Election infrastructure incident

The scenario

A voter-roll export, e-pollbook compromise, or election-night website defacement implicates your municipality, even though state or provincial authorities run the underlying election.

Who this is for: Town clerk (often the local election official), state/provincial election director, CAO.

First steps

1. 1. Notify the state or provincial election director within the hour

   First hour

   They own the response. Your job is to hand off facts and follow their public-communication lead. Do not freelance statements.

2. 2. Notify CISA EI-ISAC (US) or Elections Canada / Elections [Province]

   First hour

   EI-ISAC is the elections-specific MS-ISAC arm. Membership is free for election offices and they are calm, fast, and discrete.

3. 3. Preserve the e-pollbook or voter-roll system state

   First day

   Do not factory-reset devices. Image the device or coordinate with EI-ISAC to do so.

4. 4. Confirm whether the website was defaced or the results were altered

   First day

   These are very different incidents. A defaced front page is bad PR; altered results is a constitutional matter.

Continuity of service

• Election day: paper backup pollbooks are required in most jurisdictions — confirm they are at the polling station.
• Results reporting: most jurisdictions have a paper canvass of record that overrides the website.

Communication

Regulator hand-off

• US: state election director (primary), EI-ISAC, CISA, FBI field office.
• Canada: provincial chief electoral officer (primary), Elections Canada if a concurrent federal election, CCCS.

FAQ