Defending 2020: What Worked, What Didn’t, and What’s Next

The 2016 presidential election served as a wakeup call to the threat of authoritarian interference, and in the years since, many segments of American society—from the federal government to private companies and civil society groups—have taken valuable steps to prepare for and counter it. Congress and the Executive Branch stood up a new government agency and multiple coordinating bodies to protect election infrastructure, while social media platforms have instituted policies to restrict the manipulation of advertisements, label misleading and false content, and slow the spread of disinformation. Working together, civil society instituted new cross-sector coordination mechanisms for election security. Yet longstanding vulnerabilities—including crippling political polarization and underfunded election jurisdictions—persist. A series of high-profile failures to prosecute the solicitation of foreign interference in U.S. elections further threaten to solidify a dangerous new norm.

Meanwhile, the threat landscape is growing more dynamic. New actors, including China and Iran, have taken an interest in adopting elements of Russia’s information manipulation playbook. And that playbook is itself evolving. In 2020, Russia and Iran took active steps to influence U.S. voters, engaging in information operations—at times augmented by cyberattacks—to denigrate candidates, sow chaos and division, and reduce trust in democratic institutions.¹ New players, including Cuba, Venezuela, and other, non-state actors also took steps to influence voters and attack election infrastructure.

Most notably, domestic actors embraced disinformation tactics, as President Trump and his allies repeatedly undermined confidence in the legitimacy of the election. These events highlighted the extent to which foreign and domestic threats to democracy are related. Domestic attacks on democratic institutions and principles create opportunities for foreign actors to carry out their activities, while authoritarian efforts to increase polarization and decrease trust in institutions can create an enabling environment that is ripe for democracy-denigrating activity by domestic partisans.

For nearly a year, the Alliance for Securing Democracy has documented steps taken by the government, the private sector, and civil society to secure the 2020 election against foreign interference. Our team has collated more than 200 actions in the cyber, financial, election infrastructure, and information domains beginning in February 2020 with the Iowa Caucus and continuing through the inauguration of President Biden. Using this data, we conducted a cross-sector, multi-domain assessment to identify gaps and failures in election security efforts, as well as successes to be built upon. We identified six findings:

Platforms do not have answers to the tough questions. Ahead of 2020, social media companies implemented numerous, wide-reaching policies to try to prevent a foreign operation on their platforms. But in certain, arguably predictable circumstances, they were again caught flat-footed, suggesting that they still do not have good answers for some of the thorniest problems. In particular, the events of 2020 highlighted that:

• Platforms do not have effective mechanisms for handling a suspected “hack and leak,” in part because there are few good options available to them. Platforms need to act quickly to have an impact but will not have definitive attribution in real time.
• Platforms do not have effective policies for handling an information operation run through authentic domestic voices and institutions, which implicates constitutionally protected speech.
• Labeling can inadvertently create the false impression of endorsement for misleading content or inspire confusion about the platforms’ intent.
• Platform architecture drives engagement with conspiracy groups, but business incentives cut against changing that architecture.

Civil society conducts resilience-building activity in the information space that is essential, but potentially unsustainable. Civil society organizations stepped in to fill gaps between government and the private sector, monitoring the domestic information space, informing citizens of emerging disinformation tactics and narratives, and facilitating cross-sector information sharing and coordination. These activities were fueled by a high degree of public interest and considerable philanthropic support that may not be sustainable.

Communication and coordination on cyber and election infrastructure security increased substantially, but there is still room for improvement. Ahead of 2020, coordination among federal, state, and local officials, as well as with election stakeholders in other sectors, increased dramatically. Federal agencies and civil society partners also offered a range of services, support, and funding to state and local election jurisdictions. But there is more to do, starting with expanding outreach to the 7,000 jurisdictions who have yet to join the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), and including strengthening defenses against cyberattacks and protecting election workers and staff.

Politicization undermines efforts to shore up vulnerabilities, provides fodder for foreign influence campaigns, and reduces trust in democratic institutions. In 2020, senior government officials appeared to politicize the threat of foreign interference with statements that misrepresented threats to the election. Politicization inhibited Congress from closing known vulnerabilities and providing regular, predictable funding to state and local election officials. A domestic disinformation campaign launched by President Trump and his allies—including some members of Congress—undermined confidence in the electoral process and provided fodder for foreign influence operations.²

Cross-sector communication about and public exposure of foreign interference has improved since 2016. Ahead of the 2020 election, government officials took regular action to communicate with the public about foreign interference threats and activity, as well as government responses—from proactive warnings to public announcements of retaliatory measures, such as sanctions. Social media companies exposed foreign state-sponsored information operations. Meanwhile, government, private sector, and civil society leaders directed citizens to trusted sources of information and helped prepare citizens for coronavirus-related changes to election processes.

Current mechanisms to protect electoral legitimacy assume good faith leadership from the top. Bad faith efforts from the White House and from some members of Congress undermined public confidence in the election, accomplishing the goals of foreign actors for them and providing fodder for authoritarian actors to denigrate democracy. The U.S. election system proved resilient in spite of these attacks because of the energetic work of leaders from all corners of society.

