Account Security, Measuring Results and Reporting Digital Spending

The last lesson of this module covers three jobs that happen behind the posts: keeping the accounts safe, finding out whether any of it worked, and reporting what it cost. Each one gets skipped in small campaigns because it is invisible until something goes wrong. A hijacked Facebook page in the last week of a race, a dashboard that credits the wrong ad, and a Sunshine report that lists "Visa" as the payee for $3,000 of advertising are all common, and all avoidable.

Home and personal security basics are in the home computer security module's lesson on passwords, two-step and passkeys, and threat planning for people in public life is in the training site's digital safety module. This lesson applies them to a campaign's shared accounts.

Account security for campaigns

Why small campaigns are targets

A local campaign has three things worth stealing: an audience (a page with thousands of followers can be renamed and sold, or used to push scams), money (a linked ad account with a saved card), and information (donor and volunteer lists, internal email, the candidate's personal accounts). Most attacks are not aimed at the campaign at all. They are the same phishing emails and fake "your page will be disabled" messages sent to every page manager, and they work on whoever clicks first.

Logins: one person, one account, phishing-resistant

The single most common campaign security failure is the shared password: one Facebook login or one Gmail account that five volunteers use, written on a sticky note, with text message codes going to the candidate's phone. Nobody can tell who did what, nobody can be removed without changing the password for everyone, and the account is only as safe as the least careful person who knows the password.

Use the platforms' own sharing systems instead. Each person logs in with their own account and is granted a role on the campaign's page, ad account or workspace. Then make each of those personal accounts hard to phish. CISA's multifactor guidance says "any MFA is better than no MFA," but also that not all methods protect equally, and that the only widely available phishing-resistant authentication is FIDO/WebAuthn: security keys and the passkeys built on the same standard. A text message code can be read by someone who has stolen your number, and a code typed into a fake login page goes straight to the attacker. A passkey or security key only works on the real site. Where phishing-resistant login is not yet possible and a platform uses push approval, CISA suggests considering number matching to stop "push bombardment," the trick of sending approval requests until someone taps yes.

Roles and admins

Every major ad platform separates who can see, who can edit and who can control access. Use those separations.

Platform	Roles as of October 2026	Who should get what
Google Ads (access levels)	Email-only; Billing; Read-only; Standard (edit campaigns, view reports); Admin (all of Standard plus granting and changing user access, linking Analytics, reviewing users' authentication methods and last login, completing advertiser verification)	Two trusted Admins (candidate and treasurer or manager). Standard for the person running ads. Read-only for the treasurer if not an Admin, so they can pull invoices. Google warns that an account with only one admin may lose access to its tags if that person becomes unavailable
Meta business portfolio (roles, from Meta's help text)	Full control (formerly business admin: everything, including adding and removing people and deleting the portfolio); Basic partial access (only assigned assets, the default); Apps and integrations; Finance access as an added option; Temporary access from 3 to 75 days that ends on its own	Two people with full control. Basic access to the page and ad account for each volunteer, with only the tasks they need. Temporary access for a short-term vendor or a summer intern
Email platform, website host, domain registrar, donation platform	Varies; most offer owner or admin and limited user roles	Owner is the campaign, not a vendor. Keep the domain registrar login with the candidate or treasurer; losing the domain loses the website and email

Meta's role names have changed more than once, and the official help page could not be loaded for this lesson; the names above come from a help article adapted from Meta's Business Help Center. Check the current names in the business settings screen.

Phone numbers and SIM swaps

If an account's recovery or two-step codes go to a phone number, the account is only as safe as that phone line. In a SIM swap, a caller talks a carrier into moving your number to a new SIM, then receives your codes. Ask your carrier for a number lock, port-out PIN or SIM protection setting, which most carriers offer to account holders, and move important accounts from text codes to passkeys or an authenticator app. Do not publish the candidate's personal cell number; use a separate campaign number.

Phishing aimed at page managers

Campaign page managers get messages that look like platform warnings: "your page violated our policy, appeal within 24 hours," with a link to a fake login page, or a fake "copyright complaint" with an attachment. Real platform notices appear inside the platform's own support or account quality screens. Go there directly instead of clicking the link. The home security module's lessons on email and browsing and common scams show more examples.

