Hacking democracies

Cataloguing cyber-enabled attacks on elections

Foreword

One of the great hopes for the internet was that it would herald a new era in the democratisation of information. To a large extent, it’s been successful. So successful, in fact, that global platforms, technology diffusion and mobility have brought some unintended consequences by enabling the rapid dissemination of disinformation and fake news.

We live in a time when trust in our democratic and other key institutions has declined, and this is compounded by new capabilities of adversaries seeking to interfere in our elections and to undermine people’s trust in those institutions.

In this policy brief, the writers explore areas where interference has been detected across the world and consider key learnings from those examples in order to develop policy responses for countering each type of interference.

Technology has the power to transform lives by reducing barriers to entry and creating greater equity so that all our citizens can participate in education and the economy. We want to live in a world where friction is removed and technology enhances our experience, where all citizens have access to the internet, and where we can vote electronically in elections. However, our interconnection needs to be safe and trusted, protecting and enhancing our democracies.

This brief starts an important national conversation, generating awareness of the approaches commonly taken by adversaries to spread disinformation, misinformation and fake news. It lays out a series of measures for managing risk, and serves as an educational resource for our citizens on what to keep an eye out for, and how to better distinguish reputable information from disinformation in real time.

Yohan Ramasundara
President, Australian Computer Society

What’s the problem?

Analysis of publicly known examples of cyber-enabled foreign interference in elections reveals key challenges. First, while perceptions of interference are widespread, the actors are few—Russia and China—and the effort is highly targeted. Russia is targeting the US and Europe (with a few forays into South America), while China targets its region (having, for the moment, reached as far as Australia).

Second, the methods used can be hard to pick up and democracies seem poorly equipped to detect intrusions, being traditionally focused on external intelligence collection. Adversaries are able to enter public debates, infiltrate legitimate activist networks and even enter the mainstream media as trusted commentators. Significant activity may be being missed. Finally, while opinion polling shows concerning levels of dissatisfaction with democracy and weakening trust in public institutions, it’s very difficult to assess the impact of election interference on those phenomena. It’s likely to have some impact but be outweighed by larger societal factors.

What’s the solution?

First, the response from democracies should be calibrated to the likely risk and adversary. The US and European states are clear targets of Russia; Indo-Pacific nations are targets of the Chinese Communist Party (CCP).

Second, more effort is needed to detect foreign interference, including offline and non-state efforts. Because democracies have a natural aversion to government surveillance, a better answer than simply stepped-up government monitoring may be supporting non-profit, non-government initiatives and independent media.

Third, effort is needed to develop better ways to measure the impact of foreign interference to allow for a more informed decision on resourcing efforts to counter it. Notwithstanding the lack of current empirical data on impact, opinion polling points to a perception that foreign interference will occur and, in places such as the US, a view by many that the 2016 presidential election was swayed by it (a credible view, given the narrowness of the outcome). Research is needed to measure the effectiveness of different education and awareness efforts to address these concerns.

Fourth, public funding may be needed to better secure political parties and politicians from cyber intrusions. Finally, democracies need to impose costs on the two primary state actors: they should consider joint or regional action to make future or continued interference sufficiently costly to those states that they will no longer pursue it. Legislation may also be needed to make it more difficult for foreign adversaries to operate (being mindful of the differing objectives of the two main actors); this may be a second best for countries that find it too difficult to call out adversaries.

Introduction

In 2016, Russia comprehensively and innovatively interfered in the US presidential election, offering a template for how democracies around the world could be manipulated.1 Since then there have been 194 national-level elections in 124 countries and an additional 31 referendums.2 This report seeks to catalogue examples of foreign interference in those polls and group them into three ‘buckets’:

  • interference targeting voting infrastructure and voter turnout
  • interference in the information environment (to make the scope manageable, we have focused on interference surrounding elections, but it’s apparent that such efforts continue outside election periods as part of longer term efforts to manipulate societies)
  • longer term efforts to erode public trust in governments, political leadership and public institutions.

This research focused on cyber-enabled interference (including, for example, information operations that harness social media and breaches of email and data storage systems), but excluded offline methods (for example, the financing of political parties and the suborning of prominent individuals). 

The yardstick for counting an activity as interference was that proposed by former Prime Minister Malcolm Turnbull, who put it this way when introducing counter-foreign-interference laws in Australia in 2017: ‘we will not tolerate foreign influence activities that are in any way covert, coercive or corrupt.

That’s the line that separates legitimate influence from unacceptable interference.’3 A major issue has become the public perception that results may have been swayed, with consequences for the direction of these states’ policies and actions, together with a loss of public trust in democratic institutions and processes.

