Propaganda and the Weakening of Trust in Government

On November 4, 2016, the hacker "Guccifer 2.0,: a front for Russia's military intelligence service, claimed in a blogpost that the Democrats were likely to use vulnerabilities to hack the presidential elections. On November 9, 2018, President Donald Trump started tweeting about the senatorial elections in Florida and Arizona. Without any evidence whatsoever, he said that Democrats were trying to steal the election through "FRAUD."

Cybersecurity experts would say that posts like Guccifer 2.0's are intended to undermine public confidence in voting: a cyber-attack against the US democratic system. Yet Donald Trump's actions are doing far more damage to democracy. So far, his tweets on the topic have been retweeted over 270,000 times, eroding confidence far more effectively than any foreign influence campaign.

We need new ideas to explain how public statements on the Internet can weaken American democracy. Cybersecurity today is not only about computer systems. It's also about the ways attackers can use computer systems to manipulate and undermine public expectations about democracy. Not only do we need to rethink attacks against democracy; we also need to rethink the attackers as well.

This is one key reason why we wrote a new research paper which uses ideas from computer security to understand the relationship between democracy and information. These ideas help us understand attacks which destabilize confidence in democratic institutions or debate.

Our research implies that insider attacks from within American politics can be more pernicious than attacks from other countries. They are more sophisticated, employ tools that are harder to defend against, and lead to harsh political tradeoffs. The US can threaten charges or impose sanctions when Russian trolling agencies attack its democratic system. But what punishments can it use when the attacker is the US president?

People who think about cybersecurity build on ideas about confrontations between states during the Cold War. Intellectuals such as Thomas Schelling developed deterrence theory, which explained how the US and USSR could maneuver to limit each other's options without ever actually going to war. Deterrence theory, and related concepts about the relative ease of attack and defense, seemed to explain the tradeoffs that the US and rival states faced, as they started to use cyber techniques to probe and compromise each others' information networks.

However, these ideas fail to acknowledge one key differences between the Cold War and today. Nearly all states -- whether democratic or authoritarian -- are entangled on the Internet. This creates both new tensions and new opportunities. The US assumed that the internet would help spread American liberal values, and that this was a good and uncontroversial thing. Illiberal states like Russia and China feared that Internet freedom was a direct threat to their own systems of rule. Opponents of the regime might use social media and online communication to coordinate among themselves, and appeal to the broader public, perhaps toppling their governments, as happened in Tunisia during the Arab Spring.

This led illiberal states to develop new domestic defenses against open information flows. As scholars like Molly Roberts have shown, states like China and Russia discovered how they could "flood" internet discussion with online nonsense and distraction, making it impossible for their opponents to talk to each other, or even to distinguish between truth and falsehood. These flooding techniques stabilized authoritarian regimes, because they demoralized and confused the regime's opponents. Libertarians often argue that the best antidote to bad speech is more speech. What Vladimir Putin discovered was that the best antidote to more speech was bad speech.

Russia saw the Arab Spring and efforts to encourage democracy in its neighborhood as direct threats, and began experimenting with counter-offensive techniques. When a Russia-friendly government in Ukraine collapsed due to popular protests, Russia tried to destabilize new, democratic elections by hacking the system through which the election results would be announced. The clear intention was to discredit the election results by announcing fake voting numbers that would throw public discussion into disarray.

This attack on public confidence in election results was thwarted at the last moment. Even so, it provided the model for a new kind of attack. Hackers don't have to secretly alter people's votes to affect elections. All they need to do is to damage public confidence that the votes were counted fairly. As researchers have argued, "simply put, the attacker might not care who wins; the losing side believing that the election was stolen from them may be equally, if not more, valuable."

These two kinds of attacks -- "flooding" attacks aimed at destabilizing public discourse, and "confidence" attacks aimed at undermining public belief in elections -- were weaponized against the US in 2016. Russian social media trolls, hired by the "Internet Research Agency," flooded online political discussions with rumors and counter-rumors in order to create confusion and political division. Peter Pomerantsev describes how in Russia, "one moment [Putin's media wizard] Surkov would fund civic forums and human rights NGOs, the next he would quietly support nationalist movements that accuse the NGOs of being tools of the West." Similarly, Russian trolls tried to get Black Lives Matter protesters and anti-Black Lives Matter protesters to march at the same time and place, to create conflict and the appearance of chaos. Guccifer 2.0's blog post was surely intended to undermine confidence in the vote, preparing the ground for a wider destabilization campaign after Hillary Clinton won the election. Neither Putin nor anyone else anticipated that Trump would win, ushering in chaos on a vastly greater scale.

We do not know how successful these attacks were. A new book by John Sides, Michael Tesler and Lynn Vavreck suggests that Russian efforts had no measurable long-term consequences. Detailed research on the flow of news articles through social media by Yochai Benker, Robert Farris, and Hal Roberts agrees, showing that Fox News was far more influential in the spread of false news stories than any Russian effort.

However, global adversaries like the Russians aren't the only actors who can use flooding and confidence attacks. US actors can use just the same techniques. Indeed, they can arguably use them better, since they have a better understanding of US politics, more resources, and are far more difficult for the government to counter without raising First Amendment issues.

For example, when the Federal Communication Commission asked for comments on its proposal to get rid of "net neutrality," it was flooded by fake comments supporting the proposal. Nearly every real person who commented was in favor of net neutrality, but their arguments were drowned out by a flood of spurious comments purportedly made by identities stolen from porn sites, by people whose names and email addresses had been harvested without their permission, and, in some cases, from dead people. This was done not just to generate fake support for the FCC's controversial proposal. It was to devalue public comments in general, making the general public's support for net neutrality politically irrelevant. FCC decision making on issues like net neutrality used to be dominated by industry insiders, and many would like to go back to the old regime.

