Why Regulating AI in Elections Hasn’t Worked

In the United States, millions of Americans will go to the polls this fall. We’re hurtling toward the midterm elections (opens in new tab), and the digital battleground looks entirely different than it did just two years ago.

More than 204 million Americans (opens in new tab) are registered to vote, according to USAFacts, and primary turnout (opens in new tab) currently sits around 22.8%. With all 435 U.S. House seats and 35 U.S. Senate seats up for grabs, the stakes are gigantic.

If you look at the historical trajectory of election security, the primary anxiety used to center around physical infrastructure. Security leaders stayed awake at night worrying about state-sponsored hackers breaching voter registration databases or finding zero-day exploits in electronic voting machines.

Today, attackers have realized that hacking a highly secured voting machine is expensive, difficult, and risky. Hacking the voter’s perception, however, is incredibly cheap and highly scalable.

Voter manipulation has shifted from network breaches to mass-scale social engineering. Threat actors are leveraging generative AI to clone candidate voices, spoof political action committees (PACs), and flood social feeds with fabricated narratives.

That shift creates a new security problem. Campaigns have to defend their own networks and the candidate’s identity, their communications, their fundraising infrastructure, and the public’s ability to distinguish authentic information from impersonation. That’s not easy.

The attack surface now stretches across social platforms, domains, messaging apps, search engines, AI-generated media, and the broader open web. And because attackers can create and distribute convincing content in minutes, many of the defenses campaigns have traditionally relied on simply weren’t built for the speed or scale of today’s threats.

Campaign defenses are struggling to keep up

Lawmakers have responded to the rise of AI-generated political content. More than 30 states have passed legislation regulating the use of artificial intelligence in elections, including disclosure requirements, rules around synthetic political ads, and restrictions on deceptive deepfakes.

Those measures can play an important role in establishing accountability and deterrence. But they are only one layer of the defense. Security teams responsible for protecting campaigns in real time face a much more immediate challenge: an AI-enabled influence operation can be created, distributed, and amplified long before a legal, communications, or platform response catches up.

Look at the lifecycle of a modern campaign interference campaign:

1. Drop: A threat actor uses an open-source large language model (LLM) and a voice-cloning tool to generate a hyper-realistic audio clip of a candidate admitting to a controversial crime.
2. Distribution: They use automated bot networks to blast the audio clip across TikTok, X, and Meta simultaneously.
3. Amplification: Because modern society has collapsed news, entertainment, and personal communication into a single digital feed, the clip goes viral instantly. Algorithms prioritize high-engagement outrage, pushing it to millions of screens.
4. Damage: Within two hours, major news networks are forced to cover the "scandal," shifting the entire political narrative days before voters head to the polls.

This creates a mismatch in velocity. A campaign may need to determine whether the content is authentic, coordinate with legal and communications teams, report it to platforms, and communicate with the public. Meanwhile, the attacker only needs a few minutes and a handful of burner accounts to get the content moving.

The challenge becomes even greater when the attacker operates outside the jurisdiction where election rules apply. A financially motivated cyber group or foreign influence operation has little reason to care about a state requirement governing AI-generated political content.

That doesn’t make regulation irrelevant. But it does mean that campaign security teams can’t treat regulation, manual platform reporting, or after-the-fact corrections as their primary line of defense. They need technical capabilities that operate at the same speed as the threat.

Inside political impersonation attacks

Campaign interference is a lucrative financial hustle.

When we talk about campaign manipulation in 2026, we’re talking about advanced brand impersonation. A political campaign operates just like a Fortune 500 enterprise. They have a brand identity, highly visible executives (the candidates), a sprawling supply chain of vendors, and a massive base of digital consumers (the voters and donors).

Threat actors hijack that political brand to execute devastating social engineering attacks. Here are vectors they weaponize:

1. Fake PAC hustle

Attackers register lookalike domains that closely mirror legitimate campaign sites, like registering vote-smith2026.com instead of votesmith2026.com. They spin up pixel-perfect donation portals and run targeted ads on social media, siphoning millions of dollars in campaign contributions directly into offshore cryptocurrency wallets.

2. Candidate cloning

Using AI, attackers generate synthetic media that flawlessly mimics a candidate's likeness. They spin up spoofed social media accounts using the candidate's exact headshot and biography. These accounts post inflammatory, alienating statements designed to suppress voter turnout among the candidate's core demographic.

