[null, null, null, null, null, null, {"document_url": "https://www.belfercenter.org/publication/election-cyber-incident-communications-coordination-guide", "unformatted_src": "/sites/default/files/inline-images/Screen%20Shot%202018-02-06%20at%205.38.47%20PM.png", "src": "https://www.belfercenter.org/sites/default/files/inline-images/Screen%20Shot%202018-02-06%20at%205.38.47%20PM.png", "formatted_filename": "Screen Shot at", "alt_text": "stakeholder"}, null, {"document_url": "https://www.belfercenter.org/publication/election-cyber-incident-communications-coordination-guide", "unformatted_src": "/sites/default/files/inline-images/cordinationprocess.jpg", "src": "https://www.belfercenter.org/sites/default/files/inline-images/cordinationprocess.jpg", "formatted_filename": "cordinationprocess", "alt_text": "lines of coordination"}, null, {"document_url": "https://www.belfercenter.org/publication/election-cyber-incident-communications-coordination-guide", "unformatted_src": "/sites/default/files/inline-images/drafting.jpg", "src": "https://www.belfercenter.org/sites/default/files/inline-images/drafting.jpg", "formatted_filename": "drafting", "alt_text": "drafting and coordination"}, null, {"document_url": "https://www.belfercenter.org/publication/election-cyber-incident-communications-coordination-guide", "unformatted_src": "/sites/default/files/inline-images/distribution.jpg", "src": "https://www.belfercenter.org/sites/default/files/inline-images/distribution.jpg", "formatted_filename": "distribution", "alt_text": "distro process"}, null, null, null, null, null, null, null]
Collage: Adobe Stock / AP

Shaping Disruptive Technological Change for Public Good Bernard Gagnon / CC BY-SA 3.0

The Collapse of Civilizations AP Photo/Matt Dunham

The Rise of Authoritarian Capitalism Not for the Faint of Heart



Special Initiatives AP Photo/Charles Dharapak


A view of the podiums during a news conference in the Rose Garden at the White House, Monday, April 2, 2012.

Election Cyber Incident Communications Coordination Guide


For the Election Infrastructure Government Coordinating Council

Defending Digital Democracy Project: About Us

There are two groups on the frontlines of defending democracy: (1) political campaigns, which enable citizens to pursue elected office; and (2) election officials, who ensure the election process is free and fair.


The Election Cyber Incident Communications Coordination Guide [PDF]

Last year, we set out to provide campaign and election professionals with practical guides to the most applicable cybersecurity best practices in advance of the 2018 midterm elections. In November 2017, we released “The Campaign Cybersecurity Playbook” for campaign professionals.


Authors and Contributors
How to Use this Communications Guide

Executive Summary and Purpose

Strategy, Mission, and Objectives

Establishing a Cyber Education Baseline

Cyber Crisis Communications Best Practices
Planning Ahead
Communications Response

Communications Process
Phase 1: Baseline Communications Activities
Phase 2: Communications Planning, Activation, and Coordination
Phase 3: Message/Document Drafting, Coordination, and Distribution
Phase 4: Evaluation and Feedback

Communications Coordination & Response Checklist


D3P is a bipartisan team of cybersecurity and policy experts from the public and private sectors. To better understand the cyber threat and other challenges that election administrators face, our team spent four months interviewing state officials about their communications practices and how they would or would not apply these practices in a cyber incident. We spoke with state and local election officials, as well as key national-level players and members of the Election Infrastructure Government Coordinating Council (EI-GCC).

These interviews exposed the range of challenges election officials confront in the cyber domain. One of the most significant needs we encountered was the ability to communicate consistently across states in the event of a major election cyber incident, in order to maintain public trust.

This Guide is primarily intended for use by the EI-GCC to coordinate multiple voices (and multiple facts) in an election cyber incident that crosses traditional jurisdictions. We are releasing the Guide publicly, because a range of officials may be interested in learning more about how state and local leaders can, and should, coordinate their communications in the event of this type of cyber incident. We hope this Guide becomes a starting point for the EI-GCC to establish its role as a central communications node in the event of an election cyber incident.

