Hacking the 15th Amendment

The 15th Amendment, ratified in 1870 as the last of the Reconstruction Amendments,Footnote ² prohibited states and the federal government from denying or limiting a citizen’s right to vote “on account of race, color, or previous condition of servitude.” The Reconstruction Amendments did not stop states from making it difficult or impossible for Black Americans to vote, however. The states’ hack was to erect a host of barriers to voting that were keyed to vulnerabilities experienced disproportionately by Black Americans, as opposed to blatant race-based bans on voting: poll taxes that exploited the poverty of most Black Americans at the time, literacy tests to exploit the legacy of brutal repression of literacy among enslaved people and the limited educational opportunities of their progeny, and organized violence by non-state actors (such as the Ku Klux Klan) to deter Black participation in elections, among other measures. Especially in the American South, so-called grandfather clauses restricted voting to those whose grandfathers had voted, which had the effect of disenfranchising generations of Black Americans with grandfathers who had been enslaved and ineligible to vote.

The Supreme Court ruled in 1915 that grandfather clauses were unconstitutional. The Court reasoned “the grandfather clauses in the Maryland and Oklahoma constitutions to be repugnant to the Fifteenth Amendment and therefore null and void.”Footnote ³ In 1920, voters extended the right to vote to women with the 19th Amendment, which “prohibits the United States and its states from denying the right to vote to citizens of the United States on the basis of sex.” This followed the establishment in 1913 of direct popular election of senators upon ratification of the 17th Amendment.

The poll tax exploited a vulnerability that was pervasive in the American South through much of the twentieth century and cut across racial lines: poverty. In 1959, 56.2 percent of Black Americans and other people of color lived below the poverty line. This proportion of persons below the poverty line eventually declined to 13 percent in 1968, but the poverty rate among Blacks and other people of color remained about three times the rate among White Americans (U.S. Department of Commerce, 1969). As of 1966, eleven states in the American South had poll taxes. Americans outlawed the practice for federal elections in 1964 with the 24th Amendment, but five states – Alabama, Arkansas, Mississippi, Texas, and Virginia – retained poll taxes for state elections (Lebetter Jr., Reference Lebetter1995). In Harper v. Va. Board of Elections, the Supreme Court invalidated the practice for states, on the basis that “once the franchise is granted to the electorate, lines may not be drawn which are inconsistent with the Equal Protection Clause of the Fourteenth Amendment.” The Court held that “a State violates the Equal Protection Clause of the Fourteenth Amendment whenever it makes the affluence of the voter or payment of any fee an electoral standard,” because “voter qualifications have no relation to wealth nor to paying or not paying this or any other tax” and thus have no rational basis other than to discriminate against poor people.Footnote ⁴

The 26th Amendment, ratified in 1971 amid social turmoil in the United States over the Vietnam war and US reliance on a conscript military, lowered the voting age to eighteen, giving Americans eligible for the military draft the right to vote in state and federal elections – and thus have a say in national policy on the deployment of US armed forces (Baum, Cea, & Cohen, Reference Baum, Cea and Cohen2021).

This collection of constitutional requirements and accompanying Supreme Court case law establishes the constitutional floor for voting rights in the United States. The constitution otherwise defers to state and federal legislators on most ballot decisions, saying that the “times, places and manner” of elections are state matters unless Congress sets nationwide standards. This entails that the selection, implementation, and oversight of elections and polling-related infrastructure (e.g., voting machines) are also left to the states, which, in turn, often leave many aspects of election administration to local (often county) governments.

Electoral Infrastructure Basics

Election infrastructure in the United States rests on this constitutional foundation and is usefully broken down into several discrete components: partisan campaign infrastructure and interest groups; voter registration; ballot casting; and ballot counting and certification of election results. Each of these components is subject to different state and federal laws, as well as having different cybersecurity and other risk attributes pertaining to the vulnerability of election infrastructure.

John Lewis, White Hat Hacker

In June 1964, three voting rights activists were murdered in Mississippi for helping Black Americans register to vote.Footnote ⁹ The violent episode galvanized support for the Civil Rights Act, which Congress passed, and President Lyndon B. Johnson signed, one month later.Footnote ¹⁰ The Civil Rights Act outlawed segregation in public places and in businesses that serve the general public and banned discrimination on the basis of race, color, religion, sex, or national origin in employment. It also required that laws relating to voter qualification be applied equally within a jurisdiction, banned the practice of using errors in registration documents and ballots to disqualify a Black American from voting even when an error was not material to that person’s eligibility to vote, and outlawed literacy tests unless all voters had to take them and certain transparency requirements about them were met.

On March 7, 1965, John Lewis, a prominent civil rights activist and future Member of Congress,Footnote ¹¹ led a march of over 600 people across the Edmund Pettus Bridge in Selma, Alabama to protest racial discrimination in the American South. The peaceful protesters encountered violent resistance at the top of the bridge from Alabama state troopers, whose unprovoked brutality against the procession was captured by television cameras and broadcast nationwide, turning the event in Selma into a pivotal moment in civil rights history. Outrage over the local incident, known as Bloody Sunday, swept the nation and further fired up support for the civil rights movement (Klein, Reference Klein2020). Congress passed the VRA five months later.

The VRA patched numerous vulnerabilities in America’s election infrastructure at the time. Aimed at safeguarding the voting rights of racial minorities, it prohibits discriminatory measures in elections that hinder their ability to cast ballots, such as literacy tests and poll taxes. The VRA also introduced federal oversight of states with a history of voter suppression, requiring them to seek federal approval before changing their voting laws. This “preclearance” requirement aimed to ensure fair and equitable access to the ballot box. The immediate impact of the VRA was substantial, leading to the registration of 250,000 Black Americans by the end of the year and ensuring that by the end of 1966, only four out of the thirteen southern states had less than 50 percent of eligible Black Americans registered to vote (National Archives, 2022).

In 2013, the Supreme Court ruled 5–4 in Shelby County v. Holder that the VRA’s preclearance requirements were unconstitutional because the coverage formula was, in the majority’s view, “based on 40-year-old facts having no logical relationship to the present day.”Footnote ¹² The decision made it possible for state governments previously subject to preclearance requirements to move forward with a variety of measures that made it more difficult for eligible voters to cast a ballot, with the effects being disproportionately felt by Black Americans, who voted for Democratic candidates 86 percent of the time in 2022 (Alexander & Fields, Reference Alexander and Fields2022). These measures – which included voter registration purges, polling location closures, limitations on absentee and mail-in ballots, and restrictions on the ability of third-party groups to facilitate registration and ballot casting – were predominantly the product of Republican-led state governments, who justified them as saving money or guarding against voter fraud (Waldman et al., Reference Waldman, Weiser, Moraels-Doyle and Sweren-Becker2018).

In the decade since Shelby, the ideological composition of the Court has shifted further rightward. Senate Republicans refused to advance President Obama’s nomination of Merrick Garland to the Court in 2016 to replace the late Justice Antonin Scalia, and so President Trump was able to replace Justice Scalia with another conservative, Neil Gorsuch. President Trump replaced the retiring Justice David Kennedy, a moderate, with the conservative Brett Kavanaugh and the late Justice Ruth Bader Ginsburg, a liberal, with the conservative Amy Coney Barrett. In a 2021 decision from the Court’s six conservative justices, Brnovich v. Democratic National Committee, the Court upheld Arizona’s policy of discarding out-of-precinct ballots and prohibiting third-party groups from returning early ballots for another individual, which had been challenged under the VRA as racially discriminatory due to the disproportionate effect the policies have on persons of color.Footnote ¹³

Since 2021, lawmakers in at least nineteen states have passed thirty-three laws that make it more difficult for people to vote. In Iowa and Kansas, election officials who typically assist voters with ordinary and essential tasks in the electoral process, such as returning ballots on behalf of voters with disabilities, are now deterred from doing so by the threat of criminal charges. Similarly in Texas, election officials that attempt to regulate poll watcher conduct or encourage voting by mail can now face criminal prosecution. These laws disproportionately affect voters of color. Again in Texas, the recently enacted Senate Bill 1 (SB 1) makes it more difficult for those who face language barriers to get help to cast a ballot. The law additionally bans twenty-four-hour and drive-thru voting (Waldman et al., Reference Waldman, Weiser, Morales-Doyle and Sweren-Becker2021a).

The policy objectives of protecting and expanding access to voting and preventing those who are ineligible to vote from voting are not necessarily in conflict. After all, votes cast illegally dilute the political power of eligible voters. Even so, there are trade-offs between these two objectives, which is where the ideological conflict lies. On the American left, the emphasis has long been on protecting and expanding access, with an implicit acceptance that this could in theory result in a higher incidence of voter fraud. The principal adversaries are partisan (Republican) legislators and elected officials. Voter fraud is a federal crime and an exceedingly rare one at that: In a 2007 report, the Brennan Center for Justice found incident rates of fraud between 0.0003 percent and 0.0025 percent (Levitt, Reference Levitt2007).