Trump's efforts to undermine confidence in the Florida and Arizona votes work on a much larger scale. There are clear short-term benefits to asserting fraud where no fraud exists. This may sway judges or other public officials to make concessions to the Republicans to preserve their legitimacy. Yet they also destabilize American democracy in the long term. If Republicans are convinced that Democrats win by cheating, they will feel that their own manipulation of the system (by purging voter rolls, making voting more difficult and so on) are legitimate, and very probably cheat even more flagrantly in the future. This will trash collective institutions and leave everyone worse off.

It is notable that some Arizonan Republicans -- including Martha McSally -- have so far stayed firm against pressure from the White House and the Republican National Committee to claim that cheating is happening. They presumably see more long term value from preserving existing institutions than undermining them. Very plausibly, Donald Trump has exactly the opposite incentives. By weakening public confidence in the vote today, he makes it easier to claim fraud and perhaps plunge American politics into chaos if he is defeated in 2020.

If experts who see Russian flooding and confidence measures as cyberattacks on US democracy are right, then these attacks are just as dangerous -- and perhaps more dangerous -- when they are used by domestic actors. The risk is that over time they will destabilize American democracy so that it comes closer to Russia's managed democracy -- where nothing is real any more, and ordinary people feel a mixture of paranoia, helplessness and disgust when they think about politics. Paradoxically, Russian interference is far too ineffectual to get us there -- but domestically mounted attacks by all-American political actors might.

To protect against that possibility, we need to start thinking more systematically about the relationship between democracy and information. Our paper provides one way to do this, highlighting the vulnerabilities of democracy against certain kinds of information attack. More generally, we need to build levees against flooding while shoring up public confidence in voting and other public information systems that are necessary to democracy.

The first may require radical changes in how we regulate social media companies. Modernization of government commenting platforms to make them robust against flooding is only a very minimal first step. Up until very recently, companies like Twitter have won market advantage from bot infestations -- even when it couldn't make a profit, it seemed that user numbers were growing. CEOs like Mark Zuckerberg have begun to worry about democracy, but their worries will likely only go so far. It is difficult to get a man to understand something when his business model depends on not understanding it. Sharp -- and legally enforceable -- limits on automated accounts are a first step. Radical redesign of networks and of trending indicators so that flooding attacks are less effective may be a second.

The second requires general standards for voting at the federal level, and a constitutional guarantee of the right to vote. Technical experts nearly universally favor robust voting systems that would combine paper records with random post-election auditing, to prevent fraud and secure public confidence in voting. Other steps to ensure proper ballot design, and standardize vote counting and reporting will take more time and discussion -- yet the record of other countries show that they are not impossible.

The US is nearly unique among major democracies in the persistent flaws of its election machinery. Yet voting is not the only important form of democratic information. Apparent efforts to deliberately skew the US census against counting undocumented immigrants show the need for a more general audit of the political information systems that we need if democracy is to function properly.

It's easier to respond to Russian hackers through sanctions, counter-attacks and the like than to domestic political attacks that undermine US democracy. To preserve the basic political freedoms of democracy requires recognizing that these freedoms are sometimes going to be abused by politicians such as Donald Trump. The best that we can do is to minimize the possibilities of abuse up to the point where they encroach on basic freedoms and harden the general institutions that secure democratic information against attacks intended to undermine them.

This essay was co-authored with Henry Farrell, and previously appeared on Motherboard, with a terrible headline that I was unable to get changed.

Posted on November 27, 2018 at 7:43 AM • 35 Comments

Comments

stineNovember 27, 2018 8:14 AM

My weakening of trust in my government occurred more than 30 years ago and I've seen very little over the last 30 years that even suggested they were trying to earn it back.

johnNovember 27, 2018 8:26 AM

This is NOT a Donald Trump problem, but the result of decades of atrophy caused by educational and political systems that do NOT reinforce the purpose and common cause of this republican form of government. How can you identify abuses without this knowledge paired with the critical thinking skills that remain parse across the USA today? He is a symptom of a far greater problem as was the coronation attempt of the corrupt alternatives.

tzNovember 27, 2018 8:37 AM

What about the months between Trump's election though the inauguration where the left was demanding the Electors vote for Hillary even though Trump won their vote in the Electoral college.

Also that the Russians hacked the election somehow and Hillary really won (I think over 50% of Democrats still believe this).

Did you notice all the #NotMyPresident tweets, or was this just bots and where was the outrage? Hillary and the DNC did more in the closing weeks of 2016 to attack the election system than anything Trump has said or done. Have you watched CNN or MSNBC saying Trump stole the election?

And after almost two years of investigating and indicting for process crimes and perjury traps, there is still no evidence of crimes, or even collusion. Mueller was supposed to get Trump on something impeachable, but hasn't found anything yet. Cheating? Distrust of the system? Hillary got off when she should have been at least indicted, and did far worse things, but Flynn had his life destroyed. But that is the system you want Republicans to trust. Not to menion the fraud on the FISA court, and the "insurance policy" texts from the top of the FBI and DoJ. And Rosenstine wanting to wear a wire to find a 25th amendment way to get rid of Trump.