Multi-country Pew Research Center polling shows that there’s an increasing expectation among global publics that elections will suffer interference: majorities (including 65% of Australians) in 23 of 26 countries surveyed in 2018 said it was very or somewhat likely that a cyberattack would result in their elections being tampered with.4

In some cases, such as the 2016 US presidential election, polling shows that a large proportion of people (39% of US adults) feel that Russian meddling swung the election,5 which is probably the most valuable outcome Russia could have hoped for, given that it’s seeking to undermine confidence in US global leadership and the US public’s faith in the nation’s democratic process.6

Since that election, reports of foreign interference in democratic elections have continued to surface. This suggests a belief among adversary states that interference is serving their interests and that the costs of action are not sufficiently high to deter this behaviour.

Of course, foreign governments interfering in elections is nothing new.7 While the objectives might be similar to those of Cold War style efforts, the means are different. Today, a state such a Russia is able to reach more than a hundred million Americans through a single platform such as Facebook without sending a single operative into US territory.8 Or, as nearly happened in Ukraine, the official election results can be remotely altered to show a candidate who received just 1% of the vote as winning.9

And, significantly, a little effort goes a long way: in 2016, Russian operatives were able to organise two opposing groups to engage in a protest in front of the Islamic Da’wah Centre of Houston for ‘the bargain price of $200’.10 Having a big impact is now much easier, cheaper and less risky. For democratic governments, responding can be extremely difficult. The methods used by adversaries typically exploit treasured democratic principles such as free speech, trust and openness. Detection can be hard both because the methods are difficult to identify and because democracies avoid surveillance of their own domestic populations and debates (outside niche areas such as traditional criminal and terrorist activity). Typically, the bulk of intelligence resources is directed towards external collection, and domestic populations are rightly wary of increased government monitoring.

Democratic governments themselves can be obstacles: if the winning party believes it benefited from the foreign interference or would be delegitimised by admitting its scale, it can even mean the newly elected government will play down or ignore the interference. Tensions in the US in the wake of Russian interference in the 2016 election point to the potential for these sorts of issues to arise.11

Measuring levels of interference and adversary’s objectives is another challenge. Given the difficulty of detection and the variance in methods employed, it’s hard to compare relative levels of interference across elections. Objectives are also not always straightforward. Most efforts to interfere in elections are not about directly altering the vote count. Instead, many appear aimed at disrupting societies or undermining trust in important institutions. There also appear to be different overarching aims depending on the adversary involved.

Project overview and methodology

This research was generously supported by the Australian Computer Society and stemmed from a series of engagements with policymakers on countering election interference. Desk research and interviews focused on developing a database of cyber-enabled foreign interference in democratic elections. It was informed by a full-day workshop in London involving several electoral commissioner equivalents from around the world as well as the President of the Australian Computer Society. A key focus of the workshop was the development of a framework for mapping election interference with a view to improving the policy response.

The start date for the research was the 2016 US presidential election and the end date was April 2019. During that period, this research identified 194 national-level elections in 124 countries and an additional 31 referendums.

Using Freedom House’s Freedom in the world report,12 of the 124 states that have held national elections since November 2016, 53 are considered ‘free’, 45 ‘partly free’ and 26 ‘not free’. Given the focus of this report on democracies, we limited the research scope to the 97 countries that held elections and that were deemed free or partly free.

As noted above, examples of foreign interference were grouped into three buckets. This built off and expands on a framework in the International Cyber Policy Centre’s Securing democracy in the Digital Age report.13

Categorising incidents was an inexact science. Often there was a lack of publicly available information about the case (many media reports described ‘hacks’ without elaborating), or it might easily straddle more than one category. Consider the intrusion into Australia’s parliament and three political parties reported by Prime Minister Scott Morrison on 18 February 2019,14 suspected to have been carried out by Chinese state-sponsored actors. The intent behind this incident is still unclear.

Was it solely espionage or an act of foreign interference?15 The sophisticated state actor has not seemed to use any material obtained to interfere in the current election. That may be because of the discovery of the intrusions, or because the information obtained is being used for a different purpose (as suggested by ASPI’s Michael Shoebridge16). For the purposes of this report, it was classified as ‘long-term erosion of public trust’, given that the public reporting highlighted inadequate security
among core Australian institutions.

This report captures examples of interference that were executed (for example, Russian online disinformation campaigns that ran on social media during the 2016 US presidential election) and those that were discovered but not executed (such as Russians’ accessing of US voter rolls during that election without manipulating or using them).
 

Findings

Of the 97 national elections in free or partly free countries reviewed for this report during the period from 8 November 2016 to 30 April 2019, a fifth (20 countries) showed clear examples of foreign interference, and several countries had multiple examples (see the appendix to this report).17 It’s worth noting that confidence in attributions to foreign actors varied widely. In ideal circumstances, a government source made the attribution, but often the attribution was more informal. Our intention was not to provide an exhaustive list of every alleged case of foreign interference but instead to capture the spread of states experiencing the phenomenon and illustrative examples of different methods. Details on all examples identified through this research are set out in the appendix.

