EI-ISAC preps election officials for coordinated cyber-physical attacks
The prep work runs through a subscription-funded info-sharing group that lost its federal cooperative agreement in 2025.
TL;DR
The Elections Infrastructure ISAC is helping state partners plan for continuous operations if cyber incidents arrive alongside physical threats, as early voting gets underway. The group is pushing secondary communications, incident-command integration for cyber staff, and county tabletop exercises simulating hybrid attacks. EI-ISAC now runs on a subscription model after CISA terminated its cooperative funding agreement in 2025, though election officials still get free membership for alerts.
The EI-ISAC held a quarterly call with members on Oct. 21 and a virtual forum Oct. 1 that drew more than 700 participants, both aimed at previewing the threat landscape ahead of Election Day on Nov. 3.
The focus this cycle is coordinated attacks: cyber incidents timed to physical threats. EI-ISAC is working with states to stand up secondary communication channels and to make sure cyber and election officials sit inside state-led incident command structures, so a cluster of cyber incidents in one region doesn't outrun the response. County tabletop exercises with local law enforcement and emergency management have simulated hybrid attacks.
On the vulnerability front, EI-ISAC flagged critical remote code execution flaws in PHP, the scripting language underneath a large share of the web. An exploit could take down election office sites that carry voter logistics, registration lookup tools, or election-night reporting, with possible spillover to government networks and candidate websites.
For Election Day itself, analysts are tracking registered domains spoofing legitimate election sites and bracing for distributed denial-of-service and website defacement. They're also watching the tabulation and certification window after polls close on Nov. 3, where they expect a rise in AI-generated content aimed at sowing misinformation about results.
The backdrop is a funding shift. CISA ended its cooperative agreement with the Center for Internet Security in 2025, and the EI-ISAC and Multi-State ISAC moved to a subscription model. Election officials still get free EI-ISAC membership for alerts, and the National Association of Secretaries of State is convening states with election duties to keep them connected through the cycle.
Published ·Deep Fathom