You are correct, but the problem is on both sides. When any common sense measues are taken to insure only people who are authorized to vote do so, it is called "voter suppression" - even some kind of free voter picture IDs - it's two years to the next election so there's time - is called suppression. As is cleaning the voter list of dead people, felons, or those who have moved away or haven't voted in 10 years.

But you call all this manipulation and cheating

If Republicans are convinced that Democrats win by cheating, they will feel that their own manipulation of the system (by purging voter rolls, making voting more difficult and so on) are legitimate, and very probably cheat even more flagrantly in the future.

First to condense the sentence, you said "Republicans ... [already] ... cheat ... flagrantly". Cheating is fraud. What specific instance of Republican actual cheating do you know of since it had to be flagrant?

So leave voters who are dead, convicted of felonies, or who have moved on the voter rolls or it is manipulation or cheating? That requiring at some point proof of eligibility to vote before casting the vote is "cheating". Only slightly, even trivially, more difficult, but do we want it so easy, anyone including those under aged, non-citizens, or felons can vote?

Also, having boxes of votes going outside the chain of evidence, or like back in 2016, a voting machine reported 300 votes (in Detroit, a Hillary area!) but only had 50 paper ballotts inside). For some reason I don't see stories like this happening in deep red areas, but they are small towns. And every "discovered" vote seems to be for the Democrat.

So what Republicans are calling for is manipulation or cheating but all the irregularities, or violation of the voting laws by Democrats should just be accepted?

If Republicans knew that the voting rolls were valid, and that voters had to present some ID and evidence they were qualified to vote in that specific location, and didn't yet vote, and the "chain of evidence" was maintained, there would be no reason to suspect the ballot counting could be tainted.

No, we have to fix the system to the satisfication of both sides so that neither side can cheat. It isn't Trump's tweets, but even the ordinary news coverage of finding ballot boxes in trunks, closets, where the counts are way off which are hard facts. And I will give you some voter ID and such makes it more difficult, but a free (not necessarily-)motor voter ID and registration - have a valid list of voters - can be done by the 2020 elections.

Neither side seems to want to do reasonable things to fix it and the losing side will insist the other side cheated and won't accept the results.

And using every story to attack Republicans and Trump because you don't like him or he is #NotMyPresident isn't going to help because it sounds like you dismiss or want the Democrats to be able to cheat.

AnuraNovember 27, 2018 9:13 AM

@tz

If you really think that the Republicans aren't cheating, you are not paying attention. Seriously, there isn't even an attempt to pretend that Republican election laws are about anything but suppressing votes anymore. It's proven beyond a reasonable doubt that Republicans cannot win elections without BOTH using propaganda like Fox News and Breitbart, AND writing election laws specifically with the intent of suppressing votes of minorities. Seriously, Fox News, Breitbart, right-wing radio, etc. are all designed solely for the purpose of being pro-Republican propaganda - Democrats don't have anything remotely equivalent (all left-wing news sites care about the issues rather than just making sure Democrats win).

"Both-sides" is just lazy arguing so that you don't have to address the real, sweeping corruption that has consumed the Republican party, which is literally an active threat to democracy in America today. Democrats aren't great, but one side is obviously much much worse. It's not even comparable - it's one side supports a popular agenda but also engages in cronyism, while the other has no other objective but to take power for themselves and their friends so they can implement an unpopular agenda that they know people won't support if they are either well-informed or given a choice.

Mr VerhartNovember 27, 2018 9:38 AM

@stine, your opponents have generated enough noise to cause you to remove your self from the process. Remember, in a democracy, the people are the government, and allow representatives to proxy for them through consent.

Democracies do not get the governments they want, or even the governments they need. They get the governments they deserve.

GregWNovember 27, 2018 9:41 AM

I wonder if the Russians learned about the best antidote to more speech was bad speech (trolling/flooding) from Microsoft's attempts to flood Slashdot in late 90s/early 2000s.

I never saw evidence MS was directly/indirectly doing this but they had means motive and opportunity. It always seemed more malicious and persistent than could be explained solely by schoolboyism or rebellious gamesmanship.

There was also plenty of anti-MS fanboyism on Slashdot of course.

bobNovember 27, 2018 9:43 AM

@Anura

Both sides cheat and both sides are hypocritical. Your comment about Fox News and Brietbart parrot Democratic hyperbole much like Trump's "Fake News" focus on CNN. Your side thinks the New York Times is NOT biased. So you know, it is as is Politico.

If you want to talk about suppressing opposition votes, look at the paragon of one-party rule in CA. Their jungle primary system is set up to suppress Republican influence and chances to win statewide elections. Now you know how HRC was able to amass such a large majority to wipe out Trump's 1.5 million vote lead heading into CA. Funny how all jungle primaries (that I know of) in the USA were established by the Democrats. Talk about suppressing the opposition by effectively barring them from the ballot. Guess it backfired on them in LA.

Regarding voter ID, every established program I can think of was established by Democrats either to reinforce control and suppress vote. They lost control of GA and reporting of purging has been inaccurate. Even if you were purged (because you hadn't voted for multiple elections), you could still vote with ID showing residency. At least some Republicans talk to protecting the vote with voter ID, not suppression. Yes, it is indicated by some as a way to suppress minority vote, but when balloted for the people, they pass because most want to ensure legitimate votes are cast.

My problem with Bruce's, et. al. paper is that it is a political hit job, not an unbiased look at how messy democratic elections can be influenced using social media and virtual echo chambers. This explains the Sanders run as well.

