Security for Politicians and Election Candidates

Candidates, elected representatives and the small, fast-changing teams around them are targeted by state actors and criminals through personal email, messaging apps and borrowed campaign infrastructure that no corporate security team owns. The UK National Cyber Security Centre (NCSC) names elected representatives, candidates and staffers among the high-risk individuals it advises, and its guidance for political organisations lists credential attacks, spear-phishing, denial of service against party websites and domain spoofing as the threats it sees. This guide covers the people and the campaign rather than the voting systems: how to protect the candidate's accounts and devices, run a campaign organisation with volunteers and short-term staff, protect websites and email domains, handle impersonation and harassment, and respond when something goes wrong. It is for campaign managers, party IT staff and candidates. For voting systems and election administration, see the Election Security Guide.

Source note: threat, service and guidance details are attributed to the NCSC, NPSA, CISA, FEC and Defending Digital Campaigns pages linked in the text, checked in November 2026. Eligibility for each service is set by its provider. Campaign phase tasks, metrics and targets are NHI Mgmt Group recommendations. Confirm against the official text before relying on it.

Key takeaways

Personal accounts are the main target. The NCSC's Star Blizzard advisory describes an actor that mainly targets personal email addresses, builds rapport over time and then sends links to fake sign-in pages, so the candidate's private Gmail or Outlook account needs the same protection as the office one.
Use phishing-resistant sign-in for the few accounts that matter. The same advisory describes EvilGinx being used to capture credentials and session cookies and bypass two-factor authentication; passkeys or security keys on email, cloud storage and the main social accounts close that gap.
Treat the campaign as a short-lived organisation with real admin duties. Volunteers and contractors join and leave within weeks; give them named accounts in a managed workspace, remove access the day they leave and never share the candidate's passwords.
Own the domain and the website properly. Registrar lock, two-step verification (2SV), SPF, DKIM and DMARC on every domain, including ones that send no email, and denial of service readiness before polling day.
Use the free government services. In the UK, NCSC Account Registration and Personal Internet Protection are offered by invitation to candidates and elected officials, alongside Early Warning and Check your Cyber Security for organisations.

Who is targeted and what attackers want

Political targets attract three kinds of attacker, each wanting something different.

Attacker	Goal	Typical approach	Examples from official sources
State actors	Intelligence, leak and influence material, long-term access	Researched spear-phishing of personal accounts, impersonation of known contacts, fake event invitations	Star Blizzard (also tracked as SEABORGIUM, COLDRIVER, TA446), assessed by the NCSC as almost certainly subordinate to FSB Centre 18, targeting politicians since 2019; NCSC reporting of Chinese state-affiliated reconnaissance against UK parliamentarians' email in 2021
Disruptive groups and hacktivists	Embarrassment and disruption at key moments	Denial of service, website defacement, account takeover of social media	The NCSC notes denial of service attacks against UK party websites before the 2019 General Election
Criminals and fraudsters	Money: donations, payments, extortion	Domain spoofing, fake donation pages, invoice fraud against the campaign, ransomware	Domain spoofing is listed among NCSC threats to political organisations

Two features make campaigns different from a normal small organisation. First, the most valuable target, the candidate, uses personal devices and accounts that sit outside any managed estate. Second, the attack surface grows sharply for a few weeks and then collapses, so access granted in a hurry is often never removed. For the general high-risk personal security baseline that applies beyond politics, see the Personal Security for High-Risk Individuals Guide.

Protect the candidate's accounts first

Start with an inventory of the accounts that would cause real harm if taken over. For most candidates the list is short.