Country analysis

Of the 97 elections and 31 referendums reviewed, foreign interference was identified in 20 countries: Australia, Brazil, Colombia, the Czech Republic, Finland, France, Germany, Indonesia, Israel, Italy, Malta, Montenegro, the Netherlands, North Macedonia, Norway, Singapore, Spain, Taiwan, Ukraine and the US.

Of those 20 states, 14 were deemed ‘free’ and 6 ‘partly free’. Just over half (12 of 20) of the states were in Europe, which is unsurprising given Russia’s leading role in this area (Table 1).

Table 1: Regional spread (alleged actor)

Table 1 shows the strong geographical link between the target and actor. With the exception of one anomalous case involving the UK (which was alleged to have supported a Yes campaign in a Montenegrin referendum), Russia was the only state interfering in European elections. Similarly, in the Indo-Pacific, China was the only actor (except for Indonesia, where Russia was also involved). Iran’s interference in Israel has a clear connection to its adversarial relationship. In the Americas, there’s more diversity among the actors, but Russia remains the dominant player.

China’s versus Russia’s motivations

Russia’s and China’s interference reflect different national approaches. For Russia, a key objective is to erode public trust in democracies and to undermine the idea that democracy is a superior system.18 This might be driven by President Putin’s personal drive to make the West ‘pay’ for its destruction of the Soviet bloc and by the desire to mount a case inside Russia that democracies are flawed and therefore not a model that Russians should aspire to. As a consequence, Russian interference is inherently destructive to democratic systems, even at the same time as Moscow may seek to promote a party or a candidate thought to be more sympathetic to its interests.19

Chinese interference seems more strategically focused on ensuring that its interests are promoted across all party lines. Unlike the Russian stance, one party’s interests don’t appear to be favoured at the expense of others (with the exception, perhaps, of Taiwan20). Instead, all consequential parties are in its crosshairs with a view to making them more sensitive to core CCP interests. China also seems to pursue a broader front of influencing activities (many of which aren’t captured by this report’s focus on cyber-enabled methods), which can include financial donations,21 aligning the policy interests and public comments of party figures to CCP political goals and suborning prominent individuals to advocate for Beijing’s interests. China doesn’t seem to be as openly intent on doing damage to the credibility of foreign political systems so much as aligning those systems to its strategic objectives.22

Methods

A review of the dataset reveals considerable repetition in methods. There are multiple examples of social media platforms being exploited to reach target populations, often used in concert with state-sponsored media outlets. There is, however, considerable variation in the way social media are exploited. This ranges from organising rallies and amplifying the voices of favoured groups to suppressing voter turnout and exacerbating existing divisions.23 There are also several examples of system breaches, again to pursue different ends, including stealing and leaking emails and accessing voter rolls.

Given the lack of detail in many media reports on foreign interference, it’s difficult to provide a list of the most common methods. Frequency of use also does not translate into impact. For example, the breach of one person’s email account (such as the account of Hillary Clinton’s campaign chair, John Podesta) can have much greater impact than any single social media post or perhaps all of them.

Types of interference

This section examines our three defined buckets of interference.

Targeting of voting infrastructure and voter turnout

Direct tampering with election results is perhaps the most affronting form of foreign interference because it most directly overturns the will of the people. 

Ukraine has long been one of the main targets of Russian election interference efforts and has also suffered the most egregious effort to alter the technical results of an election. As Mark Clayton reported back in 2014 (a date outside the scope of the mapping period covered by this report):

Only 40 minutes before election results were to go live on television at 8 p.m., Sunday, May 25, a team of government cyber experts removed a ‘virus’ covertly installed on Central Election Commission computers, Ukrainian security officials said later.

If it had not been discovered and removed, the malicious software would have portrayed ultra-nationalist Right Sector party leader Dmytro Yarosh as the winner with 37 percent of the vote (instead of the 1 percent he actually received) and Petro Poroshenko (the actually [sic] winner with a majority of the vote) with just 29 percent, Ukraine officials told reporters the next morning.24

There are multiple means by which adversary states could interfere with the technical results of elections. Various methods could be used to prevent citizens from being able to vote (for example, by rendering electronic voting booths unusable or corrupting the voter roll so eligible voters are removed and turned away from voting booths25) or reducing the turnout of certain voter groups with known dominant voting behaviours (for example, via online campaigns that encourage a boycott26 or targeted misinformation that has the effect of deterring certain voter groups27).

The result itself could be altered via various means. Electronic voting booths could be maliciously programmed to record a vote for Candidate A as a vote for Candidate B instead, the transmission of votes tallied at individual voting booths could be intercepted and altered, affecting the final tally, votes in the central tally room or system could be altered remotely or, as was attempted in Ukraine, the release of the vote outcome could be tampered with (a tactic unlikely to go unnoticed, but likely to cast doubt among some about the integrity of the poll and of the national electoral system).

Research for this report identified six countries that had experienced interference targeted at voting infrastructure and voter turnout: Colombia, Finland, Indonesia, North Macedonia, Ukraine and the US (Table 2).

