1. A. Understanding Election Insecurity
   1. Table 1: Non-Comprehensive List of Election Security Threats³³
2. B. A Brief History of Cyber-Enabled Election Interference
3. C. Digital Repression

II. Unpacking the Cyber Threat to Democracies

Threats to democracy, both foreign and domestic, take a variety of forms, which is part of the challenge in coming up with coherent policy responses.¹⁸ For example, depending on the scale and preferred lens, it is possible to view post-2016 efforts to secure democracies as an exercise in regulating social media firms to guard against both misinformation and disinformation,¹⁹ protecting vulnerable critical infrastructure,²⁰ or even as one facet of a larger needed debate on governing the Internet of Things,²¹ to name a few. This Part helps to frame out this broader discussion by providing a short history of cyber-enabled election interference and how authoritarian regimes use digital repression both at home and abroad to help shape political debates.

¹⁸. See THE WHITE HOUSE, NATIONAL SECURITY STRATEGY OF THE UNITED STATES OF AMERICA 26–28 (2017), https://perma.cc/SGG4-9TLH (PDF) (explaining that, due to the patient and strategic combination of political, economic, military, and informational strategies employed against the United States, responding to threats such as those related to cyber security, are more challenging).

¹⁹. Disinformation is commonly understood as false information that is spread deliberately with the goal of deceiving a targeted population, while misinformation may or may not be intentional, but is inaccurate. See Propaganda vs. Misinformation, JOHNS HOPKINS UNIV. SHERIDAN LIBRS., https://perma.cc/E2QW-G74W (last updated June 20, 2020, 4:28 PM) (comparing propaganda, information, misinformation, and disinformation).

²⁰. See Scott J. Shackelford, Opinion, How to Make Democracy Harder to Hack, CHRISTIAN SCI. MONITOR (July 29, 2016), https://perma.cc/S6M6-EDFU (listing the items that are considered critical infrastructure).

²¹. See Scott J. Shackelford, When Toasters Attack: Enhancing the‘Security of Things’ Through Polycentric Governance, 2017 U. ILL. L. REV. 415, 418 (considering the protection measures needed for cybersecurity resulting from the Internet of Things).

A. Understanding Election Insecurity

In general, election security is discussed in two interconnected yet separate areas of research.²² The first involves election infrastructure security and is focused on the security of the system itself, such as voting machines and tabulation systems.²³ The second is the fight against digital repression, including misinformation disseminated by social media.²⁴ Both areas are essential to the overall goal of defending democracy, and one cannot be successful without the other.²⁵

Hacking into voting machines remains far too easy.²⁶ The vulnerabilities are not just theoretical.²⁷ They have been exploited around the world, such as in South Africa, Ukraine, Bulgaria and the Philippines.²⁸ In 2014, for example, Russian-backed hackers targeted Ukraine by attempting to fake vote totals for its presidential election.²⁹ They were caught just in time, but the sophistication of the attacks should have been seen as “a warning shot for future elections in the US and abroad.”³⁰ Unfortunately, the U.S. government did not take the warning as seriously as it should have, as is discussed in Part III. But it should be noted that successful attacks do not need the resources and expertise of national governments—even kids have managed to orchestrate them.³¹

²². See THE NAT’L. ACADS. OF SCIS., ENG’G., & MED., SECURING THE VOTE: PROTECTING AMERICAN DEMOCRACY, xi–xiii (2018) (ebook) [hereinafter SECURING THE VOTE] (explaining that while the authors thought that their attentions would be devoted to the threats posed by long polling lines and outdated election systems, they also had to focus on the threats emerging from social media and other digital media).

²³. See LAWRENCE NORDEN & CHRISTOPHER FAMIGHETTI, BRENNAN CTR. FOR JUST., AMERICA’S VOTING MACHINES AT RISK 8–15 (2015), https://perma.cc/5ZP7-JDV2 (PDF) (discussing the need to replace and upgrade aging voting systems and address insecure tabulation systems to protect election security).

²⁴. See Shahbaz, *supra *note 17 (discussing the connection between digital censorship and repression).

²⁵. See SECURING THE VOTE, supra note 22, at 4 (articulating the threats of both election infrastructure and digital media on election security). 26. See Shackelford, *supra *note 20 (detailing the ability of researchers from the University of Michigan to hack into government webpages in 2012 to have the University’s fight song play after votes were casted).

