Presidential Campaign Security 2020

Only a few weeks before the 2016 election, WikiLeaks published the emails of John Podesta, chairman of Hillary Clinton’s presidential campaign. Those emails were stolen from his email account through a data breach and ultimately helped derail Clinton’s bid for the presidency.

A few months later—two days before the 2017 presidential election in France—hackers leaked nine gigabytes of emails from candidate Emmanuel Macron’s campaign.  The same cybercriminals behind that hack have since been linked to attacks on other campaigns in countries throughout Europe.

The 2020 US presidential election will be no different. In fact, unless candidates take the steps needed to protect their staff, voters, and donors, it could be worse.

While the security controls of most webmail platform providers have grown adept at ferreting out malicious links and malware, they are powerless on their own against advanced, identity-based phishing attacks. Cybercriminals are taking advantage, sending personalized attacks to campaign staff to gain sensitive information and login credentials.

Advanced email protection, designed to stop these identity deception tactics before they ever hit the inbox, is needed. But despite the ease of implementing an advanced threat protection solution, only 15% of top contenders have done so.

Another email-based threat could pose an equal danger to candidates and to our electoral system itself. For US presidential candidates with domains unprotected by the DMARC email authentication protocol, they risk finding their campaigns impersonated in phishing attacks targeting not their staff, but rather their most important constituents—including voters, donors, and the press.

When implemented correctly, DMARC authentication at its highest level is the single most important element in stopping attacks that pose as trusted brands or individuals—including political candidates and their campaigns. Unfortunately, only six of the top candidates have fully implemented DMARC to prevent fraudulent email from reaching voter inboxes.