independent expenditures, donor disclosures and committee records.
• Could public-facing services have been targeted to undermine confidence? Examine whether incidents affected only public information layers or touched systems that transmit, reconcile or certify results.
• Could foreign actors have exploited domestic divisions? Test this through attribution-quality evidence, not nationality inferred from an IP address or similarity of tactics.
• Could domestic actors have exploited the same weaknesses? Investigate political vendors, intermediaries, candidate recruitment, disinformation and unlawful coordination without partisan exemptions.

There is also meaningful counter-evidence: Colorado officials said its back-end county reporting was unaffected; Washington's reported attack concerned a ballot-box map; Nextgov reported no foreign influence operation had been reported to EI-ISAC by 9:30 p.m. Eastern on Election Day. No evidence cited here establishes that ballots or certified vote totals were altered.

The correct conclusion is therefore not that one coordinated plot has been proved. It is that the public record contains enough serious, separate events and unanswered questions to justify a forensic review capable of testing whether any are connected.

10. A call for a nationwide, independent inquiry

I respectfully call on the US Executive Branch, the Department of Justice, the FBI, CISA, the Department of Homeland Security, the Federal Election Commission and relevant state authorities to support a comprehensive, bipartisan and independently supervised inquiry into the 2026 election threat environment.

1. Preserve and examine election-office, vendor, state and federal incident logs from the full 2026 election cycle.
2. Correlate source IPs, timestamps, ASNs, proxy classifications and technical indicators across jurisdictions, with appropriate privacy safeguards.
3. Investigate possible links between residential proxy networks, credential attacks, automated traffic and election-service disruptions.
4. Publish a technical account of the FEC incident, including access, alteration, exfiltration, filing delays and recovery findings.
5. Reconcile super PAC receipts, independent expenditures, late filings, donors, vendors and candidate-recruitment activity.
6. Investigate foreign-linked activity only where evidence supports a connection to US electoral institutions or election-related public confidence.
7. Review ENR vendor dependencies, county-to-state transfers, public results websites, reconciliation procedures and audit trails.
8. Examine domestic political interference and federal agency conduct under the same legal and evidentiary standards.
9. Publish an unclassified report that separates established facts, allegations, attribution confidence, unresolved questions and recommended safeguards.

The inquiry should not presume guilt, protect any party or validate a predetermined political narrative. It should follow the evidence wherever it leads—including evidence that disproves the hypothesis.

Sources and evidence record

The links below are the core source record for the claims in this report. Government advisories and filings are prioritised where available; independent reporting is identified as such. Sources may update their pages after publication.

1. US Election Assistance Commission — Election Night Reporting Systems (May 12, 2026).
2. KIRO 7 — Washington ballot-box map cyberattack (Nov. 3, 2026).
3. Colorado Public Radio — Election results website issues (Nov. 3, 2026).
4. Colorado Politics — Vendor-wide traffic surge (Nov. 3, 2026).
5. Nextgov/FCW — Election office reports failed attempts to hack online services (Nov. 3, 2026).
6. FBI FLASH — AVrecon and SocksEscort residential proxies (Mar. 12, 2026).
7. IRS / DOJ — SocksEscort disruption and scale (Mar. 12, 2026).
8. Europol — Operation against SocksEscort (Mar. 12, 2026).
9. US Department of Justice / FBI — QScan, QTRouter and QTFY (Aug. 26, 2026; updated Aug. 28).
10. FBI — Water and wastewater sector cyber alert (2026).
11. Reuters — FEC electronic filing system cyberattack (Oct. 28, 2026).
12. Federal Election Commission — Fair Deal Alaska filings (primary filing record).
13. The Washington Post — Both parties' tactics in Alaska's Senate race (Nov. 1, 2026).
14. Axios — Third-party candidates and outside super PAC support (Nov. 1, 2026).
15. Fox News — Report on subpoenas and the Alaska investigation (Nov. 3, 2026; attributed to sources familiar with the investigation).
16. Reuters — Federal efforts involving state election systems and voter records (Apr. 27, 2026).
17. ProPublica — Report on DHS appointees' request to acquire and examine a voting machine (Oct. 19, 2026).
18. Axios — State election security preparations and federal support (Nov. 3, 2026).
19. Shadowserver — Public cybersecurity statistics (methodological context; not election-specific logs).