²⁷. See id. (providing concrete examples of hacking incidents on voting machines and databases in South Africa and the United States).

²⁸. See *John Leyden, *Hacker Almost Derailed Mandela Election in South Africa, REGISTER (Oct. 27, 2010), https://perma.cc/LW3L-MJKX (detailing the ability of an unidentified hacker to almost successfully derail the democratic elections in South Africa); Daniel Funke & Daniela Flamini, A Guide to Anti-Misinformation Actions Around the World, POYNTER (Sept. 8, 2020),

Election security suffers from common threats, as are summarized in Table 1, that range from outdated voting machines to insecure tabulation systems, each of which requires a different policy response as is discussed in Part V. This non-comprehensive list underscores the extent to which cyber insecurity enables digital repression, and vice versa, such as when hackers target vulnerabilities in government IT systems to spread misinformation about an upcoming election purportedly through official channels.³²

https://perma.cc/2MPG-DWP9 (last updated Aug. 13, 2020) (referencing reports conducted by the EU to address the growing concern about misinformation and summarizing the responses of different countries to the spread of online misinformation).

²⁹ See Mark Clayton, Ukraine Election Narrowly Avoided ‘Wanton Destruction’ from Hackers, CHRISTIAN SCI. MONITOR (June 17, 2014), https://perma.cc/23H9-AGZ6 (discussing the three-pronged cyber-attack on Ukraine’s presidential election).

³⁰. Id.

³¹. See Alex Hern, Kids at Hacking Conference Show How Easily US Elections Could be Sabotaged, GUARDIAN (Aug. 22, 2018), https://perma.cc/TBM2-VD87 (highlighting a child’s ability to hack into websites, including those used for voter registration and campaigning efforts and the significant potential that creates for undermining election security).

³². See, e.g., Seven Ways Misinformation Spread During the 2016 Election, KNIGHT FOUND. (Oct. 4, 2018), https://perma.cc/ZBR5-633R (providing a list of the many ways that misinformation was conveyed during the 2016 election).

Table 1: Non-Comprehensive List of Election Security Threats³³

³³. NIS COOP. GRP., COMPENDIUM ON CYBER SECURITY OF ELECTION TECHNOLOGY 16 (2018), [hereinafter COMPENDIUM] https://perma.cc/BMG4- C8WS (PDF).

Table 1 serves as a framework for exploring the complex issue of democracy insecurity; however, no single issue should be focused on in isolation as each forms a complex backbone of the overall needs of the democratic system.³⁴ This Article focuses specifically upon the dual, related issues of securing election infrastructure and digital repression.³⁵ Yet, as is clear, these threats only constitute a small fraction of the larger conversation about maintaining the integrity of democratic systems.³⁶ As such, this Article attempts to break down these areas into discrete conversations, without losing sight of the larger context in which the system is placed.

B. A Brief History of Cyber-Enabled Election Interference

Foreign electoral interference is nothing new.³⁷ One study found that from 1945 to 2000, the United States and Russia combined tried to influence foreign elections 117 times, using both overt and covert methods.³⁸ It is not even a novelty to use cyber-attacks to influence the outcome of an election. As far back as 1994, Nelson Mandela’s presidential victory in South Africa was initially diluted due to an illicit computer program.³⁹ Russia, in particular, has been developing its disinformation capabilities for decades, long before the first packet of information was sent on a fiber optic cable.⁴⁰ Pre-Soviet Union, the Tsarist secret police (the Komitet Gosudarstvennoy Bezopasnosti (KGB), now Federalnaya Sluzhba Bezopasnosti (FSB), which is the predecessor Federal Security Service) used disinformation.⁴¹ Joseph Stalin created an independent agency for dezinformatsiya designed to undermine political opponents and mislead Soviet citizens and foreigners alike as to the USSR’s intentions.⁴² During the Cold War, for example, Russian agents helped plant “hundreds of bogus headlines around the world” such as the claim that the U.S. government created the autoimmune disease AIDS, a false claim that was first mentioned in an Indian newspaper in the 1980s after being planted by a KGB agent.⁴³ That story eventually circled the world, and was even mentioned by a famous American newsperson, Dan Rather, on the CBS Evening News in 1987.⁴⁴

³⁴. See SECURING THE VOTE, supra note 22, at 4 (discussing the impacts of election infrastructure and digital media).