Free help

Defending Digital Campaigns (DDC), a nonprofit, describes itself as giving eligible campaigns and committees "free products, services and knowledge to defend themselves from cyber threats and attacks," including a security toolkit for AI use, a knowledge base and incident response guidance. Its site was active in 2026 and lists eligibility pages for federal campaigns and for campaigns in a handful of states (Ohio, Georgia, Virginia and Michigan when checked); Idaho state and local races were not listed. The FEC addressed DDC's free services to federal candidates and party committees in Advisory Opinion 2018-12, issued in final form May 21, 2019. That opinion is about federal law. A state or local Idaho campaign offered free security services by any company should ask the Secretary of State's elections division whether they are an in-kind contribution before accepting.

CISA's election security page, as of October 2026, is aimed at election officials and election infrastructure vendors: no-cost services for state and local governments, EI-ISAC membership and an election cybersecurity toolkit. It listed no campaign-specific checklist when checked. Its general guidance, such as the MFA page above, is still useful to anyone.

When an account is hacked

Speed matters most in the first hour. An attacker who takes over a page usually changes the email and phone on the account, removes the other admins and starts posting or running ads on the saved card. The second admin is the reason you set one up.

Measuring results

The measurement and experiments lesson in the social media strategy module explains what to measure and how to run a fair test. This section is the plumbing: how a small campaign actually collects the numbers.

UTM tags

A UTM tag is a set of labels on the end of a link. When someone clicks it, the website's analytics records where they came from. Google Analytics says you should always use utm_source, utm_medium and utm_campaign, and recommends utm_id and utm_source_platform; utm_content separates two links in the same email or two versions of an ad, and utm_term is for paid keywords. Missing parameters show up as "(not set)." Values are case sensitive, so "Facebook" and "facebook" become two different sources. Pick lowercase and a fixed list of names, and write them down.

A tagged link for the volunteer signup button in the second weekly email looks like this:

https://example-campaign.org/volunteer?utm_source=newsletter&utm_medium=email&utm_campaign=gotv2026&utm_content=button2

Conversions

Clicks and views are activity. Results are the things the plan in lesson 1 set as goals: signups, donations, volunteer forms, RSVPs. Count each one as a conversion. On the website, analytics can record a conversion when someone reaches the "thank you" page. Ad platforms offer their own tracking code (a pixel or tag) to report conversions back to the ad account; it collects data about visitors, so mention it in the privacy policy from lesson 3. The donation platform's own export is the most reliable count of money, and the email platform's list growth is the most reliable count of signups.

A dashboard a treasurer can read

One row per week, filled in every Monday from the platforms' own reports, beats a live dashboard nobody checks.

Week	Ad spend	Impressions	Clicks	Signups (all sources)	Signups from paid	Cost per paid signup	Donations ($)	Email list size	Note
1	$200	13,500	150	32	18	$11.11	$740	410	Ad A (video)
2	$200	13,000	160	40	20	$10.00	$1,150	452	Forum on Thursday
3	$200	13,500	170	48	22	$9.09	$980	500	Ad B (photo) tested
Total	$600	40,000	480	120	60	$10.00	$2,870		Invented figures

Check the arithmetic each week: 18 + 20 + 22 = 60 paid signups, and $600 / 60 = $10.00. The "Note" column matters most. A spike in week 2 that lines up with a forum is not the ad's doing.

Honest attribution

Every platform claims credit generously. Meta and Google count a conversion when someone saw or clicked an ad within a set window, even if the person also got three emails and a knock on the door. Add up each platform's claimed conversions and you will often get more signups than you actually have. Use the donation platform and email list as the ground truth, use tagged links to split them roughly by source, and remember that the goal in a local race is votes, which no dashboard measures. Turnout among the people you contacted, compared with similar voters you did not, is the only honest test of that, and the strategy module's measurement lesson explains how small campaigns approximate it.

Reporting digital spending on Idaho Sunshine reports

Digital spending is reported like any other spending; Idaho law has no separate category for it. The basics of Idaho's reports and filing calendar are in Idaho Sunshine Reports, the treasurer's duties are in course 46 lesson 3, and searching other campaigns' reports is in course 46 lesson 10.

What the statute requires

Idaho Code 67-6607(1)(b) requires each expenditure or encumbrance of $25 or more to be itemized with the name and address of the person paid and the amount, date and purpose. Smaller items may be reported as one total. Every itemized expenditure must be backed by an invoice, receipt or canceled check, which is not filed but must be kept for one year after the report is filed. The section was last amended in 2020.

