Situation Room: A theft in Florida and decertification in Texas exemplify that compromises to election equipment security take many forms.
Resource Library: The Election Technology Education Fund aims to demystify election technology for both election officials and voters.
Planning Desk: Effective detection is the first and most critical step in incident response.
Equipment Security Requires a 360-Degree View
Election offices operate complex, distributed systems involving hardware, software, vendors, temporary workers, and real-time decision-making under pressure. Any one of those elements, if compromised, can create downstream consequences for election administration and public trust. Securing elections means accounting for the full 360-degree view.
Earlier this year, in Palm Beach County, Florida, a long-time poll worker, who was training for the March primary, wasarrested and charged with stealing computer equipment. After an electronic key to an e-pollbook kiosk was stolen, staff consulted the security video to identify a suspect. Though the key only provided access to a training database with no confidential data, the kiosk was taken out of service for that election.
In December 2024, the State of Texasdecertified electronic pollbooks after a software issuein the 2024 General Election, forcing counties to adapt quickly for their elections in May 2025. No malice was required to create a significant operational problem. When certified equipment loses that status, or a software update introduces unexpected behavior, the consequences ripple out to offices that had no role in creating the problem.
These incidents offer a useful reminder: Election equipment security is not a single problem with a single solution.
The Situation Room focuses on real security incidents and threats in the news relevant to election security. To review previous issues, see thenewsletter archive.
Election Technology Education Fund
Technology is woven into every aspect of a modern election, making it crucial for voters and election officials to understand how these systems function. TheElection Technology Education Fund(ETEF), a nonprofit organization established in January 2026, aims to demystify election technology by providing both voters and election professionals with plain language, fact-based information to build confidence in the election system.
ETEF offers a series of easily digestible one-pager guides that break down critical components of election technology, including:
This guide highlights the key principle that "machines help voters mark ballots and help officials count them, but paper is the official record."
It explains the processes for marking ballots and counting votes and corrects the misconception of widespread "electronic voting machines with no paper ballots."
This resource offers a concise explanation of the Common Data Format (CDF) and outlines the requirements for CDFs within federal voting system standards.
It emphasizes that CDFs "do not track voters and do not connect a voter’s identity to a ballot."
These resources serve a critical purpose. When an incident occurs or when questions arise about the security or functionality of election systems, such as those described in the Situation Room section of this issue, ETEF's plain-language guides can be quickly deployed to help set the record straight. These resources empower election officials to proactively communicate, manage crises, and reinforce the public's trust in the integrity of elections.
The Resource Library section of the newsletter spotlights election security resources. All highlighted resources are available online in the Resource Library.
Week E-26: Detection - Notice It Early, Name It Clearly
Detection is the hinge of every Incident Response Plan because you cannot respond to an incident you didn’t notice. It is the step most offices underinvest in, usually because it is often considered a technology problem rather than a team problem. In reality, it is both.
Strong detection relies on three things:
People in the right places who know what "unusual" looks like because they have learned the baseline;
A simple way to raise a hand and report the “unusual”; and
A reliable feed of outside information so that you learn about what happened to your neighbors in time to take action before it happens to you.
Three Kinds of Signals
Detection across an election office runs in three channels, and each one needs someone paying attention.
Technical signals come from: security tools (endpoint protection, firewalls, email filters); vendor and partner alerts (voter registration system, tabulation vendor, website host); and information-sharing bodies like the Election Security Exchange, your State Fusion Center, Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), and the Cybersecurity and Infrastructure Security Agency (CISA). Someone needs to be responsible for monitoring these daily, not just when something pings.