³⁵. See id. (exploring the relationship between election infrastructure and digital repression).

³⁶. See COMPENDIUM, supra note 33, at 16 (providing a list of election security threats).

³⁷. See Don H. Levin, When the Great Power Gets a Vote: The Effects of Great Power Electoral Interventions on Election Results, 60 INT’L. STUD. Q. 189, 189 (2016) (discussing electoral interventions).

³⁸ Id.

³⁹ See Aislinn Laing, Election Won by Mandela ‘Rigged by Opposition,’ TELEGRAPH (Oct. 24, 2010, 6:47 PM), https://perma.cc/C63L-VW5K (stating that a hacker rigged the election). Unfortunately, the hacker who installed this program was never identified. Id. For more on this topic, see Shackelford et al., supra note 8, at 629.

⁴⁰. See Ben Popken, Factory of Lies: Russia’s Disinformation Playbook Exposed, NBC NEWS (Nov. 5, 2018, 8:02 PM), https://perma.cc/H974-GPDY (noting Russia’s early efforts to spread disinformation during the Cold War through inaccurate newspaper headlines).

⁴¹. See id. (dating Russia’s use of disinformation back to the 1880s when it was utilized by the Tsarist secret police).

⁴². See id.

⁴³. See id (describing the worldwide spread).

⁴⁴. Id.

Effective disinformation campaigns typically have three components: (1) a state-sponsored news outlet to originate the fabrication; (2) alternative media sources willing to spread it without adequately checking the underlying facts; and (3) witting or unwitting “agents of influence” (e.g., accomplices or unknowing agents) to advance the story in other outlets.⁴⁵ The advent of cyberspace has put the disinformation process into overdrive, both speeding the viral spread of stories across national boundaries and platforms with ease, and causing a proliferation in the types of traditional and social media willing to run with fake stories.⁴⁶ One tragic example is a false story about adopted children being butchered for their organs and sold to wealthy U.S. citizens that first appeared in Honduras in 1986, which was quickly debunked with the official whom was quoted denying the episode and issuing a correction, but that did not stop Soviet newspapers from spreading it around the world.⁴⁷ But this is just one tool among many.⁴⁸ Nations such as China and Russia also inundate internet discussion forums with so-called “flooding attacks” that enable distraction and disinformation.⁴⁹ As Henry Farrell and Bruce Schneier write: “Libertarians often argue that the best antidote to bad speech is more speech. What Vladimir Putin discovered was that the best antidote to more speech was bad speech.”⁵⁰

Such actions are not confined to the physical or digital borders of illiberal regimes.⁵¹ Russia has been linked with “confidence attacks” aimed at destabilizing democracies (especially those in bordering countries, such as Ukraine) and undermining trust in elections, ⁵² a practice that, as we have seen, dates back centuries but now makes use of modern technologies along with the implicit trust and openness in democratic societies. Russia, of course, is not alone in such efforts.⁵³ As will be discussed further, China is increasingly emulating Russian disinformation efforts, particularly in Taiwan and Australia, as is Iran, North Korea, and an array of non-state actors including criminal organizations, terrorist groups, and hacktivists.⁵⁴ These groups are employing a range of tactics to undermine trust in electoral processes ranging from directly or indirectly intimidating voters to compromising candidates by releasing damaging (and potentially fabricated) information.⁵⁵

⁴⁵. See id. (detailing a successful disinformation campaign).

⁴⁶. See, e.g., Davey Alba & Adam Satariano, At Least 70 Countries Have Had Disinformation Campaigns, Study Finds, N.Y. TIMES (Sept. 26, 2019), https://perma.cc/TGZ4-93FS (demonstrating that at least seventy countries have suffered from political disinformation campaigns despite overwhelming efforts by programs designed to stop them).

⁴⁷. See Popken, supra note 40 (explaining the promulgation of false headlines by Russian and Soviet agents during the Cold War).

⁴⁸. See Henry Farrell & Bruce Schneier, The Most Damaging Election Disinformation Campaign Came from Donald Trump, Not Russia, VICE (Nov. 19, 2018, 10:26 AM), https://perma.cc/5GYL-KE4S (articulating the many methods of undermining election security, including the spread of false information, flooding attacks, confidence attacks, and Donald Trump’s own comments about fraudulent election results).

