Cyber risk comes in two varieties: general risks - the ones every computer user and campaign faces – and specific risks - circumstances that apply to your campaign or candidate that could be indicators of increased risks.
You can think of general risks as similar to the risks we face every time we hop in a car. The possibility of an accident always exists. However, if we stick to the basics - buckle our seatbelts, follow traffic laws and signage, and maintain situational awareness - we can reduce the harm or an accident substantially. The same applies to campaigns using technology. More than the average person, campaigns and candidates can be targets of cybercriminals, nation states and hacktivists. Implementing basic protections can eliminate or mitigate the most common risks and threats we face. Addressing those risks is the concept behind the core protections Defending Digital Campaigns (DDC) recommends every campaign implement. Enabling simple tools to protect your accounts, website and email is essential. Read about how to enable core protections here: https://defendcampaigns.org/secure-your-campaign
Some candidates enter the campaign with increased cyber risk. There are a number of factors that can increase that risk (see the risk factors below). In traditional cybersecurity risk management the focus is on people, process, and tech. In the political sector, we need to overlay other factors that might be indicators of increased risk, such as the competitiveness of your race.
Cyber risk is never stagnant. From the moment your candidate announces their intention to run until they hopefully take a victory lap, change and changing dynamics are a constant. New domestic or geopolitical events can impact the risk environment, even ups and downs in the polls can play a role in cyber risk. It is very important to maintain situational awareness of how these factors could impact your candidate and campaign and take actions necessary to prevent your campaign from being blindsided.
DDC considers every campaign as high-risk. If your campaign has any of these risk factors your campaign is likely at even higher risk:
The outcome of your race is significant in terms of the balance of power: In each campaign cycle there are a number of races that will determine the balance of power. These campaigns are often the focus of national committees seeking to maintain or flip districts, the national media, and extensive fund raising efforts. When the stakes are high and a lot of money is flowing into campaign coffers, the risk goes up.
Your candidate is in a highly competitive race: Races that are close and could go either way have higher risk profiles since the possibility of changing the outcome through interference grows.
Your candidate and campaign are taking on a well-loved incumbent: Is your campaign going to have strong opposition even within your own party that may cause people to be upset with your candidate and attempt to thwart your effort.
Your candidate is from an underrepresented group and/or your community with a history of hostility towards specific groups: Unfortunately, there are still communities where you need to take community viewpoints towards your candidate's background and beliefs into account when determining cyber risk. Consider if there are people who want you to fail and are looking to find ways to sabotage your campaign, distribute false or misinformation about the candidate, or find other ways to embarrass the campaign.
Your candidate is an incumbent and has recently had to make tough votes or decisions that have evoked strong negative feelings in the community: For example, they voted on a major decision across party lines. Or, took an unpopular stance on an issue that caused significant public blow back. Leadership can sometimes mean making unpopular decisions.
Your candidate is known outside your district: There are some candidates and incumbents who are well known regionally or nationally and are in a “spotlight” brighter than their colleagues. They can have followers and detractors in great numbers. This can make them a target for a variety of bad actors including hacktivists.
Your candidate holds a leadership position: Similar to spotlight risk, leaders often face higher risk. They can be more broadly known since they are often the spokespeople for the party and have significant media exposure.
You won the primary: Good news, you have won a primary. Unfortunately, now your risk might rise. You have gone from being one in a field of two or more to THE candidate. There is more attention from the media and the public especially if your district has been on the national radar. It’s not automatic that your risk is higher but should be considered especially if any of the above risk criteria apply.
It is generally agreed that overall risk increases as election day nears.
Opportunities for bad actors to impact the outcome of an election increase toward the end of a campaign cycle. Taking down a campaign’s website in the last days of a race could deny access to information on the candidate or accepting donations, and/or be an embarrassment. Changing voting information on the website on the eve of the election could send voters to the wrong polling place before the campaign becomes aware of the breach. Flooding social with false or highly sensitive information at the time many voters are making a final choice, could have a significant impact. This is exacerbated if some of the above criteria also applies, such as the race is close or will determine the balance of power. As election day draws near, double check that staff are following the security steps you have implemented and remind them to remain alert to efforts to infiltrate the campaign like phishing attacks.
Do something
Regardless of the size of your campaign, addressing the cybersecurity concerns in your campaign is neither time consuming nor costly. There are free tools from Google and Microsoft that specifically design to help high risk organizations and individuals. Additionally, there are other free tools to protect your website and even your outbound emails. Here are simple steps you can take now to get started: https://defendcampaigns.org/secure-your-campaign
If you are a DDC eligible campaign (you can check your campaign’s eligibility on our website) we have an array of tools to help you implement core cybersecurity and address specific threats such as protecting mobile devices and your presence on social media. We will even help you get the tools set up. Reach out to us at https://defendcampaigns.org/contact-us with questions or to get started.