Campaigns gear up to face toughest cybersecurity threats to date

• Campaigns are facing mounting threats from nation-state spies, cybercriminals and politically motivated hackers looking to collect secrets and cause chaos.

The big picture: Political campaigns have unique needs to properly secure their systems.

• These organizations need to onboard staff as quickly as possible, and they don't have time to try out different security vendors.
• Each campaign also has its own budget, run time and tech stacks. Not every campaign can afford to work with multiple vendors, and the solutions they pick need to be installed quickly.

Threat level: In 2024, campaigns are seeing threats from every possible foreign adversary, as well as politically motivated hackers and cybercriminals.

• That's unlike 2020 or 2016, when just one or two nation-state threats were top of mind, Matthew Masterson, director of information integrity at Microsoft, told Axios.
• "We see China, we see Russia, we see Iran actively targeting this election," said Masterson, who is also a former commissioner for the U.S. Election Assistance Commission.

Driving the news: News of a China-linked phone hacking campaign targeting the U.S. presidential race — and government officials — has brought campaign cybersecurity to the top of campaigns' priority list.

• This week, the New York Times reported that Salt Typhoon also targeted phones belonging to Eric Trump, Jared Kushner and Biden administration officials in its most recent campaign.

Catch up quick: The 2016 Russian hack and leak of the Democratic National Committee's emails kick-started conversations about how to properly secure a political campaign from government adversaries.

• Now, election and intelligence officials are facing a wider range of problems, including threats of website takedowns and phone hacking.
• Hackers have also started targeting tech vendors who provide services to political campaigns, Alissa Starzak, global head of public policy at Cloudflare, told Axios.

Between the lines: When any organization is hacked, its peers often worry they'll be next. The same is true for political campaigns, Starzak said.

• Cloudflare has seen some campaigns sign up for its free services offered to political campaigns after hearing about a website takedown impacting another entity, she added.
• Some customers have even upgraded their Cloudflare services after hearing about a distributed denial-of-service attack on another campaign.

The intrigue: High-profile election cyberattacks have focused the conversation and helped campaigns figure out what security tasks to prioritize, Masterson said.

• If they see a campaign's credentials were stolen, they know to prioritize implementing multifactor authentication, he added.

Yes, but: Getting campaigns to dedicate time to participate in a security training is still tough, Masterson said.

• "Every hour matters to a campaign," Masterson said. "But when they're there, man, they're dialed in and taking this seriously."

Reality check: Website takedowns and defacements, disinformation campaigns, and hack attempts are expected to escalate in the days leading up to Election Day.

• Both Cloudflare and Microsoft say they're able to rapidly respond to ongoing incidents or get a campaign access to their services quickly over the weekend.
• The AI Elections Accord — a pledge signed by 27 companies, including Microsoft, to mitigate safety issues tied to AI elections content — also has resources for reporting any deceptive uses of AI tools to various companies.

What's next: Campaigns will soon start winding down, and as they do, they'll need to take certain precautions to ensure their digital data isn't at risk, according to Defending Digital Campaigns, a nonprofit that connects cybersecurity vendors to campaigns.

• Storing passwords to key accounts in a shared password manager, deleting accounts tied to departing staffers, and securing a campaign website in between election cycles are good practices to consider.