Can a nonprofit give free cybersecurity tools and training to Virginia political campaigns without triggering campaign finance reporting?

Plain-English summary

Senator Ryan McDougle asked the AG whether a 501(c)(4) nonprofit could donate free cybersecurity software, hardware, and training to Virginia campaigns without forcing those campaigns or the nonprofit to file campaign-finance reports. The AG said no reporting is required, but the answer turns on one specific test.

Under Virginia's Campaign Finance Disclosure Act, a "contribution" or "expenditure" exists only when the money, goods, or services are provided "for the purpose of expressly advocating the election or defeat of a clearly identified candidate." Free cybersecurity tools that protect a campaign from hacking are not express advocacy. They don't tell anyone how to vote. Given that the nonprofit in this case was offering its services to every eligible campaign on a nonpartisan basis with objective eligibility criteria, the AG concluded the donations do not need to be reported.

The opinion is narrow. It depends entirely on the facts the senator presented: a 501(c)(4) operating non-partisanly, with public objective eligibility thresholds, offering technical assistance only. Change those facts (donate only to one party, tie eligibility to political position, offer endorsement messaging) and the analysis changes.

What this means for you

If you run a nonprofit considering free services to campaigns

The opinion turns on whether the goods and services are provided "for the purpose of expressly advocating the election or defeat of a clearly identified candidate." Under the facts the senator described, the AG identified the features that kept the offering outside that purpose:

1. The organization set objective eligibility requirements (threshold fundraising levels for the election cycle, or ballot access) so that campaigns could access the goods and services on a "fair and equal basis."
2. The goods and services were offered on a nonpartisan basis, not to endorse, promote, or favor any particular party or campaign.
3. The offerings were technical (cybersecurity software, hardware, information-sharing systems, training) and aimed at protecting a campaign from cyber threats, not at advocating any candidate's election or defeat.

The opinion does not address other kinds of in-kind services, and it is expressly limited to the facts presented.

If you are a Virginia campaign accepting these services

Under this opinion, on the facts presented, donated nonpartisan cybersecurity goods and services are not reportable "contributions" or "expenditures" because they are not provided for the purpose of expressly advocating a candidate's election or defeat. The opinion rests on those specific facts, so a relationship that took on an express-advocacy purpose would fall outside what the AG analyzed.

If you are a Virginia campaign finance attorney

The opinion turns on the express-advocacy purpose that the Act builds into the definitions of "contribution" and "expenditure." Two points practitioners should note:

• The donated goods and services fit the Act's definition of an "in-kind contribution," but the opinion holds they are reportable only if provided "for the purpose of expressly advocating the election or defeat of a clearly identified candidate." Nonpartisan technical assistance with objective eligibility criteria does not meet that purpose.
• The opinion is fact-bound. It does not read as a general safe harbor for any in-kind service donation; it resolves the specific nonpartisan-cybersecurity facts the senator presented.

If you are a State Board of Elections investigator

The opinion describes a specific factual pattern (objective eligibility tiers, nonpartisan offering, no electoral messaging) that the AG found nonreportable. If your investigation encounters facts that diverge from this pattern (eligibility tied to candidate ideology, services that include messaging or voter outreach, undisclosed coordination), the express-advocacy line is no longer clean and reporting obligations may apply.

Common questions

Q: What counts as "express advocacy" under the Virginia Campaign Finance Disclosure Act?
A: Per 1 Va. Admin. Code § 20-90-30, express advocacy means a communication using phrases like "vote for," "elect," "support," "cast your ballot for," "Smith for Congress," "vote against," "defeat," "reject," or "any variation thereof," or a communication that, taken as a whole, could only be interpreted by a reasonable person as advocating the election or defeat of one or more clearly identified candidates. Technical assistance that doesn't address voting is well outside this line.

Q: Does Virginia's Act restrict donations at all, or just require reporting?
A: Just reporting. Unlike federal law, the Virginia Act doesn't limit how much an individual or entity can donate. The question is always whether the donation must be disclosed, not whether it's allowed.

Q: Can the nonprofit pick which candidates get the free services?
A: Only on objective, nonpartisan criteria. The AG's analysis depended on the nonprofit using objective fundraising thresholds and offering the services "on a fair and equal basis." If the nonprofit cherry-picks one party's candidates or candidates with particular positions, the donation starts looking like express advocacy and would require reporting.

