Making Cyberspace Safe for Democracy

With the 2020 U.S. presidential campaign underway, stories of Russian interference are again in the headlines. In 2016, Russia’s hacking operations and use of social media to manipulate public discourse in the United States caught U.S. policymakers off-guard. Four years later, officials have not yet fully understood that those attacks reflected the changing landscape of geopolitical competition. Viewing Russia’s attempts at interference in 2016 in isolation misses the larger context: rival states compete in the twenty-first century as much over information as any other terrain. 

Democratic countries view information as an empowering force in the hands of people: the free and open flow of ideas, news, and opinion fuels deliberative democracy. Authoritarian systems see this model as a threat, viewing information as a danger to their regimes and something the state must control and shape. Using surveillance, censorship, and the manipulation of information, authoritarian regimes shore up their power at home while weakening democratic competitors abroad. 

The United States and its democratic allies have not adjusted to this reality. They have been reactive, focusing on what they are trying to defeat; they have not developed a strategy for success. The struggle over information has emerged at a time when democracies are under increasing pressure from within and without and as authoritarianism is gaining ground around the world. The new great-power competition won’t necessarily take place on battlefields or in boardrooms; it will happen on smartphones, computers, and other connected devices and on the digital infrastructure that supports them. The typically hands-off approach that many democratic governments take to information will make it hard for them to compete. 

Democracies face a dilemma. If they don’t take an active role in the information contest, they will leave themselves vulnerable at home and lose ground abroad. But if they are more proactive and aggressive in the wrong ways, they will risk mimicking the heavy-handed behavior of autocracies and creating the kind of rigidly controlled environment autocrats seek. 

The stakes of this contest are high. If authoritarian actors succeed, states will increasingly control information and shape how their citizens perceive reality. The global rules that govern information infrastructure will favor authoritarian systems, not democracies, limiting the United States’ ability to exert influence and project power, while weakening its own system of government. The world will become more authoritarian and less democratic. 

Policymakers must protect a democratic information space in order to preserve the ability of democracies to function and defend their way of life. Understanding the nature of this contest, defining a vision for success, and developing a new strategy to fulfill that vision are critical to protecting U.S. national security in the information age. 

WAGING THE INFORMATION WAR

Unlike the United States, China and Russia have made the information contest a key part of their national security strategies. They have prioritized activities both in cyberspace (the network infrastructure underlying the Internet, such as servers and computer systems, which can be vulnerable to intrusions) and in the information space (the arena of data and public perception, where states can employ surveillance, gather data, perform espionage, and distort information). Both countries emphasize their sovereignty in cyberspace, aiming to monitor or control the flow of information within their borders. At the same time, although they use different tactics, both China and Russia have developed methods of manipulating information abroad. China and Russia are also striving to lead in the emerging technologies, such as artificial intelligence (AI), that will shape this geopolitical contest in the years to come.

As with much of its foreign policy, Russia frames its approach to cyberwarfare and information warfare in defensive terms, believing the United States already uses information to support dissidents within its borders. Its 2016 Doctrine of Information Security formalized “protecting the information sovereignty of Russia” as central to maintaining the stability of Russian society. Its election interference makes up only part of a broader strategy of eroding the political and social systems of a targeted country, attempting the psychological manipulation of its population, and, in the words of the Russian Defense Ministry’s 2011 document Conceptual Views on the Activity of the Armed Forces of the Russian Federation in Information Space, coercing “the state to take decisions for the benefit of the opposing force.” 

Russian actors typically manipulate information not to persuade others or spread a view or an ideology but to sow confusion and disruption. Their aim is to create the impression that truth does not exist, undermining trust and authority in democracies. Russian manipulators on social media amplify extreme views, conspiracy theories, and doubts about democratic institutions. State-backed media outlets also help spread these narratives. For example, after Russian operatives were accused of poisoning the former Russian intelligence officer Sergei Skripal and his daughter in the United Kingdom, Russian officials used Twitter to spread alternative theories that other forces may have been behind the attack, implying that identifying the culprit would be impossible. State media and covert online networks amplified these claims.

China aims to control the flow of information inside its borders while trying to influence societies abroad.

In China, authorities are similarly committed to tightly controlling the flow of information inside the country while harnessing information to influence societies abroad. The Chinese Communist Party has called for close coordination across all organs of the state in guarding cyberspace and the information space, seeking to create a “harmonious Internet” by censoring dissent, limiting foreign suppliers of technology to China, and promoting China’s model of cyber-sovereignty, including elements of its Great Firewall, in other countries. China has also built institutions to advance this strategy, with organs such as the Cyberspace Administration of China and the People’s Liberation Army playing roles in China’s integrated approach to cyberspace and the information space. 