Finally, we would like to thank the election officials around the country for whom we wrote this guide You are the frontline defenders of democracy. We hope this effort helps make that tremendous responsibility a little easier.

The D3P Team

Authors & Contributors

This project was made possible by dozens of people who generously volunteered their time. Special thanks are due to Siobhan Gorman for leading the project and who, in addition to Matt Chandler, Meredith Davis Tavera, and Chris Farley, wrote this Coordination Guide.

Senior Advisory Group
Eric Rosenbach, Co-Director, Belfer Center; Director, Defending Digital Democracy Project
Robby Mook, Co-Director, D3P
Matt Rhoades, Co-Director, D3P
Heather Adkins, Dir. of Information Security and Privacy, Google
Dmitri Alperovitch, Co-Founder and CTO, CrowdStrike
Siobhan Gorman, Director, Brunswick Group
Yasmin Green, Head of Research & Development, Jigsaw (Alphabet)
Stuart Holliday, CEO, Meridian International Center
Kent Lucken, Managing Director, Citibank
Debora Plunkett, former Director of Information Assurance, National Security Agency
Colin Reed, Senior Vice President, Definers Public Affairs
Suzanne Spaulding, Senior Advisor for Homeland Security, Center for Strategic and International Studies
Alex Stamos, Chief Security Officer, Facebook

Lori Augino, Director of Elections, WA Office of the Sec. of State
Matt Chandler, Partner, Frontier Solutions
Caitlin Conley, Executive Director, D3P
Amy Cohen, Executive Director, National Association of State Election Directors
Meredith Davis Tavera, D3P, Harvard Kennedy School
David Forsey, Policy Analyst,  National Governors Association
Shannon Cortez, Deputy Director of Elections, WA Office of the Secretary of State
Chris Farley, Associate, Albright Stonebridge Group
Karen Ejiofor, Staff Assistant, Belfer Center
Eben Kaplan, Principal Consultant, CrowdStrike
Jane Khodos, Senior Director, Comms. and Content, FS-ISAC
Matthew Masterson, Commissioner, Election Assistance Commission
Jeff McLeod, Division Director for Homeland Security and Public Safety, National Governors Association
Michelle Tassinari, Director/Legal Counsel, Elections Division, Office of the Secretary of the Commonwealth of MA


The D3P team would like to especially thank Heather Adkins of Google, Yasmin Green of Jigsaw, theHewlett Foundation, the Democracy Fund, and the Belfer Family; without whom this plan would not have been possible. Additionally, we would like to thank the following organizations and offices for sharing their time with us through conversations, simulation participation, or field visits. Your perspectives were critical in shaping our approach to this document.

Department of Homeland Security (DHS)
National Association of State Election Directors (NASED)
National Association of Secretaries of State (NASS)
National Governors Association (NGA)
National Guard Bureau (NGB)

Election Officials from the Following States and Jurisdictions:


This communications guide includes best practices and guidelines to help the Election Infrastructre Government Coordinating Council  (EI-GCC) quickly coordinate the response to an election-related cyber incident that affects more than one state during the early days of the incident. While every cybersecurity incident is unique, this document provides a foundation on which the EI-GCC can build a response that addresses the incident with the goal of maintaining confidence in the election system.

This Guide should be owned by the communications director, or a similar position, at the EI-GCC and be updated at least annually.

Key topics include:


What constitutes a “cyber incident” in elections can range from theft of voter registration data to disruption or manipulation of the vote tally. This Guide is designed to help coordinate and align communications across jurisdictional boundaries in an election-related cybersecurity incident that involves more than one state. Its primary purpose is to maintain (or regain) public confidence in the face of such an incident.

This Guide is written to help the Election Infrastructure Government Coordinating Council (EI-GCC) assist state and local election officials, who will need to communicate across jurisdictions if an election-related cyber event has impacts beyond a single state. While every jurisdiction should have its own plan to respond to a cyber incident, many incidents will have implications beyond state boundaries. It is critical to coordinate the response from the outset, so public comments confidently convey that the issue is being addressed and maintain public trust in election systems across the country.

We recommend the creation of a communications coordination structure within the EI-GCC, including a communications director, or similar role, who would be a key spokesperson in a cyber crisis.