PhaeteNovember 27, 2018 9:49 AM

The entire USA voting system is flawed and needs a total makeover.
The 2 party bias ensures you are not voting for the best, but you are voting for the least worse.
People can become president with a minority of people votes, but a majority of those intermediaries (forgot what you call em)
For an outsider those elections look the same as any dictatorship, except your dictator is money.
Words like freedom and democracy are starting to sound sarcastic coming from an american (to me)
I hope stuff will get better soon then late, as the USA influence in the world is undeniable.

AnuraNovember 27, 2018 9:57 AM

@bob

Your comment about Fox News and Brietbart parrot Democratic hyperbole much like Trump's "Fake News" focus on CNN. Your side thinks the New York Times is NOT biased. So you know, it is as is Politico.

CNN is centrist media; it generally tries to be accurate, but doesn't want to take sides with either party. Fox News, on the other hand, was created specifically to sell you a very specific political agenda, the agenda that is good for the wealthy. It is literally propaganda. It's not hyperbole, there is simply no more accurate term to describe what it is. CNN parrots politicians, and thus is also propaganda, but it's pro-US propaganda, not pro-Republican propaganda like ALL right-wing media in the US is.

With Breitbart, they were literally publishing verifiably fake news pieces during the 2016 election. They made the news for republishing an article that was written by a website that was literally a fake news website. The term was actually created for this literal fake news that sites like Breitbart kept publishing, because their journalistic standards are that low when the piece is critical of their opponents.

https://www.snopes.com/news/2016/08/07/breitbart-duped-by-fake-news-again/

brett osborneNovember 27, 2018 9:59 AM

Excellent, and chilling, article. This could be made into the next spy thriller.

However, the article only cited negative Trump acts, without citing any of the at least equally nefarious actions by Democrats (I'll call them the Barrel of Delusionals). Some of these include calling on voting results for Trump to be thrown out, to only use popular vote, and worst of all, calling for College of Electors to disregard the voters. In many states these were at least petitions for illegal activity, and were Anti-Constitutional. With all these anti-freedom, anti-constitutional noises (seditious? revolutionarious? treasonous?), no wonder we hear Trump's response. This is baseline, and I apologize for appearing to go off topic. There is more than enough examples from BOTH sides to heap blame.

Note that the Election system doesn’t refer to voting machines or ballot counters. It is all the element – politicians, their constituencies, the ballots, etc.

Most security frameworks include mention of “INSIDER THREAT” – sometimes focus on intellectual property, sometimes government or military secrets, sometimes on embezzling. While there is always a threat from outside, the more significant is the threat from within.

Now to the topic at hand - the Midterms. Again, the article cited Russian interference and on the next breath mentions Trump, with respect to Florida. But again, if we dump on Trump, lets also note the equally bad if not worse actions of the Dems. While imprecise, Trump's claim of "stealing" the election was not nefarious. I am an actual observer of the post-election actions from multiple sources in multiple regions. While not traditional "ballot stuffing" nor canvasing board manipulations, there are numerous actions that any reasonable person should question. Democrats switched from pitching candidates to pitching “sue-balls”. Democrat candidates sued to allow what by law are invalid ballots, e.g. mailed ballots received too late, to be included. That one should be and was disposed of simply. Democrat candidates also sued to allow ballots that had non-matching signatures. That one was disposed of, but not simply-Florida likely will gain a new law to allow review and correction. This one should warm all of our Infosecurity hearts and mind – improving authenticity is a good thing. But to clarify my position above, the suits were painted with statements that “all ballots should be included” without noting that the ballots in question were by law already invalid. Additional suspicions can be raised in that the only two locations with “issues” were highly Democrat leaning counties. On top of that, the same two locations, which are among highest income in US let alone Florida claimed to have the oldest, and most error-prone, ballot counting machines. Now you don’t have to wonder why Trump said what he did. Guccifer WAS ALMOST right. Again, sorry for the diversion; it is significant background and I hope it assists.

I’m not going to again challenge the presumption that “Trump's efforts to undermine confidence in the Florida and Arizona votes work on a much larger scale.”, but I suspect that the Georgia Governor contest could equally be used as an example of the Democrat using the same tactics. This is, however, based on significantly less information than I have for Florida.

Now we can link our Six Elements (formerly “Triad”) of Infosecurity to specific needs in the election systems, The obvious point to make (oddly, doesn’t seem to be stated in article) is for authenticity. Election systems traditionally promoted privacy (voting booth), confidentiality (booth and maybe even pseudo-randomization of results) and maybe even availability/usable (absentee, mail-in and more recently, early voting). But we found that even if available/usable, sometimes usefulness failed (as in the ‘chads’ in 200 election). Authenticity at most was a driver’s license or voter card, additionally the signature. And we must now guide our election system to greater levels of authenticity of both voters and ballots. We have been surprised by External Threat. We should be alarmed, due to the actions from both sides, by the Insider Threat.