On the American right, the emphasis is on preventing fraud, even if it means that otherwise eligible voters encounter more barriers to casting their ballot. The principal adversaries are fraudsters and their partisan (Democratic) enablers. To the extent that these additional barriers are encountered primarily by the right’s political opponents, it could be a feature rather than a bug of their efforts to address fraud. Following the Supreme Court’s decision in Brnovich, Texas Governor Greg Abbott, a member of the Republican Party, approved the implementation of SB 1, a law aimed at imposing restrictions on voting methods and schedules (Wilder & Hira, Reference Wilder and Hira2021). The Texas Tribune reported that the legislation targets voting initiatives employed in Harris County, a populous and diverse county with a Democratic lean (Ura, Reference Ura2021). The law prohibits overnight early voting hours and drive-thru voting, which were both well-received by voters of color in the previous year’s elections.

Hanging Chads and the Help America Vote Act (HAVA)

On November 20, 2000, the State of Florida officially declared George W. Bush as the winner of its twenty-five electoral votes in the race for the U.S. Presidency. The declaration came three weeks after a tumultuous election night on November 7, with reports of significant problems plaguing Florida’s administration of the election. The Florida Division of Elections reported that Governor Bush had beaten Vice President Gore by 1,784 votes, which was less than one-half of a percent of the votes cast. This triggered an automatic machine recount under Florida elections law. The machine recount showed Governor Bush still winning, but by a substantially diminished margin of just 537 votes.Footnote ¹⁴ Vice President Gore sought manual recounts in several key counties, but this would take more time; the State of Florida and Governor Bush opposed the manual recount on the grounds that there was no basis in law for extending the deadline for local county canvassing boards to submit their results to the Florida secretary of state – the official responsible for election administration in Florida. The dispute was eventually decided in a 5–4 decision by the Supreme Court in Bush v. Gore, which ordered a stop to the manual recount underway in Florida and effectively made Governor Bush the winner of Florida’s electoral votes and, as a result, the winner of the presidential election (for a timeline of this episode, see Stanford Law School, 2021). As the Supreme Court observed in Bush v. Gore, “This case has shown that punchcard balloting machines can produce an unfortunate number of ballots which are not punched in a clean, complete way by the voter,”Footnote ¹⁵ resulting in ballots with paper fragments still attached – so-called hanging chads. County officials grappled with deciphering voter intent amid hanging chads and the controversial “butterfly ballot” design in Palm Beach County, which caused confusion and inadvertently affected thousands of votes.

The U.S. Commission on Civil Rights (USCCR) investigated the administration of Florida’s election and issued a report in June 2001 that documented widespread problems. In the years before the election, Florida had purged from its voter registration rolls tens of thousands of individuals suspected to be ineligible to vote, but the purge snared thousands of eligible voters as well. The USCCR found that Black voters were placed on purge lists “more often and more erroneously than Hispanic or White voters” (U.S. Commission on Civil Rights, 2002). A person on the so-called exclusion list had to affirmatively prove their eligibility to be relisted in voter registration rolls – a nontrivial burden. The USCCR also found that Black voters’ ballots were ten times more likely to be rejected on technical grounds, such that of the 180,000 spoiled ballots cast in Florida during the November 2000 election, over half were cast by Black Americans despite comprising around 11 percent of Florida voters (U.S. Commission on Civil Rights, 2002).

Cybersecurity and the Help America Vote Act (HAVA)

HAVA sought to facilitate the digitalization of election infrastructure presented by creating a new federal agency, the Electoral Assistance Commission (EAC), comprising four commissioners subject to Senate confirmation and a specialized staff, and creating new election-related responsibilities for the National Institute of Standards and Technology (NIST), an existing federal agency with deep experience developing digital governance standards, guidelines, and best practices. Among other responsibilities, the EAC would test and certify voting equipment as compliant with standards that the legislation tasked NIST to develop on the security, reliability, and accessibility of voting systems as chair of a Technical Guidelines Development Committee (TGDC).

HAVA set a deadline of nine months from the appointment of the four EAC commissioners for the TGDC to provide its first set of recommendations on voting system security, reliability, and accessibility. To meet this deadline, the TGDC formed three subcommittees focused on core requirements and testing, human factors and privacy, and security and transparency, hosting a series of workshops, meetings, and teleconferences in accordance with NIST’s established practice of developing standards, guidelines, and best practices through open and transparent processes. The effort produced the VVSG 2005, which the TGDC submitted to the EAC in May 2005, meeting the established timeline.

The VVSG 2005 focused on usability, accessibility, and security of election systems. The goal of the usability-related guidelines was to ensure that the system was user-friendly and intuitive, allowing voters to interact with ease. Additionally, the guidelines emphasized the need for the system to incorporate error alert mechanisms, such as notifying voters about overvoting to reduce the number of improper ballots. The accessibility guidelines detailed requirements aimed at ensuring that individuals with limited vision and other disabilities, or non-English-speaking voters, would have equal access to the voting process – including accommodations to protect their privacy.

The security section of the VVSG 2005 provided explicit guidelines regarding the distribution and validation of voting system software. These requirements were put in place to guarantee that states and localities receive the accurate and verified version of the voting system software that has undergone testing and certification. By ensuring the correct software deployment, the integrity of the voting process is safeguarded, as the software used in the voting systems aligns with the approved and validated version.

Furthermore, the security section included provisions for validating the setup of the voting systems. This involved conducting inspections of the voting system software after it has been loaded onto the voting systems, verifying that it corresponds to the tested and certified software. This additional validation step played a crucial role in enhancing the security and reliability of the voting systems, reinforcing confidence in the accuracy and integrity of the election results. By emphasizing these security measures, the VVSG 2005 aimed to mitigate potential risks and protect the integrity of the voting process (U.S. Election Assistance Commission, 2005).

To help states meet HAVA’s requirements, the law authorized $3.9 billion in funding for a grants program that the EAC would administer. Congress appropriated $2.8 billion for the first phase of the grants program to help states and localities purchase new voting equipment, upgrade their voter registration systems, and make other improvements to their election infrastructure. In 2006, Congress appropriated $1.1 billion, which was used to continue the work of phase one and fund new initiatives such as the Help America Vote College Program (HAVCP). In total, the EAC has awarded $3 billion in grants to state and local governments.

Vulnerabilities in Digital Systems Identified

The passage of HAVA in 2002 and its push for digitizing voting systems led to greater interest among security researchers in the security of voting systems. For example, Bannet and coauthors demonstrated the relative ease of injecting malicious code in DRE systems and the difficulty of detecting them. Bannet et al. (Reference Bannet, Price, Rudys and Singer2004), and Kohno et al. (Reference Kohno, Stubblefield, Rubin and Wallach2004) demonstrated major security problems in a Diebold DRE system by studying source code that an independent researcher, Bev Harris, found online.Footnote ¹⁶ In 2006, it was expected that electronic voting would be utilized by approximately 80 percent of American voters in the upcoming midterm elections, where control of the House of Representatives was on the line (Tapper & Venkataraman, Reference Tapper and Venkataraman2006). In the run-up to the election, researchers identified new problems with the security and reliability of electronic voting systems. Princeton Professor Edward Felten and graduate students Ariel Feldman and Alex Halderman acquired a Diebold AccuVote-TS machine from an undisclosed source and successfully identified methods to rapidly upload malicious programs onto the machine (Feldman, Halderman, & Felten, Reference Feldman, Halderman and Felten2006). They discovered that malicious programs could be installed by gaining access to the machine’s memory card slot and power button, which were located behind a locked door on the side of the machine. The lock could be easily picked in a mere ten seconds, enabling unauthorized access. Once inside, the installation of the malicious software took less than a minute to complete.

The researchers developed software capable of modifying all records, audit logs, and counters stored by the voting machine. They ensured that even a thorough forensic examination would not detect any tampering. These programs had the ability to change vote totals or cause machine malfunctions, which could potentially impact the outcome of an election, especially if the compromised machines were located in critical polling stations. Furthermore, the researchers discovered the possibility of spreading malicious programs to multiple machines through a computer virus. This could be achieved by piggybacking on a new software download or an election information file being transferred between machines.

These studies are part of a line of research documenting security shortcomings in election infrastructure, with a primary focus on voting systems – the machines used to record and potentially document and count votes – and how an attacker could subvert those systems to affect election outcomes or undermine the public’s perception of the integrity of an election. For example, a study from the Brennan Center for Justice on the security of voting systems documented numerous attack scenarios on voting systems that resulted in changed votes (Lawrence, Reference Lawrence2006). The State of Ohio’s EVEREST study examined the usability, stability, and security of voting systems and found that every voting system used in Ohio had “critical security failures that render their technical controls insufficient to guarantee a trustworthy election” (McDaniel et al., Reference McDaniel2007, p. 3). Its threat model focused on how a threat actor could exploit cyber vulnerabilities to influence election outcomes by producing incorrect vote counts or blocking eligible voters, or undermine integrity by delaying the results or violating the secrecy of the ballot (McDaniel et al., Reference McDaniel2007, pp. 14–15). California’s “Top-to-Bottom Review” in 2007 of voting systems used in California yielded similar results (Bowen, Reference Bowen2007) and focused on how an attacker might change election outcomes (Bishop, Reference Bishopn.d., p. 1);Footnote ¹⁷ it also “made no assumptions about constraints on the attackers” and did not consider the likelihood of any of its attacks (Bishop, Reference Bishopn.d., p. 2). Florida and Connecticut pursued studies of their own, with a comparable threat model and similar results about the poor cybersecurity of voting systems. In 2015, Norden and Famighetti used interviews and data from the Verified Voting Foundation to document a range of vulnerabilities across election infrastructure (Norden & Famighetti, Reference Norden and Famighetti2014). They too emphasized the risks of altered election outcomes and soured confidence, but in ranking the severity of threats, they also incorporated such factors as feasibility and cost. Finally, in the run-up to the 2016 elections, several other researchers and research groups issued recommendations about shoring up election systems considering the growing cybersecurity threat (National Institutes of Science and Technology, 2016).

