The Federal Bureau of Investigation (FBI) announced a new internal policy to clarify and guide the timely federal notification of appropriate state and local officials of cyber intrusions affecting election infrastructure.

The new policy outlines how the FBI will notify state and local officials responsible for administering election infrastructure of cyber activity targeting their infrastructure.

According to a release, the FBI’s new policy recognizes the necessity of notifying responsible state and local officials of credible cyber threats to election infrastructure. Each state has a designated person to serve as its chief state election official with ultimate authority over elections held in the state, which often includes certifying election results. However, most election infrastructure is owned and operated by local governments. Likewise, the local election process is overseen by local election officials. The FBI’s interactions regarding election security matters must respect both state and local authorities. Thus, the FBI’s new policy mandates the notification of a chief state election official and local election officials of cyber threats to local election infrastructure.

The new policy is informed by existing FBI policies surrounding cyber incident notification thresholds and cyber victim notification in general. The new policy, however, said the FBI, provides updated and additional guidance on the timely dissemination of notifications and/or threat reporting; the protection of victim information and disclosures; and coordination between FBI and other agencies in regard to election security for maximum impact. Decisions surrounding notification continue to be dependent on the nature and breadth of an incident and the nature of the infrastructure impacted.