A behind-the-scenes account on what it was like to provide basic cybersecurity training to 41 Democratic Congressional campaigns from late 2017 to 2018
You know how it happens. You try to secure one Congressional campaign, and then another, and pretty soon you can't stop. Tweets: @pinboard , @allafarce , @codinghorror , @patio11 , @allafarce , @howelloneill , @thegrugq , and @codinghorror Tweets: @pinboard : I wrote this blog thingo about what I learned last year trying to secure Congressional campaigns. https://idlewords.com/... Dave Guarino / @allafarce : These bits were what resonated with me most, but the whole thing is a joy to read. It also contains many very interesting details about the minutiae of campaigns and potential attack vectors. And quips! Many quips! Go read it. https://idlewords.com/... Jeff Atwood / @codinghorror : Dear Tech Peoples: we need to kick much ass in the 2020 election, so pay attention https://idlewords.com/... Patrick McKenzie / @patio11 : Cross apply this experience to in-office politicians, regulators, the military and intelligence communities (to an under appreciated degree), high-value business targets, etc, although the transient nature of campaigns is rare among institutions. https://twitter.com/... Dave Guarino / @allafarce : This, from @Pinboard, on his work to provide security training to congressional campaigns in the 2018 election cycle, is very good (funny even!) Much also resonated with my experiences at the nexis of tech and govt, and I'd like to pull out some points: https://idlewords.com/... Patrick Howell O'Neill / @howelloneill : A really interesting and frankly educational blow-by-blow about what it's like to teach campaigns cybersecurity: https://idlewords.com/... Thaddeus E. Grugq / @thegrugq : Truth from the trenches. @Pinboard tries to get normies to implement basic security measures. You'll laugh, you'll cry, you'll shudder with horror. Motivated high value targets struggle to use FIDO! https://idlewords.com/... Jeff Atwood / @codinghorror : Unpopular But Correct Opinion: password managers don't work for normal humans, and *never will*. Focus on getting people to use hardware security keys, because that DOES work. https://idlewords.com/... https://twitter.com/...
Context & Ripple Effects
After 2016, the Democratic National Committee rebuilt its own security operation, hiring Silicon Valley staff and pushing phishing warnings in its post-breach buildout — but that apparatus stops at the party level. Down-ballot, the gap was filled by whoever showed up: this account describes one volunteer, Pinboard's Maciej Cegłowski, delivering basic hygiene training to 41 House and Senate campaigns over the 2018 cycle.
The piece lands between two structural constraints documented elsewhere in the coverage: election law bars companies from giving candidates discounted services, pricing professional help out of most races under existing campaign-finance rules, and campaign tech runs on one-off, startup-style funding with no budget for maintenance per the recurring funding critique. Volunteer labor is what remains when both markets fail.
First-order effects
- The 41 campaigns got baseline defenses — phishing awareness and account hardening — from a single unpaid outsider rather than from the DNC, a vendor, or any government body.
- Cegłowski's writeup turns his experience into reusable knowledge for the next cycle's volunteers, effectively documenting the playbook the party infrastructure never provided.
Second-order effects
- Security firms that might serve campaigns face a choice shaped by the discount prohibition: charge full commercial rates few congressional races can pay, or sit out — leaving the market to amateurs and the DNC's limited reach.
- The reliance on individual volunteers raises the same talent-scarcity problem the broader field reports: even professionals disagree on which skills matter most per the practitioner survey, so quality of volunteer help varies wildly race to race.
Third-order effects
- If the pattern holds, every even-year election reproduces a scramble where down-ballot security depends on whichever technologists volunteer — until either election law is amended to allow subsidized services or a public body like CISA, itself reported as underfunded and short-staffed in interviews with its own people, absorbs the mission.
- The deeper shift is organizational: campaign security migrating from ad-hoc heroics toward standing infrastructure, the same consolidation the DNC began internally now needing an equivalent for hundreds of separate campaign organizations.
The trend: US campaign cybersecurity is being improvised from volunteer labor and centralized party patches because election finance law and one-off funding structures leave down-ballot races without a real market for professional defense.