Seemingly insignificant details, such as a staff schedule visible in a photo posted online or a photo of the ballot storage room, can reveal vulnerabilities in your operations and create opportunities for a malicious actor to target your election infrastructure.
Operational security, or OPSEC, is a process of identifying and protecting sensitive information, data, and capabilities. This includes reducing unnecessary exposure of small pieces of information that, when combined, can reveal more than intended.
Set aside 30 minutes for an OPSEC check-in with your team. OPSEC is everyone’s responsibility, so consider including communications, IT, legal, and operations staff in the discussion. The following steps provide a simple framework to guide that review.
- Step 1:Identify Sensitive Information
- Purpose: Identify information that could be valuable to an adversary.
- Examples: Staff roles and schedules; details of facilities and equipment, election procedures, security protocols, systems, and networks.
- Step 2: Understand Threats
- Purpose: Consider who might seek this information and how they might use it.
- Examples: Hackers, online actors, organized groups, insiders, foreign nation-states.
- Step 3: Identify Vulnerabilities
- Purpose: Identify weak points and sensitive details that could be pieced together to reveal vulnerabilities in your operations.
- Examples: Weak cyber and physical security, social media oversharing, recycling and trash, eavesdropping, and mistaken disclosure in public records.
- Step 4: Assess Risks
- Purpose: Evaluate the likelihood and potential impact of each vulnerability being exploited.
- Examples: Loss of sensitive information, operational disruption, and harm to staff.
- Step 5: Implement Safeguards
- Purpose: Reduce risk by putting safeguards in place to protect sensitive information and operational details.
- Examples: Strengthen security protocols; improve physical security measures; and train staff on threat awareness, information security, remote access, handling and disposal of sensitive materials, suspicious activity reporting, and insider threat mitigation.
- Step 6: Assess Effectiveness
- Purpose: Monitor and update safeguards as operations, threats, and risks change.
- Examples: Regular reviews, inspections, updates to procedures or security measures.
- Incidents & Threats
These nonpartisan resources offer a deeper dive into OPSEC:
- CISA Guide to Operations Security for Election Officials
- ODNI Operations Security
- NCSC Enterprise Risk Mitigation Blueprint for Non-Intelligence Agencies
The Planning Desk is a running timeline of key election security tasks. You can find prior editions in the newsletter archive.