Can Campaign Websites Be Trusted With Your Money?

Many political campaigns in this current election have a nifty “donate now!” button on their websites. While they’re convenient for the candidates, it’s not clear if these buttons are secure for the donors.
Websites and retailers who collect credit-card numbers, both online and offline, are subject to rules regarding how the financial data is stored.

Those rules are laid down and enforced by the Payment Card Industry Security Standards Council, commonly referred to as PCI, a global body that won’t hesitate to yank the credentials of any organization not in compliance.

However, campaign websites are generally not considered retailers, and are usually transitory in nature, not lasting beyond an election cycle. That removes them from strict PCI oversight, said Tim Erlin, director of product management and IT risk and security strategy at nCircle in San Francisco.
Erlin has examined campaign websites for politicians running for state and federal offices in the past few election cycles.

In most cases, Erlin said, he has no idea after looking at a particular site whether or not the campaign outsources credit-card payment-processing to a third party, who that third-party processor might be or who stores the collected information.  Contunue Reading...