A common thread running through many of these studies is a narrow focus on how an adversary might exploit cyber vulnerabilities to affect election outcomes and undermine confidence, in isolation from other means to achieve the same outcomes. As we have seen, however, hackers have exploited vulnerabilities in electoral infrastructure for centuries to affect election outcomes and challenge confidence in the integrity of elections: Hostile, black hat measures such as poll taxes and grandfather clauses were intended to affect election outcomes in favor of a dominant White majority, while white hat actions by civil rights leaders such as John Lewis exposed legitimacy shortcomings in electoral infrastructure that led to legislative reforms. The researchers behind the studies invested time and energy to acquire voting systems or their source code, identify vulnerabilities, and develop techniques to exploit them. A malicious hacker would have to as well, and if their goal is to subvert democracy, they might reasonably conclude that there are proven and potentially more cost-effective ways to do so than carrying out cyberattacks against voting machines: Why go to the trouble, risk, and expense of hacking a voting machine when partisan gerrymandering or selective shuttering of polling places could yield a comparable result?

This reasoning could explain why the initiative that arguably most reflected the cyber policy zeitgeist in Washington, DC for much of the period between the enactment of HAVA and the 2016 presidential election did not mention voting system security at all. The Center for Strategic and International Studies convened a commission of experts chaired by the bipartisan pair of Representatives Jim Langevin (D-RI) and Mike McCaul (R-TX) in advance of the 2008 presidential elections to provide analysis and recommendations to the new presidential administration. The commission’s report emphasized “the militaries and intelligence services of other nations” as the main cyber adversaries, and highlighted American economic competitiveness and US critical infrastructure – “electricity, communications, and financial services” as being most at risk from cyberattacks (Center for Strategic and International Studies, 2008). At the time, however, the US government did not consider election infrastructure to be part of critical infrastructure – that infrastructure’s designation as critical by the Department of Homeland Security (DHS) would have to wait until shortly after the 2016 election (U.S. Election Assistance Commission, 2022).

What Happened in 2016

The story of the 2016 election and its brush with cyberattacks is documented in the Senate Select Committee on Intelligence’s bipartisan opus, “Russian Active Measures Campaigns and Interference in the 2016 U.S. Election” (Senate Select Committee on Intelligence, 2020). The condensed depiction presented here is intended to further contextualize efforts to shore up electoral infrastructure in the aftermath of 2016.

The digital elements of the Russian campaign involved cyberattacks aimed at compromising the confidentiality, integrity, or availability of targeted systems and information operations aimed at denigrating Hillary Clinton, exacerbating political polarization, and undermining the public’s confidence in the integrity of democratic procedures. In June 2016, a hacker posted online a trove of nonpublic documents from the Democratic National Committee (DNC). One month later, a hacker calling themselves Guccifer 2.0 claimed to have shared 20,000 nonpublic DNC emails with WikiLeaks, the notorious publisher of stolen information (Thielman, Reference Thielman2016). Cybersecurity researchers and the US government have concluded that the Russian government was behind these operations, though Moscow denies the allegations. The emails, consisting of 19,252 messages and 8,034 attachments, were leaked on October 7 by WikiLeaks and a pop-up sister site called DCLeaks (Krawchenko et al., Reference Krawchenko, Judd, Cordes, Goldman, Flores and Shabad2016). The leaked correspondence revealed a bias within the DNC toward Hillary Rodham Clinton over her primary rival, Bernie Sanders, despite the DNC’s earlier claims of neutrality, and contained other embarrassing vignettes about the inner workings of the DNC. The timing of the leaks was noteworthy, happening within hours of video footage airing Clinton’s rival Donald J. Trump boasting about sexually assaulting various women. Later that day, a statement from Federal Bureau of Investigation (FBI) Director James Comey, DHS Secretary Jeh Johnson, and Director of National Intelligence (DNI) James Clapper warned that the US government was “confident that the Russian Government directed the recent compromises of e-mails from U.S. persons and institutions, including from U.S. political organizations” (Department of Homeland Security & Director of National Intelligence, 2016).

Russian government hackers also systematically scanned election-related state infrastructure in likely all fifty states and breached the systems of at least two of them.Footnote ¹⁸ The hackers were able to access voter registration data, and while there is no evidence that the hackers altered data, their access would have allowed them to do so. The hackers also researched voting systems and other aspects of electoral infrastructure, though there is no evidence that any such systems were compromised in 2016.

In August 2016, DHS Secretary Johnson hosted a conference call with state election officials to “to discuss the cybersecurity of the election infrastructure” (Department of Homeland Security, 2016). He told the officials that while “DHS is not aware of any specific or credible cybersecurity threats relating to the upcoming general election systems,” he offered DHS assistance in helping state officials manage risks to voting systems in each state’s jurisdiction. He also mentioned the possibility of designating electoral infrastructure as critical infrastructure, which would enable DHS to prioritize the sector for support and establish protected channels for information exchange.

The reaction to such a designation from officials who spoke out during the meeting, Secretary Johnson said later, “ranged from neutral to negative,” with those expressing negative views asserting that administering elections was their responsibility, not the federal government’s (Department of Homeland Security, 2016; Johnson, Reference Johnson2017). Later in August, the FBI issued an alert about malicious activity targeting election-related state infrastructure, and in September, Congressional leaders issued a bipartisan plea to state officials to accept DHS support. Forty-nine states requested technical assistance, which DHS delivered primarily in the form of remote scans of internet-facing election-related state infrastructure (Government Accountability Office, 2020).

In December 2016, Brian Kemp, then-secretary of state for the State of Georgia, sent letters to the DHS and President-elect Trump alleging that the DHS had scanned Georgia’s voter registration systems as a precursor to attacking them and asking Trump to investigate the matter upon taking office (Fulghum, Reference Fulghum2017). Secretary Johnson’s response days later explained that there was no scan, and that the traffic described in Kemp’s letter was from a DHS contractor at the Federal Law Enforcement Training Center (FLETC) conducting research on “whether incoming FLETC contractors and new employees had a certain type of professional license – a service that, as I understand it, your website provides to the general public” (Fulghum, Reference Fulghum2017). He further explained that “the technical information we have corroborated [this explanation], and indicates normal Microsoft Internet Explorer interaction by the contractor’s computer with your website” (Fulghum, Reference Fulghum2017). DHS Congressman Jason Chaffetz, Chairman of the House Committee on Oversight and Reform, followed with a letter to DHS complaining that Secretary Johnson’s written response and subsequent briefings from DHS staff “did not provide adequate information to verify or validate” this explanation; he requested that relevant records be preserved and that the DHS inspector general undertake an investigation. In June 2017, the inspector general notified Congress that Kemp’s allegations were “unsubstantiated” and that “the activity Georgia noted on its computer networks was the result of normal and automatic computer message exchanges generated by the Microsoft applications involved” (Department of Homeland Security, 2017).

The bitterness of the 2016 election, with the incumbent administration warning that Russia had interfered in the election in support of the opposition’s candidate, Donald J. Trump, and the opposition’s distrust of the incumbent administration’s motives as well as baseless claims throughout the election by Trump that the election was “rigged” against him, set the stage for post-2016 efforts to address cyber threats to electoral infrastructure.

Measures Taken between 2017 and 2020

The period between 2017 and 2020 – with the Congressional midterm elections in 2018 and the 2020 presidential contest – were an especially sensitive moment for American democracy, especially debates around electoral integrity and the resilience of election-related infrastructure. The 2016 election highlighted that cynical partisans were not the only potential threat to electoral integrity: Foreign governments also had reason to intervene. That the foreign government’s preferred candidate, Donald J. Trump, won the presidential contest raised the uncomfortable question of the extent to which Russia’s efforts contributed to it. His own linkages to Russia – including his public invitation in the summer of 2016 for Russia to find and presumably release deleted emails from Hillary Clinton’s private email server – and the Department of Justice (DOJ) inquiry into those linkages further sharpened the potential ideological stakes of whether and how to make election infrastructure more resilient against digital threats. In particular, the Trump administration, facing a series of threats to its legitimacy built in part on the vulnerability of electoral infrastructure to digital threats, could have denied or played down the existence of the vulnerability in policy. The fact that it didn’t is fairly remarkable.

