Digital Security
You Are a Target
The moment you decide to run for office, something changes that most candidates don’t anticipate: you become a higher-risk target online. Not because of anything you’ve done wrong. Because of what you’re doing: seeking public office and asking your community to trust you.
Key point
Your average computer user is at risk of cybercrime, open to attacks by someone trying to steal money or passwords. But candidates face an additional layer of threat: foreign governments, hacktivists, and bad actors whose goals extend beyond financial gain. They may seek to interfere in elections, steal sensitive information, or leak it publicly to embarrass candidates and influence voters. The stakes are different when you’re on a ballot.
Think about the difference between these two candidates:
Without Protection
“I figured I was a local candidate. No one would come after me. Two weeks before the election, someone posted my private emails. We never recovered.”
With Protection
She set up passkeys, enrolled in Google’s Advanced Protection Program, and made sure her website was shielded from attacks. When someone tried to get in, they couldn’t. She won.
The second candidate didn’t spend thousands of dollars or hire a security firm. She put the core protections in place: the same ones you’re going to learn in this module. Getting to “core” is neither time-consuming nor expensive. Most of it is free.
Key Definitions
You don’t need to become a cybersecurity expert. But a handful of terms will help you understand what’s being protected and why.
Passkey
A digital credential stored on your device that replaces passwords. Passkeys are phishing-resistant: even if someone tricks you into clicking a fake link, the passkey won’t work for them. It’s the strongest form of account authentication available to everyday users.
Phishing
A scam where someone impersonates a trusted source (Google, your bank, a colleague) to trick you into handing over your login credentials. Phishing is the #1 way campaigns get compromised.
MFA
Multi-Factor Authentication: an extra layer of verification beyond your password. A passkey is the strongest form. A texted code is the weakest.
DDoS Attack
A “distributed denial of service” attack that floods your campaign website with fake traffic until it crashes. A common tool used to take down campaign sites right before Election Day.
DMARC
An email authentication standard that prevents bad actors from sending emails that appear to come from your campaign address, like fake fundraising requests sent to your supporters.
Security Key
A small physical device (like a USB stick) that verifies your identity. The strongest form of two-factor authentication. Especially recommended for campaign administrators.
The Core Five · Highest-Risk Areas
The 5 Things Every Campaign Must Do
Cybersecurity isn’t about defending against every possible threat. It’s about protecting against what’s most likely to happen. Open any section for the setup steps.
Unauthorized account access is the #1 threat campaigns face. Attackers use phishing to break into email, files, social, and financial accounts, and the damage is immediate and public.
Passkeys, MFA, and Advanced Protection Programs
What
You need more than a password. You need strong multi-factor authentication on every primary account: email, cloud storage, social media, and financial accounts. The strongest option right now is a passkey.
How
Google users: Set up a passkey on your Google account, then enroll in the Google Advanced Protection Program (APP), a free program built specifically for high-risk users like candidates.
Microsoft users: Set up a passkey on your Microsoft account, then explore Microsoft AccountGuard, a free program for campaigns with enhanced threat monitoring.
Tip: Consider a physical security key (such as a YubiKey), especially if you’re a campaign administrator managing others’ access. It’s the strongest form of two-factor authentication available.
Reusing passwords is one of the most dangerous habits. If one account is breached, attackers try that password everywhere, and campaigns use dozens of tools.
Stop reusing passwords. Store them safely instead
What
A password manager creates and stores complex passwords (and passkeys) for all your accounts. You only remember one master password. The manager handles everything else.
How
Google users: Use the built-in Chrome Password Manager. It is free, already installed, and syncs across all your devices.
Microsoft users: Use the built-in Microsoft Edge Password Manager. It is free, built-in, and syncs across devices.
Taking down a campaign website right before an election causes maximum damage: halted donations, voter confusion, reputational harm. The most common attack is a DDoS.
DDoS protection so your site stays up when it matters most
What
Your website needs DDoS protection. The accounts with access to your content management system and web hosting also need the same strong authentication from Protection #1.
How
Cloudflare offers free DDoS protection for any website.
Google’s Project Shield provides free DDoS protection specifically for campaigns and high-risk organizations.
If your campaign is eligible, Defending Digital Campaigns can connect you with Cloudflare for Campaigns, a business-tier version with enhanced protections, at no cost.
Tip: Check your eligibility: Defending Digital Campaigns offers free tools and setup assistance for eligible campaigns. Visit defendcampaigns.org to see if you qualify.
It’s surprisingly easy for someone to send email that looks like it came from you, to steal from donors or trick supporters into clicking dangerous links. Your reputation is on the line.
Stop bad actors from impersonating your campaign
What
DMARC is an email authentication standard that tells the internet: “Only these approved services are authorized to send email from our campaign address.” Unauthorized spoofing attempts get blocked or flagged.
How
Start by checking whether your domain already has DMARC configured. It takes about 30 seconds.
If your campaign is eligible, Defending Digital Campaigns can help you configure DMARC properly.
When you become a candidate, people search your name, and some don’t have good intentions. Data brokers publish your home address, phone, and family names, enabling harassment and doxxing.
Reduce what opponents or bad actors can find about you
What
You can take steps to reduce how much of your personal information appears in search results and set up alerts so you know when new results about you appear online.
How
Start by searching your own name. Review what personal information is publicly available.
Use Google’s tools to request the removal of sensitive personal information like your home address or phone number.
If you use Microsoft Defender (available with personal Microsoft accounts), it continuously scans the dark web for your personal information.
Make it a habit: search your name periodically throughout the campaign, not just at launch.
Watch & Learn
Lunch & Learn: Defending Digital Campaigns
In this session from a New Politics Academy event, the team at Defending Digital Campaigns walks through the security landscape for first-time candidates, including live demonstrations of the tools covered in this module.
As you watch, pay attention to:
- The specific threats campaigns face that ordinary computer users don’t
- How quick and simple most of these protections actually are to set up
- The free resources available specifically to candidates and campaigns
On Your Own
Your Action Plan
Complete these before your first major campaign event, public announcement, or fundraising push, ideally before your website goes live.
1
Set up a passkey on your primary email account
·
2
Enroll in Google Advanced Protection or Microsoft AccountGuard
·
3
Enable a password manager and store all campaign credentials in it
·
4
Set up DDoS protection on your campaign website
·
5
Check your DMARC status and configure it if it’s missing
·
6
Google your name and review what personal information is publicly available
7
Request removal of sensitive personal info from Google search results
·
8
Run a Google Security Checkup or review Microsoft Recent Activity, then check DDC eligibility
·