"Why wouldn't someone think of democracy as a target?": Security practices & challenges of people involved with U.S. political campaigns

TL;DR

This study explores the digital security challenges faced by U.S. political campaign participants, revealing complex vulnerabilities due to diverse practices and cultural factors, and emphasizes collaborative solutions to safeguard democracy.

Contribution

It provides the first qualitative analysis of security practices and challenges among campaign staff, highlighting the need for cross-sector collaboration to improve security.

Findings

Campaign staff use diverse, ad hoc security measures.

Multiple vulnerabilities stem from work culture and threat complexity.

Collaborative efforts are essential for effective security improvements.

Abstract

People who are involved with political campaigns face increased digital security threats from well-funded, sophisticated attackers, especially nation-states. Improving political campaign security is a vital part of protecting democracy. To identify campaign security issues, we conducted qualitative research with 28 participants across the U.S. political spectrum to understand the digital security practices, challenges, and perceptions of people involved in campaigns. A main, overarching finding is that a unique combination of threats, constraints, and work culture lead people involved with political campaigns to use technologies from across platforms and domains in ways that leave them--and democracy--vulnerable to security attacks. Sensitive data was kept in a plethora of personal and work accounts, with ad hoc adoption of strong passwords, two-factor authentication, encryption, and access controls. No individual company, committee, organization, campaign, or academic institution can solve the identified problems on their own. To this end, we provide an initial understanding of this complex problem space and recommendations for how a diverse group of experts can begin working together to improve security for political campaigns.