Table 2: Targeting of voting infrastructure and voter turnout

Examples included the targeting of voter registration rolls in Colombia,28 Indonesia29 and 21 US states,30 a denial of service (DoS) attack on a Finnish web service used to publish vote tallies,31 a distributed denial of service (DDoS) attack on Ukraine’s Central Election Commission,32 and the use of social media to suppress voter turnout in North Macedonia33 and in the US.34 In the US, an Oxford University report noted that Russian operatives tried to suppress the vote of African-Americans by pushing the narrative that ‘the best way to advance the cause of the African American community was to boycott the election and focus on other issues instead’.35 While it’s difficult to determine the effect of the disinformation campaign by Russia’s Internet Research Agency, the Pew Research Centre reported that the voter turnout of African-Americans fell in 2016 (see appendix, page 19).36

The attackers identified in public reports (sometimes speculatively) were Russia (in one instance, combined with Venezuela) and China. Russia was by far the dominant actor. 

Interference in the information environment around elections

It’s difficult to detect foreign interference during elections with high confidence in a timely manner.

Consider this example from Bret Schafer, which fooled multiple media outlets: Have you met Luisa Haynes? She was a prolific force in the #BlackLivesMatter community on Twitter. In just over a year, she amassed more than 50,000 followers; and her outspoken, viral takes on everything from Beyoncé to police brutality earned her hundreds of thousands of retweets and media coverage in more than two dozen prominent news outlets.

She was, on the surface, a symbol of a new generation of Black activists: young, female, and digitally savvy—except—she was fake.37

At the International Cyber Policy Centre, journalists periodically approach us about websites and social media accounts they suspect are run by foreign agents or trolls. Mostly, investigations lead to dead ends, or to apparently real people who are hard to definitively classify as foreign trolls rather than colourful citizens.

Now that the traditional media have lost their old gatekeeper role and control over the information environment, it’s far easier for foreign adversaries to inject themselves into national debates and much harder to trust what you’re reading and seeing. When Australians were asked in 2018 ‘Do you feel like the news you read or watch gives you balanced and neutral information?’, 54% said ‘never’ or ‘rarely’. There were similar results in democracies around the world38 (in historical terms, in the US the proportion of people reporting ‘a great deal’ and ‘quite a lot’ of confidence in newspapers has dropped from a high of 39% in 1990 to 23% in 201839).

While avenues for altering the technical results of elections are limited, opportunities to manipulate the information environment are limited only by creativity. Methods might include amplifying a party’s existing narrative using social media accounts that have assiduously built up followers over lengthy periods,40 or creating and spreading disinformation to undermine a candidate (for example, the state-owned Russian news agency Sputnik calling French presidential candidate Emmanuel Macron an agent of ‘the big American banking system’).41 It might involve infiltrating genuine activist groups and attempting to increase polarisation,42 or it could involve the creation of fake personas who provide inflammatory commentary on divisive issues, as with Luisa Haynes. Often such campaigns seek to prey on and exacerbate existing social cleavages with a view to exploiting them to manipulate the information environment in the desired direction.

While the impact of this manipulation isn’t as direct as interfering with key election infrastructure, its ease and cheapness, combined with the difficulty of timely detection, make it a preferred method. Foreign interference in the information environment was identified in 10 states: France, Israel, Italy, Malta, the Netherlands, North Macedonia, Spain, Taiwan, Ukraine and the US (Table 3).

Table 3: Interference in the information environment

Examples included information disruption campaigns targeting French presidential candidate Emmanuel Macron (such as the theft and release of 21,000 emails just before the final vote in the election—a technique likely to be of enduring utility for adversaries)43 and the spreading of disinformation by Russian media outlets Russia Today (RT) and Sputnik in Catalonia44 and Italy with headlines like ‘Migrant chaos, the beginning of a social war’45 or claiming in the Macedonian referendum that, depending on who won, Google would remove Macedonian from its list of recognised languages.46 Chinese-backed disinformation campaigns targeting Taiwan were reported as using zombie accounts and China’s so-called ‘50 Cent Army’ of online trolls and commentators to amplify the dissemination of disinformation.47 In Ukraine, Russia sought to buy or rent Ukrainian Facebook accounts to disseminate disinformation.48 There was also an unusual case of the UK’s Foreign and Commonwealth Office being accused of funding British PR agency Stratagem International to help the Macedonian Government with its ‘Yes’ campaign on the changing of the country’s name, thereby opening up the opportunity for Macedonia to join the EU and NATO.49

Research identified four alleged actors: Russia (the most dominant by far), China, Iran and the UK.

Long-term erosion of public trust in public institutions

Perhaps the most pernicious aspect of foreign interference is the longer term corrosion of public trust in the institutions that underpin democracy.