A multistate cyber incident could take many forms. It could be a series of incidents that collectively have a broader impact. It could be one or a few incidents that, because of their strategic significance or other factors, have an impact beyond state boundaries, or receive outsized attention from national media outlets. This could even be a false rumor that requires a coordinated effort to stamp it out.

This Guide provides:

Additional communications response materials, including a sample escalation process and scenario-planning materials, are available to election officials and can be obtained upon request from the National Association of Secretaries of State, the National Association of State Election Directors, or the U.S. Election Assistance Commission.


The potential for cyberattacks on our elections systems is an unfortunate reality of our time. Election officials should recognize, and plan for, a possible incident. The primary objective of this communications guide is to enable the EI-GCC to help election officials maintain public confidence in the integrity of the U.S. election system in the event of cyber incidents both locally and crossing state boundaries.

Election officials from both parties and at all levels of government agree that there is a shared national interest in preserving the public trust in our election system.

Maintaining public trust is most effectively accomplished when election officials—across parties and jurisdictions—speak with one coordinated voice. If federal officials are contradicting state leaders, as occurred in 2016, the public is left confused and it can become all the more difficult to maintain confidence in the election process. Likewise, if federal, state, or local officials are contradicting one another, it is counterproductive and confusing to the public. For these reasons, EI-GCC will play a crucial role in coordinating the response.

All public statements should demonstrate the incident is being handled competently. Any specifics that are provided should be limited only to those that will not change. The scope of the incident, for example, is likely to shift and shouldn’t be discussed publicly at the outset. Modifying your story can undermine confidence in the management of the incident and the election system itself.

To institutionalize a means to maintain public trust, the communications response strategy underlying this Guide coordinates communications messages and delivery among election officials in a multistate cyber incident to ensure consistency and accuracy of public information. To enable a unified response, we provide communications best practices and coordination processes.

Elections are governed at the state and local level, and there is a national interest in maintaining the integrity of, and confidence in, our elections system. So it is important to have a process that will enable officials from all levels of government to: obtain and analyze the information; decide who will speak about the national implications of the incident; and provide information and communications to all elections officials, so they can communicate accurately, dispel rumors, and reinforce coordinated messages.

Beyond the coordinated multistate process outlined in this Guide, election officials at all levels of government should take measures to prepare for a cyber incident.

Among the steps you can take immediately are:

It is important to update and exercise communications response plans frequently—at least every year—to familiarize new players with the process and ensure you apply lessons learned from past experiences and exercises.


The public needs to understand the steps state elections officials are taking to counter cyber threats, as well as how difficult it is to execute a cyberattack that will disrupt an election outcome. If the public, and the media, understand the “new-normal,” baseline activity of cyber threats targeting elections, they will be less likely to worry unnecessarily about news of small-scale election-related cyber incidents. If you don’t have to spend considerable time allaying concerns over inconsequential incidents, you can focus your attention on the consequential ones.

The main point to make is that cyberattacks are now an issue all election officials must contend with, and the states have taken, and continue to take, steps to mitigate those threats. However, not every attempt is successful, and even successful ones are very unlikely to impact the outcome of an election.

Communications in a cyber crisis are most effective when the public has a baseline understanding of:

We recommend that the EI-GCC consider taking on some of this public education role, which would address issues that extend across the states. The council is in a strong position to draw on data from across the country and across levels of government about both threats and actions being taken to enhance the cyber defenses of election systems. For this reason, we suggest that it consider publishing an annual report on the state of election cybersecurity.

The EI-GCC, perhaps in concert with the relevant associations and Information Sharing and Analysis Centers, could provide a regular cadence of cyber threat information, so the public understands how frequently attempts are made by a range of cyber threat actors to target election infrastructure. Making this information common knowledge will mitigate the tendency to treat every reported attempted attack as a reason to question the election system.

The type of information you may want to share could include statements such as: “Based on threat information from the Department of Homeland Security and the Federal Bureau of Investigation (or state/local law enforcement), we are taking the following steps to address and mitigate these threats.” If appropriate, this effort could take the form of regular background briefings for the media, as well as online materials and public panels or other educational events for other key stakeholders. The EI-GCC could also consider a joint public panel or forum with representatives of both political parties to discuss measures states are taking to mitigate cyberattacks.

