A bipartisan group of political operatives and cybersecurity experts, drawn together in a project sponsored by Harvard University, is out today with a “Cybersecurity Campaign Playbook,” designed to protect political candidates against electronic hacking – foreign or domestic.

The 27-page guide reflects the heightened concern about cyberattacks among political professionals and election officials alike in the wake of the 2016 election, when hackers apparently backed by the Russian government distributed thousands of emails lifted from Democratic Party accounts and penetrated voter registration systems in at least 21 states.

“Human error is the number one cause of breaches,” the authors write, admonishing candidates and political professionals to take security concerns seriously.

The report begins with a “top five checklist,” including recommendations that campaigns use commercial “cloud” servers to handle their office functions, require two-factor authentication for access to email, social media and other important accounts, use only long, difficult-to-duplicate passwords, and have plans in place to deal with security breaches.

“We come from different political parties and don’t agree on much when it comes to public policy, but one thing uniting us is the belief that American voters should decide our elections and no one else,” Robby Mook, Hillary Clinton’s 2016 campaign manager, and Matt Rhoades, who ran Mitt Romney’s 2012 campaign, write in an introduction to the guidebook.

“Our increasingly digital way of living and working offers new ways for adversaries to influence our campaigns and elections,” the pair add. “While you don’t need to be a cyber expert to run a successful campaign, you do have a responsibility to protect your candidate and organization from adversaries in the digital space.”

The report was prepared and distributed by the Defending Digital Democracy project at the Belfer Center for Science and International Affairs, part of Harvard’s Kennedy School of Government. The authors include more than three dozen scholars, students, political operatives, and cybersecurity experts from firms including Google, Facebook, Citibank, Goldman Sachs and Aetna.

###