How Australia can help the US make democracy harder to hack

In the drumbeat of reports^[1] about Russian attempts to undermine U.S. democratic institutions with trolls^[2], Twitter bots^[3] and cyberattacks on congressional candidates^[4], it is easy to forget that the problem of election security is not isolated to the United States, and extends far beyond safeguarding insecure voting machines^[5].

Consider Australia, which has been grappling with repeated Chinese attempts to interfere with its political system. One 2018 report, for example, found that the Chinese have infiltrated “every layer of Australian Government^[6], right down to local councils.” That’s why a group of academics and policymakers from Indiana University and the Australian National University recently met to discuss how we might make democracy harder to hack. We found that we had far more to work on together than we had anticipated.

Protecting a diverse, widespread system

In the wake of the 2016 U.S. elections, scholars, government officials and concerned citizens are debating how to mitigate the risk of foreign groups targeting the election machinery upon which democratic societies^[7] are built.

Vulnerabilities are widespread across the thousands of largely locally managed systems that together comprise U.S. election infrastructure. These vulnerabilities include voting machines that in some cases still have no paper trails^[8] and are often running “severely outdated operating systems like Windows XP,” which has not been patched since 2014^[9].

But that is just a taste of the parade of horribles against which people must inoculate the election system. Other risks include hacked tabulation systems, which was a major concern in the 2017 Dutch elections^[10], as well as compromised media outlets, as in Ukraine^[11].

What’s been done so far?

Since 2016, the U.S. government has made progress in protecting democratic institutions. In January 2017, for example, the U.S. Department of Homeland Security reclassified elections^[12] as critical infrastructure, which has helped to focus attention^[13] on the issue. Congress has also appropriated US$380 million^[14] to help speed the purchase of new, more secure voting machines.

In addition, local and state election officials have a new way to get up-to-date cyber threat information from the federal government^[15]. But further progress has stalled^[16], including the Secure Elections Act, which would, among other things, ensure that every vote cast in the U.S. is on a verifiable paper ballot.

What more should Americans be doing, and what can Australia teach us?

Protecting democracy down under

Threats to Australia’s democracy differ in several key respects from those facing the U.S. To begin with, voting is mandatory^[17] in Australia, so there aren’t thorny political battles over who is allowed to vote^[18]. The major parties also agree on electoral boundaries so as to prevent gerrymandering.

Voting itself is different, too. When Australian voters enter a booth, they use paper forms, which are tallied by hand. And the election process is overseen by a central federally mandated body, the Australian Electoral Commission^[20]. This contrasts significantly to the U.S., where voting processes and infrastructure are heavily privatized, using antiquated technologies^[21], though various constituencies have experimented with different forms of electronic voting^[22].

With centralized operations, the Australian government has more control over the voting process and less need to worry about local variations that might threaten its integrity. At the same, such centralization makes for a tempting target^[23].

Lessons from afar

Both countries do have reasons to worry, though. Their shared concerns include manipulation of public opinion^[24] via social media; alleged foreign influence over politicians^[25]; diminished public confidence around trust, privacy and data; and overseas ownership^[26] of news outlets. Fixing these depends much more on addressing human shortcomings than vulnerabilities in digital systems^[27] or formal institutions.

Australia also recognizes that political parties are potential targets – as the U.S. found out^[28] when the Democratic National Committee’s emails were hacked in 2016^[29] – as well as the lesser-known hack of Republican National Committee emails^[30].

Australia is also working to reduce foreign influence in other aspects of its political and business activities. Like the U.S., Australia has passed tough new foreign agent registration laws^[31] with bipartisan support. It has also blocked attempts by Chinese firms to buy controlling stakes in resource companies or large amounts of agricultural and urban land^[32]. And it recently excluded the Chinese tech giant Huawei^[33] from bidding to provide an Australian 5G mobile data network, citing a potential threat to national security.