The EI-GCC should also consider sharing limited, aggregate information on successful attacks once they have been addressed, which would establish the EI-GCC as a valuable resource for this type of information.

You should couple the cyber threat data with information on the actions states and localities are taking to strengthen the cyber defenses of election systems. This information should be specific enough to be credible while not being so detailed as to undermine your defenses. Work closely with information security and legal experts to strike the right balance.

We discuss how to establish a communications baseline in more detail in the section on communications process.


Election-related incidents fall broadly into five categories:

The top priority in a cyber crisis will be to maintain public trust. The most effective way to achieve that goal is to respond confidently and quickly. To do this, the EI-GCC will need to prepare, train for, and test its response ahead of time—especially because it is a new organization.



Best Practices

Guidelines for Communicating with the Public

Best Practices for Countering Misinformation


Maintaining a coordinated process is critical to effective and efficient communications planning and response to a cyber-related incident. For an incident affecting multiple states, this coordinated communications process outlines:

In this communications process, we assume that information and messaging coordination functions will be performed by cross-jurisdictional organizations that have played a similar role in past crises. Further, we recommend that new coordinating functions and mechanisms be created to execute information-sharing and communications.

We recommend that the EI-GCC—with support from other interested parties, such as the National Association of Secretaries of State (NASS), International Association of Government Officials (IGO), the U.S. Election Assistance Commission (EAC), the National Association of State Election Directors (NASED), and the National Governors Association (NGA)—establish a Cybersecurity Communications Response Group (CCRG).

This newly formed entity will provide the EI-GCC and its stakeholders with a communications coordination function that currently does not exist, allowing for collaborative, coordinated public message planning and execution if and when it is needed in the future.


On a regular basis, the CCRG will provide updates to the public and other key stakeholders on current cyber threats and actions being taken to counter them. These baseline updates, whether part of a regular cadence or spurred by suspected nefarious activity, should be developed and coordinated with the expectation that they will be made public. Audiences and stakeholders are catalogued below with recommendations for actions that can be taken now to establish or maintain relationships with them.

Communicating with these groups on a regular basis, before something happens, is key to setting a baseline with critical audiences so that there is a level of understanding around the issue that allows mutual alignment on escalation and coordinated response. In order to provide this ongoing education, we recommend communicating early and often, in addition to when moments of interest (i.e., elections) arise. This baseline work could take the form of behind-the-scenes demonstrations and briefings for your audiences.

Stakeholders may include: 
Cyber-related incidents rely on evolving investigations, making their scope and impact difficult to understand, particularly at the outset. This can make communications decision-making, coordination, and messaging even more important for reducing confusion.

Some incidents may be discovered as an attack or breach occurs, while most tend to be discovered after the fact—often after significant time has passed. The key to an effective response is not just coordination but also knowing with whom to coordinate. In any response, there are likely to be multiple voices speaking publicly, at both the national or field level.

In this phase, we assume an anomalous event has been identified, which activates a communications coordination scheme. It may be detected by a range of entities, such as a security researcher, state/local election official, law enforcement, or media.

When an incident occurs, many representatives from a variety of organizations will become involved. The section below outlines resources, coordination mechanisms, lines of coordination, and a checklist to be used in response to, or in advance of, a cyber-related incident.

Assembling Key Players

Note: The U.S. Federal Government’s National Response Framework outlines public information as an Emergency Support Function (ESF) and includes a framework for public information coordination and action around incidents that involve, or may involve, federal response. This process aligns with the ESF #15 Standard Operating Procedure.

CCRG Roles & Responsibilities: The CCRG should establish the following roles for responding to a multistate cyber incident. These individual roles can be filled by specific people from a variety of interested parties, which may include, but are not limited to, NASS, NASED, IGO, EAC, and NGA.

Please note that as the EI-GCC builds on this Guide, updates should include a table with these roles assigned to individuals, along with their contact information.

Activation of the CCRG: The CCRG, while regularly communicating in Phase 1 during baseline operations, should plan for and exercise the activation of the CCRG in a crisis. Activation of the CCRG would be at the discretion of the Communications Director, with input from operational leads in response to a verified or potential incident. Additional information on the escalation process is in the Appendix available to election officials and can be obtained upon request from NASS, NASED, or the EAC.