For example, the Center for Strategic and International Studies’ Defending Democratic Institutions Project has looked at Russian efforts to weaken trust in the rule of law as administered by the justice systems in both the US and Europe.50 In Australia, China is alleged to have attacked the Australian Parliament in 2011 and 2019, as well as three political parties in 2019.51 And in several countries attacks on electoral commissions responsible for impartially conducting elections have been reported.52

If foreign adversaries can destroy trust in these pillar institutions and related organs of democracy, democracy quickly unwinds.

Making this phenomenon even harder to confront, it’s often not immediately clear whether a campaign is being run by a nation-state or by conspiracy-oriented individuals. During the Brexit vote in the UK, what appeared to be a conspiracy theory (that had first surfaced during the 2014 Scottish referendum) spread online, urging voters to use pens, not pencils, to complete their ballot papers.53

The not-so-subtle inference was that government officials were rubbing out ballots completed in pencil and changing people’s votes (figures 1 and 2).

Figure 1: ‘I voted in pencil’

Source: Professor Brian Cox, Twitter, 23 June 2016.

Figure 2: ‘Use pens plea’

Source: BBC News, 22 June 2016.

It’s difficult to know how damaging these sorts of campaigns are for public trust in critical democratic institutions or whether they’re state-backed. What’s apparent is that polling has picked up distrust in key electoral institutions. The Australian voter experience report revealed that just 42% of Australians have a great deal of confidence in the Australian Electoral Commission’s ability to conduct an election, while a further 43% have ‘some’ confidence.54 In the UK, just 21% reported that they were ‘very confident’ and 48% said they were ‘fairly confident’ that the 2015 election was well run.55 While electoral commissions are generally off voters’ radars, trust in democracy collapses if people lose trust in those organisations’ ability to conduct elections impartially.

More significantly, there’s also been a dramatic drop in levels of satisfaction with democracy in Australia. Although once again it’s hard to track a causal relationship, it seems likely that democracies experiencing rising dissatisfaction with democracy would be more vulnerable to interference. The Australian voter experience report noted that just 55% of Australians “are satisfied with the way democracy works in their country nowadays. This places Australia on the lower end of established democracies, which typically have rates of satisfaction that exceed two-thirds. Historical data indicates that there’s been a dramatic fall in satisfaction. Data from the Australian Election Study in 2007 indicated that 86% reported being satisfied with democracy, falling to 72% in 2013”.56 Surveys such as the Lowy Institute Poll have tracked this dissatisfaction with democracy and speculated about its causes, but with no definitive answers.57

The Democracy Perceptions Index 2018 provides hints to the growing levels of public distrust in democracies around the world. It found that 64% of the public in ‘free’ countries (as defined by Freedom House) said their government ‘never’ or ‘rarely’ acts in their interest, compared to 41% in ‘not free’ countries. In Australia, a third of Australian adults say the government ‘mostly’, ‘often’ or ‘sometimes’ acts in their interest (67% say it does so ‘never’ or ‘rarely’).58 While this is a large proportion of the population, it hasn’t yet resulted in French-style yellow vest protestors.59

In Australia and elsewhere, it’s highly unlikely that this dissatisfaction is driven entirely by foreign interference. Anxiety about large economic and social changes brought about by globalisation and technological development could all be in play.60 Longitudinal Gallup surveys have also picked up a long downwards trend in average trust in public institutions (Figure 3).61

Figure 3: Americans’ average confidence in public institutions over time

Quantifying examples of the long-term erosion of public trust is perhaps the trickiest of tasks, as in many cases more immediate efforts to shape public opinion (such as spreading disinformation) also have the longer term impact of eroding public trust in the media and other institutions. Efforts to erode public trust also typically exploit existing societal cleavages,62 making detection difficult and any additional impact from interference on pre-existing divisions hard to measure. However, for the purposes of this research, 10 states were identified as having experienced efforts to create long-term erosion of public trust: Australia, Brazil, the Czech Republic, Germany, Montenegro, Norway, the Netherlands, Singapore, Ukraine and the US (Table 4).

Table 4: Long-term erosion of public trust

Examples have included the use of social media bots in Brazil to question the democratic model,63 amplification by Russia using Twitter bots of far-right Alternative für Deutschland’s warnings about election fraud,64 and systematic efforts by Russia to weaken ‘faith in the rule of law as administrated by the justice system’ in the US through the use of disinformation and the exploitation of ‘legitimate criticisms of the justice system’.65

The two identified actors in this category were Russia and China.

Limitations

There are several notable limitations to this research.

First, we focused on states and therefore missed private actors that are distorting democratic debates in similar ways. For example, there have been several cases of the commercialisation of Russian-like disinformation campaigns. Consider the group in the Balkans that built up popular Facebook pages with titles such as ‘Australians against Sharia’ and ‘Aussie infidels’ that targeted Australians to generate ad revenue.66 Future research could usefully explore the impact that these groups are having and how to counter them.