Peter S. ShenkinNovember 27, 2018 10:09 AM

It is worth recalling the following, due to Stalin and, in its context, attested at Snopes.com:

“I consider it completely unimportant who in the party will vote, or how; but what is extraordinarily important is this — who will count the votes, and how.”

vas pupNovember 27, 2018 10:49 AM

@Bruce: I see difference between influencing election by providing information to electorate (everybody should think by their OWN head analyzing together content of information with the source of content) and inspiring and supporting violent changes of regimes in other countries (by special operations - see Guatemala, Iran as example, financial support, and direct intervention).
By legitimization the government coming to power through violent methods you do legitimize the methods as well. That will sooner or later come to your doorstep.
I'd say if you want to get real information, then go to sources which are not friendly to each other, e.g. watch Fox and CNN, then trust ONLY overlapping part. Try to separate facts and opinions. But if you want to get confirmation to your OWN views, then stick to the source that provide confirmation bias.
On foreign issues: same applied. Plus try to apply SAME standards of evaluation. Internet provides you with option to watch US, Russian, Chinese, UKs(the last one I trusted more - just less attempts to swing you to emotional state which make you vulnerable to suggestions including subliminal versus logical analysis),DW - Germans, France 24, etc. and compare. E.g. on South China Sea; find out Chinese point and reasons directly out of their government source and compare with information provided by US sources, on Ukraine - compare presentation of events by both sides of the conflict. Same applied to Brexit analysis. Don't see with only one eye, hear with only one ear and think with half of the brain only. But keep you findings for yourself. Recall examples from the history. 'Thought Police' kind of Inquisition of the XXI century present in almost all countries in the world, but its power and methods depends on regime - just opinion.
@Shenkin provided good quote from Joseph Stalin, and Bruce is right that without reliable, transparent and uniform electoral process of election and verifiable mechanism of count the votes - you are trapped in Stalin's quote.

Paul CollinsNovember 27, 2018 10:57 AM

This comment thread has neatly demonstrated the problem.

Bruce’s solutions seem good, especially paper trail balloting. Let’s support that.

gadflyNovember 27, 2018 11:13 AM

@Paul Collins
"This comment thread has neatly demonstrated the problem."

Indeed. Sadly, vitriol (from both sides) makes me want to stick my fingers in my ears and chant "la la la I can't hear you" -- which in itself is part of the problem.

SergeyNovember 27, 2018 11:52 AM

The best way to restore trust in the elections is by increasing their transparency. The observers from all the political forces must be able to verify that the elections are honest.

As it is, we do have plenty of evidence that Democrats are behaving dishonestly. Project Veritas has done much to expose this dishonesty, with the videos of the election officials inviting the non-citizen to vote. Trump provided plenty of evidence of attempts to steal the elections in the Broward county, all the way up to "stuffing the ballot boxes" with the fake votes. Such behavior must be investigated and punished. Just firing the election official in charge is not enough, she must be tried, and spend a few years in prison.

Even your statement that the illegal immigrants must be counted in the census is a great example of this kind of dishonesty. The illegal immigrants (or maybe a better word for them is "invasives", as in the "invasive species") must not be allowed to have any effect on the elections, so obviously they must not be counted. All they are entitled for is punishment and deportation. Moreover, even the legal immigrants who are not citizen are not allowed to vote, and thus must not be counted in the census for the purpose of the representation in the Congress and Electoral College. They might be counted for the other purposes, but they certainly have nothing to do with the elections. Suggesting otherwise is suggesting the election fraud.

Bruce SchneierNovember 27, 2018 12:29 PM

I just deleted five comments that were not about the essay, or the underlying paper. I may go back and delete a few more comments; I haven't decided yet.

Steve-ONovember 27, 2018 1:13 PM

Phaete • November 27, 2018 9:49 AM

The entire USA voting system is flawed and needs a total makeover.

Each state is responsible for their own elections. The feds only get a say in the 2 National offices, and the "Founders" came up with the EC, Electoral College, for a number of reasons. Some of those reasons still exist and others do not.

Only the President and Vice President aren't directly elected. All state elected offices are 100% democratically elected. 1 person = 1 vote.

Look at the House of Representative voting by party,
https://upload.wikimedia.org/wikipedia/commons/4/48/US_House_2018.svg and you'll see that most of the country isn't in population centers where they tend to vote for Democrats.
There are very different problems in big cities than in the rest of the country.

There will never be a centrally managed election system due to states rights in the US Constitution. This is a key part to the design of the US Republic.

BTW, you'd probably be discouraged to learn that some US citizens live in places where they don't have any elected and voting members of Congress. US territories don't get any representation in Congress. Same applies to Washington D.C. residents. That is by design.

Jim KNovember 27, 2018 1:34 PM

I thought the motherboard headline was a fair summary - at least on my first 6am reading.

Hildegaard WintergaardenNovember 27, 2018 3:17 PM

> But what punishments can it use when
> the attacker is the US president?

The solution is not writing new laws or rules.

There is no new or old law that can make those in power to obey law. The very problem is that they do not obey the laws. They can not be prosecuted or brought in the court. They themselves are the law independently of whatever is written in the books.

The only solutions are either
- the civil war or
- the military rule

God bless Mr. Trump in draining the swamp.

echoNovember 27, 2018 4:01 PM

@Bruce

This is one key reason why we wrote a new research paper which uses ideas from computer security to understand the relationship between democracy and information. These ideas help us understand attacks which destabilize confidence in democratic institutions or debate.

Yes, the UK position is equivalent. Basically, politicians and weakened instititions and media feeding a shortattention span cycle have undermined democracy. While there has been a post 1950s erosion of deferment the transition hasn't been helped by increasingly partisan and tribalistic politics, shifts in tax and income distributions, or failures to uphold already existing law and best practice and access to justice. Where the fabric of democracy has been weakened and the checks and balances eroded this creates the opportunity for "lone wolf"extremists and movements and foreign powers with vested interest to manipulate affairs to their advantage.

To protect against that possibility, we need to start thinking more systematically about the relationship between democracy and information. Our paper provides one way to do this, highlighting the vulnerabilities of democracy against certain kinds of information attack. More generally, we need to build levees against flooding while shoring up public confidence in voting and other public information systems that are necessary to democracy.