Generally speaking, this activation would be executed via a blast email to CCRG members with shareable background information on the incident, direction on the use of coordination mechanisms (discussed below), and next steps. For example, on discovery of a potential incident, the Communications Director would activate the CCRG by hosting an Election Sector Incident Communications Coordination Line call regarding the incident, thereby beginning the communications coordination process.

Election Sector Incident Communications Coordination Line (ESICCL): This bridge line is a standing conference call line that can be created to use for coordination before, during, or after a cyber-related incident. The CCRG will maintain a list of relevant contacts from federal, state, and local election offices in order to invite relevant parties to a call, should it be necessary. This resource does not currently exist and it would be incumbent upon the CCRG to coordinate the creation of this standing line at the outset.

Election Sector Information Center (ESIC): In the event of a multistate event, the CCRG should create a specific Information Center where communications activity is planned, coordinated, and executed real-time. This should include all the roles above and can reside in one physical location or it could be done virtually through online means. An ESIC would be the functional nerve center of all communications-related activity.

Coordination Mechanisms

Using the Election Sector Incident Communications Coordination Line (ESICCL)

Standing up the ESIC

Current Coordination Processes

Should there be current coordination processes that are effective in sharing information, such as regular calls or email listservs, continue to use them–particularly prior to, or during the beginning phases of, activation. However, the scope and volume of an incident may make more direct communications, such as via the ESICCL or ESIC, more useful. 
Message/Document Drafting and Coordination

It is best to have some communications materials ahead of time; however, every incident is different and depends on a range of factors, so communicators will oftentimes have to adapt on the fly.

Messaging will need to be adapted, drafted, coordinated, and distributed quickly in order to effectively respond. In addition to the coordination resources, mechanisms, and processes described above, the diagram below shows how that loop may work practically, in and among the various parties who will be speaking publicly. The CCRG staff will not necessarily retain authority to approve messages emanating from affected communities’ communications staffs, nor vice versa; however, the CCRG staff can provide message direction when needed or warranted. In addition, key inputs should be sought from Congressional/Inter-governmental Affairs and Law Enforcement Liaisons, and approval authority can be retained by those communicators with whom these liaisons work at their home agencies or organizations.


Distribution of approved communications materials to the public and other stakeholders should leverage, and mirror, existing processes to the degree possible. The CCRG, by virtue of its makeup, with communications professionals from a variety of relevant organizations, should coordinate the messaging, but largely leave distribution to the organizational members.

A sample distribution process is illustrated below: 
Incorporating both real-time evaluation and feedback, as well as post-incident after-action reviews into your response is critical to both the response you are currently managing, and capturing lessons learned for the future.

Real-Time Evaluation

While capabilities and resources may differ greatly among affected communities, the CCRG could augment these by providing services that can assist the holistic communications response, including:

After-Action Review and Report

Once an incident has concluded, it is important to review communications-related activities, discuss what worked and didn’t work, and document those lessons to be incorporated into both steady-state and crisis planning.

Many of the coordination resources and mechanisms described above can be adapted for this purpose, for example the ESICCL call. The after-action process should analyze the incident from start to finish, examining the Plan-Prepare-Respond-Recover communications lifecycle of that incident.

Your after-action report should include:

This after-action process will assist in building your communications response capability and coordination in a resilient process that can be more effectively utilized when facing future incidents.


This checklist will help guide actions prior to, and through, the first several days of a multi-state election-related cyber incident.

There are five lists:

1. Before a cyber crisis

2. Before a cyber crisis becomes public

3. Multistate Election-Related Cyber Incident Assessment & Activation

4. Coordination/Communications Outreach

5. Products

Before a cyber crisis

Create a list of terms with common nomenclature for use by all stakeholders.

Set an internal communication plan with elections staff.  (How often, when, and where will all staff meet? Information must travel up and down the chain of command with clear boundaries for disseminating information and interfacing with the public/media.)

Ensure that all stakeholders can be reached in a crisis without access to networks or smart phones.