Ten weeks would elapse between election day on November 7, 2016 and inauguration on January 20, 2017. On December 28, 2016, President Obama signed an Executive Order (EO) 13757, “Taking Additional Steps to Address the National Emergency with Respect to Significant Malicious Cyber-Enabled Activities,” to authorize economic sanctions against actors involved in “tampering with, altering, or causing a misappropriation of information with the purpose or effect of interfering with or undermining election processes or institutions” and sanctioned Russian organizations and individuals in connection with the 2016 election interference. It also expelled Russian intelligence officers operating under diplomatic cover from the United States and forced the closure of two Russian diplomatic facilities. In January 2017, Secretary Johnson designated electoral infrastructure as critical infrastructure. In addition to enabling the DHS to forge a deeper partnership with the sector on security issues, the designation also signaled to international partners and adversaries the sensitivity of electoral infrastructure from a national security perspective. For example, the United States had been engaged in diplomatic deliberations over norms of behavior in cyberspace during peacetime and was advocating inter alia for a norm that states do not interfere with critical infrastructure during peacetime.

When Trump took the oath of office on January 20, 2017, he inherited a policy trajectory from the Obama administration of trying to hold Russia accountable for its actions while deterring Russia or any other country from running a similar play as Russia in future elections. He rejected the assessment that Russia had intervened in the election to support him, however, and instead focused his attention on alleged voter fraud. The threat actor he had in mind was not a foreign government such as Russia or even a cyberthreat actor, but a person who is ineligible to vote that nevertheless casts a vote.Footnote ¹⁹ Such instances are exceedingly rare – in the 2016 election, for example, the Associated Press identified “fewer than 475 – a number that would have made no difference in the 2020 presidential election (Cassidy, Reference Cassidy2021). In May 2017, however, he signed an EO to launch a “Presidential Advisory Commission on Election Integrity” charged with identifying and rooting out fraudulent or improper voting and voting registration (Trump White House Archives, 2017). Not surprisingly, the commission had uncovered no evidence of widespread voter fraud when it disbanded in January 2018.

Inside the bureaucracy of the Trump administration, however, agencies such as the DHS and the FBI were positioning themselves as allies of state election officials in those officials’ efforts to prepare for the 2018 midterm elections and later the 2020 presidential elections. The DHS and the FBI hosted briefings with state election officials on threats to election integrity and how to build resilience against them (Department of Homeland Security, 2018), and in March 2018, the DHS announced the launch of the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC) to coordinate the sharing and exchange of cyber threat information among election officials and organizations (Center for Internet Security, n.d.). In addition, the designation of electoral infrastructure as critical infrastructure enabled DHS to convene a Government Coordinating Council (GCC) and a Sector Coordinating Council (SCC) to facilitate information sharing among public and nongovernmental actors engaged in election administration. In September 2018, President Trump signed EO 13848, “Imposing Certain Sanctions in the Event of Foreign Interference in a United States Election” (Trump, Reference Trump2018). The EO directs the DNI to prepare a report within forty-five days of an election on whether foreign governments interfered with it; the EO also directs that DOJ and DHS prepare a report within forty-five days of the DNI’s report on whether the foreign interference affected the election outcomes. The order also authorized sanctions and other measures against actors found to have interfered with a US election.

Congress, meanwhile, had debated multiple major legislative proposalsFootnote ²⁰ and three passed both houses: the consolidated appropriations acts of 2018Footnote ²¹ (Royce, Reference Royce2018) and 2020 (U.S. Government Publishing Office, 2019) appropriated $380 million and $425 million, respectively, to the EAC to give to states to improve election technology and security, and the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) included $400 million in HAVA emergency funds for the 2020 federal election cycle. The 2018 funding came too late to contribute much to the 2018 Congressional midterms, but by September 2020, states had spent nearly 94 percent of the 2018 funding, with thirty-five states spending their allocation completely and another thirteen spending above 90 percent of theirs (U.S. Election Assistance Commission, 2021). The CARES Act funding could only be used in direct connection with helping states manage elections in the context of a pandemic, though some states used the funding to purchase new enterprise IT in support of remote work, which could have some modest cybersecurity benefit as newer IT tends to be easier to secure than older IT (U.S. Election Assistance Commission, n.d.).

In October, the heads of the DHS, the DOJ, the FBI, and the Office of the DNI jointly warned of “ongoing campaigns by Russia, China and other foreign actors, including Iran,” to influence elections as well as attempted intrusions into state election-related infrastructure, though in the latter instance, the heads explained, “[i]ncreased intelligence and information sharing among federal, state and local partners has improved our awareness of ongoing and persistent threats to election infrastructure” and there was no evidence of a successful breach (Office of the Director of National Intelligence, n.d.).

A joint statement on November 5 from the same group took on a reassuring tone and described the government’s efforts to guard against digital threats to election infrastructure as “unprecedented”:

The agency heads warned voters to be vigilant, especially in the face of foreign influence campaigns designed to shape “public sentiment and voter perceptions … by spreading false information about political processes and candidates, lying about their own interference activities, disseminating propaganda on social media, and through other tactics.” Voters should seek ground truth about elections and election processes by contacting their local election organizations and be cautious consumers of information.

After the election, news reports surfaced that the U.S. Cyber Command had carried out cyberattacks against the Russia-based Internet Research Agency (IRA) to shut it down during the election. The IRA was a notorious “troll farm” engaged in propaganda operations, often using social media. The IRA, its leader Yvgeniy Prigozhin, and others connected with it had previously been indicted by the DOJ on criminal charges stemming from the IRA’s interference in the 2016 election,Footnote ²² and in September 2018 the DOJ indicted a Russian accused of overseeing Project Lakhta, the Russian codename for a propaganda operation targeting the United States and other countries, carried out in part through the IRA. The goal of the attack, according to this reporting, was to keep the IRA out of commission from election day until election results were certified (Barnes, Reference Barnes2019). The attack was reportedly part of a broader campaign by US military and intelligence organizations to interfere with the ability of foreign actors, especially Russia, to interfere in the midterm elections (Barnes, Reference Barnes2018).

The DNI submitted the Intelligence Community (IC)’s required report under EO 13848 on foreign interference in the 2018 midterm elections to the President on December 21. DNI Coats’ public statement about the classified report said that “the Intelligence Community does not have intelligence reporting that indicates any compromise of our nation’s election infrastructure that would have prevented voting, changed vote counts, or disrupted the ability to tally votes.” In their public comments about the required follow-on report, which was classified, the Attorney General and DHS Secretary said there was “no evidence to date that any identified activities of a foreign government or foreign agent had a material impact on the integrity or security of election infrastructure or political/campaign infrastructure used in the 2018 midterm elections” (U.S. Department of Justice, 2019).

These efforts to enhance the resilience of electoral infrastructure and disrupt adversaries’ operations continued into the 2020 election cycle, with similar results, at least as far as foreign interference goes. The DNI submitted a classified report to the president in January 2021 pursuant to EO 13848; in March, the Biden administration released a declassified version. According to that report, the USIC found “no indications that any foreign actor attempted to alter any technical aspect of the voting process in the 2020 US elections, including voter registration, casting ballots, vote tabulation, or reporting results.” It also “identified some successful compromises of state and local government networks prior to Election Day – as well as a higher volume of unsuccessful attempts – that we assess were not directed at altering election processes” (Director of National Intelligence, 2021). The follow-on report from the DOJ and DHS echoed the DNI, reporting that there was “no evidence that any foreign government-affiliated actor prevented voting, changed votes, or disrupted the ability to tally votes or to transmit election results in a timely manner; altered any technical aspect of the voting process; or otherwise compromised the integrity of voter registration information of any ballots cast during 2020 federal elections” (U.S. Department of Justice, 2021, p. 2) Both reports, however, highlighted the growing range of foreign actors engaged in digitally enabled influence operations against the United States.

President Trump lost his reelection bid to former Vice President Joseph Biden in 2020. He claimed without evidence, however, that the election was stolen from him because of widespread voter fraud. He denigrated the results of the election as illegitimate and sought ways to stay in power, despite the election’s outcome. In contrast, the DHS issued a joint statement from the elections infrastructure GCC and SCC nine days after the election describing it as the “most secure in American history” and said “[t]here is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised” (Cybersecurity & Infrastructure Security Agency, 2020).

Definitions: Misinformation and Disinformation

While disinformation and misinformation are both dangerous and deepen societal divides, the critical difference is intent. This research is concerned with disinformation – sharing false information in intentional efforts to harm or deceive. Misinformation is the “spreading of unintentionally false information” (Theohary, Reference Theohary2018, p. 5). Misinformation can manifest as internet users sharing hoaxes or conspiracy theories they believe are authentic.

Typical examples of disinformation include doctored photos, inaccurate news articles, or tampered official documents purposely planted online. These instances occur within the information environment, which encompasses systems and actors “collect[ing], disseminat[ing], or act[ing] on information” (Theohary, Reference Theohary2018, p. 5). Disinformation in international relations is a pervasive challenge, especially given the internet’s potential for anonymity, low entry cost, and global spread.

Analyzing Online Disinformation from Russia and China

Russia and China are two powers seeking to challenge or undermine norms they view as dominated by the West. Where publications sometimes focus on one or the other, this research analyzes their distinct aims side by side in deploying disinformation against democracies. While there is ample research on historical disinformation from the Soviet Union during the Cold War and its aftermath, renewing this study after Putin’s presidency began in 2000 is helpful. Likewise, President Xi rose to power in China in 2012 and implemented bold breaches of international norms and law, including cyberattacks (White House, 2015). Coupled with China’s economic and geostrategic power, these influence campaigns make valuable case studies.