Account	Why it matters	Minimum control	Stronger control
Personal email (including old accounts)	Password resets for everything else; private correspondence that could be leaked	Unique password, authenticator app 2SV, forwarding rules checked	Passkey or security key; an enhanced protection programme such as the Google Advanced Protection Program
Office or parliamentary email	Constituent casework and official business	Managed by the employer's IT team; report every suspicious message	Phishing-resistant MFA required by policy
Campaign workspace (email, files, chat)	Strategy, donor data, volunteer personal data	Named accounts for every user, MFA enforced for all, admins separate	Security keys for administrators and the candidate
Public social media accounts	Impersonation, false statements posted in the candidate's name	2SV, a social media management service so staff post without the candidate's password	Passkeys where offered; a small, named list of people with publishing rights
Messaging apps	Group chats with staff, donors and journalists	App 2SV or registration lock, linked devices reviewed	Disappearing messages for sensitive groups; verify new contacts by phone
Domain registrar and website host	Takeover redirects the site and email	Unique password, 2SV, registrar lock	Delegated access instead of shared logins
Bank, payment and donation platforms	Direct financial loss	2SV, payment approvals by two people	Separate device or browser profile for finance

Passwords: the NCSC recommends strong, unique passwords for important accounts, three random words as a method, and a password manager built into the browser or as a dedicated app. Never share passwords for any account. See the Password Manager Setup Guide.
2SV choice: the NCSC guidance prefers an authenticator app to SMS. Because adversary-in-the-middle kits capture codes and session cookies, the candidate's email and storage accounts should move to passkeys or hardware security keys. See the Phishing-Resistant MFA Guide.
Unexpected prompts: deny any 2SV prompt you did not start, then change the password on that account and on any account that shares it, as the NCSC advises. Never read a code out to anyone, including someone claiming to be the platform or a colleague. See the MFA Fatigue and Bypass Guide.
Mail forwarding: the Star Blizzard advisory describes attackers setting up forwarding rules after compromise and recommends disabling forwarding or checking rules regularly. Check forwarding, filters, delegates and connected apps on personal email monthly during a campaign.

Spear-phishing and impersonation patterns to train for

Briefings for candidates and staff work best when they describe the actual tradecraft rather than generic phishing advice. The NCSC's December 2023 Star Blizzard advisory is a good teaching text because it describes the full sequence.

Research: the attacker uses open sources and social media to find real contacts and topics of interest. ATT&CK tracks this preparation under T1598 Phishing for Information and the creation of fake profiles under T1585.001 Social Media Accounts.
Approach: an email from a webmail address (the advisory names Outlook, Gmail, Yahoo and Proton Mail) impersonating a known contact or an expert in the field, often with a conference or event invitation.
Rapport: benign conversation, sometimes over an extended period, before any link appears.
The link: a link to a sign-in page, or a link inside a document shared through OneDrive or Google Drive (ATT&CK T1566.002 Spearphishing Link). EvilGinx is used to steal credentials and session cookies (T1539 Steal Web Session Cookie).
After access: the attacker reads mail, steals attachments, sets up forwarding (T1114.003 Email Forwarding Rule), harvests contacts and phishes others from the compromised account.

Messaging apps add their own pattern. The NCSC warns high-risk individuals not to share verification codes or scan unexpected QR codes, because attackers have used them to link their own devices to a victim's account. Teach staff to check the list of linked devices and to verify any new contact, or a known contact on a new number, with a phone call. See the QR Code Phishing (Quishing) Guide.

Voice and video impersonation of the candidate is a separate risk: a cloned voice asking a staff member to move money or release a statement. Agree a verification step for any urgent request that arrives by phone or video, such as a call back on a known number or a code word. See the Deepfake and AI Impersonation Guide.

Harden devices and the household

Updates: automatic updates on, apps from official stores only, and replace any phone, tablet or laptop that no longer receives security updates.
Extra protection modes: the NCSC suggests Apple's Lockdown Mode for people who may face sophisticated attackers, and Windows in S mode, which only runs apps from the Microsoft Store. See the Apple Lockdown Mode Guide and the Android Advanced Protection guide.
Physical access: PIN or password at power-on, a screen lock from standby, Find My on iPhone or Find My Device on Android with remote wipe enabled, and no public USB charging points.
Family members: spouses, children and close relatives are a route to the candidate and a target for harassment. Brief them on the same basics: unique passwords, 2SV on email and social accounts, private social profiles, no location tagging and no posts that reveal the home address or routines.

Run the campaign organisation securely

A campaign is a small organisation that forms quickly, handles sensitive personal data and disbands after polling day. The controls below fit that life cycle.

