Election Cybersecurity: How to Protect the Systems Behind the Vote

Elections have always attracted people who want to tamper with them. Ballot box stuffing, bribery and registering dead people as voters are old tricks. What has changed is how much of an election now runs on IT systems. Voter rolls, poll books, counting equipment, the laptops that carry results from a polling station to the central count, and the websites that publish the final numbers are all software and networks now.

What’s happening: Recently, warnings from governing bodies like CISA say that AI is making these attacks harder to find, and they are spiking around election periods.

That shift means security is now in danger at scale. Compromising a central counting system or a results website can affect an entire country. As CounterCraft product specialist Richard Barrell put it in our recent webinar, you get more bang for your buck. Cyber deception lets election authorities spot attackers during reconnaissance, long before a vote is cast or counted. CounterCraft has spent years protecting national and regional elections with deception, including long-running deployments for governments. Read on to find out why.

This guide covers what election cybersecurity protects, how election systems work, the attacks that have already happened, how AI is raising the stakes, and the practices that keep election infrastructure safe. It also explains where cyber deception fits, drawing on Richard’s session, Behind the Ballot Box: Step-by-Step on Defending Elections with Deception.

What is election cybersecurity?

Election cybersecurity is the work of protecting the technology and processes used to run an election from cyber attack. That includes the databases that hold voter and candidate records, the equipment used to check in voters and count ballots, the networks that move results from local stations to a central count, and the websites that announce the outcome. It also covers the people with access to those systems, from senior officials to temporary poll workers.

The goal is simple to state and hard to achieve: every result should be accurate, on time and verifiable, and the public should have good reason to trust it.

This post focuses on the machinery and process of elections. Disinformation aimed at voters is a serious problem in its own right, and it needs its own set of tools and specialists. Here we focus on the systems: how attackers try to get into them, how they try to tamper with them from inside, and how defenders can see them coming.

Why election infrastructure counts as critical infrastructure

In the United States, election systems have carried the critical infrastructure label since January 2017, when the Department of Homeland Security placed them inside the Government Facilities sector. The reasoning is that losing or corrupting these systems would do serious damage to the country. The Cybersecurity and Infrastructure Security Agency (CISA) leads the federal side of that work and covers both the physical security and the cybersecurity of election assets.

CISA’s definition of election infrastructure is broad. It takes in voter registration databases and the IT around them, the systems used to count, audit, display and certify results, the voting systems themselves, the warehouses where equipment is stored between elections, and polling places, including early voting sites. CISA’s 2026 Election Infrastructure Security Plan sets out the free, voluntary services it offers state and local officials and private sector election vendors.

Other democracies take a similar view, even where the legal label differs. National election commissions in Europe, Asia and Latin America hold the same kinds of data and run the same kinds of systems, and they face many of the same attackers. The difference is in the details. As Richard noted in the webinar, every country builds its election technology around its own laws, compliance rules and suppliers, so no two election systems look alike.

How election technology works, stage by stage

An election is a long chain of systems, and each link is a possible entry point. The exact technology varies by country, but most elections pass through the same stages.

Two points stand out. The first is that the back-end systems that process and count votes are often air-gapped, meaning they have no direct connection to the internet. That protects them, but it also rules out many security tools that depend on a cloud connection. The second is that almost every election keeps a manual fallback, such as paper ballots that can be recounted by hand. That fallback is what lets officials isolate a problem in one district without throwing out a national result, provided they can tell where the problem is.

Why elections are a bigger target now

Elections are more and more important and each season they become targets of cyber attacks.

The people who want to interfere fall into a few groups:

• Nation-state actors. A government that gains from instability in a rival country has every reason to target its elections. Disrupting a vote, or simply making people doubt the result, can serve a foreign policy goal without a single changed ballot.
• Hacktivists. Political and activist groups use their skills to support causes they care about, and election periods give them a large audience.
• Criminals. Richard described a scenario where a fake result is published early, perhaps while the real counting system is slowed by a denial of service attack. Even a short window of false information can move financial markets, and anyone who knows which way they will move stands to make money.
• Insiders. People with legitimate access to election systems, from staff to contractors to temporary workers, can be bribed, pressured or recruited.

 
Attackers are also preparing earlier. In a June 2026 report covered by Nextgov/FCW, Check Point counted roughly 1,300 newly registered web domains containing the word “election” and nearly 3,000 containing “vote” in January 2026 alone. Not every one of those domains is malicious, but together they give attackers a ready supply of addresses for phishing, fake donation pages and impersonation. The same report found that the most immediate exposure sits in election-adjacent systems, such as the accounts, platforms and local government services that election organizations depend on every day. Local governments are especially exposed, since they tend to run older technology with smaller security teams.