Despite authoritarian similarities between Russian and Chinese disinformation targets and strategies, there are distinct contrasts. One difference is Russia’s longstanding tradition of implementing international disinformation campaigns that precede the internet’s advent. In comparison, China’s power and participation in the global disinformation landscape have grown in recent years (Bradshaw & Howard, Reference Bradshaw and Howard2019; Wray, Reference Wray2020). This chapter creates an analytical framework to map authoritarian regimes’ foreign influence efforts against democracies: (1) through longer-term, ambient disinformation, (2) during transitions of political power, and (3) during social and cultural divides. This framework drives our analysis.

Russian Disinformation’s Strategic Aims

Moscow’s aims and global positioning as an authoritarian geostrategic power help us contextualize Russian disinformation. Because Russian disinformation provides some of the most well-known and credibly attributed examples of foreign interference, Kalathil (Reference Kalathil2020, p. 36) suggests the Russian state serves as a “model for other authoritarians’ efforts.” Evidence of Russian online disinformation affecting democracies across Europe, North America, and elsewhere confirms the reach of Kremlin-initiated interference campaigns.

Bernstein (Reference Bernstein2011) calls Russia a “‘hybrid’ authoritarian regime” under Presidents Putin and Medvedev because of the existence of some democratic institutions, including multiparty elections and competitive parties. These democratic institutions are restricted yet noteworthy. In theory, these institutions’ existence should indicate that democracy’s norms are accepted and a possibility – if meager under Putin’s regime – of movement toward a more complete democracy.

Russia’s strategy has long incorporated influence operations, with the Kremlin-supported Internet Research Agency (IRA) beginning as an effort to exert influence within Russia (Pomerantsev, Reference Pomerantsev2019). Turning to Russia’s foreign targets, this research concentrates on two categories: geographically close democracies and Western democracies. Russia deployed strategic efforts externally with post-Soviet “near abroad” targets of Estonia, Georgia, Latvia, Moldova, Lithuania, and especially Ukraine (Kalathil, Reference Kalathil2020; Sukhankin, Reference Sukhankin2019). Because Russia assesses its might compared to the United States and other powers, the Kremlin also targeted Western democracies. Weakened democracy, particularly in the West, helps increase Russia’s perception of its power and influence.

Kendall-Taylor and Shullman (Reference Kendall-Taylor and Shullman2018) describe Russia’s global strategy as “confrontational and brazen.” The Kremlin’s assault on democratic institutions spans foreign interference in elections, disinformation campaigns, and corruption to erode global commitment to democracy. This research focuses on the disinformation component while recognizing disinformation as one method within the broader Russian foreign influence approach. Even within disinformation, multiple strands of influence emerge. While some understand disinformation as only overt falsehoods, this work asserts that disinformation is a complex challenge for democracies, including tactics such as the Russian military intelligence (GRU) use of narrative or information laundering and boosterism, as supported by DiResta and Grossman (Reference DiResta and Grossman2019). Narrative laundering is when “a story is planted or created and then legitimized through repetition or a citation chain across other media entities,” and boosterism is repetitious content “created and disseminated to reinforce the perception that a given position represents a popular point of view” (DiResta & Grossman, Reference DiResta and Grossman2019, p. 5). These tactics rest at the heart of the Kremlin’s foreign influence efforts.

The U.S. Department of State’s Global Engagement Center (GEC, 2020) organizes Russia’s disinformation strategy into five pillars. Those pillars are official government communications, state-funded global messaging, cyber-enabled disinformation, proxy source cultivation, and social media weaponization (GEC, 2020). These activities’ explicit connection to the Russian government ranges from clear-cut, such as official government communications, to more covert strategies, such as cyber-enabled forgeries or cloned websites. By employing a combination of overt and covert tactics, the Kremlin’s penetration of the information environment is multifold for increased effect.

Analytical Framework Applied to Russian Campaigns

Considering Russia’s aims, this section studies Russian online foreign influence in the form of ambient disinformation campaigns, exploitation of social divides, and interference during transitions of power. Ongoing, ambient disinformation plays a critical role in this strategy for amplifying falsehoods’ reach. With continuous foreign disinformation, a divided democracy can become a less powerful threat with reduced capacity to withstand further attacks, and this diffusive disinformation strategy can create optimal conditions for more targeted disinformation efforts (Beskow & Carley, Reference Beskow and Carley2019). The Kremlin’s strategy capitalizes on these advantages by employing long-term, ambient disinformation campaigns against democracies between more targeted information attacks.

Military leaders denote the movement from isolated periods of conflict to persistent information operations from authoritarian powers in the international system. Current warfare is not always declared but is undeniably already happening (Beskow & Carley, Reference Beskow and Carley2019; Gerasimov, Reference Gerasimov2016). Thus, democracies must be perpetually vigilant about widespread disinformation. The continual nature of Russian disinformation necessitates planning and foresight for successful long-term influence efforts. Researchers suggest the Kremlin organized disinformation activities on social networks far before notable moments, including elections (Kalathil, Reference Kalathil2020; Starks, Cerulus, & Scott, Reference Starks, Cerulus and Scott2019). The long-term preparation allows for increasingly effective targeted attacks during moments of particular vulnerabilities. While the exact extent is difficult to quantify, ongoing campaigns continually seek to decay democratic institutions and progress authoritarian vigor.

Chinese Disinformation’s Strategic Aims

Despite authoritarian similarities to Russia, China’s strategy maintains unique qualities, making it an attractive second case study. The Chinese Communist Party (CCP) is well-known for its propaganda, censorship, and disinformation (Blumenthal & Zhang, Reference Blumenthal and Zhang2020). China’s political leaders deny any chance of movement to democracy and favor authoritarian norms. However, China’s authoritarian leadership maintains both soft and hard aspects along with self-branding as a “consultative democracy” (Bernstein, Reference Bernstein2011; Kim, Reference Kim2019). While China was previously content to coexist with democracies, its growing power brings a willingness to challenge democracy’s broader norms.

The CCP acknowledged that China’s military and economic power was insufficient to achieve its aims and turned to increased information warfare through disinformation (Cole, Reference Cole2019). President Xi lionized “discourse power” to influence narratives and share China’s story on the global stage (Rosenberger, Reference Rosenberger2020, para. 9). Under President Xi, China created a narrative of democracy to grant their political system more “ideological legitimacy” in mainland China, Taiwan, and Hong Kong – and among other communities watching (Kim, Reference Kim2019, para. 8). There has been a marked increase in the CCP’s investment in technologies and its disinformation efforts’ intensity in positively branding China.

China increasingly prioritizes the global race for technological advancement. Citing security risks, the United States restricted Chinese companies Huawei and ZTE and encouraged European restriction of their reach (Bartz & Alper, Reference Bartz and Alper2022; Mukherjee & Soderpalm, Reference Mukherjee and Soderpalm2020; Shepardson, Reference Shepardson2021). Amid this technological power struggle, the CCP expanded its funding for the China Standards 2035 and Made in China 2025 initiatives, aiming to minimize reliance on the United States and promote domestic products (Sinkkonen & Lassila, Reference Sinkkonen and Lassila2020).

In the State Council Information Office’s White Paper on China’s Political Party System, the CCP shared “socialist democracy” branding, combining consultative and electoral democracy (Kim, Reference Kim2019, para. 2; USC US-China Institute, 2007). China’s vulnerability to criticism spurred leaders to create an image of a democracy differentiated by “Chinese characteristics” instead of blanketly criticizing democracy (Kim, Reference Kim2019, para. 2). Still lacking specific democratic processes and values, this effort sought to protect China’s domestic and international image. Beijing shifted its strategy to project China’s system as legitimate and necessary for its prosperity. China’s concerns about its global standing contextualize its foreign disinformation strategy.

Kendall-Taylor and Shullman (Reference Kendall-Taylor and Shullman2018, p. 1) assert that China “used a subtler and more risk-averse strategy, preferring stability that is conducive to building economic ties and influence.” This argument contends China’s approach focuses on offering resources to weaker democracies to distance them from the West (Kendall-Taylor & Shullman, Reference Kendall-Taylor and Shullman2018). These CCP efforts would be less influential without Russian and other countries’ concurrent campaigns to erode democratic fixtures.

The CCP’s economic, relatively risk-averse, and opportunistic strategies align with this research’s examination of Chinese online disinformation. We contend there is a combination of an insufficient public understanding of past foreign interference operations from China coupled with a marked increase in China’s disinformation activity in recent years. Kalathil (Reference Kalathil2020, p. 38) notes the CCP’s foreign influence operations were seen as mainly consisting of apparent, innocuous propaganda on official channels for “relatively minimalist and ineffective” outcomes. However, the CCP’s approach had likely been oversimplified and underestimated. Kalathil (Reference Kalathil2020) adds that this analysis ignores China’s longtime foreign influence activities to affect the international information environment in their favor.

