1. Short thread - @schneierblog and I have a new paper on what we call "common knowledge attacks" against democracy. And a new piece here motherboard.vice.com/en_us/article/… applying some of our arguments to Trump and voting results (nb - neither Bruce nor I chose the title for the article).
2. The basis for our argument is straightforward. In 2016, Guccifer2.0 claimed that Democrats were going to hijack the vote. In 2018, Trump did more or less exactly the same thing. The Guccifer blogpost (by GRU) has been treated as a cyberattack. The Trump tweets have not. Why?
3. We argue that if we treat expectations over democratic elections as a key part of the democratic information system, both are similar in aim, and the Trump tweets are plausibly far more consequential in effect. This is in many ways similar to standard infosec problems
4. Where attacks that are aided or instigated by insiders, who are better equipped to exploit vulnerabilities are far more likely to succeed than attacks mounted by outside parties. But this causes problems for our standard ways of thinking about cybersecurity. As we put it:
5. "The US can threaten charges or impose sanctions when Russian trolling agencies attack its democratic system. But what punishments can it use when the attacker is the US president?" That's a question that conventional deterrence based cybersecurity theory has a hard time with.
6. That's why we argue for an approach that focuses on stabilizing the institutions that help support the expectations that democracy needs to work, and hence minimizes attack surface for both outside attackers and politicians with an interest in destabilizing expectations
7. as a means of mitigating both "flooding" and "confidence" attacks. This would not only involve electoral reform and protecting census, but also reforms to e.g public commenting systems at FCC and elsewhere.
8. Part of what we are trying to do is to highlight increase in a set of attacks that go substantially beyond the standard efforts by both sides to "play the ref" in close-fought elections. Some actors have an incentive to destabilize expectations more generally, attacking system
9. Thus, for example, it is highly plausible that Trump, by attacking vote counts in Florida and Arizona, was prepping the way for a far broader set of attacks on vote should he lose in 2020. Equally as we note, attacks on FCC commenting system were plausibly aimed:
10. " not just to generate fake support for the FCC’s controversial proposal [but] to devalue public comments in general, making the general public’s support for net neutrality politically irrelevant." Hardening systems against this kind of abuse is an urgent problem for policy.
11. Figuring it out also plausibly requires far more intense collaboration between political scientists (who understand democracy) and infosec people (who think about information systems and their vulnerabilities in useful ways that are unfamiliar to political scientists). Finis.