⁴⁹. See id. (discussing flooding attacks and their effect on democracy).

⁵⁰. Id.

⁵¹. See id. (stating that the United States felt like the internet could positively spread liberal, American values).

It is impossible to say with certainty what the long-term impacts have been of Russian, Chinese, and other state-sponsored efforts to undermine trust in democratic elections.⁵⁶ John Sides, Michael Tesler, and Lynn Vavreck, for example, did not find a lasting measurable impact of Russia’s efforts in the United States following the 2016 election,⁵⁷ while Yochai Benker, Robert Farris, and Hal Roberts have argued“that Fox News was far more influential in the spread of false news stories than any Russian effort.”⁵⁸ Still, the fact that such efforts are spreading and that, to date, the efforts of the U.S. government, allied nations, and internet platforms have proven insufficient to stem the flood raises questions about how best to inoculate both advanced and emerging democracies against these threats, some of which stem from authoritarian regimes as is discussed next.

⁵². See id. (describing the “Russian social media trolls” that spread rumors to create confusion during the 2016 election).

⁵³. See Tim Mak, Former U.S. Diplomat Warns China Is Emulating Russian Political Interference, NAT. PUB. RADIO (June 20, 2018, 4:19 PM), https://perma.cc/W2N6-NMRC (discussing a former U.S. official’s warning that nations, including China, Iran, and North Korea, are beginning to interfere with elections).

⁵⁴. See id. (discussing the National Security Council’s observation that China, Iran, and North Korea are discovering that cyberspace is a good outlet for their political agendas).

⁵⁵. See, e.g., JAKUB JANDA, EUR. VALUES: KREMLIN WATCH REP., A FRAMEWORK GUIDE TO TOOLS FOR COUNTERING HOSTILE FOREIGN ELECTORAL INTERFERENCE, 13–15 (2017), https://perma.cc/B22B-7HB9 (PDF) (listing thirty-five ways the integrity of an election can be compromised by foreign actors).

⁵⁶. See Farrell & Schneier, supra note 48 (citing JOHN SIDES ET AL., IDENTITY CRISIS: THE 2016 PRESIDENTIAL CAMPAIGN AND THE BATTLE FOR THE MEANING OF AMERICA (2018)).

⁵⁷. Id. (citing JOHN SIDES ET AL., IDENTITY CRISIS: THE 2016 PRESIDENTIAL CAMPAIGN AND THE BATTLE FOR THE MEANING OF AMERICA (2018)).

⁵⁸. Id. (quoting YOCHAI BENKLER ET AL., NETWORK PROPAGANDA: MANIPULATION, DISINFORMATION, AND RADICALIZATION IN AMERICAN POLITICS (2018)).

C. Digital Repression

As Farrell and Schneier have argued, “[c]ybersecurity today is not only about computer systems. It’s also about the ways attackers can use computer systems to manipulate and undermine public expectations about democracy.”⁵⁹ This process has only accelerated after the end of the Cold War, with the vast majority of nations enjoying some degree of internet access and more than thirty nations developing offensive cyber-attack capabilities.⁶⁰ Rather than being the final nail in the coffin of authoritarianism, as was hoped by early cyber libertarians such as John Perry Barlow’s maxim in his Declaration of the Independence of Cyberspace, “Governments of the Industrial World, you weary giants of flesh and steel . . . [,] [y]ou have no sovereignty where we gather.”⁶¹ Instead, illiberal regimes from Damascus to Beijing have coopted the internet to entrench their power and control their populations.⁶² The autocratic threat to democracy is therefore not confined to election interference or misinformation campaigns.⁶³ There are myriad other ways in which illiberal regimes are using digital technologies to undermine democratic values at home and abroad.⁶⁴

⁵⁹. Id.

⁶⁰. See id. (contrasting the Cold War era to today); Steve Ranger, US Intelligence: 30 Countries Building Cyber Attack Capabilities, ZDNET (Jan. 5, 2017), https://perma.cc/QMP3-UYAR (claiming that more than thirty nations have started to develop offensive cyber-attack strategies in response to increased cybersecurity threats).