Recommendations

Closing longstanding vulnerabilities, keeping pace with evolving threats, and building resilience to new challenges is a whole of society task. Leaders from across sectors will need to take action to address platform architecture, strengthen civil society efforts in the information space, expand on progress in cyber and election infrastructure coordination, and construct a safety net that can protect against the politicization of election security.

Address Platform Architecture and Moderation

• Platforms should emphasize policies to slow the spread of election-related disinformation before it achieves virality. Platforms should construct mechanisms to identify harmful content before it achieves virality and to slow its spread to give time for other policy responses. Companies should expand human moderation of accounts with high potential for public harm and implement measures to remove false and misleading content from recommendation algorithms. Platforms should consider punishing repeat offenders for sharing false content by attaching labels to accounts.
• Platforms should increase transparency and information-sharing with researchers. Companies should provide more clarity around moderation policies and decisions, including making them accessible to users. Platforms should be more forthcoming about the details and impacts of architecture and algorithm changes.
• Platforms should amplify authoritative voices. Companies should take steps to identify, verify, and amplify the accounts of election officials ahead of future elections, including prioritizing content in newsfeed and recommendation algorithms. They should consider more permanent architecture changes to boost authoritative news sources in algorithms.
• Platforms should empower credibly independent oversight. Platforms should establish oversight bodies to insulate important content moderation decisions from business interests, improve transparency around decisions, and build public confidence. Oversight bodies should be granted broad jurisdiction to be responsive to users and platforms should commit to adhering to and enforcing the precedence of oversight decisions. The bodies should aim to promote healthy online discussion and protect the interests of users and the public.
• Congress should consider establishing an independent federal regulator for social media platforms. Congress should establish a federal regulator to conduct oversight of digital platforms in the public interest, focusing on protecting consumers and promoting a healthy information space. The regulator could conduct audits of platform algorithms and confirm companies are taking sufficient action to mitigate negative externalities. Congress could consider requiring companies to cooperate with the regulator as a condition of maintaining liability protections from content published on their platforms.

Sustain and Build on Civil Society Efforts in the Information Space

• Civil society organizations should consider establishing a permanent coordinating center for cross-sector information sharing. Building on the work of organizations like the Election Integrity Partnership, the center could take an active role in identifying, tracking, and flagging mis- and disinformation narratives and could serve as a clearinghouse for cross-sector information sharing. To maintain independence and credibility, the center should be funded by foundations focused on democracy, elections, and the information space. To increase sustainability, its scope of work should expand beyond elections to cover broader trends in the information space.

Build on Improvements in Cyber and Election Security Coordination

• Congress should provide additional support to authorities responsible for election security. Congress should provide sufficient funding—including in non-election years—to help states and local jurisdictions update election systems and improve their security. Congress should also ensure that Cybersecurity and Infrastructure Security Agency (CISA), the Election Assistance Commission (EAC), and the EI-ISAC receive robust support to expand outreach and deliver support to state and local jurisdictions. Congress should also consider clarifying responsibilities for federal agencies supporting election security.
• Congress should strengthen security standards and incentivize local jurisdictions to innovate. Congress should provide funds for jurisdictions to replace paperless voting machines with paper-based voting systems and should support the implementation of risk-limiting audits. Congress should also resource the EAC to expand its Voluntary Voting System Guidelines to include non-voting election technologies and should equip CISA to investigate threats to the election security supply chain. Congress should consider ways to incentivize innovation in state and local election security efforts.
• Federal and state lawmakers should invest in the protection, recruitment, and training of election workers. Lawmakers should examine ways to improve worker safety for state and local election officials and to deter threats against officials as seen in the 2020 election cycle. Lawmakers should also invest in programs to develop and retain talent in election administration, including cybersecurity trainings and certification or fellowship programs. Lawmakers should also help state and local election officials build out communications plans for public communication in future election cycles.

Develop A Safety Net Against Politicization of Election Security

• Congress should explore methods to depoliticize reporting on foreign interference. Congress should investigate mechanisms to empower non-partisan reporting of election security threats. One model to examine is Canada’s Security and Intelligence Threats to Elections Task Force, which empowers senior civil servants to decide on publicly disclosing foreign interference operations.
• Congress should reinforce CISA’s independence. Congress should insulate CISA from potential future political pressure by making the CISA Director a 10-year, single-term position. Congress should also require other high-ranking positions within CISA to be held by career officials rather than political appointees and should move responsibility for permanent maintenance of CISA’s “Rumor vs. Reality” webpage to the EI-ISAC.
• Americans must rebuild their democratic culture. The United States must reinvest in democratic values, institutions, and processes. This challenge goes beyond the scope of this paper, but an important first step will almost certainly be to reconstruct civic infrastructure and establish programs that bring citizens together outside of the online environment. That should include embracing civic education and service learning.

Please click here to read the full report.