Cloudflare for Campaigns: A Security Suite Built for Politicians Under Fire

Political campaigns have become prime targets for state-sponsored hackers, hacktivists, and criminal groups. From phishing attacks against the Macron and Merkel campaigns to DDoS attacks on UK political parties and brute-force login attempts on US congressional campaigns, the threat landscape has shifted decisively. Cloudflare has watched this up close: the company has provided services to 18 major US presidential campaigns during the 2020 cycle, blocking roughly 400,000 attacks per day on a typical day across those properties—and more than 40 million on busy days.

That front-line experience is now being productized. Cloudflare is launching a new offering, Cloudflare for Campaigns, designed to give political parties and candidates—particularly smaller operations with limited IT staff—access to a suite of security and reliability tools that would otherwise be out of reach.

What's in the Package?

For the campaign website itself, the package includes Cloudflare's Business-level service plus security controls that map directly to known threat types targeting campaigns: a web application firewall, rate limiting, load balancing, bot management, and "I am Under Attack" support at the Enterprise level. Multi-user account enablement is included so teams can share access without sharing credentials.

For internal teams, Cloudflare is bundling Cloudflare Access, which lets campaigns secure, authenticate, and monitor user access to any domain, application, or path on Cloudflare without requiring a VPN. Cloudflare Gateway will also be provided—adding DNS-based filtering at multiple locations to block malicious content before it reaches campaign staff, mitigating phishing and malware. Gateway will be available after the product's public release. The package is rounded out by a best-practice guide for keeping both the public site and internal tools secure.

The Regulatory Hurdle: Free Versus Paid

There is broad consensus that campaigns face real cyber threats, but far less agreement on how to help without bending campaign finance rules. In the US, corporations are barred from contributing money or services to federal candidates or political parties. That prohibition extends to free or discounted services unless they are offered on the same terms to the general public.

The Federal Election Commission (FEC) has been wrestling with the application of those rules to cybersecurity. The agency has issued advisory opinions that show a path forward:

  • In 2018, the FEC approved Microsoft's plan to offer enhanced account security to "election-sensitive" users, reasoning that the service was offered to paying customers in the ordinary course of business.
  • In July 2019, the FEC approved a cybersecurity company's proposal to sell low-cost anti-phishing services to campaigns—again because the services were offered on the same terms to non-political clients.
  • In May 2019, the FEC approved Defending Digital Campaigns' (DDC) request to partner with tech companies to offer free or discounted cybersecurity services, citing the "unusual and exigent circumstances" of demonstrated foreign cyberattacks against party and candidate committees.

Those decisions reflect an effort to balance the demonstrated threat environment against the intent of campaign finance laws—allowing assistance while insisting on transparency and consistent pricing.

A Free Tier via DDC—and a Paid Option for the Rest of the World

Cloudflare is partnering with DDC, a nonprofit founded to help campaigns defend themselves, to offer Cloudflare for Campaigns at no cost to US candidates and parties that meet DDC's eligibility criteria. Those criteria are the ones DDC set out in its FEC filings:

  • House candidate committees with at least $50,000 in receipts for the current cycle, or Senate committees with at least $100,000;
  • House or Senate candidates who have qualified for the general election ballot; or
  • Any presidential candidate committee polling above five percent nationally.

For campaigns outside the United States—or US campaigns that don't qualify under DDC's rules—Cloudflare will also sell Cloudflare for Campaigns as a paid service. That approach acknowledges that campaign finance rules differ worldwide and that the integrity of democratic processes should not depend on where a candidate happens to run.

More details on eligibility for the free services are available at cloudflare.com/campaigns/usa, and information on the paid package is posted at cloudflare.com/campaigns.