Q: What about a 501(c)(3) charity offering the same services?
A: A 501(c)(3) is barred by federal tax law from supporting or opposing candidates at all, so the IRS rules already preclude this kind of activity. The AG opinion is specifically about 501(c)(4) social welfare organizations, which can engage in some political activity within limits.

Q: Does this opinion mean the campaign doesn't have to report the value of the services anywhere?
A: Correct for Virginia campaign finance purposes, under the facts the senator described. The campaign should still keep records internally for tax and audit reasons, and consult counsel about any federal disclosure obligations.

Q: What if the nonprofit also issues press releases about its services that mention specific campaigns?
A: That moves into riskier territory. Public communications that name candidates and could be interpreted as endorsing or opposing them risk crossing into express advocacy. The AG's analysis assumed the nonprofit's offerings were not for the "purpose of expressly advocating" any candidate's election or defeat.

Background and statutory framework

The Virginia Campaign Finance Disclosure Act of 2006 (§§ 24.2-945 to -953.5) is built on a single triggering concept: the regulated conduct must be "for the purpose of expressly advocating the election or defeat of a clearly identified candidate." This phrase appears in the definitions of both "contribution" and "expenditure" in § 24.2-945.1(A), and the AG has consistently held that no reporting obligation arises unless that purpose is present.

The Act covers two kinds of regulated parties: candidates and campaigns themselves (which report contributions received and expenditures made) and outside actors who make "independent expenditures." Both categories are limited to activity that supports the election or defeat of a clearly identified candidate.

Applying that test, the AG reasoned that the donated cybersecurity goods and services fit the Act's definition of an "in-kind contribution," but become reportable only if provided for the purpose of expressly advocating a candidate's election or defeat. Because the organization described offering its services on a nonpartisan basis, with objective eligibility criteria, and to protect campaigns from cyber threats rather than to favor any candidate, the AG concluded the donations are not reportable contributions or expenditures under the Act.

Citations and references

Statutes:

• Va. Code Ann. § 24.2-945.1 (definitions)
• Va. Code Ann. § 24.2-945.2 (independent expenditure reporting)
• Va. Code Ann. § 24.2-947.4 (campaign reporting contents)

Regulations:

• 1 Va. Admin. Code § 20-90-30 (express advocacy)

Prior AG opinions cited:

• 2023 Op. Va. Att'y Gen. No. 23-055
• 2021 Op. Va. Att'y Gen. No. 21-022
• 2001 Op. Va. Att'y Gen. 127

Source

• Landing page: https://www.oag.state.va.us/annual-reports-opinions/official-opinions
• Original PDF: https://www.oag.state.va.us/files/Opinions/2024/23-041-McDougle-issued.pdf

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain, the linked PDF is authoritative.

COMMONWEALTH of VIRGINIA

Office of the Attorney General

Jason S. Miyares
Attorney General

202 North Ninth Street
Richmond, Virginia 23219
804-786-2071
Fax 804-786-1991
Virginia Relay Services
800-828-1120
7-1-1

March 12, 2024

The Honorable Ryan T. McDougle
Member, Senate of Virginia
Post Office Box 187
Mechanicsville, Virginia 23111

Dear Senator McDougle:

I am responding to your request for an official advisory opinion in accordance with § 2.2-505 of the Code of Virginia.

Issue Presented

You inquire regarding the application of the Virginia Campaign Finance Disclosure Act of 2006 (the Act) to certain services offered by a private organization to Virginia candidates and campaigns. You specifically ask whether the provision of cybersecurity goods and services at no or reduced cost to a candidate/campaign constitutes a reportable "in-kind contribution" under the Act.

Response

It is my opinion that, under the facts presented, providing the described goods and services does not constitute a contribution or expenditure that must be disclosed and reported under the Act.