⁶¹. Christopher Shea, Sovereignty in Cyberspace, INT’L. ECON. L. & POL’Y BLOG (Jan. 15, 2006), https://perma.cc/CZ5D-8HKG.

⁶². See EVGENY MOROZOV, THE NET DELUSION: THE DARK SIDE OF INTERNET FREEDOM 100–03 (2011) (arguing that the internet presents many avenues through which governments can censor information, including outsourcing).

⁶³. See id. at 13 (outlining political implications that an email in the United States had on foreign relationships with Iran, China, and the Soviet Union).

⁶⁴. See id. at 99–101 (outlining ways that authoritarian governments can censor internet information, including using hyperlinks and aggregation).

Generally conceived, digital repression is the coercive use of information and communication technologies by the state to exert control over potential and existing challenges and challengers.⁶⁵ Digital repression includes a ranges of tactics through which states are able to use digital technologies to monitor and restrict the actions of their citizens, which include, but are not limited to, digital surveillance, advanced biometric monitoring, misinformation campaigns, and state-based hacking.⁶⁶ While digital repression does not specifically entail the use of physical sanctions against an individual or organization, it often carries with it the implicit assumption that information gathered could be used for more violent means.⁶⁷ This often has the outcome of inflicting a chilling effect on dissent against the state without sustained violence.⁶⁸ Furthermore, as discussed above, these repressive activities can be directed to individuals outside the state’s national borders, in some cases compelling them to organize domestic dissident groups or even compromise the election process itself.⁶⁹

⁶⁵. See Erica Frantz et. al., Digital Repression in Autocracies 1–5 (Varieties of Democracy Inst., Working Paper No. 27, 2020), https://perma.cc/6U5D-G58F (PDF) (defining digital repression and identifying the tools employed by governments engaging in it).

⁶⁶. See Steven Feldstein, The Road to Digital Unfreedom: How Artificial Intelligence Is Reshaping Repression, 30 J. DEMOCRACY 40, 41 (2019) (arguing that AI technology and computer systems have provided autocracies with substantially more political control over constituents).

⁶⁷. See id. at 42 (“Because of this omnipresence, [AI systems] can induce changes in behavior and create a significant ‘chilling effect’ even in the absence of sustained physical violence.”).

⁶⁸. See id. (asserting that AI systems motivate the public to conform and avoid sending dissentious messages against the government).

⁶⁹. See, e.g., Scott Shane, How Unwitting Americans Encountered Russian Operatives Online, N.Y. TIMES (Feb. 18, 2018), https://perma.cc/6L7C-KAKZ (recounting the Russian operators who created phony Heart of Texas and Blacktivist groups and announced rallies to interfere with the 2016 election).

States have always repressed.⁷⁰ Even democracies, particularly those democracies under threat,⁷¹ have used surveillance and sometimes physical repression against their own citizens.⁷² Repressive tactics include the violation of physical integrity rights, such as harassment, detainment, torture,⁷³ and extrajudicial killings,⁷⁴ as well as covert repression through monitoring and surveilling which can include wiretapping, organizational infiltration, and the use of informants and agents provocateur.⁷⁵ Repression in all forms is costly for the state, and its citizens.⁷⁶ Repression carries the physical costs of maintaining a coercive apparatus and, in more open regimes, it carries the potential audience costs of having these actions exposed to the public.⁷⁷ States choose to incur these costs when they are under (real or perceived) threat, which may be created or reinforced through disinformation.⁷⁸

⁷⁰. See Christian Davenport, State Repression and Political Order, 10 ANN. REV. POL. SCI. 1, 1 (Margaret Levi et al. eds., 2007) (proposing that repression is as old as “the founding of the nation-state”); see also ROBERT JUSTIN GOLDSTEIN, POLITICAL REPRESSION IN MODERN AMERICA FROM 1870 TO THE PRESENT 547 (1978) (“Political repression has been an important and neglected factor in shaping major aspects of American political development since 1870.”).

⁷¹. See Rudolph Rummel, Democracy, Power, Genocide, and Mass Murder, 39 J. CONFLICT RES. 3, 3 (1995) (articulating that governments, themselves, commit democide and repress their citizens).