3. ‘October surprise’ injection

Attackers understand that trust is a fragile commodity, so they impersonate trusted journalists or authoritative advocacy groups, launching spoofed websites that ‘leak’ fabricated internal campaign documents or fake scandal reports right before Election Day (opens in new tab). They exploit the public's inherent trust in journalistic institutions to launder their misinformation.

Accountability shift: platforms and providers

Defending against these attacks requires looking beyond the campaign itself and understanding who controls the flow of digital trust.

The ecosystem is split between two entities: the platforms that distribute the content, and the providers that supply it.

• Gatekeepers (platforms): Social media networks control distribution, amplification, and discovery. Their algorithms dictate what the electorate sees.
• Voices (providers): Campaigns, journalists, and advocacy groups supply the actual narratives. Voters rely on their established credibility and authority to interpret the noise.

This relationship is powerful, but it’s also highly fragile. When either layer is compromised, the downstream impact compounds instantly.

If an attacker successfully impersonates a campaign manager (the voice) and uses a major social network (the gatekeeper) to distribute a fake concession statement on election night, the system breaks down. The attacker has weaponized the campaign's credibility and the platform's reach at the same time.

Because both entities are vulnerable to this exact dynamic, security leaders at both platforms and political organizations share an escalating, intertwined responsibility to secure the narrative.

A new security playbook for 2026

Security can’t prevent every piece of synthetic content from being created. The more practical objective is to identify the infrastructure and impersonation campaigns behind these attacks early enough to disrupt them before they reach meaningful scale.

That requires shifting from reactive content moderation toward proactive threat disruption. Security leaders should treat election interference more like enterprise fraud: identify the infrastructure being staged, understand how different signals connect, and dismantle the operation before the attack reaches its intended audience.

Additionally, campaign teams should lean on valuable resources like Defending Digital Campaigns (DDC) (opens in new tab), which connects eligible political organizations with cybersecurity technology, resources, and expertise designed specifically for the unique threats they face.

Elevate authenticity from assumption to practice

Political campaigns can’t assume the public knows which accounts are real. Authenticity needs to be actively managed.

Campaigns should maintain strict, highly publicized authoritative sources of truth by:

• Publishing verifiable provenance signals for original content
• Maintaining rapid-response workflows to debunk synthetic media immediately.

When voters know exactly where to look for the truth, lookalike accounts lose their leverage.

And education matters too. Doppel and Defending Digital Campaigns recently launched a free voter safety course designed to help voters recognize and respond to election-related scams, impersonation, deepfakes, and other forms of digital deception.

Dismantle the infrastructure, not just the post

Playing whack-a-mole with viral social media posts is a losing strategy. You have to burn down the attacker's staging ground.

Before a threat actor can launch a fake donation portal or a spoofed news site, they have to register a domain and secure hosting. Security teams should continuously monitor global domain registrars for typosquatted variations of the candidate's name, the campaign slogan, or affiliated PACs.

When you detect malicious infrastructure, neutralize it at the DNS level before the first fake donation link is shared.

Execute machine-speed takedowns

You can’t fight AI with human analysts. If you rely on a manual ticketing queue to flag a deepfake or report a spoofed profile, you’re granting the adversary infinite dwell time.

Deploy native, agentic AI that can identify impersonation across all channels, including open web, social platforms, and the dark web. These agents should be empowered to execute automated API takedowns, interfacing directly with hosting providers and social networks to strip the malicious content from the internet in milliseconds.

Securing the ultimate battleground

Election and campaign security has permanently evolved, and it’s no longer just about protecting the physical systems that tally the votes.

The bigger challenge for 2026 is that attackers can now target the information environment surrounding an election with unprecedented speed and scale. A cloned candidate voice, spoofed campaign account, fake PAC, or lookalike donation domain can reach voters before traditional security, legal, and communications processes have time to react.

The real battleground is trust.

To defend that trust, political campaigns, advocacy groups, and communication platforms need to recognize that proactive impersonation protection is a baseline requirement for democratic integrity.

By aggressively monitoring external infrastructure, authenticating legitimate communication channels, and utilizing agentic AI to execute automated takedowns, security leaders can stop playing defense against viral headlines. You can dismantle the adversary’s campaign before it ever reaches the electorate's feed.

Are you ready to protect your political brand and secure your digital perimeter? Get a demo to see how Doppel’s agentic AI executes machine-speed takedowns against lookalike domains, fake profiles, and advanced impersonation threats.