Craft communications materials that can be used in a potential cyber incident. (For examples, elections officials may request sample materials from NASS, NASED, or the EAC.)

Ensure that staff understand their role in a cyber incident. For those who do not have a specific role, ensure they understand why their work matters to the outside world and how they can continue doing their jobs while designated managers handle the cyber incident.

Ensure that communications plans can be accessed and are regularly updated.

Before a cyber crisis becomes public

Obtain technical briefing. (Assess and verify all information.)

Decide whether to activate CCRG.

Decide whether website can remain online. If you must disable it, launch a microsite (hosted on a different network) in its place.

If email is potentially compromised, use an outside communications channel.

Consult authorities, if needed.

Meet internally in war room; set internal communication schedule.

Determine CCRG roles and responsibilities, if you have not done so already.

Assess stakeholders.

Determine broad communications strategy.

Prepare holding statement.

Develop communications plan.

Establish plan for traditional and social media monitoring.

Establish media response protocol.

Notify stakeholders (See list on reverse page), if appropriate, and galvanize support.

Multistate Election-Related Cyber Incident Assessment and Activation

Notification to, and activation by CRCG, of a cyber-related incident or threat.

Situation Assessment/Escalation.

High-Intensity Incident: Cyber-related incident that triggers reporting obligations, or one that is highly visible requiring response.

Medium-Intensity Incident: Cyber-related incident resulting in the loss or compromise of the data or systems, but no formal reporting obligations are triggered. There may be some awareness of the incident, however, spurring proactive communication.

Low-Intensity Incident: Cyber-related incident resulting in minor disruptions that may not be visible to public.

If Major or Moderate, Media Operations Director and Communication Plans Director identified by Communications Director.

Additional Relevant Personnel identified.

Contact information for Relevant Personnel distributed.

CRCG designates spokesperson, if applicable.

Depending on assessment of situation, key messages determined based on specific scenario.

Coordination/Communications Outreach

Communications Director activates ESICCL call.

Incident Overview.

Affected Communities Communications Representative Update.

Initial Response Communications Plan.

Designate spokesperson based on type of incident, geography(ies) affected, and scope. In a Major Incident, the spokesperson role may include several people including a EI-GCC representative as well as an Affected Community spokesperson as well to share information at both a field and national level. In a Minor Incident, a single spokesperson may suffice, i.e. an Affected Community spokesperson.

Prep designated spokesperson for media engagement. This includes review of relevant facts and messaging as well as a peer review session, known as a “murder-board.”

Congressional/Inter-governmental Affairs Update.

Congressional/Inter-governmental Affairs activity and plans.

Law Enforcement Liaison Update.

Law Enforcement Liaison activity and plans.

Messaging Coordination outlined by Communications Director.

Battle Rhythm (Daily Schedule).

Conclusion & Next Steps.

Communications Distribution & Rollout.

ESIC activation, if necessary.


Staffing Plan with updates for Communications Director.


Staffing Matrix and Organization Chart.

Communications Plan.


Press Releases.

Traditional and Social Media Monitoring Reports.

Regular/Daily update on response activities.

Blog and Social Listening Updates.

Talking Points.

Website updates.

Congressional/Inter-governmental Advisories, fact sheets, operations reports and briefing materials.

Daily Communication Summary to include next day activity plans.


As we head into the next election cycle, we hope that this Guide provides additional tools to help the EI-GCC, and by extension election officials across the country, prepare for, and manage, this emerging and evolving cyber risk. As with all communications plans, we recommend that this one be regularly updated by the EI-GCC, as the council further develops and defines its role.

More information is available on different types of communications materials for responding to a cyber incident. Election officials seeking examples of these additional materials can request the communications materials appendix to this document from NASS, NASED, or the EAC.


For more information on this publication: Please contact the Belfer Communications Office
For Academic Citation: “Election Cyber Incident Communications Coordination Guide.” Belfer Center for Science and International Affairs, Harvard Kennedy School, February 2018. Robby Mook Matt Rhoades Eric Rosenbach



In the Spotlight Wikimedia CC/Muhammad Sajid Mehmood Ash Carter Talks Tech and Public Purpose on CNBC Squawk Box Wikimedia CC/Greg Goebel



Belfer Center Email Updates