Real attacks on election systems

The threat to election systems is well documented. Three cases from three continents show different ways attackers go after them.

➤ Ukraine, 2014: an attempt to publish fake results

Ahead of Ukraine’s presidential election on May 25, 2014, a pro-Russian group called CyberBerkut broke into the Central Election Commission’s network. Ukrainian investigators later found the attackers had been inside since March, more than two months before the vote. CEPA reports that the group disabled core parts of the election system four days before polling, leaving the system that shows live vote counts unreliable for nearly 20 hours. On election day, government experts removed malware designed to post a fake result, about 40 minutes before results were due to go live, according to the Christian Science Monitor. A Russian TV channel broadcast the false figures anyway. The attack did not change the outcome, but it showed that results publication is a real target and that long, quiet access usually comes before the visible damage.

➤ United Kingdom, 2021 to 2022: more than a year inside

In August 2021, attackers got into the UK Electoral Commission’s systems. Nobody noticed until October 2022. During that time they had access to electoral registers holding the names and addresses of about 40 million people registered between 2014 and 2022, along with the commission’s email. In March 2024 the UK government attributed the intrusion to a China state-affiliated actor. The UK data regulator later found that the security patches for the vulnerabilities the attackers used had been available months before the break-in but had not been installed, as LBC reported. The commission said the election process itself was not affected. The lesson for defenders is the 14 months of undetected access.

➤ Philippines, 2016: an entire voter roll leaked

On March 27, 2016, about six weeks before the national election, hackers defaced the website of the Philippines Commission on Elections. A second group then published what it said was the commission’s voter database. SecurityWeek reported that the leak exposed personal information on roughly 55 million people, and a searchable copy of the data later appeared online. Records for about 1.3 million overseas voters included passport numbers. The breach became known as “Comeleak” and is still one of the largest government data leaks on record.

These cases share a pattern. In each one, the attackers spent time looking around before they acted, and in each one, the defenders would have benefited from seeing that reconnaissance early.

How AI changes election cybersecurity

AI lowers the cost of almost every step of an attack, and election systems feel that early because they are valuable targets that run on a fixed date.

Phishing is more realistic. On October 16, 2026, the FBI and CISA issued a joint public service announcement warning election officials, candidates and campaign teams about AI-assisted phishing ahead of the midterms. The agencies said election officials saw a surge in phishing during the last two election cycles, and that the FBI has seen more text-message phishing through encrypted chat apps over the past year. Spelling mistakes and clumsy grammar used to give these messages away. AI tools now write in natural, local language, and they can produce convincing fake audio and video to back up the lie.

It’s easier for anyone to create an exploit. Richard made the point in the webinar that someone with little skill can now ask an AI model to help write an exploit or a piece of malware aimed at a specific system. Election technology is custom-built in almost every country, which used to make it harder to attack. AI makes it cheaper to study an unfamiliar system and build something that fits it.

Government websites host insecure autonomous agents. In September 2026, OpenAI disclosed that its own AI agents, during training and testing, had interacted with government websites outside their assigned tasks. Nextgov/FCW reported that the agents used developer keys found in public code repositories to query US Census data, and that researchers identified a failed attempt by agents linked to OpenAI to break into a Department of Education website. OpenAI said most of the activity it found was low severity. Even so, it shows that agents will push into government systems when a path is open, and that they do it at machine speed.

Defenders must adapt to these new challenges. Security tools built around known signatures struggle when an attacker can generate new techniques on demand. Defenders need detection that does not depend on recognizing the attack in advance, and they need it to work as fast as the attacker does. That is one of the main reasons deception is getting renewed attention. An AI agent cannot easily check whether the systems it finds are real. In a deception environment, the defender decides what the attacker sees, so the attacker’s picture of the network is one the defender wrote. At CounterCraft we describe this as owning the attacker’s reality.

What makes election systems hard to defend

Election systems have a set of problems that most corporate networks never face.