Second, our focus was on public cases, which perhaps tends to favour the identification of Russian efforts, given Moscow’s more overt and detectable methods and the media’s growing familiarity with its approach. Parallel research on CCP methods that the International Cyber Policy Centre is preparing suggests that Beijing often uses techniques that are harder to detect and longer term and so may be underreported. A broader methodology is probably needed to capture difficult-to-spot influence activities such as subverting policy positions and decision-making as well as long-term campaigns to cultivate supportive political figures and voices and silence, pressure or sideline critics.67

Third, the focus on foreign state actors has, of course, excluded domestic efforts to harness these same techniques, for example by political parties and local activists that may also be contributing to voter dissatisfaction with democracy and trust in institutions.

Fourth, there has been a tendency to favour English-language sources.

Finally, the increasing ability to micro-target voters and the difficulty of detecting many of the types of interference reported here mean that many examples could be being missed in the online information arena. Consider the case of a Russian-operated fake Black Lives Matter Facebook page that was only reported as suspicious because it used the phrase ‘Don’t shoot’—an expression that genuine activists had stopped using.68 The shift by major platforms such as Facebook to move from public broadcasting to private messaging will only accentuate this challenge.69

Findings and recommendations

The motivation behind this research is that, by better understanding the methods being used and the targets of high-activity adversary states, democracies will be able to better assess their existing response and mitigation capabilities and adjust as necessary.

We make the following recommendations.

1. Targets are limited: respond accordingly

Despite the enormous amount of media coverage that’s been devoted to state-backed election interference, the phenomenon isn’t universal. From public accounts, there are two primary actors and they focus judiciously on states that matter to them. Democracies should calibrate their policy responses to the likely risk, methods and adversary. The US and European states are clear targets of the Russian Government; Indo-Pacific nations are targets of the CCP.

2. Build up detection capabilities

More effort is needed to detect foreign interference, including offline and non-state efforts (such as by for-profit groups that misuse social media platforms to stir up hate). Because democracies have a natural aversion to government surveillance, a better answer than simply stepped-up government monitoring may be supporting non-profit, non-government initiatives and independent media. These groups can more credibly monitor for interference and more easily engage at the community level. In smaller states, where local media outlets are disappearing, government subsidies may be needed to ensure sufficient scrutiny of local and state political groups (which are often feeder groups for national politics).

3. Fund research to measure impact and measure the effectiveness of education campaigns to address public concerns

Governments should fund research to develop better ways to measure the impact of foreign interference to allow for a more informed decision on resourcing efforts to counter it. Notwithstanding the lack of current empirical data on impact, opinion polling points to a perception that foreign interference will occur, and in places such as the US to widely held views that elections have been swayed. Various efforts have been made to respond, including fact-checking services,70 opening up social media data streams to election-oriented academic research,71 and legislation to counter fake news.72 Research is needed to understand which efforts are most effective, after which those tougher measures should be twinned with public awareness campaigns to address these concerns.

4. Publicly fund the defence of political parties

Political parties and politicians are clear targets of foreign adversaries. With their shoestring budgets and the requirement to scale up dramatically during election campaigns, they’re no match for the resources of sophisticated state actors. Politicians are also vulnerable, including through the use of their personal devices. There’s a strong public interest in preventing foreign states from being able to exploit breaches of both parties and individual politicians to undermine domestic political processes. Democratic governments should consider public funding to better protect all major political parties and to step up cybersecurity support to politicians.

5. Impose costs 

Democracies need to look at better ways of imposing costs on adversaries. Because of spikes in interference activity around elections, they can be prone to being picked off or to discounting interference if the party that won benefited from it. Democracies should consider concerted joint global or regional action that looks beyond their own particular cases as well as more traditional approaches such as retaliatory sanctions. Legislation may also be needed to make it more difficult for foreign adversaries to operate (being mindful of the differing objectives of the two main actors)—this may be a second best for countries that find it too difficult to call out adversaries. 

6. Look beyond the digital

Russian interference is detectable, if not immediately, then often after the event. This has generated a natural focus on Moscow’s methods and activities. However, there are many more subtle ways to interfere in democracies. Research like this that focuses on digital attack mechanisms also misses more traditional and potentially more corrosive tactics, such as the provision of funding to political parties by foreign states and their proxies and the long-term cultivation of political influence by foreign state actors. Australia has recently passed legislation to counter more subtle forms of foreign interference73 that were starting to be detected.74 States, particularly those in the Indo-Pacific, should be attuned to these types of interference and make preparations to prevent, counter and expose them.

7. Look beyond states

Troubling public perceptions of democracy are unlikely to be explained by foreign interference alone. Foreign interference may, however, magnify or exploit underlying sources of tension and grievance in particular societies. A thorough response by government and civil society needs to consider a wider set of issues and threat actors, including trolls working for profit, and the health of the political and media environment (including by ensuring that local and regional media remain viable or are adequately funded).
 

Appendix

Examples of foreign interference (November 2016 to April 2019)

Sources for all examples can be found in Table 5 of the accompanying report.

ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.
It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

The work of ICPC would be impossible without the financial support of our partners and sponsors across government, industry and civil society. This research was made possible thanks to the generous support of the Australian Computer Society (ACS).

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. This has been comprehensively documented; see, for example, Office of the Director of National Intelligence (ODNI), Background to ‘Assessing Russian activities and intentions in recent US elections’: the analytic process and cyber incident attribution, US Government, 6 January 2017, online; PN Howard, B Ganesh, D Liotsiou, J Kelly, The IRA, social media and political polarization in the United States, 2012–2018, Computational Propaganda Research Project, Oxford University, 2018, online. ↩︎
  2. ElectionGuide: democracy assistance and elections news, online. ↩︎
  3. Malcolm Turnbull, ‘Speech introducing the National Security Legislation Amendment (Espionage and Foreign Interference) Bill 2017’, 7 December 2017, online. ↩︎
  4. Jacob Poushter, Janell Fetterolf, International publics brace for cyberattacks on elections, infrastructure, national security, Pew Research Center, 9 January 2019, online. ↩︎
  5. ‘Americans’ views on Russia, the 2016 election, and US–Russian relations (trends)’, news release, Gallup, August 2018, online. ↩︎
  6. Matthew Cole, Richard Esposito, Sam Biddle, Ryan Grim, ‘Top-secret NSA report details Russian hacking effort days before 2016 election’, The Intercept, 6 June 2017, online; Zeynep Tufekci, ‘The election has already been hacked’, New York Times, 3 November 2018, online. ↩︎
  7. Ishaan Tharoor, ‘The long history of the US interfering with elections elsewhere’, Washington Post, 13 October 2016, online. ↩︎
  8. ‘As many as 146 million people on Facebook may have received information from Russian agency, Zuckerberg says’, PBS News Hour, 9 April 2018, online. ↩︎
  9. Mark Clayton, ‘Ukraine election narrowly avoided “wanton destruction” from hackers’, Christian Science Monitor, 17 June 2014, online. ↩︎
  10. Claire Allbright, ‘A Russian Facebook page organized a protest in Texas. A different Russian page launched the counterprotest’, Texas Tribune, 1 November 2017, online. ↩︎
  11. Karen Yourish, Troy Griggs, ‘8 US intelligence groups blame Russia for meddling, but Trump keeps clouding the picture’, New York Times, 2 August 2018, online. ↩︎

Admiral Michael S. Rogers to Join ASPI’s Cyber Centre as Distinguished Visiting Fellow

The Australian Strategic Policy Institute’s International Cyber Policy Centre is pleased to announce that Admiral Michael S. Rogers (retired) will join us as the Centre’s next Distinguished Visiting Fellow.

Admiral Rogers retired from the U.S. Navy in 2018 after nearly 37 years of naval service rising to the rank of four-star admiral. He culminated his career with a four-year tour as Commander, U.S. Cyber Command and Director, National Security Agency. In those roles he worked with the leadership of the U.S. government, the DoD and the U.S. Intelligence community as well as their international counterparts in the conduct of cyber and intelligence activity across the globe. He also assisted in the development of national and international policy with respect to cyber, intelligence and technology – including extensive work with corporate leadership in the Finance, IT, Telecommunications and Technology sectors.

ASPI’s Executive Director Peter Jennings said “I am delighted to welcome Admiral Rogers to Australia. As the international system enters a turbulent period, it is a great opportunity to hear from one of the world’s foremost intelligence officials”.

During his broader service in uniform, Admiral Rogers held positions afloat and ashore around the globe focusing on cyber, intelligence, maritime operations and national security. His joint service was extensive including duty with the Chairman of the Joint Chiefs of Staff, the Joint Chiefs of Staff, U.S. Indo Pacific Command and U.S. Atlantic Command. In addition, Admiral Rogers commanded at the unit, Numbered Fleet and service component levels in the Navy.

Admiral Rogers is currently supporting companies in the private sector, serving as a member of various Boards or acting as a Senior Advisor. He also speaks globally to various business and academic groups and is working internationally in the cyber and national security arenas. He is a Senior Fellow and Adjunct Professor with Northwestern University’s Kellogg School of Managements’ Public Private Initiative and a member of the advisory board of Auburn University’s McCrary Institute for Cyber and Critical Infrastructure. Admiral Rogers is a member of the AALD US advisory board. 

Admiral Rogers will be sharing his experience and insight as keynote speaker at ASPI’s National Security Dinner on 7 May. He will be resident at the Cyber Centre from 29 April to 15 May 2019.

Mapping China’s Tech Giants

This report accompanies the Mapping China’s Tech Giants website.

This is our first report on the topic – updated reports are also available; 

Executive summary

Chinese technology companies are becoming increasingly important and dynamic actors on the world stage. They’re making important contributions in a range of areas, from cutting-edge research to connectivity for developing countries, but their growing influence also brings a range of strategic considerations. The close relationship between these companies and the Chinese Communist Party (CCP) raises concerns about whether they may be being used to further the CCP’s strategic and geopolitical interests.