This concerted strategy comes from the top. Chinese President Xi Jinping has emphasized the importance of “discourse power”: the creation and dissemination of narratives that serve the state’s interests and the suppression of those that threaten the state. For example, Chinese entities have purchased independent media outlets across numerous African countries, incentivizing the publication of favorable narratives in Africa and the removal of unfavorable content. In 2019, actors linked to the Chinese government tried to manipulate discussions of the Hong Kong protests on platforms such as Facebook, Twitter, and YouTube. Chinese officials and media outlets also sought to shape coverage of the outbreak of the novel coronavirus, which began in late 2019, by suppressing reporting on China’s failings (including by ejecting three Wall Street Journal reporters from the country in retaliation for an op-ed critical of China’s initial cover-up), spreading the conspiracy theory that the virus resulted from a U.S. bioweapons attack, and exploiting U.S. President Donald Trump’s lack of transparency about the virus to portray the Chinese response to the pandemic as superior.

China’s traditionally more cautious diplomats have recently taken more strident postures online, with numerous Chinese officials using Twitter (which is blocked in China) as a bully pulpit. The Foreign Ministry spokesperson Zhao Lijian is a particularly aggressive diplomat who gained notoriety for defending China’s human rights abuses in Xinjiang by mocking American concerns; in several cases, he pointed to examples of racism in the United States to argue that Washington, not Beijing, had a problem with human rights. Meanwhile, China uses coercion to control speech outside its borders, pressing companies to avoid “sensitive” topics if they want to continue to conduct business in the country. In 2019, Chinese companies retaliated against the National Basketball Association by cutting off partnerships, sponsorships, and broadcasts after the general manager of the Houston Rockets tweeted in support of protests in Hong Kong. The league quickly apologized, eager to protect its access to the Chinese market. That incident followed similar cases involving Marriott, Mercedes-Benz, and numerous airlines. Chinese officials have also intimidated foreign media for coverage they considered unfavorable: China’s ambassador to Sweden threatened a Swedish media outlet over its reporting on the detention of a dissident bookseller. China’s decision to expel all reporters from The New York Times, The Washington Post, and The Wall Street Journal in March, supposedly in retaliation for the Trump administration’s decision to restrict the size of Chinese state-backed media outlets in the United States, was another escalation in this global war on the free press.

A TOTALIZING APPROACH

China and Russia treat cybersecurity and information security as two sides of the same coin, an approach that enables the control and manipulation of information at multiple levels. In China, the government and the private sector work more closely together to develop and deploy new technologies. Both Beijing and Moscow have also injected significant amounts of capital into emerging technologies, guiding development in the state’s strategic interest. 

Chinese and Russian firms have already begun to develop new technologies and applications that have a global reach. In 2019, the popularity of FaceApp—an application designed and distributed by a Russian company that encouraged users to upload pictures of their faces—raised questions about whether the Russian government could use it to gather facial recognition data from around the world. Algorithms can also be trained to privilege certain content or suppress other content, a function China mandated domestically in its latest content-regulation rules and appears to be using globally through platforms such as the popular video-sharing app TikTok. 

Beijing is developing AI-enabled surveillance technology for what it calls “social governance,” exemplified in its treatment of the Muslim minorities in the western province of Xinjiang, who are subject to all-encompassing monitoring by such technology and forced into concentration camps for perceived disloyalties. But it is also rolling out surveillance technology across China, accompanied by a system of assigning behavior-based “social credit” scores to individuals. And Beijing is exporting surveillance technology to other countries, often billed as “safe city” programs to supposedly provide high-tech public safety systems. Although Russia lags behind China on AI development, Russian President Vladimir Putin has sought to catch up, investing heavily in research and expanding AI partnerships with China.  

To train algorithms and feed machine-learning processes, developers need more and more data from diverse sources. The export of their technology allows China and Russia to shape the global information architecture of platforms, applications, and surveillance systems. And it allows them to collect more data in the interest of training AI applications and more finely tuning methods of controlling and manipulating information. China’s so-called Digital Silk Road, a technological plank of its infrastructure- and investment-driven Belt and Road Initiative, is one vehicle through which it exports network and platform technologies and shapes the infrastructure and norms that govern information in other countries. The installation of Chinese 5G equipment around the world will enable the collection of huge tranches of data by Chinese telecommunications companies. This information could be shared with Chinese state or Communist Party institutions. The Chinese government’s support for Huawei, a Chinese technology company that sells telecommunications equipment, smartphones, and other consumer electronics, has helped create a global behemoth. China also distributes its surveillance technologies to Western democracies; the French city of Marseille is working with the Chinese telecommunications company ZTE to establish a public surveillance network. Although China is a bigger exporter of global information infrastructure, Russian companies also export lower-cost Internet monitoring technologies to many countries, including Iraq and Mexico.