⁷². See generally CHRISTIAN DAVENPORT, STATE REPRESSION AND THE DOMESTIC DEMOCRATIC PEACE (2007) (discussing the repressive practices of the then Hutu-led government); see also Courtenay Conrad et al., Torture and the Limits of Democratic Institutions, 55 J. PEACE RSCH. 3, 4 (2018) (highlighting the approval of executives in democratic nations that engage in torture and repression).

⁷³. See DARIUS REJALI,TORTURE AND DEMOCRACY 1–3 (2007) (arguing that there are physical forms of torture but also silent torture tactics that generally go unnoticed).

⁷⁴. See Matthew Krain, State-Sponsored Mass Murder: The Onset and Severity of Genocides and Politicides, 41 J. CONFLICT RESOL. 331, 332 (1997) (asserting that the internal and external characteristics of a state influence the degree of genocide and politicide therein); see generally MANUS I. MIDLARSKY, THE KILLING TRAP: GENOCIDE IN THE TWENTIETH CENTURY (2005) (offering a comparative analysis of genocides, politicides, and ethnic cleansings); BENJAMIN A. VALENTINO, FINAL SOLUTIONS: MASS KILLING AND GENOCIDE IN THE 20TH CENTURY (Robert J. Art et al. eds., 2004) (discussing mass killings).

⁷⁵. See Christian Davenport, Understanding Covert Repressive Action: The Case of the U.S. Government Against the Republic of New Africa, 49 J. CONFLICT RESOL. 120, 122 (2005) (describing the numerous covert techniques that nations can use to learn about its constituents, the information spread therein, and the social movements taking hold).

⁷⁶. See Davenport, supra note 70, at 4 (exploring the costs associated with repression and the cost-benefit analysis employed by repressive leaders).

⁷⁷. See id. at 10 (noting that democratic nations have increased costs associated with repressive action because officials are held accountable through the electoral process).

⁷⁸. See DAVENPORT, supra note 72, at 2 (discussing the Hutu- and Tutsi-led governments’ repressive tactics).

While the repressive power and potential of the state is not a new phenomenon, digital technologies are offering a fresh platform through which governments can exercise their powers of control and self-preservation domestically.⁷⁹ Rather than offering the liberating potential originally associated with these technologies,⁸⁰ many are now arguing that “social media [is] driving the spread of authoritarian practices.”⁸¹ Examples of this phenomenon include the Arab Spring, as well as more recent conflicts across the Middle East, and beyond.⁸²

Digital technologies are changing the nature of state repression in two primary ways. First, the speed and scope with which information can be collected and processed is far greater than any monitoring or surveillance techniques of the past.⁸³As Ron Deibert and Rafal Rohozinski write, “[d]igital information can be easily tracked and traced, and then tied to specific individuals who themselves can be mapped in space and time with a degree of sophistication that would make the greatest tyrants of days past envious.”⁸⁴ This can be done on a much wider swath of the population than was ever previously possible. For example, states threatened by mass mobilization are able to closely monitor, in real-time, crowd formations with the potential to become mass rallies, allowing police to be put on standby to immediately break up a protest before it grows.⁸⁵

⁷⁹. See Ronald J. Deibert, Three Painful Truths About Social Media, 30 J. DEMOCRACY 25, 31 (2019) (arguing that social media enables authoritarianism).

⁸⁰. See Larry Diamond, Liberation Technology, 21 J. DEMOCRACY 69, 70 (2010) (examining social media as a tool for activists to organize against authoritarianism).

⁸¹. Deibert, supra note 79, at 31.

⁸² See, e.g., Caroline Caywood, This Is How Social Media Is Being Used in the Middle East, NAT’L INT. (Nov. 21, 2018), https://perma.cc/96LF-8258 (“Governments are using social media to rally domestic and foreign support for their policies.”).

⁸³. See Ronald Deibert & Rafal Rohozinski,* Liberation vs. Control: The Future of Cyberspace*, 21 J. DEMOCRACY 43, 43 (2010) (noting that no technology other than digital technology has “grown with such speed and spread so far geographically in such a short period of time”).

⁸⁴. Id. at 44.

⁸⁵. See Feldstein, supra note 66, at 44 (noting that governments can use AI to control protests).