The CCP seeks to alter broader narratives through private business and journalism, making China’s strategy more complex than merely promoting its economic interests. The likely underestimation of China’s foreign influence through disinformation partially stems from the deception involved. Evidence of Chinese computational propaganda existed largely within its borders through QQ, WeChat, and Weibo until 2019 (Bradshaw & Howard, Reference Bradshaw and Howard2019). The CCP can maintain power over messaging in China by employing censorship and banning social networks. Despite their ban for Chinese citizens, the CCP’s interest in global platforms indicates a wider strategy. Their strategy targets norms, standards, infrastructure, governance, and technology (Kalathil, Reference Kalathil2020).

Two central trends of the CCP’s disinformation against democracies are a notable rise in disinformation campaigns in recent years and a greater investment in technology for foreign influence. The following sections analyze examples of this shift to include increasingly global platforms and audiences related to our analytical framework’s themes of political transitions, societal divides, and ambient disinformation.

Analytical Framework Applied to Chinese Campaigns

Ongoing disinformation proves significant to China’s aims to emit a positive reputation. Online campaigns enable China to project favorable information while also burying criticisms. Within China, the CCP can swiftly erase dissenting comments on Chinese platforms while banning other networks. Disinformation allowed China’s reach across social networks to grow commensurately with its global stance (Lee Myers & Mozur, Reference Lee Myers and Mozur2019). While the CCP can censor and crack down on unwanted information to curate its narrative within China, it can also deploy bots to bury unwanted information and spread pro-CCP messaging across global networks.

In addition to creating supportive press for China and unfavorable press for adversaries, some CCP disinformation aims to deflect attention from China’s perceived national failings, including COVID-19’s early mishandling, by inundating Chinese and global audiences with heightened campaigns to drown criticisms (Lee Myers & Mozur, Reference Lee Myers and Mozur2019; Wallis et al., Reference Wallis, Uren, Thomas, Zhang, Hoffman, Li, Pascoe and Cave2020). Given the CCP’s intent to maintain positive narratives and geostrategic relationships globally, ongoing disinformation proves valuable in burying negative commentary and projecting pro-China content.

China–Australia relations provide a compelling example of this strategy. Australia’s democracy experienced decades of economic benefits from its relationship with China, including Chinese tourism and student populations (Searight, Reference Searight2020). However, the revelation of Chinese disinformation to impact Australian politics and discourse stirred the relationship, with some attempts to rebuild trust (Morrison, Barnet, & Martin, Reference Morrison, Barnet and Martin2020; Wallis et al., Reference Wallis, Uren, Thomas, Zhang, Hoffman, Li, Pascoe and Cave2020; Woo, Reference Woo2023). Evidence revealed CCP-linked disinformation and political donations aspiring to influence major Australian political parties’ policies on China (Searight, Reference Searight2020; Wallis et al., Reference Wallis, Uren, Thomas, Zhang, Hoffman, Li, Pascoe and Cave2020). Because China’s ongoing disinformation and soft power in Australia are pervasive, this dynamic presents economic and security challenges for their relationship’s future.

While these ongoing disinformation efforts targeting democracies serve as a backdrop to the international system, there are marked periods when China opportunistically exploits democratic vulnerabilities through societal divisions. This chapter next analyzes Taiwan as a case of Chinese influence during political transition before assessing the Hong Kong protests as Chinese influence during social and cultural divides.

Distinguishing Aims and Leadership Profiles

While Russia and China’s disinformation campaigns share similar strategic aims, they may or may not use similar strategies. Broadly speaking, Russia builds on its longstanding history of propaganda for a more direct, manipulation-driven approach, while China invested heavily in technological innovation more recently for a gradual, permeating, censorship-driven approach. The CCP prioritizes its efforts to show China’s global image as respectable, uncorrupt, and morally sound and subdues content indicating otherwise (Jeangène Vilmer & Charon, Reference Jeangène Vilmer and Charon2020). Russia is less concerned with its image and appears as a “well-armed rogue state” aiming to disrupt the present international order (Dobbins, Shatz, & Wyne, Reference Dobbins, Shatz and Wyne2019, para. 1). While China seeks increasing power, it is less concerned with Russia’s goals to disrupt the system because it holds greater power and faces steeper reputational risks. Part of Russia’s impetus for disinformation is its weakening global stance and lack of benefits from the present international order (Jeangène Vilmer & Charon, Reference Jeangène Vilmer and Charon2020). The Kremlin is thus willing to embrace risks in its disinformation strategy to disrupt the system for greater power and influence.

In contrast to Russia, China more strategically prioritized economic relationships, including investment, trade, and development assistance, to grow its influence in the international system (Dobbins, Shatz, & Wyne, Reference Dobbins, Shatz and Wyne2019). China’s export of products and services aids the country financially and helps develop other countries’ relationships with – and dependency on – China. Chinese exports’ breadth showcases Beijing’s infrastructure investments to lead technologically and globally (Sinkkonen & Lassila, Reference Sinkkonen and Lassila2020). China’s Belt and Road Initiative incorporates a Digital Silk Road component to further Chinese global advancement (Greene & Triolo, Reference Greene and Triolo2020). These relationships make China more risk-averse, reputation-oriented, and gradual in its disinformation than Russia.

China holds a more dominant role in the current international order and must be more careful and less overtly aggressive in its strategy. Despite their deflection and denial, Russia and China do little to hide their interference efforts because there is little need. With low costs, lack of gatekeepers, and accessible social networks, disinformation is an alluring way to further aims with relative anonymity (Garcia, Reference Garcia2020). While research indicates the most likely source of disinformation against a specific democracy, exact proof of culpability is challenging. The disinformation-deploying state can evade consequences by denying responsibility while inflicting ramifications on the targeted state.

If President Xi’s foreign policy becomes more aggressive, these differences in Russian and Chinese aims may shrink. For the first time in July 2021, China announced sanctions against Western institutions criticizing them (Rudd, Reference Rudd2022). Another example is China’s growing interest in near abroad territories and lack of concern for positive relations with certain democracies, particularly Taiwan. Rudd (Reference Rudd2022, para. 3) contends “ideology drives policy more often than the other way around” under Xi’s leadership, and he seeks to strengthen the Communist Party by stirring nationalism and asserting foreign policy to solidify China’s power. In contrast, President Putin projects a “clever, manipulating strongman” image to protect his power as a ruler (Kovalev, Reference Kovalev2023, para. 4). A strongman losing the appearance of might could lead to drastic action or demise. The Russia–Ukraine war, especially the Wagner Group rebellion, prompted doubts about Putin’s crafted image (Kovalev, Reference Kovalev2023; Sly, Reference Sly2023). While Putin moves to preserve his leadership status, Xi appears driven by a “Marxist-inspired belief” that Chinese strength means a “more just international order” (Rudd, Reference Rudd2022, para. 3). These approaches centering the person versus the party lead to different strategies for authoritarianism.

While it is unlikely that China will forgo its priority of positive international relations, President Xi is likely watching the Russia–Ukraine war closely as it assesses possible territorial moves. While analysis of disinformation campaigns needs to happen within the individual dyads of the instigating state and the targeted state, it is useful to analyze the extent of partnerships between or among authoritarian states in pursuing their interests to undermine democracy. This is especially true when interests align, such as Russia in Ukraine and China in Taiwan for territorial conquests.

Power Relations and Strategic Cooperation

This inquiry requires analysis of strategic cooperation between authoritarian states to target democracies. China and Russia share a border and adversarial US relations, with Xi and Putin projecting an “intimate” friendship (Lau, Reference Lau2023, para. 1). Russia and China’s agendas share aims to influence the hallmarks of democracy, including free speech and public debate. Both measure their power relative to Western democracies, meaning that weakened democracy could increase their strength (Kendall-Taylor & Shullman, Reference Kendall-Taylor and Shullman2018). Both states leverage disinformation to legitimize authoritarian systems and delegitimize democratic systems. While some cooperation between Russia and China exists, this dynamic is more nuanced than simply an authoritarian alliance. Despite sharing similar adversaries, authoritarian regimes are also competing with each other.

Disinformation-propagating authoritarian regimes learned from each other’s anti democracy campaigns, especially from Russia under Putin, to grow more robust disinformation strategies. With the Russian government’s disinformation appearing as the most visible, it is understandable yet simplistic to apply the same motivations to China. China is unlikely to cooperate extensively with Russia and its aggressive approach for fear of losing its dominant position in the international trading system. Unless necessary, the CCP will likely tread carefully to avoid harming its economic and strategic relationships.

While priorities differ, authoritarian states’ collective efforts create a “more corrosive effect on democracy than either would have single-handedly” (Kendall-Taylor & Shullman, Reference Kendall-Taylor and Shullman2018, p. 1). Russia and China’s aims are specific to their regimes, yet they operate within the same antidemocratic ecosystem. Without Russian campaigns to erode global commitment to democracy and democratic institutions, China’s foreign interference efforts would likely be less powerful (Kendall-Taylor & Shullman, Reference Kendall-Taylor and Shullman2018).

Some experts designated 2020 and 2021 as “years for Russian–Chinese science cooperation with the focus on communications, AI and the Internet of Things” building off of past partnerships like 2019’s “Sino-Russian Joint Innovation Investment Fund” (Sinkkonen & Lassila, Reference Sinkkonen and Lassila2020, p. 6). As much of this cooperation would presumably occur in private due to disinformation’s deceptive nature, we lack concrete evidence of the extent the governments are strategically cooperating.

