Planning Desk, Week E-26: Detection – Notice It Early, Name It Clearly

Detection is the hinge of every Incident Response Plan because you cannot respond to an incident you didn’t notice. It is the step most offices underinvest in, usually because it is often considered a technology problem rather than a team problem. In reality, it is both.

Strong detection relies on three things: 

1. People in the right places who know what “unusual” looks like because they have learned the baseline;
2. A simple way to raise a hand and report the “unusual”; and
3. A reliable feed of outside information so that you learn about what happened to your neighbors in time to take action before it happens to you.

Three Kinds of Signals

Detection across an election office runs in three channels, and each one needs someone paying attention.

1. Technical signals come from: security tools (endpoint protection, firewalls, email filters); vendor and partner alerts (voter registration system, tabulation vendor, website host); and information-sharing bodies like the Election Security Exchange, your State Fusion Center,  Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), and the Cybersecurity and Infrastructure Security Agency (CISA). Someone needs to be responsible for monitoring these daily, not just when something pings.
2. Physical signals are often the ones your frontline catches first: a visitor lingering by the tabulation room door; an unexpected package at a polling place; a broken lock on a drop box; or a delivery that doesn’t match the order. Your front counter staff, poll workers, warehouse staff, and drop box couriers are the people best positioned to notice these.
3. Operational signals are the subtle ones: a mail ballot batch that does not reconcile; a precinct turnout number that looks odd against historical patterns; a call from a journalist asking about something you have not announced; or a vendor notice that reads more urgently than the last one. These rarely come with a flashing light.

The Hand-raise Has to be Easy

The most common detection failure isn’t failing to see something troubling. It is when someone sees it and doesn’t know who to tell or worries they will look foolish if it turns out to be nothing. The answer is to designate a single, widely-known point of contact.

Pick one phone number and one email address for reporting concerns. Put them in every briefing, on every badge lanyard, in every poll worker packet. Make it clear that the person raising a hand is there to raise it, not to diagnose. Analysis comes later, by someone trained to do it.

Actions You Can Take

• Map your signal sources. List the tools, alerts, feeds, and human sources that would signal when something goes wrong, and assign a named owner to each.
• Brief the frontline. Spend time with poll workers, front counter staff, and warehouse staff on what to report, how to report it, and where to send it. Keep the examples concrete.
• Set a single intake point. One number, one email, one person on call. The goal is to make reporting easy when a potential problem surfaces.
• Subscribe and actually read. EI-ISAC, CISA, and your State Fusion Center put out steady, practical information. Designate a daily reader, even if it is the same person every day for ten minutes.
• Log everything, including the false alarms. Patterns only show up if you keep a record. A notebook counts.

Detection is where your Incident Response Plan either starts on time or starts late. Next issue, we turn to the harder question: Once a signal comes in, how do you decide what it actually is and what to do about it?

---

The Planning Desk is a running timeline of key election security tasks. You can find prior editions in the newsletter archive.