Background

You relate that a private organization holding a tax-exempt status under § 501(c)(4) of the United States Internal Revenue Code seeks to provide certain free or reduced-cost services to Virginia candidates and campaign committees, on a nonpartisan basis. The proposed goods and services include cybersecurity software and hardware, information sharing systems, and on-site and remote cybersecurity training. Eligible candidates and campaigns, as identified by the organization, include any Virginia candidate/campaign committee registered with the State Board of Elections that meets certain threshold fundraising requirements for the current election cycle, or candidates for state/local office who have secured ballot access for the general election.

Applicable Law and Discussion

Virginia's Campaign Finance Disclosure Act of 2006 applies "to all elections held in Virginia." The Act serves generally to "regulate the receipt and expenditure of money intended for expressly advocating the election or defeat of a clearly identified candidate." "[T]he emphasis in [the Act's] statutory provisions is on disclosure of [‘contributions’ and] ‘expenditures.'"

More specifically, the Act directs that "[a]ny person... that makes independent expenditures" totaling over a certain amount during an election cycle, "shall maintain records and report... all such independent expenditures made for the purpose of expressly advocating the election or defeat of a clearly identified candidate." In similar fashion, campaigns "shall keep detailed and accurate accounts of all contributions turned over to and expenditures made by the candidate or his treasurer on behalf of the [campaign]," which must be included in the required campaign finance reports and "filed on a form prescribed by the State Board." These reports "shall include all financial activity of the campaign."

Critically, to fall under the Act's reporting requirements, the money or services provided or received must be a "contribution" or an "expenditure" as defined by the Act. A "contribution" is broadly defined as "money and services of any amount, in-kind contributions, and any other thing of value, given,... or in any other way provided to a candidate, campaign committee, political committee, or person for the purpose of expressly advocating the election or defeat of a clearly identified candidate..." Pertinent to your inquiry, this definition encompasses an "in-kind contribution," which in turn is defined as "the donation of goods, services, property, or other thing of value, other than money, including an expenditure[,]... that is provided for free or less than the usual and normal charge." An "expenditure" broadly includes "money and services of any amount, and any other thing of value, paid, loaned, provided, or in any other way disbursed by any candidate, campaign committee, political committee, or person for the purpose of expressly advocating the election or defeat of a clearly identified candidate...."

Statutes are to be applied according to their plain language "unless the terms are ambiguous or applying the plain language would lead to an absurd result"; and, absent clear contrary intent, undefined words are afforded "their ordinary meaning, given the context in which they are used." Words and phrases are not to read in isolation; rather, statutes are to be applied in their entirety, giving effect to every part, and in accordance with their grammatical arrangement.

Here, as a donation of goods or services at no or reduced costs, the provision of cybersecurity assistance you describe fits the Act's definition of an "in-kind contribution." Nevertheless, to be a "contribution" subject to the Act's requirements, an in-kind contribution still must be made "for the purpose of expressly advocating the election or defeat of a clearly identified candidate[.]" Accordingly, per the terms of the Act, only those goods and services, including those offered at no or reduced cost, that are provided "for the purpose of expressly advocating the election or defeat of a clearly identified candidate" constitute reportable contributions or expenditures.

You describe a § 501(c)(4) social welfare organization that seeks to offer cybersecurity goods and services to candidates and campaign committees "on a non-partisan basis and in a manner that would not influence Virginia elections." You indicate that, to do so, the company has established objective eligibility requirements to ensure that Virginia campaigns have access to the company's goods and services on a "fair and equal basis." You also relate that, although the goods and services will be made available to individual campaigns, the goal of providing such goods and services is to enable a receiving campaign to protect itself from cyber threats and not to endorse, promote, or favor any particular party or campaign. More specifically, as you describe the proposed activities, the company's offerings would not be for the purpose of expressly advocating the election or defeat of a clearly identified candidate. I therefore conclude on that basis that, although the company would be providing goods and services at no or reduced cost, the provision of those goods and services would not constitute a "contribution" or "expenditure" under the Act.

Conclusion

Accordingly, it is my opinion that Virginia law does not prohibit a nonprofit organization from providing free or reduced-cost cybersecurity goods/services to Virginia campaigns, and, that if such goods/services are provided on a nonpartisan basis, not for the purpose of expressly advocating the election or defeat of a clearly identified candidate, such goods/services are not reportable contributions or expenditures under the Act.

With kindest regards, I am,

Very truly yours,

Jason S. Miyares
Attorney General