What three Liferaft queries showed about polling-place security, protest activity and election conversation from late September through the week of the vote.
Midterm elections put security teams in an unusual position. Polling places are schools, churches, community centers and sometimes corporate facilities, and campaign events book commercial venues on short notice. The organizations that own and operate those spaces inherit some of the election’s risk for a few weeks, whether or not they have any role in politics.
The 2026 cycle added specific pressure. In mid-October, federal authorities investigated letters containing suspicious substances that were mailed to election and congressional offices in several states. The District of Columbia Board of Elections asked the National Guard to keep troops away from ballot drop boxes after a photo of soldiers standing beside one circulated online. In Washington state, Gov. Bob Ferguson deployed about 100 unarmed, plainclothes Guard members to help watch ballot drop boxes in seven counties after threats to officials. This brief looks at how that environment appeared in online conversation and what security practitioners can take from it.
In the filtered polling-place corpus, 58% of posts referenced at least one of six security themes. The most common was the presence of federal agents, National Guard troops or immigration officers at or near voting sites, which appeared in 29% of posts overall. Police at voting sites (16%) and armed individuals at voting sites (11%) followed. Before October 20, these three themes were even more prominent.
Three news events produced the clearest spikes in this part of the conversation, and each drew posts from hundreds of separate accounts:
Daily posts in the filtered Polling Station Violence corpus, Sep 28 to Nov 5, 2026 (Eastern time)
Source: Liferaft query export; filtered corpus of 8,869 posts. Nov 6 omitted (partial day).
These clusters were driven by news coverage and by advocacy from both parties, and the data does not establish whether any of these arrangements broke a rule. Their relevance for security teams is practical. A dispute over who may stand near a voting site creates a setting where filming, confrontation and complaints to officials are more likely, and it can attach to any location that hosts voting.
Fraud and cheating claims appeared in 16% of polling-place posts from September 28 to October 19 and in 25% from October 20 to November 2. This content included claims of noncitizen voting, accusations that election officials would cheat, and calls for supporters to watch polling places. Chart 2 shows how the mix of themes moved across the period.
Share of filtered polling-place posts touching each theme, by period. Posts can touch more than one theme.
Source: Liferaft query export; filtered corpus of 8,869 posts. Theme tags are keyword-based; see methodology.
The 1,802 posts containing fraud or cheating claims came from 1,215 accounts, and a single account posted 135 of them. On Election Day, another account posted the same block of text urging supporters to protect the vote against expected cheating 31 times. Repetition at this scale can make a claim look more widespread than it is, so these shares are best read alongside the number of accounts behind them.
November 3 was the busiest day in the polling-place corpus, with 1,271 posts, or 14% of the filtered total. On that day, 25% of posts referenced threats, hoaxes or evacuations at voting sites, up from under 2% in each earlier period.
Of the Election Day posts in that category, 87% concerned a bomb threat that forced the evacuation of an elementary school polling site in Toledo, Ohio. According to local reporting, county election officials brought voting machines outside so people could keep voting while the building was cleared. Other threats reported at polling places that day drew a handful of posts each.
The school in Toledo had no part in the election beyond lending its building, and that arrangement is typical. Most polling places are schools, libraries, churches and community centers that host voting for a day, or for the full early voting period, with little control over who comes to the door. A threat aimed at the election still lands on the institution that owns the building. Its staff are pulled into the evacuation, its facility is the one searched and closed, and its name is the one attached to the incident afterward.
Most of these sites have, at best, a guard. As more corporate campuses and offices are used as polling places, corporate security teams can find themselves in the same position, carrying election risk without any role in the election.
Election Day posts referencing threats, hoaxes, or evacuations at voting sites (n=312), 87% discussed the Ohio polling-place bomb threat vs. 13% discussing all other threats, hoaxes and evacuations
Source: Liferaft query export; filtered polling-place corpus, Nov 3, 2026 (Eastern time).
Online volume on Election Day measured how far a story traveled. It did not measure how many incidents occurred. A team relying on volume alerts would have seen the Toledo threat quickly and could easily have missed the others.
The same pattern held during early voting. Starting October 17, the first day of early voting, voters at the Desert Breeze Community Center vote center in Las Vegas were confronted by a woman with a bullhorn, nicknamed “Bullhorn Becky,” who shouted insults at people entering the polls. The ACLU of Nevada said one voter was struck with a megaphone and that police and election officials did little to stop the behavior. A Clark County judge, Joe Hardy, granted the ACLU a temporary restraining order ahead of the final day of early voting and later extended it through Election Day. The order required the county to treat the narrow pathway into the site as its entrance and barred electioneering within 100 feet.
Sustained harassment at one site, serious enough to require a court order, produced 68 posts in the polling-place corpus. Thirty of them came from a single account asking followers to identify the woman and tagging federal law enforcement. Most of the rest appeared on October 30 and 31, when news of the restraining order broke. Crowdsourced identification of this kind carries its own risk, because a misidentified person can become the target.
After Election Day, references to physical assault rose to 18% of posts from November 4 to 6. Most concerned video of Stephen Redic, 70, allegedly slapping an 18-year-old Turning Point Action volunteer outside a polling place in Laconia, New Hampshire. Police arrested Redic and charged him with assault.
The civil unrest query is broad by design, and it captured protest activity of all kinds. Within it, posts about disrupted campaign rallies accounted for 35% of the corpus (16,425 posts from 11,367 accounts), and they coincided with each of the largest daily spikes.
Daily posts in the Nationwide Civil Unrest corpus, split by whether they reference a disrupted campaign rally
Source: Liferaft query export, 46,879 posts. Peaks labeled with the rally location most referenced that day.
About a third (32%) of rally-disruption posts described physical confrontation, including attendees striking or tackling protesters. One in ten framed protesters as paid or planted. Rally-related posts fell to 64 on Election Day as campaign travel ended, so this risk was concentrated in the five weeks before the vote.
Outside of rallies, election terms appeared in 17% of the civil unrest corpus. The larger share of protest conversation concerned the Israel, Gaza and Iran conflicts (29%), immigration enforcement (10%), campus protests (9%), labor actions (6%) and data center projects (5%). These topics overlap, and a single post can touch several.
Collection. Data comes from three Liferaft query exports pulled on November 6, 2026, covering X, Facebook, Bluesky, Instagram, Threads, TikTok, Reddit, Telegram, chan boards and alternative social sources. Timestamps were converted to U.S. Eastern time. November 6 is a partial day in all exports.
Themes. Theme shares come from keyword and proximity matching, checked against samples of posts. They indicate what posts referenced, not what posters believed or whether claims were true. A post can carry more than one theme. Rally-disruption counts are conservative, because posts describing a rally without the word rally were not counted.
Scope. Figures describe the analyzed corpus only. They are not a measure of public opinion, of how many incidents occurred offline, or of how common any view is among voters. Volume reflects how widely a story was shared. Reposts and duplicate text are included; 86% of polling-place posts had unique text. Platform risk and sentiment scores were not used.
Context sources. Incident details not drawn from the data come from reporting by the Associated Press, NBC News, NPR, Reuters, Axios, Task & Purpose, the Washington Sun, Bridge Michigan, NBC Boston, WTVG, KTNV, KSNV and FOX5 Las Vegas.
Liferaft is a threat intelligence and OSINT platform that helps security teams find, assess and act on threats in online data. Visit our product page to learn more about the platform.