As there are moving pieces to disinformation campaigns and the states’ individual aims vary, coordination may not be necessary. Russia, China, and other authoritarian states can and do act independently and amplify each other when it aligns with individual interests (Jeangène Vilmer & Charon, Reference Jeangène Vilmer and Charon2020). Given Beijing’s central aim to promote pro-CCP messaging, it is unlikely Moscow would spread pro-CCP propaganda without benefiting the Kremlin or eroding adversaries’ powers. Although antidemocracy disinformation serves both states’ interests, applying a blanket model to authoritarian regimes’ influence operations would be a disservice to countering interference.

Resilience and Democracy

Foreign interference efforts from authoritarian states have implications for democratic health and vulnerabilities, and democracies must take preemptive steps to protect themselves. There are multiple technical and governance strategies that democracies can consider to increase resiliency against targeted disinformation campaigns (RAND Corporation, 2023). Two useful methods are improved digital and media literacy among citizens and partnership-building across affected sectors and countries. Creating and promoting information literacy support for citizens can reduce vulnerabilities to disinformation. Especially in recent years, practitioners created resources for citizens to safely navigate the online information environment, including IREX’s Learn 2 Discern curriculum, Stanford’s Putting Civic Online Reasoning Program initiative, Google’s Interland, and the News Literacy Project’s Checkology curriculum (Brooks, Reference Brooks2020; News Literacy Project, 2023; RAND Corporation, 2023; Stanford History Education Group, 2023). Civil society education alone is insufficient against targeted online disinformation, but greater information literacy is vital for democracies to stay resilient against foreign interference (Brooks, Reference Brooks2020).

Another means to reduce democratic vulnerabilities to online disinformation is through partnerships. Much like disinformation-propagating outlets partnered to spread their nefarious content, collaboration among reputable outlets can reduce democratic vulnerabilities. For disinformation happening in the context of Hong Kong or Ukraine, partnerships between citizen journalists and mainstream media can strengthen the quality of information (Brooks, Reference Brooks2020; Huang, Reference Huang2020). In places where high-risk geopolitical events or other conditions make international reporting challenging, networks of trusted citizen journalists are critical to mitigating erroneous information and reporting timely authentic news (Visram, Reference Visram2020).

By combining education and partnerships, Taiwan’s response showcases a whole-of-society approach to combating Chinese disinformation (Huang, Reference Huang2020). The creation of laws, notably the Anti-Infiltration Act, imposed potential prison sentences and heavy fines for people spreading disinformation (Aspinwall, Reference Aspinwall2020; Halpert, Reference Halpert2020). Taiwan’s institutional approach formed ministry-specific disinformation detection task forces and supported programs led by Taipei’s digital minister. Other countries implemented other forms of regulations and protections, and democracies should continue to assess what models work best for their online and in-country contexts.

For democracies to stay healthy and competitive against targeted disinformation, they must create policies and safeguards to protect the free flow of reliable information online. Sokol (Reference Sokol2019, p. 1) describes how successful disinformation campaigns are “based on a core of truth … distorted and exaggerated beyond recognition.” The challenge of disinformation requires democracies to protect their institutions in mundane times and times of greatest vulnerability. So long as they support transparency, public debate, and free speech, democracies will likely remain targets of disinformation. By addressing the root of divisions within democracies, they have greater resiliency to foreign influence efforts.

Libertarian and Neoliberal Logics

Cyberspace, encompassing the interactions among users of websites, social media platforms, messaging, and related technologies, has been constituted through the libertarian and neoliberal logics that generate the technical and regulatory structures of internet development and policymaking. Cyberspace consequently usually permits anonymity, pseudonymity, and even spoofing.Footnote ⁶ Although early in the development of the internet many computer scientists and engineers held a soft socialist view that saw code as something to be shared and the internet as something of a public service, by the 1980s that had changed (in tandem with larger social shifts). Internet developers had adopted a Silicon Valley worldview: “‘Technolibertarianism’ became one of the central ideologies of the Internet” (Rosenzweig, Reference Rosenzweig1998, p. 1550; see also Borsook, Reference Borsook1996). Decentralized, participatory decision-making procedures, which in the earlier period signaled equality and camaraderie, were repurposed to fit libertarian norms of limited government intervention and individualism. The emphasis on individual liberty fits with allowing the individual to hide their identity as the default setting, making anonymity and pseudonymity permitted and warranted (See Berker, Reference Berker2022 on deontic and fitting categories.) Put differently, it would have been possible to engineer into internet systems a strong requirement or an expectation that users would have to identify themselves truthfully to have an online presence. That did not happen.

The move to libertarian logics included a shift toward business and profit-making, prioritizing the commodification of information and the protection of intellectual property (Marlin-Bennett, Reference Marlin-Bennett2004), all of which overlap with neoliberal logics. The Clinton administration designed support for neoliberal logics into its formative internet policies, as evinced by the decision to open the internet to commercial activities and by the creation of the Internet Corporation for Assigned Names and Numbers (ICANN) as a private, nonprofit, multistakeholder organization that would perform internet governance functions. In doing so, the United States maintained its hegemonic position and the power of corporations in cyberspace (Taggart & Abraham, Reference Taggart and Abraham2023).Footnote ⁷ To require identification by default would have added friction to the system, which was optimized for efficient, fast transactions of a market. What this meant for users’ anonymity and pseudonymity was that there was no reason to change course and require that users identify themselves truly by default. Nor was there any requirement that a person (natural or legal) could have only one cyber identity. In short, the libertarian and neoliberal underpinning of the structure of the internet is constitutive of cyberspace in which users generally may keep their (multiple) identities hidden.

Actors as Emergent

Furthermore, actors and agencies are emergent (Abraham, Reference Abraham2022; Chatterje-Doody & Crilley, Reference Chatterje-Doody, Crilley, Stengel, MacDonald and Nabers2019; Dunn Cavelty & Jaeger, Reference Dunn Cavelty and Jaeger2015; Elder-Vass, Reference Elder-Vass2008), regardless of whether the actors are identified, pseudonymous, or anonymous. As Karen Barad explains: Actors “do not preexist their interactions; rather [actors] emerge through and as part of their entangled intra-relating.” Emergence continues as actors “are iteratively reconfigured through each intra-action” (Barad, Reference Barad2007, p. ix). When actors’ identities are reasonably stable, efforts to identify bad actors open opportunities for deterring their actions in the future. That is often the case when actors are states or recognized as institutionally coherent non-state actors, though even if they do exist in a recognizable form, they are changing.

The emergence of surprising new micro-actors whose messages undermine democracy is not a novel phenomenon of the Information Age. Henry Ford (1863–1947), well-known as the founder of Ford Motor Company, surprisingly became a leading proponent of antisemitic hate and disinformation. His hate-filled screed, The International Jew, was subsequently used for Nazi propaganda (Flink, Reference Flink2000). The anti-Black and antisemitic Ku Klux Klan, which was created in 1865 by a group of Confederate Army veterans in Pulaski, Tennessee, is another example (Baudouin, Reference Baudouin2011; Quarles, Reference Quarles1999).

However, cyber-enabled technologies, because of their affordability, make it easier for surprising new micro-actors to participate in spreading hate, divisiveness, and mis- and disinformation. The resurgence of racism, antisemitism, Islamaphobia, and other forms of intergroup hatred spread through cyber-enabled technologies, and a large proportion of people were exposed to abusive content (ADL, 2023; Vidgen, Margetts, & Harris, Reference Vidgen, Margetts and Harris2019). Cyber-enabled technologies have allowed anti-vaxx groups to share anti-vaxx misinformation and promote vaccine hesitancy and rejection, eroding trust in public health agencies and causing a drop in vaccination rates, as these groups become a “political force” in democratic societies (Piper, Reference Piper2023; see also Burki, Reference Burki2020; Wilson & Wiysonge, Reference Wilson and Wiysonge2020). Perhaps most surprising is the pseudonymous QAnon, which first emerged on the 4chan social media site. QAnon adherents spread a bizarre conspiracy theory that combines alt-right divisiveness, disinformation about the outcome of the 2020 US presidential election, confabulation about the so-called deep state, and hatred for Jews, the LGBTQ+ community, and immigrants (QAnon | ADL, 2022). Many of the participants in the January 6, 2021, attack on the United States Capitol were QAnon followers (Lee et al., Reference Lee, Merizalde, Colautti, An and Kwak2022).

In the next two sections, I focus upon conceptualizing malign soft power and exploring how it is wielded using cyber-enabled technologies.

Content

The property of content refers to messages being transmitted and the emotions they convey. Message density is important as well, as the more times a particular message is received, the more it seems to be correct because it is common knowledge (Unkelbach et al., Reference Unkelbach, Koch, Silva and Garcia-Marques2019). I focus here on three commonly deployed modes by which the content works: seduction, trickery, and amusement.Footnote ¹⁶ When malign soft power seduces, tricks, or amuses, it does so through a combination of semantic and emotional content of messages.