• No two systems are alike. There is no standard, off-the-shelf election platform. Even when a country brings in a large consultancy with a template design, the result is shaped by local law, compliance rules and the equipment available. Security products built for a typical enterprise network often fit poorly.
• The fixed date works in the attacker’s favor. Everyone knows when the election is. Attackers can plan backward from that date, while defenders have very little room to patch or rebuild once voting starts.
• Equipment is prepared long in advance. In one deployment Richard described, laptops for polling stations had to be configured six months before the vote and then sat in a warehouse. Officials had no way of knowing whether anyone had tampered with them in that time.
• The work is spread across thousands of sites. Polling stations are temporary, staffed partly by short-term workers, and connected to the center through portals or secure tunnels. Each one is a small point of exposure.
• The most sensitive systems are air-gapped. Counting and processing back ends are often cut off from the internet on purpose, which rules out many cloud-based security tools.
• Insiders have real access. Officials, contractors and poll workers need credentials and permissions to do their jobs. Telling normal use apart from someone working beyond their role is hard with conventional monitoring.
• Defenses cannot catch innocent people. Voters, candidates and journalists all use public election websites. Any security measure on those sites has to avoid treating ordinary citizens as suspects.
• Trust can break even when systems hold. A failed attack that becomes public can still damage confidence in the result. Defenders need to be able to show what happened and prove what did not.

Election cybersecurity best practices

No single control protects an election. The strongest programs combine good basic hygiene with early detection.

• □
  Use phishing-resistant multi-factor authentication. The FBI and CISA put this first in their October 2026 alert, especially for email, VPNs and any account that reaches critical systems. Hardware keys and passkeys hold up far better against AI-written lures than codes sent by text.
• □
  Patch quickly and track it. The UK Electoral Commission breach came through vulnerabilities that already had fixes available. Keep an up-to-date inventory of every server and device in the election chain, and treat CISA’s Known Exploited Vulnerabilities catalog as a priority list.
• □
  Give each person only the access they need. Role-based, least-privilege access limits what a stolen password or a dishonest insider can do. Review accounts before each election and remove access when temporary staff leave.
• □
  Keep counting systems separate. Segment networks so that a compromise of a public website or an office laptop cannot reach the systems that process votes. Where systems are air-gapped, keep them that way and control every device that crosses the gap.
• □
  Keep paper records and audit them. Voter-verified paper ballots and routine post-election audits give officials an independent way to confirm results and to recount a single district if something looks wrong.
• □
  Plan for denial of service on results day. Results websites draw huge traffic and are an obvious target. Have extra capacity, a backup way to publish, and a communications plan ready in case the main site goes down.
• □
  Watch for lookalike domains. Monitor new registrations that imitate official election sites and move to take them down before they are used for phishing or fake results.
• □
  Train for the attacks people will face. Election staff need practice spotting realistic phishing and text-message lures, and a simple way to report anything suspicious. Tabletop exercises, such as the free Election Security exercise packages CISA publishes, help teams rehearse their response before it counts.
• □
  Share information. Threat details from one jurisdiction can protect many others. Join the sharing networks available to election officials in your country, and agree in advance who calls whom during an incident.
• □
  Add detection that catches attackers early. Most of the controls above make attacks harder. They do less to tell you that someone is already scouting your systems or moving inside them. That is the gap cyber deception fills.

How cyber deception strengthens election cybersecurity

Cyber deception means placing realistic but fake systems, credentials and data inside or around your real environment. Legitimate users have no reason to touch them. Anyone who does is either scouting, attacking or working outside their role, so every alert is worth looking at. That gives election teams something rare: detection with no false positives to wade through during the busiest weeks of the year.

Deception is part of a wider approach called active defense. Richard summed it up in the webinar as raising the cost and complexity of an attack for the attacker while lowering them for the defender. There is an old saying in security that the attacker only has to be right once, while the defender has to be right every time. Deception reverses that. Once an attacker knows some of what they see might be fake, they have to slow down and second-guess every step, and a single wrong move gives them away.

A deception deployment for an election does four things:

• Detect activity at the earliest stage, often during reconnaissance.
• Deflect the attacker away from real systems and into the deception environment.
• Quarantine them there, in a space where nothing they do can touch real votes or data.
• Engage with them to learn who they are, what they want and how they work.

 
The last point is where the value builds. While the attacker works inside a deception environment, defenders can collect their tactics, techniques and procedures (TTPs), their indicators of compromise (IOCs), and clues to who is behind the attack. That intelligence then protects the real systems at the same time. If the attacker is exploiting a weakness in one system, the team can patch the real one or watch it closely. If they are testing stolen credentials, the team can find out where those credentials came from.

This also allows what Richard called an intelligent response. In an election, shutting an intrusion down the moment you see it is not always the best move. If tampering shows up in one district, officials can use the manual backup to recount that district, then check every other district for the same indicators. If none appear, the rest of the result stands. That is far better than cancelling a national vote because of a problem nobody can locate.

Three ways deception protects an election

In eight years of election deployments, CounterCraft’s work has centered on three areas. Each one covers a different part of the election chain.

1. Tracking external reconnaissance

Before attackers strike, they look around. They scan for subdomains of government departments, search tools like Shodan and Censys for exposed systems, and probe candidate registration portals, press registration sites and media portals for a way in. In attack terms, this is the far left of the kill chain, well before anything goes wrong.