I have been trying to articulate arguments with officials bearing things like systems theory (including information theory and game theory) in mind, and psychology and sociology, and tie this up with existing case law but making a very bad job of it.

It's easier to respond to Russian hackers through sanctions, counter-attacks and the like than to domestic political attacks that undermine US democracy. To preserve the basic political freedoms of democracy requires recognizing that these freedoms are sometimes going to be abused by politicians such as Donald Trump. The best that we can do is to minimize the possibilities of abuse up to the point where they encroach on basic freedoms and harden the general institutions that secure democratic information against attacks intended to undermine them.

I'm personally more concerned about US "deep money" influencing issues like abortion rights and Brexit than anything the Russians may or may not have said or done. The shift to the extremes by UK politicians does have an effect on the US and also the EU as extremists play off one another.

I welcome your articles but at the same time there is very very very little expert technical or academic discussion of issues in the UK. Discussion seems to be driven by and owned by high status establishment or celebrities. There is very very little dialogue as such or nothing which makes any difference. UK NGOs have traditionally been very weak and often "captured by the system".

It is notable that Sheffield University (?) did a study which proved UK civic action was signficiantly lower than in the US and mainland EU. I daresay this is because the UK lacks well formed discussion and a strong sense of social rights.

We're left with mostly rich people (!) and crowdfunding attempts to question interpretation of constititional law and invalidate Brexit because of criminal funding by foreign (mostly Russian but also American) donors.

I also welcome again your putting security on the table as an item of discussion and earlier broadening the issue of security to include protection from abuses of power and the erosion of human rights which hopefully helps turn discussion simply from protection of the state or protection of an organisation to protection of the people (from the state and from organisations and individuals abusing their power).

gordoNovember 27, 2018 4:30 PM

@ Bruce Schneier and Henry Farrell write:

The best that we can do is to minimize the possibilities of abuse up to the point where they encroach on basic freedoms and harden the general institutions that secure democratic information against attacks intended to undermine them.

The question of system abuse and hardening general institutions, in meta-form, if you will, is taken up by Michael Lewis in his new book, The Fifth Risk. Fintan O'Toole's review of this book puts forth Lewis' approach, as follows:

The joke, though, was always likely to become a serious proposition sooner or later. If you keep saying that government is not the solution but the problem, that “Washington” as a generic term for all the institutions that manage the public realm is just a swamp to be drained, you will end up wanting to destroy it. And if this is what you want to do, then the aspects of Trump that seem most like political weaknesses—his ignorance and his incompetence—are not weaknesses at all. They are powerful weapons of administrative destruction. The best way to undermine government is to make it as stupid and as inept as your rhetoric has always claimed it to be.


The American system is uniquely vulnerable to this maneuver. Americans tend to think they have the best system of government in the world. Yet from the outside, one aspect of it seems insane. Most functioning democracies have a permanent civil service that is legally obliged to be politically neutral. It takes orders from elected politicians but is protected from subversion by protocols of parliamentary accountability and the difficulty of firing its members. In the US, there is of course a vast permanent public service of two million employees. But the top layers of each department and institution are made up of four thousand presidential appointees. Not only is there no continuity of management, but chaos is easy to create. All an incoming president needs to do is appoint people to these agencies who should not be allowed anywhere near them—or indeed appoint no one at all. There is in the US system an opportunity to abuse power by simply declining to use it.

https://www.nybooks.com/articles/2018/12/06/trump-saboteur-in-chief/

After (at least) 40 years, and showing no signs, at present, of receding, as attack trees go, this one is proving to be one of the most difficult against which to defend as it implicates "trust" or "public confidence" in government at every turn.

As seen, for example, in arguments over voter suppression versus the legitimacy of the electoral college, attempts at hardening, if not defending, the U.S. election process, i.e., its efficacy, are now subject to attack from both sides. I don't expect the ideological arguments to stop. They never do, but merely ebb and flow. Good, bad or otherwise, ideas are the stuff of even representative democracy.

It would, however, be beneficial for all concerned to come to some kind of rapprochement as it regards the actual mechanics of voting processes, i.e., registration and tabulation. Lacking that kind of system hardening there are effectively no defenses against the "soft cyber" attacks described by Farrell and Schneier in their research paper as outcomes will more and more simply be rejected out of hand. Without common knowledge, trust or agreement with respect to the mechanics of the voting process, there is no foundation. Whether the U.S. is approaching a tipping point remains to be seen.

echoNovember 27, 2018 5:55 PM

@gordo

The question of system abuse and hardening general institutions, in meta-form, if you will, is taken up by Michael Lewis in his new book, The Fifth Risk. Fintan O'Toole's review of this book puts forth Lewis' approach, as follows:

Speaking as an outside observor this has been a fairly obvious fault with US governance for a long time along with gerrymandering and afforable access to law and social programs and healthcare.

At least the discussion is moving constructively on in spite of wreckers and chancers. This is a good thing!

gordoNovember 27, 2018 7:13 PM

@echo,

Yes, with regards,

In the most-recent U.S. election, redistricting and other pro-voter ballot measures were successful in several states, in some instances by large margins.

Getting past these kinds of process issues will allow for better focus on issues like those you've raised.

For far too long, voters have been dogged by disappointment. One hopes that if in fact this is a tipping point, it continues, constructively, toward more level playing fields where the electorate is better able to hold the elected accountable.