What the Disclosure Manual adds

The Secretary of State's Campaign Finance Disclosure Manual fills in the practice:

• Report the true payee. The manual says an expenditure "should be reported with the true payee (rather than the candidate or committee name)." When a volunteer or the candidate puts a $150 ad buy on a personal card and is reimbursed, the report names the platform and the purpose, not the volunteer.
• Card payments go to the vendor. A purchase paid right away may be reported to the vendor regardless of whether it was paid by debit, credit or cash. If the campaign will not pay a card balance in full during the period, record the expenditure and also record the debt.
• Candidate spending. When a candidate pays personally for campaign costs, report it as a contribution or a loan from the candidate plus the expenditure, and when the campaign repays, report the original payee and expense code. The manual's stated aim is to be transparent about what the money was spent on.
• Refunds. A refund or credit from a vendor is recorded with "Return" under "Actions" on the original expenditure, with the reason.
• In-kind gifts appear twice. They are listed in both total contributions and total expenditures, and every in-kind gift is itemized whatever its size.
• Volunteers. Contributions do not include volunteers' personal services, but a volunteer who spends more than $25 hosting an event has made an in-kind contribution of that amount.
• Committees name the candidates. A PAC's expenditure lists the payee, the type (such as an independent expenditure) and the candidates supported or opposed, and coordinated spending is an in-kind contribution to the candidate. Independent expenditures of $1,000 or more within 16 days of an election need a 48-hour notice.

Digital item	How it appears on the report	Payee
Meta or Google ad buy charged to the campaign card	Expenditure, purpose such as "online advertising," itemized if $25 or more	The platform company
Consultant who buys ads and bills a markup	Expenditure to the consultant; ask the elections division whether the underlying platform payments should also be shown, and keep the consultant's invoices showing them	The consultant
Email platform, website hosting, domain, texting vendor monthly fees	Expenditure each time paid, or debt if billed and unpaid at the period's end	Each vendor
Donation platform processing fees	Expenditure; a fee the donor chooses to cover is part of the contribution (course 46 lesson 2)	The platform
Volunteer who posts, edits video and runs the page for free	Not reported: volunteer personal services	None
Professional designer or videographer who donates normally billed work	In-kind contribution at fair market value, and matching in-kind expenditure; counts against the contribution limit	The donor (contribution) and the donor as vendor (expenditure)
Supporter who buys a $200 ad boost for the campaign's post, coordinated with the campaign	In-kind contribution of $200 from the supporter and an in-kind expenditure to the platform	Supporter and platform
Fraudulent ad charges after a hack, later reversed	Report the charge if paid, then record the reversal as a return with the reason	The platform

Ad platforms keep their own public records too. Meta's Ad Library and Google's transparency report list political ads and spending ranges for authorized advertisers, and reporters compare them against Sunshine reports. Google's political content policy also lists an Idaho restriction on ads related to ballot measures and candidates for local elections, so a county or city campaign should not plan on Google election ads at all (lesson 5). A campaign whose Sunshine report shows $4,000 to Meta while the Ad Library shows $400 of ads under its name should be able to explain why, for example a vendor running ads under its own page.

Pictures, Numbers and Infographics

Two national figures put a small Idaho digital budget in context. The first is where the money went in the record 2024 cycle; the second is where Americans now say they get news.

Figure	Value	Source
Total U.S. political ad spending, 2023 to 2024 cycle	$11.1 billion, a record	AdImpact, 2023-2024 Cycle in Review
Broadcast TV	$5.35 billion (48 percent)
Connected TV (streaming)	$2.33 billion (21 percent)
Digital (Facebook and Google)	$1.64 billion (15 percent)
Cable / radio / satellite	$1.37 billion (12 percent) / $326 million (3 percent) / $89 million (1 percent)
U.S. adults who get news from social media at least sometimes, 2026	59 percent	Pew Research Center, Social Media and News Fact Sheet, survey Aug. 24 to 30, 2026, 5,166 adults, published Oct. 19, 2026
Regularly get news on each site, 2026	Facebook 40 percent; YouTube 34; Instagram 23; TikTok 20; X 10; Nextdoor 8

Read them together. Digital platforms took about one dollar in seven of national political ad money in 2024, yet four in ten U.S. adults now say they regularly get news on Facebook, up from 33 percent in 2024 and 38 percent in 2025 in Pew's series. The national money follows television because statewide and presidential races buy whole media markets. A county commission or legislative race in Idaho cannot afford that and does not need it: its voters fit inside a few ZIP codes, and the cheapest way to reach them is the free and low-cost digital work this module covers, plus doors and mail. AdImpact's report gives no separate Idaho figure, and the Meta and Google libraries are the place to look up Idaho spending for a given race.