Alongside digital infrastructure, China and Russia are building traditional media networks outside their borders, expanding the reach of their state-backed channels to Africa, Latin America, and the Middle East and developing partnerships with overseas outlets to spread content friendly to Chinese and Russian interests. For example, China has invested in independent media in South Africa, and the Chinese-owned StarTimes media group has operations in 30 African countries. Many of these outlets have substantial online presences. Chinese state-owned media companies control some of the fastest-growing Facebook pages, and the English-language Russian channel RT maintains a robust following on YouTube. Chinese and Russian state media outlets increasingly work together, echoing each other’s narratives, especially criticism of the United States. For example, Russia’s news agency Sputnik, a propaganda outlet, has cooperation agreements with China’s state-backed newspaper Global Times and its news agency Xinhua, including for sharing content in Arabic and Spanish, and Russia’s RT and China’s Xinhua have mirrored each other’s messages in blaming the United States for fomenting protests in both Hong Kong and Russia.

ARCHITECTURE OF CONTROL

Government control of the digital network architecture also allows authoritarians to restrict information flows within their own borders. Under its 2019 “sovereign Internet” law, Russia is centralizing Internet traffic in the country and creating chokepoints (akin to those of China’s Great Firewall) that will enable Moscow to seal off the Internet in Russia from the rest of the world. Other countries, from autocracies such as Iran to democracies such as India, have used Internet shutdowns to limit information in the face of unrest. China’s development of a separate Internet root system, the digital mechanism that directs online traffic, could be a key step toward a bifurcation of the Internet. By developing control over part of the Internet, China could turn connectivity into a geopolitical weapon, insisting that countries submit to Chinese terms and conditions. The threat of disruptions on 5G networks that Chinese companies control could provide similar leverage for geopolitical manipulation in the future.

China and Russia pose an alternative model to the free and open Internet that the United States and its allies have championed for decades. Their vision of multiple “sovereign” and controlled Internets would hand significant control to national governments. Last fall, Russia worked with China and others to secure UN General Assembly support for the development of an international cybercrime treaty, framed around national sovereignty and censorship, that would allow greater government oversight of online content. Despite U.S. opposition, the resolution passed with the support of many African, Asian, and Latin American countries. China and Russia have courted many members of this large group—including Mongolia, Nigeria, and South Africa—which scholars at the think tank New America have dubbed “the Digital Deciders.” These states have not yet committed to either the democratic Internet or the statist authoritarian model.

Beijing, in particular, is also working with other governments to develop legal frameworks, often modeled on its own laws, for “sovereign Internets” that sanction greater government control over flows of information. These laws frequently focus on censorship and the removal of sensitive content, as well as issuing requirements for data to be stored locally in a given country, a rule that erects protectionist barriers and enables government scrutiny. The laws often accompany the import of Chinese technologies and network infrastructure. Beijing also frequently trains foreign officials on media and information management and the use of data. 

THE DEMOCRAT’S DILEMMA

The United States lags behind in many ways, including in the framework it uses to understand the digital world. Washington views the information contest in largely tactical terms and has failed to recognize that these activities occur across three integrated dimensions: information (the propagation, control, and manipulation of narratives), architecture (the systems and platforms that transmit, order,  and collect information), and governance (the laws, norms, and, in some cases, standards for content, data, and technology). And the United States has not fully grasped what is already clear to China and Russia, that the domains of cyberspace and the information space increasingly converge.

Although Washington’s 2018 National Cyber Strategy notes the threat of information operations and the authoritarian challenge to an open Internet, most of the text focuses on a traditional view of cybersecurity that is more limited to the functioning of networks. The 2020 report of the Cyberspace Solarium Commission—a bipartisan intergovernmental body tasked with devising a new strategy to defend U.S. cyberspace—goes a few steps further, recommending more concerted action on developing emerging technologies and countering information operations, but doesn’t address questions on how information and data should be governed. In 2017, then U.S. Secretary of Defense James Mattis insisted that the military should recognize the importance of information in twenty-first-century warfare and great-power competition. But although civilian agencies are involved in various strategies for managing cyberspace and information, the United States lacks an integrated national strategy outside the military domain for competition in the information space. Much of the global information contest takes place on private networks aimed at civilians—areas outside of traditional U.S. government jurisdiction, where Washington has not yet figured out how to work systematically with the private sector and civil society.