---

https://www.npr.org/2018/11/07/664993438/voters-approve-major-changes-to-redistricting-and-other-voting-laws

https://ballotpedia.org/2018_ballot_measures

Sabina PadeNovember 27, 2018 7:25 PM

ID, paper ballots, and an inked finger, together with continuous multi-partisan custody and obligatory hand counting of the ballots would be an optimal solution to our problem of trust in the election system.

Given, however, that electronic voting and vote tabulation machines seem here to stay, shouldn't we be paying more attention to the custodianship of the digitized ballot information? Stalin is famous for reminding us that it is the people who count the votes, not those who cast them, who decide the result. What if our ballot-scanning machines were perfectly secure, yet sent the ballot information they had accurately collected to a third party for collation and verification... and the third party were to alter the information? And what if that third party wasn't even located in the US?

https://www.fbcoverup.com/docs/library/2018-11-06-State-Election-Encryption-Certificate-Authorities-by-State-accessed-Oct-06-2018.pdf

https://patriots4truth.org/2018/11/06/definitive-proof-that-hillary-clinton-controls-the-digital-security-keys-for-the-florida-election-results-from-ireland/

https://truthbits.blog/2018/11/09/joe-sullivan-worlds-top-election-rigger/

Chris ZNovember 27, 2018 9:24 PM

I've read the paper. A very welcome addition to the information defense of democracies. I am not surprised by some of the comments above. Much of the tech culture of the West has become antagonistic to democracy itself in recent years. It will be very interesting to watch the reception you get from your peers as you pursue the defense of the information system of democracy. Will also be interesting to see you evaluate the public statements of Edward Snowden in light of the ideas expressed in the paper.

Jon (fD)November 28, 2018 1:26 AM

As a Californian, I suppose I ought to remark on this:

"In California, aside from the jungle-primary which virtually guarantees (D) victories, there is the very odd situation in Orange County, in which several contests were won by (R) candidates--some by several points--but after "other" ballots were counted, every single race was reversed. California has Motor-Voter, whereby merely obtaining a driver's license gets you registered to vote. There is no "citizenship" requirement for obtaining a CA DL, by the way. In other events, several voters have gone ON RECORD stating that they phone-requested an absentee ballot and received up to 6 of them (!!), some by email complete with a (D) message."

-- dad29

For one, the "jungle-primary which virtually guarantees (D) victories," applies in areas that are heavily Democratic, and thus it would seem that the winner of the popular vote should be a Democrat. The 'Jungle Primary' in the 25th (mine, incidentally) District had Republican Steve Knight come out on top, but when the Democrats rallied behind one candidate (Katie Hill) the popular vote was majority Democrat, and she won.

For two, the "other ballots" are those mailed in, for a variety of reasons, and those votes are just as legitimate as those cast in person.

For three, no, there is no citizenship requirement to get a driver's license - there isn't in any state - and no, obtaining a driver's license does NOT automatically get you registered to vote.

For four, a) cite thy sources and b) the plural of anecdote is not data.

Thank you.

While this comment does not directly address Mr. Schneier's paper, it does illustrate the problem! Jon (fD)

Jon (fD)November 28, 2018 1:43 AM

Clarifying remarks:

For one, a heavily Republican district should expect two Republicans in the primary to advance to the election. The type of primary election applies to all districts in the state. And why 'jungle'? Isn't 'the top two advance to the next round' simple enough?

For three, it's a box you must tick (and as I recall, yet another signature is required) attesting that you have the right to vote and that it has not been removed, and that you wish to be registered to vote. It is by no means automatic, but it is convenient.

Jon (fD)

Wesley ParishNovember 28, 2018 4:02 AM

Having read all the comments so far and the article, I feel a strong urge to study auto-immune diseases.

@Bruce seems to be describing what in biological terms would be an auto-immune disease, where the organs of the body are viewed by the immune system as threats, and treated accordingly.

To protect against that possibility, we need to start thinking more systematically about the relationship between democracy and information.

Widen that to government and information systems and you've got a starter. Democracy is just one particular form of government, and to quote from one British politician:
Many forms of Government have been tried, and will be tried in this world of sin and woe. No one pretends that democracy is perfect or all-wise. Indeed, it has been said that democracy is the worst form of Government except all those other forms that have been tried from time to time.

http://wist.info/churchill-winston/5216/

Personally, I would say the best way to go about such an undertaking is to examine the various functions of government separately in terms of information systems before attempting to attempt a grand synthesis of the whole system of government in terms of information systems. Once you've broken down government into its several functions, you can productively compare and contrast between the different systems of government that have been tried. (And above all else, you can break free from the unproductive name-calling and finger-pointing already evidenced on the comments page.)

And, if I might be permitted to make my own private request: try not to get stuck in the (bad) habit of thinking that democracy is restricted to casting a vote every Nth year, or even in standing/running for Parliament/Congress/Duma/Knesset/whatever. As far as I can see, democracy above all else, consists in the state restricting its use of the powers of life and death and submitting them to level-headed judgement. A state that regularly hands out death sentences for being of the wrong ethnicity is not democratic, because it shows no self-restraint with regards to that particular ethnicity and that particular power, and that lack of self-restraint can so easily shift focus. It's hard being hoist by one's own petard, but that's the way things go.

WinterNovember 28, 2018 4:12 AM

Only a fool learns from his own mistakes. The wise man learns from the mistakes of others. - Otto von Bismarck

In all these discussions about the US electoral system, I have never seen a reference to how other countries organize fair and honest elections, or fail to do so. But maybe the US voters will in the end learn from their mistakes? One can hope.

Clive RobinsonNovember 28, 2018 5:14 AM

@ Winter,

In all these discussions about the US electoral system, I have never seen a reference to how other countries organize fair and honest elections, or fail to do so.