And Australia has decided to invest early to guard against future information warfare^[34], such as micro-targeting^[35] audiences with tailor-made messaging and machine learning-enhanced deepfake videos^[36]. The country has assigned top government officials^[37] to focus on cyber threats^[38] and begun an effort to ask all citizens to improve their cybersecurity.

Protecting political parties and citizens?

The U.S. has not yet followed Australia’s lead in providing government cyberdefense for political parties. Other aspects of civil society^[39] are also left undefended. Hackers have stolen public servants’^[40] data, making them vulnerable to blackmail or fraud. Think tanks and research centers^[41], as well as businesses^[42], have data and other documents that are tempting targets.

The U.S. could do more, perhaps even designating citizens themselves as critical to society and in need of government support and protection against hacking and other online threats. That would acknowledge the many efforts underway to influence voters^[43] with false and misleading information^[44].

By taking a lead from Australia – and by learning from successes and failures there, and in other countries^[45] – the U.S. could find ways to protect democracy at home and abroad.

References

1. ^{^} reports (www.nytimes.com)
2. ^{^} trolls (theconversation.com)
3. ^{^} Twitter bots (www.wired.com)
4. ^{^} congressional candidates (www.reuters.com)
5. ^{^} insecure voting machines (www.npr.org)
6. ^{^} every layer of Australian Government (www.abc.net.au)
7. ^{^} democratic societies (www.nytimes.com)
8. ^{^} no paper trails (www.cbsnews.com)
9. ^{^} has not been patched since 2014 (theconversation.com)
10. ^{^} Dutch elections (sijmen.ruwhof.net)
11. ^{^} Ukraine (www.understandingwar.org)
12. ^{^} reclassified elections (www.eac.gov)
13. ^{^} focus attention (www.csmonitor.com)
14. ^{^} appropriated US$380 million (www.mcclatchydc.com)
15. ^{^} up-to-date cyber threat information from the federal government (www.cyberscoop.com)
16. ^{^} further progress has stalled (fcw.com)
17. ^{^} mandatory (www.theguardian.com)
18. ^{^} thorny political battles over who is allowed to vote (www.theguardian.com)
19. ^{^} Nils Versemann/Shutterstock.com (www.shutterstock.com)
20. ^{^} Australian Electoral Commission (www.aec.gov.au)
21. ^{^} antiquated technologies (newrepublic.com)
22. ^{^} electronic voting (www.wired.com)
23. ^{^} tempting target (nymag.com)
24. ^{^} manipulation of public opinion (www.abc.net.au)
25. ^{^} foreign influence over politicians (www.afr.com)
26. ^{^} overseas ownership (www.abc.net.au)
27. ^{^} more on addressing human shortcomings than vulnerabilities in digital systems (www.forbes.com)
28. ^{^} the U.S. found out (www.cnn.com)
29. ^{^} Democratic National Committee’s emails were hacked in 2016 (www.theguardian.com)
30. ^{^} Republican National Committee emails (www.wired.com)
31. ^{^} foreign agent registration laws (www.abc.net.au)
32. ^{^} urban land (www.smh.com.au)
33. ^{^} Chinese tech giant Huawei (www.afr.com)
34. ^{^} future information warfare (www.internationalaffairs.org.au)
35. ^{^} micro-targeting (theconversation.com)
36. ^{^} deepfake videos (theconversation.com)
37. ^{^} assigned top government officials (cybersecuritystrategy.homeaffairs.gov.au)
38. ^{^} focus on cyber threats (cybersecuritystrategy.homeaffairs.gov.au)
39. ^{^} civil society (theconversation.com)
40. ^{^} public servants’ (www.washingtonpost.com)
41. ^{^} Think tanks and research centers (www.reuters.com)
42. ^{^} businesses (www.csis.org)
43. ^{^} influence voters (www.buzzfeednews.com)
44. ^{^} false and misleading information (theconversation.com)
45. ^{^} in other countries (www.theatlantic.com)