Second, the nature of repressive technologies has shifted the capacity required for repression which in turn has shifted the costs. As outlined above, repression is costly.⁸⁶ It carries the physical costs associated with maintaining a repressive apparatus (e.g., training and paying soldiers and police, maintaining detention facilities, etc.).⁸⁷ In the past, mass surveillance required an extensive network of informers.⁸⁸ In Poland in 1981, for example, at the height of the Sluzba Bezpieczenstwa’s (Security Service) work to undermine the Solidarity movement, there were an estimated 84,000 informers.⁸⁹ New technologies produce the same level of surveillance or greater from far fewer people.⁹⁰ Such digital technologies can be expensive. The Xinjian authorities, for example, reportedly budgeted more than $1 billion in the first quarter of 2017 for the monitoring and detention of the Uyghur population there.⁹¹ Yet this is likely a low figure when compared with the amount the Chinese state would have spent to construct a comparable system without using digital technologies.⁹²

⁸⁶. See supra notes 76–78 and accompanying text.

⁸⁷. See Feldstein, supra note 66, at 43 (“[Autocrats] relying on security forces to repress their citizenry . . . entails . . . resource costs and political risk.”).

⁸⁸. See, e.g., Andreas Lichter et al., The Long-Term Costs of Government Surveillance: Insights from Stasi Spying in East Germany 2 (SOEPpapers, Working Paper No. 865, 2016), https://perma.cc/3DDH-2BRX (PDF) (stating that the number of informants relied on by East Germany’s Stasi secret police“accounted for more than one percent of the East German population in the 1980s”).

⁸⁹. See Matthew Day, Polish Secret Police: How and Why the Poles Spied on Their Own People, TELEGRAPH (Oct. 18, 2011, 7:00 AM), https://perma.cc/C88T-MKS6 (describing how the Sluzba Bezpieczenstwa “was at the forefront of the Polish authoritarian state’s long war against opposition to communist rule”).

⁹⁰. See Feldstein, supra note 66, at 42 (“[T]he most advanced surveillance operations rely on relatively few human agents: Many functions are instead automated through AI.”).

⁹¹. See Josh Chin & Clément Bürge, Twelve Days in Xinjiang: How China’s Surveillance State Overwhelms Daily Life, WALL ST. J. (Dec. 19, 2017, 10:58 PM), https://perma.cc/SM8E-QG8B (“China’s efforts to snuff out a violent separatist movement . . . have turned the autonomous region of Xinjiang . . . into a laboratory for high-tech social controls that civil-liberties activists say the government wants to roll out across the country.”).

⁹². See Feldstein, supra note 66, at 45–46 (discussing the budget for “security-related investment projects”).

Steven Feldstein attributes the impacts of digital repression to the increased availability of big data from both public and private sources, enhanced machine learning and algorithmic approaches to the processing of that data, and the corresponding advances in computer processing power.⁹³ As Feldstein writes, “[f]rom facial-recognition technologies that cross-check real-time images against massive databases to algorithms that crawl social media for signs of opposition activity, these innovations are a game-changer for authoritarian efforts to shape discourse and crush opposition voices.”⁹⁴ In many ways digital technologies have ushered us into a new era, what Larry Diamond calls “postmodern totalitarianism,” in which we appear to be free to go about our daily lives, but governments are controlling and censoring all information flows.⁹⁵

Furthermore, digital technologies serve a very specific function for autocratic states. While leader removal by coups and civil war defeats are declining, it is increasingly common for leaders to be removed based on internal pressure and mass public uprisings.⁹⁶ In this way, “the gravest threats to authoritarian survival today may be coming not from insider-led rebellions, but from discontented publics on the streets or at the ballot box.”⁹⁷ Such observations might explain Vladimir Putin’s response to the December 2011 protests in Russia,⁹⁸ along with the color revolutions,⁹⁹ and Arab Spring.¹⁰⁰ These new trends in leadership removal increase the incentives for leaders to pursue repressive tactics capable of monitoring public opinion and mobilization potential.¹⁰¹

⁹³. Id. at 41.

⁹⁴. Id.

⁹⁵. See Larry Diamond, The Threat of Postmodern Totalitarianism, 20 J. DEMOCRACY 20, 23 (2019) (comparing this reality to “a nightmarish modern-day version of Nineteen Eighty-Four”).