In all honesty the voting systems that work are dull and consist of pen, ballot paper and indelible ink for the cast voters finger.

It's the voter registration and vote tabulating systems behind the voting system that gets more interesting. Which untill the push for "alternative voting" to try and get voter numbers up was the main fraud areas in Western political systems.

That said in less open societies the vote manipulation occurs before and after even these. That is those who are alowed to stand as candidates, "intimidation" in it's various physical and psychological forms in the vote run up and the upper level "final count" where a very few manipulate the ballot papers in some way, one trick being the "sealed box" where ballot papers get put in boxes which are then sealed, and it's the boxes that get tallied not the ballot papers (the pretence being each box contains X votes for Y, but X is shall we say "fluid").

That said all voting systems are fraudulent in a not disimilar way. Thus with carefull boundry selection the actual spread of voting gets misrepresented and thus a party A candidate may only require say 10K votes on average to get to be "first past the post" whilst a party B candidate may on average be getting 15-20K votes...

All of this kind of gets ignored in the US why I've no real idea but I suspect the education system os actually at the root level.

The thing is there never was nor never will be a "democratic" vote when what you are realy doing is voting in a popularity or beauty paggent for an uncontrolable "representitive"...

Such systems are easily provable as "undemocratic" by any reasonable definition of the word "democratic". It's a measure of just how much the citizens have been "gulled" willingly or otherwise by those who increasingly exhibit sociopathic tendencies...

Sometimes it makes me realy sad to think of all those who have given their lives, health, liberty and opportunity for a peacefull life, in just the last half century to get fobbed off with such a broken system as a representational "monkey in a suit" political process...

WinterNovember 28, 2018 5:26 AM

@Clive Robinson
"The thing is there never was nor never will be a "democratic" vote when what you are realy doing is voting in a popularity or beauty paggent for an uncontrolable "representitive"..."

I will follow Popper on Science here: Although humans will never know the ultimate truth, they can get ever closer to it.

The same on democracy. While a perfect system is not possible, improving the existing systems is always worthwhile.

WinterNovember 28, 2018 7:10 AM

Quote from the article:
"These two kinds of attacks -- "flooding" attacks aimed at destabilizing public discourse, and "confidence" attacks aimed at undermining public belief in elections -- were weaponized against the US in 2016."

Both attacks can only be addressed by installing "filters". Not so much filters at the communication channels, but filters at the authors and readers. It all comes down to education, of both authors and readers.

We can look for guidance to professions that have dealt with such "attacks" from the ignorant as well as the powerful for decades, if not centuries:
Journalism and Science.

How do these fields respond to these flooding and confidence attacks:

1) Ignore any assertion without a source (or better two sources)

2) Verify sources. If they cannot be verified, ignore

3) Any conclusion must be based on verifiable evidence

There is much more, e.g., about acknowledging alternative interpretations, but this would be a good start in my view.

Clive RobinsonNovember 28, 2018 7:42 AM

@ Winter,

The same on democracy. While a perfect system is not possible, improving the existing systems is always worthwhile.

Sometimes a cancer grows to the point where it has to be exorcised by surgery. Voting for representatives has riddled the body politic with it's cancer and it should be exorcised with extream prejudice.

That much is clear, but the question aroses as to what to replace it with...

Well history shows that "democracy" was originaly about voting on substantive issues. That is people would turn up in the town square and vote on issues, not monkeys in suits.

The monkeys only came along to get over the issue of "scale". Back then direct issue voting was only possible within a days walk / cart ride. Thus the idea of sending off somebody who proxied your wishes was sent to a central voting point. And so representational / proxy politics started.

Modern communications can easily and securely overcome the distance issue, even for voters working on the moon...

So on that asspect we can drop kick the monkeys off to an alternative occupation to which their skill set is more appropriate (grave yard hours host on local mall TV shopping channel pethaps ;-)

But is there any other aspect we need to consider? Unfortunatly yes, because the monkeys had a great deal of time on their hands they decided to emulate a camel. That is they try to push their nose under the tent flap, and unless beaten back with extream vigour they will end up compleatly filling the tent at the great expense of those inside.

Thus we need to consider where are the proper points of interest for the governmental system, especially when something like 1/6th to 1/3rd of the economicaly active citizens work directly or indirectly on the tax take... Which in many places is considerably greater than those who are unemployed for various reasons...

That is just how much is realy "makework" and could it be replaced with something that actually was economically productive?

I suspect that there are several other considerations, but unless we are prepared to talk about getting rid of the monkeys, empire builders and makeworkers that are government then we will be saddled with their ever increasing deficiences.

There is a security related question people should be asked to consider and vote on especially in the US. Which is how much of your money should be spent on "Security Theatre"? That is actually first explain just how much of a boondongle the War on Terror is and how much it is personaly costing them, and knowing the real risks and size of cash hole would they vote to continue being milked for it?

It is after all a more "democratic" question than "Does monkey X make you feel good?".

Bruce SchneierNovember 28, 2018 7:45 AM

I just deleted another ten comments.

I am undecided about the whole gerrymandering discussion. It hasn't gotten too out of hand, but it's not the topic of my original essay.

So let's put a line here -- everything below is to be about my original post.

Thank you for your understanding.

Bruce SchneierNovember 28, 2018 9:47 AM

I just deleted another five comments.

I think at this point it would be best for me to close comments on this topic.

Apologies to all.

Comments on this entry have been closed.

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of IBM Resilient.