Officials in the United States and other democratic countries cannot simply borrow from the Chinese and Russian playbooks. They have to determine how best to engage in the information contest without distorting information or compromising the fundamental openness of their societies. When democracies regulate content and increase control over the Internet’s architecture, they weaken democratic institutions. In the information contest, adhering to democratic values is not just the right thing to do—it is necessary to win the competition with autocracies. 

U.S. officials cannot simply borrow from the Chinese and Russian playbooks.

That’s because a fundamental asymmetry shapes this contest between democracies and authoritarian states. Authoritarian actors see great advantages in controlling and manipulating information, but for democracies, doing so would undermine their institutions and values. At the same time, the dependence of democracies on free and open political discourse provides opportunities for their rivals to intrude into their information ecosystems. These dynamics constrain how democracies can respond to the malicious efforts of their adversaries. Adopting the tactics of Beijing and Moscow, or accepting their framing of the contest as an information war, would mean surrendering to authoritarian terms and creating a race to the bottom in which democracies can only lose. The challenge for democracies is to thwart authoritarians without playing into their hands.

Foreign actors aren’t the only threats to a free and open public square. A polluted and chaotic information environment filled with hate speech, extremism, and disinformation has weakened democracies from within and eroded their claim to the moral high ground. From the spread of white supremacist manifestoes and anti-vaccination conspiracies, to politicians disseminating deceptively manipulated videos, to the online harassment of women, to elected leaders using social media to share lies, the promotion on online platforms of viral and extreme content has encouraged behaviors at odds with healthy democratic discourse. 

Without sufficient protections, the new digital economy pioneered in the United States risks undermining traditional protections on privacy and individual rights. What the scholar Shoshana Zuboff calls “surveillance capitalism”—the way private technology firms have turned human experience into the raw material of the new economy—actually narrows the gulf between the application of digital technologies in democracies and their application in autocracies such as China. Surveillance capitalism is motivated by profit, whereas China’s extensive surveillance systems are geared toward cementing government control. But both forms of surveillance prioritize the mass collection of data and have the power to shape how citizens perceive their world. In the absence of action by democratic governments to limit the use of surveillance technologies, such tools are eroding the boundaries of privacy in many democracies, with the monitoring of what students do in their dorms, for example, or the ability to identify individuals through images gathered from social media. Although some cities have banned facial recognition technology, others, such as London, are using that technology more concertedly. Washington’s hands-off approach to the regulation of emerging technologies doesn’t help; when democracies fail to present a clear alternative to their authoritarian counterparts, they fuel the growing perception that the digital technology being developed in the United States is no different from that being developed in China.  

European officials have begun to call for a new approach to address these challenges. French President Emmanuel Macron has expressed a desire for a “new path,” away from the “Californian form of Internet,” in which the government allows companies to make decisions that have huge social and economic implications, and from the “Chinese Internet,” in which the government drives innovation and holds the reins. French and EU officials have separately begun articulating principles for this third way, including many sound ideas. By framing their visions in terms of protecting European “sovereignty,” however, they have evoked Beijing’s and Moscow’s rhetoric, failing to clearly differentiate the democratic model. Most troubling for U.S. officials is that European officials are seeking a new model to distance their countries from the United States, rather than working to build a broader democratic framework. Refusing to address its own shortcomings while withdrawing from the world, the United States is disengaged from these important deliberations. 

FINDING STRENGTH IN HUMILITY

The United States should not continue to cede leadership to the private sector. It must wrestle with tough issues, weighing the tradeoffs among protecting democratic values, maintaining the country’s technological competitiveness, and keeping data flows relatively open while preventing that information from falling into authoritarian hands. And Washington must figure out how to gain greater cooperation from the private sector without harming the ability of U.S. companies to innovate or undermining the free market.  

The United States should not simply focus on countering disinformation or techno-authoritarianism; it must take a more proactive stance in building an information ecosystem that works in the interests of democracies. To do so, the United States needs to work with its democratic partners to develop an updated information model that reflects democratic principles and puts individuals, not companies or governments, in control of how their data are collected and used. Washington also needs to structure and resource its government agencies for success in this contest and develop new means of collaboration between the government and the private sector, particularly around emerging technologies. 

