  People who are involved with political campaigns face increased digital
security threats from well-funded, sophisticated attackers, especially
nation-states. Improving political campaign security is a vital part of
protecting democracy. To identify campaign security issues, we conducted
qualitative research with 28 participants across the U.S. political spectrum to
understand the digital security practices, challenges, and perceptions of
people involved in campaigns. A main, overarching finding is that a unique
combination of threats, constraints, and work culture lead people involved with
political campaigns to use technologies from across platforms and domains in
ways that leave them--and democracy--vulnerable to security attacks. Sensitive
data was kept in a plethora of personal and work accounts, with ad hoc adoption
of strong passwords, two-factor authentication, encryption, and access
controls. No individual company, committee, organization, campaign, or academic
institution can solve the identified problems on their own. To this end, we
provide an initial understanding of this complex problem space and
recommendations for how a diverse group of experts can begin working together
to improve security for political campaigns.