Phase	Security tasks	Owner
Before launch	Choose one managed workspace for email, files and chat; enforce MFA for all; create separate admin accounts; register the domain under the campaign, not a volunteer; set up DMARC; write a one-page incident plan with contacts	Campaign manager with IT lead
Recruitment	Named accounts for every staff member and volunteer; least privilege on donor and canvassing data; short briefing on phishing, codes and reporting	Volunteer coordinator
Active campaign	Weekly review of new accounts, shared links and admin changes; monitoring of lookalike domains and fake social profiles; denial of service readiness for the website	IT lead
Final fortnight and polling day	Freeze non-essential changes; confirm escalation contacts with the host, registrar and platforms; staff on call for takedown and incident response	Campaign manager
After the result	Remove volunteer and contractor access; export and retain records as the law requires; delete personal data no longer needed; close or archive accounts; transfer domains to the party or the elected office	Campaign manager and data protection lead

Volunteers and shared devices: do not let volunteers use the candidate's or the manager's login. Give each person their own account, even for a few weeks, so access can be removed and actions traced. See the Employee Offboarding Security Checklist.
Layered phishing defence: the NCSC tells political organisations not to rely on staff spotting malicious email: combine filtering, MFA, reporting and quick response.
Donations and payments: require two-person approval for any change of bank details and any payment above a set amount, and confirm by phone on a known number.
Personal data: canvassing returns, donor records and volunteer details are personal data under data protection law; limit who can export them. See the GDPR Compliance Guide for Security Teams.

Protect the website, domain and email

The NCSC's guidance on websites and custom email domains for high-risk individuals is short and specific. Apply it to every domain the campaign or candidate controls.

Registrar: choose a registrar that allows other people to manage domains in your account without sharing a password, offers 2SV, domain locking and DNSSEC, and keep contact details current so renewal notices arrive. See the Domain Registrar Compromise Playbook.
Email authentication: configure SPF, DKIM and DMARC even on domains that send no email, using the NCSC's parked domain guidance, and add TLS and MTA-STS. The NCSC's free email security check verifies the settings. See the DMARC, SPF and DKIM Guide.
Hosting: pick a host that offers 2SV and manages TLS certificates, keep the content management system, themes and plugins updated, and consider a managed website builder that handles security for you.
Denial of service: the NCSC asks political organisations to prepare websites to withstand denial of service and to be ready to adjust controls; consider a mitigation service before the campaign peaks (ATT&CK T1498 Network Denial of Service). See the DDoS Readiness Checklist.
Certificate transparency monitoring: sign up to be alerted when a certificate is issued for your domain, which can reveal impersonation sites.
Lookalike domains: register obvious variants of the candidate's name and watch for fake donation pages. See the Domain Portfolio and Lookalike Domain Management Guide.

Government and non-profit support

Several free services exist for political targets. Their availability depends on country and status, so confirm eligibility directly.

Service	Provider	What it does	Who it is for
Account Registration	UK NCSC	Notifies subscribers if the NCSC becomes aware of an incident affecting a personal account, and highlights extra security features	Opt-in, by invitation: election candidates, elected officials and party leaders
Personal Internet Protection	UK NCSC	Warns when a personal device visits a known malicious domain and blocks outgoing traffic to known malicious addresses from an infected device	Opt-in, by invitation; requested by email with a short business case
Early Warning	UK NCSC	Alerts registered organisations to potential threats affecting their network	UK organisations, via a MyNCSC account
Check your Cyber Security and email security check	UK NCSC	Remote checks of public-facing IT and email settings with no installation	UK organisations and individuals
Exercise in a Box	UK NCSC	Toolkit for rehearsing incident response	Organisations
Physical and personal safety guidance	UK NPSA	Defending democracy and personal safety guidance for high-risk individuals	Candidates, representatives and their teams
Defending Digital Campaigns	US non-profit	Free security products, services, knowledge and an incident response service for eligible campaigns and committees; the FEC issued Advisory Opinion 2018-12 on this kind of free provision on 21 May 2019	Eligible US campaigns and committees (federal, and state level in some states)

Detection and response

Most campaigns have no security operations centre, but can still watch a few signals and respond quickly.

