Copyright: The Guardian, October 26, 2018. With P.W. Singer.
Whether it is in the movies, media or politics, discussions of election security typically focus on the sexy story of hackers hacking into voting machines. While this is a well-founded fear that certainly requires better defence, the reality is that there is no example of this kind of cyber-attack ever being attempted or working on a national scale.
By contrast, there is another kind of attack, one which has not just been repeatedly attempted but has been proven to work. It has struck everywhere from the 2016 election in the US and the Brexit vote in the UK, to the Syrian civil war and the Myanmar genocide. This threat doesn’t come in the form of hacking networks (aka “cyberwar”) but rather hacking the people on them, by making ideas viral through a mix of “likes” and lies on social media (what we call “like war”).
While it is up to the historians to debate the impact these massive campaigns had in historically close polls two years back, we do know one thing: the attackers think it worked, because they are still at it now. In the US, Russian accounts have been caught trying stir up controversy around everything from Nike’s signing of NFL star Colin Kaepernick to the upcoming midterm elections, while in Europe, they are expected to try to influence the European parliament elections in the spring, in support of far-right parties.
Whatever the topic, the goal is always the same: using online means to alter real-world beliefs and actions. What makes the problem harder to deal with is that it is no longer just Russian actors that we have to keep our eye on. Examples now range from Iranian online influence operations to mercenaries willing to work for multimillionaires on single-issue campaigns. Indeed, it appears that the Brazilian election is being shaped by many of the same toxic tactics amid what has been called a “fake news tsunami”.
The challenge is that, as bad as all this seems, it is set to worsen. Just as the flying machines introduced in the first world war soon became antiquated, the tactics and technologies used in the first wave of “like war” will be surpassed by the next generation of online influence. What looms are not just more persuasive attacks infused by artificial intelligence, but more focused assaults, going after not merely a national vote, but single legislative districts or even local elections.
All hope is not lost in this new conflict, however. The best model to respond comes from the states along Russia’s borders, as they were the first to be attacked in this way. Drawing on a mix of defence strategy, education and lessons from public health, countries such as Estonia and Sweden have moved to create “whole-of-nation” efforts intended to inoculate their societies from viral misinformation. Overall, these efforts seek to build a layered protection, including citizen education programmes, public tracking and notices of foreign disinformation campaigns, enhanced transparency of political campaign activities and action to limit the effect of what might be thought of as “super-spreaders”, the subset of people/accounts that serve as virulent distributors of online disinformation. (During the US election, for instance, 65% of the fake news links that appeared on Twitter came from just 10 sites.)
The platform for these battles is run by a handful of private companies. This means business also has to pitch in. In many ways, Silicon Valley’s response has been more akin to parents going through the stages of grief at the dark turn taken by their creations. For instance, Mark Zuckerberg went from denial, claiming it was a “pretty crazy idea” that such threats mattered, to acceptance, describing recently how his firm is in an “arms race” with information warriors. But while companies have stepped up measures to tackle disinformation campaigns targeting both their customers and their home nation, there is still a long way to go. Indeed, on Twitter, some 80% of the accounts that spread the most misinformation during the 2016 election are still online, pushing “upward of a million tweets a day”.
Tech firms need, among other things, to step up investment in content moderation; “deplatform” proven superspreaders of harassment and foreign influence operations; wargame their products before they are deployed, not just for cybersecurity vulnerabilities, but misuse by attackers; label bots in order that humans will be able to tell when they are interacting with a machine online (aka the Blade Runner rule); and implement measures to foil the next generation of AI used in sophisticated chatbots and faked imagery.
But there is also a larger problem. The challenge for any proper response by a western government is not merely that the only cabinet meeting the US president has ever held on election security didn’t discuss the problem of misinformation. It is that the commander-in-chief himself is part of the problem, with @realdonaldtrump amplifying examples of it on multiple occasions.
White House officials, members of Congress, cable news pundits and online celebrities are highlighting the misinformation. It is notable how few have apologised for aiding and abetting enemies who seek to harm our democracy, or explained what they are doing to prevent them from poisoning future votes.
We have to understand that the fights on social media are no longer merely about one’s personal brand or political party. They are about the very future of our democracies.