Seduction links semantic content to emotion by invoking desire in the recipient. Online, as in person, we recognize how attracting through seductionFootnote ¹⁷ (of the sexual (e.g., Faisinet, Reference Faisinet1808) and nonsexual varieties (e.g., Bjerg, Reference Bjerg2016)) can cause harm. Content eliciting these desires spreads online in various ways, including through social media and via niche websites. Antidemocratic seduction convinces people to feel attachments that are inconsistent with democracy, such as hatred for political opponents, rather than simple disagreement with them. The spread of White Christian nationalist identitarianism in North America and Europe, a movement that is profoundly antidemocratic (Zuquete & Marchi, Reference Zuquete and Marchi2023), is an example. Individual participants produce and reproduce seduction through identitarian practices. For example, sharing “dog whistles” that express hatred in coded language gives participants a seductive sense that they are in on the secret (Marlin-Bennett, Reference Marlin-Bennett2022). Much of the content antisemitic feed of Stew Peters (@realstewpeters) on X (formerly Twitter) seeks to draw a White Christian audience into solidarity against Jews. Peters, who has a following on X of over 500,000 accounts (some of which may be automated) also engages in trickery about vaccines and other alt-right topics.

Trickery replaces falsehoods for facts, with claims that lies (known to be false) and/or bullshit (statements that are disconnected from the truth) (Frankfurt, Reference Frankfurt2005) are actually true. This practice is in play when disinformation is spread as misinformation by gullible users. For example, the Stew Peters Network disseminated disinformation about the COVID vaccine in a video, Died Suddenly (Skow & Stumphauzer, Reference Skow and Stumphauzer2022), on “Rumble, a moderation-averse video-streaming platform” (Tiffany, Reference Tiffany2023). Peters also promoted the video on X, Gab, and other social media sites. The many likes his tweets have received suggest that his falsehoods have been received by and are attractive to other users. The many reposts suggest that others spread his disinformation as misinformation.Footnote ¹⁸ Peters’ seductive messaging and lies connect with similar views disseminated by other individuals, creating interconnected networks of people who share antisemitism, White Christian nationalism, and anti-vaxx views. The widespread campaign to convince people that Joe Biden stole the US 2020 presidential election works similarly, drawing on trickery and often blending with the seductiveness of White Christian nationalism. Its success can be seen in a March 2023 CNN/SSRS poll that found that 63 percent of Republicans continued to believe it (Durkee, Reference Durkee2023). Individuals who believe in this falsehood have been tricked by antidemocratic mis- or disinformation.

When amusement is used for antidemocratic purposes, the content links humor or other pleasures to messages that in other contexts would be transgressive. A racist joke does not seem as bad to those who find it amusing. The mode of amusement allows funny or entertaining content to seem acceptable even when it is harmful (Apel, Reference Apel2009; Gaut, Reference Gaut1998). Topinka (Reference Topinka2018) examines the Reddit platform and specifically the r/ImGoingToHellForThis subreddit (now banned), in which members of the subreddit used humor to express racism, misogyny, antisemitism, and extreme anti-immigrant sentiments. Topinka provides a close analysis of how the redditors treated the famous, haunting picture of Alan Kurdi, the two-year old Syrian refugee who drowned along with his mother and brother in the Mediterranean Sea while fleeing to the Greek isle of Cos. The posts remixed the image of the dead toddler on the beach into jokes that were at once racist and anti-immigrant extremist. As soft power practices, “[t]he very ostentation on which this humor relies thus functions as a cloak concealing the networks of racist sentiment that the discourse sustains” (Topinka, Reference Topinka2018, p. 2066). This now defunct subreddit and other similar sites simultaneously rely on the democratic principle of free speech and eschew core democratic values. More generally, humor is often used on social media platforms to catch the eye of the user who is scrolling through feeds, be they TikTok or Instagram or another app, to find a quick laugh. Amusement is antidemocratic when it works to normalize hate or convince people of the truthfulness of fallacious claims relevant to current politics. Jokes may intensify the connection between humor and hate (Askanius, Reference Askanius2021; Marlin-Bennett & Jackson, Reference Marlin-Bennett and Jackson2022).

Velocity and Access

Controlling velocity (direction and speed) and access to messages are the other two properties for acting on soft power. Cyber-enabled technologies afford actors at all scales the capacity to manipulate these, but it is not necessarily the case that any specific techniques are relevant solely for antidemocratic purposes. If the content is antidemocratic, then increasing its velocityFootnote ¹⁹ – that is, increasing the speed at which the messages move and the spread of the messaging – is a means of wielding soft power to undermine democracy. Directions can be direct (going from a source to an expectant recipient) or circuitous. Speeds of message transmission range from fast to slow, and from constant to intermittent. The metaphor of a unit of information (e.g., a meme) “going viral,” means it is spreading quickly and in multiple directions. Messages can also jump from platform to platform and across technologies (DiResta, Reference DiResta2018).

Bots are usually designed to increase velocity. Bessi and Ferrara analyzed tweets about the 2016 presidential election during a five-week period in the fall of 2016. They found that approximately one-fifth of these tweets were generated by bots. They conclude:

Micro-actors can also increase velocity, which they do by reposting and commenting, as well as by moving posts to new platforms (Marlin-Bennett & Jackson, Reference Marlin-Bennett and Jackson2022). Wielding malign soft power could also work by decreasing the velocity of messages that support democracy.

Controlling access to information is another means of wielding soft power. At stake is whether someone is exposed – or not exposed (denied access) – to information by choice, by chance, or by force. A choice approach means providing access to those who have requested the information, those who are already attracted to the messages. This soft power doubles down on existing attachments. Social media sites like r/ImGoingToHellForThis work this way. Users choose to subscribe and, in doing so, build community among those who are attracted to the divisiveness, hate, and mis- and disinformation. An access-by-chance approach is not targeted at any specific actor but instead involves providing access widely and anticipating that some who happen upon the messages will be swayed by them. The actors behind bot accounts uncovered by Bessi and Ferrara (Reference Bessi and Ferrara2016) probably disseminated manipulated information on X using a chance strategy of sending out a lot of content quickly and widely. The effectiveness of a chance approach depends on whether the messages find a core group of people who are receptive to it. Hindman and Barash (Reference Hindman and Barash2018) also find more real news than fake news on X in the months before and after the 2016 election in the United States, but they remain concerned about the dense networks of followers of popular fake news accounts: “[T]he popularity of these accounts, and heavy co-followership among top accounts, means that fake news stories that reach the core (or start there) are likely to spread widely” (p. 4). (See also Grinberg et al. Reference Grinberg, Joseph, Friedland, Swire-Thompson and Lazer2019.) The movement of antidemocratic messaging thus accelerates when it reaches a community who are disposed to be attracted to it. Forced access involves exposing a user to information in a targeted way but without prior subscription or other sort of confirmation of willingness to receive it. Algorithms that display increasingly extreme messages to users force access to antidemocratic information upon them.

An algorithm’s control of the flow of antidemocratic information is an instance of deploying malign soft power even though the algorithm itself does not have motivation in the same way a human does. Algorithms that determine what appears in social media newsfeed are part of an assemblage (Bennett, Reference Bennett2005) determining access to information. DeCook and Forestal argue that “digital platforms not only curate and channel certain content to individual users but also facilitate a particular mode of collective thinking that [they] term undemocratic cognition” (2023, p. 631).Footnote ²⁰ The practice of curating and channeling is clearly an instance of soft power in which individuals are subject to attraction. Motivations, I suggest, are written into algorithms that collect data, analyze what would attract users in a way that serves the motivations of the assemblage, and then produce a newsfeed that gives users access to certain messaging and withholds access to other messaging. (And because of the vagaries of coding, the outcomes of this process may or may not be wholly what the firm’s management had expected.) While “make money!” is a compelling motivation for many social media firms, concerns have been raised about Chinese-owned social media like TikTok (The Economist, 2023). Kokas notes that China seeks to “manipulate messaging to key [Western] constituencies” for (implicitly) antidemocratic ends (2022, p. 95; see also Zhong, Reference Zhong2023). Additionally, a failure to actively protect against undermining democracy by preventing access to a biased stream of information in one’s newsfeed also suggests a motivation that undervalues the protection of democracy. This is perhaps a lesser kind of maliciousness, one of omission rather commission.

Control over content, access, and velocity usually operate together. For example, information flows that flood social media quickly move a large volume of messages in terms of the number of posts and/or the amount of message within posts (Cirone & Hobbs, Reference Cirone and Hobbs2023). These flows characterized by steady streams of the same untruth contribute over time to making those false claims seem true as a function of “truth by repetition” (Lewandowsky et al., Reference Lewandowsky, Ecker, Seifert, Schwarz and Cook2012; Morgan & Cappella, Reference Morgan and Cappella2023; Unkelbach et al., Reference Unkelbach, Koch, Silva and Garcia-Marques2019).

As Figure 4.1 summarizes, someone or something wields malign soft power for antidemocratic motives by controlling the flows of information. In the background of this analysis are those for whom the information flow is a hard power attack. In the foreground are the targets of malign soft power, the recipients of flows of attractive hate, mis- and disinformation, and other content that undermines democratic institutions. The intended recipients are those likely to be swayed by the information presented to them.

Figure 4.1 Wielding malign soft power.