Deception meets them at recon. A common setup is a candidate registration portal hosted on an address an ordinary user would never visit, such as a subdomain marked test, prototype or pre-release. A real candidate has no reason to find it. Someone running reconnaissance across a government’s web presence will. To make sure the right people find it, defenders can plant breadcrumbs: pointers that lead back to the deception environment, placed in scanning databases, on forums where attackers are known to be active, or on social media. Those breadcrumbs are aimed at people who mean harm and stay out of the path of ordinary voters.

Richard was clear that care is needed here. Public voter registration sites carry a risk of drawing in innocent members of the public, which is why CounterCraft’s government deployments use addresses that only someone actively hunting would reach.

2. Detecting insider threats

The second area is people inside the process. That includes anyone with credentials or permissions tied to election systems, in pre-election preparation, vote processing, counting or results distribution. The question is whether anyone is trying to do something they are not authorized to do or reach a system outside their role.

Deception assets placed inside these environments give a clear signal of “>insider threat. A file, credential or server that no one in that role should ever touch becomes an alarm when someone does. This works inside air-gapped networks too. The CounterCraft platform can run fully air-gapped, which matters because the most sensitive election back ends are rarely connected to the internet.

Results distribution deserves particular attention. Richard walked through how a fake early result, released while the real result is delayed, could send a country and its markets in one direction before the true count pushes them back. The fallout could include fraud claims and even a rerun. Protecting the path from count to publication is a core part of election cybersecurity.

3. Spotting tampering with election equipment

The third area is the equipment itself, from voting machines to the laptops used to enter results at each polling station. In one case CounterCraft worked on, those laptops had to be prepared six months before the election and then stored in a warehouse. The warehouse was reasonably secure, but no one could prove the machines had not been touched.

The solution was to build deception into the machines. Each laptop had one job: registering and entering votes. If anyone tried to step outside that purpose, the machine would trigger an automatic alert that it had been tampered with. Any laptop that raised an alert before the election could be pulled, and officials could pay closer attention to the polling station it was meant for. Teams could prepare equipment months ahead and still have a way to know if someone had interfered with it.

What an election deception deployment looks like in practice

So what does an election security deception environment look like in practice? We built an environment for a fictional country, the Republic of Burgandia, which is holding an election for its General Assembly.

One console, several campaigns

The platform is multi-tenant, so a national authority can run several deception deployments from one web console. Within each deployment, campaigns cover separate use cases. The election demo had a candidate portal campaign, an equipment monitoring campaign and an insider threat campaign still in design. The same console could also manage unrelated work, such as deception in embassies or other overseas sites.

Real machines, built to match your systems

CounterCraft deception hosts are real machines running a real technology stack. They can be built to mirror whatever database, network platform or verification system the election uses, close enough to work as a digital twin of the real environment. A lightweight CounterCraft agent turns each host into a fully monitored system that reports everything an attacker does. Hosts can run almost anywhere, from an AWS EC2 instance or a Proxmox virtual machine to Azure, Google Cloud or a physical server in an air-gapped data center. The deception sits on an overlay network with no impact on production systems or traffic.

This matters because experienced attackers test what they find. Richard put his red team hat on to explain: a simple emulation may answer four or five commands, and once an attacker goes past a directory listing it becomes obvious that the system is fake. At that point they leave, and the chance to learn about them is gone. A real host behaves exactly as expected, so the attacker keeps working through their playbook.

Catching a login attempt on the candidate portal

The demo’s external reconnaissance campaign was a single host running the Burgandian government’s candidate registration portal. Richard logged in with a made-up citizen ID number and the password “countercraft.” The login failed, as it would for any attacker. In the console, an alert appeared straight away. It showed the attempt, the username and password used, the remote IP address and network owner, and the fact that the visitor was on a Mac using a Chrome-based browser, which matched Richard’s own setup.

Even this simple setup tells defenders a lot. They can check whether the ID number belongs to a real citizen, whether it is fake, or whether it matches a leaked database of citizen IDs. If it is the first time that leaked data has been seen in use, that is valuable intelligence on its own.

Watching an attacker on the server

The demo then showed what happens when someone gets onto the server behind the portal. The data explorer logged every command. The attacker tried the Windows command “dir” on a Linux host, used the older “netstat” tool instead of its modern replacement, and tried to run the Nmap network scanner, found it missing and installed it. From a few commands, defenders could already tell the attacker was more at home on Windows and had habits that suggest an older skill set. That kind of detail builds an attributable picture of who is behind an attack.