The United States needs to approach these tasks with humility, conceding that its aloof approach to data privacy and the regulation of technology has undermined the freedom and openness of its vision for the Internet. With this admission, and through steps taken domestically to better protect privacy and regulate technology companies, Washington could more easily forge a multilateral coalition with its democratic partners, particularly those in Europe. Continuing to support a free and open Internet is important in opposing the control that authoritarian regimes seek through the spread of “sovereign Internets.” But democracies also need to recognize and address the way bad actors exploit democratic rights and freedoms to undermine them. A new framework would prioritize data privacy and make transparent how algorithms dictate what individuals see online. And it should better balance power among governments, technology companies, and individuals. These measures would provide a clear contrast with the authoritarian model and an attractive alternative for other countries tempted by China’s side of a future bifurcated Internet. 

Success in this endeavor will require restructuring the way the U.S. government works on these issues. The United States should not imitate Chinese or Russian structures, but no U.S. government entity currently has the mandate, authority, or resources to tackle the full scale of the information contest. The National Security Council should organize an integrated, civilian-led interagency approach to network, information, and emerging technologies. It should coordinate across relevant government agencies and develop new cooperative mechanisms with the private sector. The Department of Defense has begun to prioritize the information contest, and Congress has given it new authorities to conduct military operations in the information environment, such as when it sent warning messages to known Russian online operatives ahead of the 2018 midterms, but its role should be limited. Militarizing this contest would only play into the hands of authoritarians by turning information into the weapon that they want it to be.

Much of today’s diplomacy happens not at private negotiating tables but in the public square, so the United States needs to free its diplomats from traditionally slow bureaucratic forms of messaging so they can be nimble in the modern information space by engaging in public as a core part of their mission and by integrating technology into their outreach. U.S. officials should expose through public reporting and funding of independent media the malign and coercive information activities of authoritarians. U.S. leaders in the public and private sectors need to push back against extraterritorial censorship by standing with companies threatened by autocracies and exposing technologies that automate censorship. Washington should try to curb the expansion of the authoritarian model by advancing democratic principles about cyberspace and the information space in multilateral governance bodies. And the United States should invest in its own civil society, protecting free and independent media and supporting efforts to conduct research about the information space. 

The private sector has a major role to play, including through new modes of public-private cooperation. Technology companies and traditional media need to grasp how malicious actors seek to turn their businesses into geopolitical battlegrounds. At the same time, the government should not approach technological rivalry as a values-neutral exercise in domination: for example, thinking of competition over AI systems as an arms race risks the development of systems fundamentally at odds with democratic governance and values. Instead, the government and the private sector should together drive innovation that advances the democratic values of free speech and privacy, protects the free market, stops attempts by bad actors to distort information, and presents a competitive alternative to authoritarian-developed technologies. Both the public and the private sectors, for instance, have started to develop principles around the ethical use of facial recognition technology and are collaborating on technologies to detect deepfakes: AI-concocted audio or video of events that never happened. 

Thanks to declining funding for basic research and China’s hands-on role in stoking innovation, the United States risks falling behind in the development of new technologies. The government should prioritize emerging technologies such as AI and quantum computing and raise funding for research and development in partnership with private industry, redoubling efforts to train—and attract from overseas—top scientists and engineers. Policymakers should also restrict technologies that can significantly hinder democratic governance and human rights, starting with a moratorium on facial and gait recognition technology, which require oversight and clear rules to guard against abuse, followed by a more rigorous consideration of how to use and govern AI. There may also be technological solutions to problems of individual privacy: more sophisticated machine-learning models, for instance, might depend less on large tranches of personal data. The United States and its democratic allies should also prioritize a multilateral approach, in coordination with the private sector, to greater influence international standards bodies such as the International Telecommunication Union and how they guide the use of emerging technology around the world. 

 The United States urgently needs to seize the initiative in the information contest. The challenge will only grow as technologies evolve and more countries adopt digital authoritarian strategies. As the information space becomes more polluted, segmented, and rigidly controlled, it will become harder for the United States to build resilience and respond to external threats. As more physical objects—from refrigerators to cars to coffee machines—go online as part of the “Internet of Things,” digital technology will increasingly order and govern life. Worse, the reliance on digital technologies risks distorting perceptions of reality. Deepfakes may contribute to the loss of any shared sense of reality. And as authoritarian models of technology and information governance spread, the space for democratic practices will shrink.

Yet the biggest barrier to successfully contesting the information space may be the erosion of democracy at home. Democratic leaders who weaponize information and disregard the principles of democratic governance will make their societies less resilient, fail to demonstrate an alternative to the authoritarian model, and accelerate the very degradation of the information space that authoritarians seek. In the information contest, the United States cannot advance a democratic vision if its leaders do not embody it.