⁹⁶. See Feldstein, supra note 66, at 43 (stating that popular revolt and electoral defeat “have overtaken coups” as “the most common causes of departure for dictators”).

⁹⁷. Id.

⁹⁸. See Michael Crowley, Why Putin Hates Hillary, POLITICO (July 25, 2016, 6:20 PM), https://perma.cc/2WVT-KW98 (stating Putin blamed Hillary Clinton for rigging Russian elections and causing the protests).

⁹⁹. See Yulia Nikitina,* The “Color Revolutions” and “Arab Spring” in Russian Official Discourse*, 14 CONNECTIONS 87, 88 (2014) (stating the “main concern” with the color revolution is that problems are not being resolved through the constitution or existing laws, but instead through “revolutions” and “street democracy.”).

¹⁰⁰. See id. at 92–93 (discussing Putin’s negative reaction to Western intervention of parties involved in the Arab Spring).

¹⁰¹. See Feldstein, supra note 66, at 43 (“[A]utocratic leaders are embracing digital tactics for monitoring, surveilling, and harassing civil society movements and for distorting elections.”).

As is discussed further in Parts III and IV, the target of digital repression need not solely be a country’s own citizens. Surveillance, state-sponsored hacks, election interference, and misinformation campaigns have all been documented strategies of autocratic governments’ attempts at destabilizing rivals and undermining democracy globally.¹⁰² In addition to challenging the functioning of democratic governments, there have also been attempts to change the behavior of non-state actors in pursuit of a global liberal agenda, such as human rights NGOs.¹⁰³ Moreover, while the focus of this Article is mainly on digital influence from Russia and China, the nature of digital technologies is impacting which states have the ability to monitor and repress.¹⁰⁴ As the financial and material costs of digital repression decrease, the capacity to influence is no longer confined to global powers.¹⁰⁵ Finally, much like repression itself, digital repression is not and will not be confined to autocratic regimes. Democracies monitor, surveille, and repress their own citizens, particularly in times of threat.¹⁰⁶ We should, therefore, not only look for digital repression and interference from our autocratic rivals but acknowledge its potential even within the most stalwart democracies, including the United States, which we turn to next.

¹⁰². See Charles Marsh, How Autocratic Regimes Try to Undermine Democracy at Home and Abroad, DEMOCRACY WITHOUT BORDERS (Dec. 17, 2017), https://perma.cc/U9SJ-HBHP (summarizing recent research on autocrats’ attempts to weaken democracy using, among other tactics, “internet censorship and controlled narratives”).

¹⁰³. See, e.g., Bill Marczak et al., Missing Link: Tibetan Groups Targeted with 1-Click Mobile Exploits (Citizen Lab 2019), https://perma.cc/R8XL-CQCS (“[S]enior members of Tibetan groups received malicious links in individually tailored WhatsApp text exchanges with operators posing as NGO workers, journalists, and other fake personas.”); JOHN SCOTT-RAILTON ET AL., RECKLESS VII: WIFE OF JOURNALIST SLAIN IN CARTEL-LINKED KILLING TARGETED WITH NSO GROUP’S SPYWARE 8–9 (2019), https://perma.cc/X8B6-9SPJ (PDF) (describing NSO Group’s attempts to target various non-state actors, including journalists, lawyers, and anti-corruption activists).

¹⁰⁴. See Adrian Shahbaz, The Rise of Digital Authoritarianism, in FREEDOM HOUSE, FREEDOM ON THE NET 2018, 1 (2018), https://perma.cc/53HCC7EK (PDF) (“[A] cohort of countries is moving toward digital authoritarianism by embracing the Chinese model of extensive censorship and automated surveillance systems.”).

¹⁰⁵. See id. at 9 (listing countries, such as Rwanda, Bahrain, and Kazakhstan, that use telecommunications infrastructure, AI surveillance, and trainings in a similar way as China).

¹⁰⁶. See GOLDSTEIN, supra note 70, at 559 (“[I]ncreased strain and tension in society and increased dissent (which frequently, but not always, occur together) have been the most important causes of political authorities increasing political repression.”).

Table of Contents

• I. Introduction
• II. Unpacking the Cyber Threat to Democracies
• III. U.S. Efforts to Protect Democratic Institutions
• IV. Lessons from Other Democracies
• V. Implications for Policymakers
• VI. Conclusion