Signals to watch: new sign-ins from unfamiliar locations or devices on the candidate's accounts; new forwarding rules, delegates or connected apps; new linked devices on messaging apps; DMARC aggregate reports showing unknown senders; certificate transparency alerts; new social profiles using the candidate's name or photo.
Reporting route: the NCSC asks high-risk individuals to report suspicious email to their organisation's IT support, including messages sent to personal accounts, and treats reporting as blameless. UK incidents go to report.ncsc.gov.uk.
First hour after a suspected takeover: from a clean device, change the password, sign out all sessions, remove unknown forwarding rules, apps and linked devices, re-register 2SV, then warn contacts that messages from the account may be fake. See the Account Takeover Response Playbook.
Doxxing and harassment: remove home addresses from public registers where the law allows, request platform takedowns, and involve police and the NPSA guidance where threats are physical. See the Doxxing Prevention Guide.
Rehearse: the NCSC recommends political organisations maintain and rehearse an incident response plan and consider an assured incident response company.

Metrics that show the programme is working:

Percentage of staff and volunteers with named accounts and MFA in the campaign workspace (target 100%).
Number of the candidate's high-value accounts on passkeys or security keys, against the inventory.
Median time from a volunteer leaving to access removal (target same day).
DMARC policy at p=reject on every sending domain and on parked domains.
Number of suspicious messages reported per month, and time from report to response.

Common failure patterns

Protecting only the office account. The candidate's personal webmail is left on SMS codes, yet it is exactly what Star Blizzard-style campaigns aim at.
Shared logins. The candidate's social media password is known to five volunteers, so nobody can tell who posted what and nobody can remove access cleanly.
Domains registered by a volunteer. The campaign domain sits in an individual's personal registrar account and lapses or leaves with them.
No offboarding after polling day. Volunteer accounts and shared links stay live for years, holding canvassing and donor data.
Forwarding rules never checked. A compromise continues silently because a rule copies every message to an outside address.
Trusting the channel. A request from a known name on a new number or new email is acted on without a call back. The Microsoft Storm-0558 Key Breach shows that government email itself can be read by a state actor, so sensitive decisions should not rest on email alone.

Framework mapping

Campaign control	NIST CSF 2.0	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A	ATT&CK technique addressed
Named accounts, MFA, phishing-resistant sign-in	PR.AA-01	Controls 5 and 6	A.5.17	T1566.002, T1539
Least privilege on donor and canvassing data, offboarding	PR.AA-05	Control 6	A.5.18	T1114.003
Briefings for candidate, staff, volunteers, family	PR.AT-01	Control 14	A.6.3	T1598, T1585.001
Email authentication and web protection	PR.PS-01, PR.PS-02	Control 9	A.5.14	T1566.002
Website denial of service readiness	DE.CM-01	Control 13	A.8.20	T1498
Incident plan, reporting and rehearsal	RS.MA-01	Control 17	A.5.24	All of the above
Roles: who owns campaign security	GV.RR-02	Control 17	A.5.2	Not applicable

Practitioner checklist

List the candidate's high-value accounts, including old and personal ones, and move email and storage to passkeys or security keys.
Enrol eligible candidates and officials in the government services available to them, such as NCSC Account Registration and Personal Internet Protection in the UK.
Set up one managed campaign workspace with named accounts, enforced MFA and separate admin accounts.
Register campaign domains to the organisation, lock them, enable 2SV, and publish SPF, DKIM and DMARC on every domain, including parked ones.
Use a social media management service so staff publish without the candidate's password.
Brief the candidate, staff, volunteers and family on spear-phishing, verification codes, QR device linking and voice impersonation.
Check forwarding rules, delegates, connected apps and linked devices monthly, and weekly in the final fortnight.
Prepare the website for denial of service and confirm escalation contacts with the host and registrar.
Write and rehearse a one-page incident plan with reporting routes and an incident response contact.
Remove volunteer and contractor access, and delete unneeded personal data, within days of the result.

Security for Politicians and Candidates: Protecting Campaigns, Accounts and Families