From events to a finished threat report

The platform then pulls related events into an incident, with a timeline and each step mapped to the matching MITRE ATT&CK technique. From there, built-in AI tools produce a threat intelligence report, which Richard described as an analyst in a box for teams without deep threat analysis skills. The report includes attribution, hypotheses for further threat hunting, compromised accounts, attack infrastructure, notable artifacts and a timeline. It also explains each technique in context.
 

AI on both sides: deception against AI-driven attacks

AI is changing how attacks are run, and it is also changing how deception is built and used.

AI that builds the deception

Designing a convincing deception environment used to take specialist time. The CounterCraft platform now includes a natural-language prompt connected to a large language model, so a security engineer can describe what they need in plain words. Richard’s example: “I am a security engineer in Burgandia. We have a general election in six months. I need a deception campaign to protect my internal infrastructure.” The platform generates the campaign from there. CounterCraft’s own experts remain available to help, but teams no longer have to start from a blank page.

That matters for elections in particular. Many election offices, especially at the local level, run with small security teams. AI-assisted design and AI-written threat reports put mature deception within reach of teams that could not have staffed it before.

Why deception works well against AI attackers

An AI agent attacking a network behaves a lot like a human attacker, only faster and at larger scale. It enumerates services, follows leads and pushes into anything that looks promising. Because CounterCraft deception hosts are real machines, an agent explores them the same way it explores real ones. This means deception works exceptionally well defending against AI attackers. The information it brings back, though, describes the deception environment.

That has three effects for defenders:

• Early, reliable detection. The agent reveals itself the moment it touches a deception asset, whatever technique it uses. No signature is needed.
• Poisoned intelligence. The false picture the agent builds goes back to whoever is running it, and to any other agents sharing that information. Their plan is now based on a network the defender designed.
• Real-time intelligence for the real environment. While the agent works inside the deception, the platform records its tactics and techniques as they happen. Defenders can use that to protect the real systems the same attacker may be probing in parallel.

 
Every extra host an attacker explores also costs them time and computing resources, which raises the price of the attack. For election defenders racing a fixed deadline, anything that slows the attacker down and speeds the defender up helps.

Election cybersecurity FAQs

What is election cybersecurity?

Election cybersecurity protects the systems used to run an election, including registration databases, poll books, voting and counting equipment, results transmission and publication, from cyber attack and insider tampering. Its aim is accurate, timely and verifiable results.

What are the biggest election cybersecurity threats today?

Phishing against election officials and campaign staff is the most common, and AI is making it more convincing. Other major threats include long-term intrusions into registration databases, denial of service attacks on results websites, publication of fake results, insider abuse of access, and tampering with equipment before election day.

Who is responsible for election cybersecurity in the United States?

State and local governments run elections and own most of the systems. At the federal level, CISA helps election officials secure their infrastructure and the FBI investigates election crimes, including foreign interference. Election vendors are responsible for the security of the products they supply.

How does cyber deception protect elections?

Deception places realistic but fake systems, credentials and data where attackers will find them. Legitimate users never touch them, so any interaction is a reliable sign of an attack. Defenders can detect reconnaissance early, keep attackers away from real systems and collect intelligence on how they operate.

Can deception work in air-gapped election networks?

Yes. The CounterCraft platform can run fully air-gapped, which is important because the systems that process and count votes are often cut off from the internet.

Will a deception environment affect real voters or candidates?

It should not, and good design makes sure of that. CounterCraft places election deception assets where only someone actively hunting for a way in would find them, such as test or pre-release addresses, and aims breadcrumbs at places attackers go.

Protecting the next election starts well before polling day

Elections are a target, and the next 12 months bring more of them than usual. Attackers are already registering domains, collecting credentials and using AI to write better lures. The cases above show how much damage happens while defenders are still unaware anyone is there.

Strong election cybersecurity starts with the basics: phishing-resistant authentication, fast patching, tight access control and paper records that can be audited. Deception adds the piece those controls lack. It tells defenders when someone is scouting their systems or working outside their role, early enough to act and with the intelligence to act well.

CounterCraft has done this work in the field for eight years, protecting national and regional elections for governments that are among the most advanced in security, including EU governments that have used deception on their election infrastructure for nearly a decade. The platform adapts to custom election systems, runs on premises, in the cloud, across distributed sites or fully air-gapped, and now uses AI to make deception faster to build and easier to run.

Watch Behind the Ballot Box on demand. Richard Barrell’s full session, including the live Burgandia demo and audience Q&A.

Explore CounterCraft for government. Learn how national authorities use deception to detect nation-state attackers and protect critical systems.

Talk to our team. Request a demo tailored to your election infrastructure.