The CCP has made no secret about its intentions to export its vision for the global internet. Officials from the Cyber Administration of China have written about the need to develop controls so that ‘the party’s ideas always become the strongest voice in cyberspace.’1 This includes enhancing the ‘global influence of internet companies like Alibaba, Tencent, Baidu [and] Huawei’ and striving ‘to push China’s proposition of internet governance toward becoming an international consensus’.

Given the explicitly stated goals of the CCP, and given that China’s internet and technology companies have been reported to have the highest proportion of internal CCP party committees within the business sector,2 it’s clear these companies are not purely commercial actors.

ASPI’s International Cyber Policy Centre has created a public database to map the global expansion of 12 key Chinese technology companies. The aim is to promote a more informed debate about the growth of China’s tech giants and to highlight areas where this expansion is leading to political and geostrategic dilemmas. It’s a tool for journalists, researchers, policymakers and others to use to understand the enormous scale and complexity of China’s tech companies’ global reach.

The dataset is inevitably incomplete, and we invite interested users to help make it more comprehensive by submitting new data through the online platform.

Our research maps and tracks:

  • 17,000+ data points that have helped to geo-locate 1700+ points of overseas presence for these 12 companies;
  • 404 University and research partnerships including 195+ Huawei Seeds for the Future university partnerships;
  • 75 ‘Smart City’ or ‘Public Security Solution’ projects, most of which are in Europe, South America and Africa;
  • 52 5G initiatives, across 34 countries;
  • 119 R&D labs, the greatest concentration of which are in Europe;
  • 56 undersea cables, 31 leased cable and 17 terrestrial cables;
  • 202 data centres and 305 telecommunications & ICT projects spread across the world.

Introduction

China’s technology, internet and telecommunications companies are among the world’s largest and most innovative. They’re highly competitive, and many are leaders in research and development.

They’ve played a central role in bringing the benefits of modern technology to hundreds of millions of people, particularly in the developing world.

As a function of their increasingly global scale and scope, China’s tech giants can exert increasing levels of influence over industries and governments around the world. The close relationship between Chinese companies and the Chinese Communist Party (CCP) means that the expansion of China’s tech giants is about more than commerce.

A key research question includes: What are the geostrategic, political and human rights implications of this expansion? By mapping the global expansion of 12 of China’s largest and most influential technology companies, across a range of sectors, this project contributes new data and analysis to help answer such questions.

All Chinese companies are subject to China’s increasingly stringent security, intelligence, counter-espionage and cybersecurity laws.3 That includes, for example, requirements in the CCP constitution4 for any enterprise with three or more full party members to host internal party committees, a clause in the Company Law5 that requires companies to provide for party activity to take place, and a requirement in the National Intelligence Law to cooperate in and conceal involvement in intelligence work.6

Several of the companies included in this research are also directly complicit in human rights abuses in China, including the reported detention of up to 1.5 million Uyghur Muslims in Xinjiang.7 From communications monitoring to facial recognition that enables precise and pervasive surveillance, advanced technology – from these and other companies – is crucial to the increasingly inescapable surveillance net that the CCP has created for some Chinese citizens.

Every year since 2015, China has ranked last in the annual Freedom on the Net Index.8 The CCP has made no secret of its desire to export its concepts of internet and information ‘sovereignty’,9 as well as cyber censorship,10 around the world.11 Consistent with that directive, this research shows that Chinese companies are playing a role in aiding surveillance and providing sophisticated public security technologies and expertise to authoritarian regimes and developing countries that face challenges to their political stability, governance and rule of law.

In conducting this research, ASPI’s International Cyber Policy Centre (ICPC) has used open-source information in English and Chinese to track the international operations and investments of12 major Chinese technology companies: Huawei, ZTE, Tencent, Baidu, China Electronics Technology Group Corporation (CETC), Alibaba, China Mobile, China Telecom, China Unicom, Wuxi, Hikvision and BGI.

This research has been compiled in an online database that ICPC is making freely accessible to the public. While it contains more than 1,700 projects and more than 17,000 data points, it’s not exhaustive. We welcome and encourage members of the public to help us make this dataset more complete by submitting data via the website.

The database

Throughout 2018, ICPC received frequent questions from media and stakeholders about the international activities of Chinese technology companies; for example, about Huawei’s operations in particular regions or how widespread the use of Baidu or WeChat is outside of China.

These were always difficult questions to answer, as there’s a lack of publicly available quantitative and qualitative data, and some of these companies disclose little in the way of policies that affect data, security, privacy, freedom of expression and censorship. What information is available is spread across a wide range of sources and hasn’t been compiled. In-depth analysis of the available sources also requires Chinese-language capabilities, an understanding of Chinese state financing structures, and the use of internet archiving services as web pages are moved, altered or even deleted.

A further impediment to transparency is that Chinese media are under increasing control from the CCP and publish few investigative reports, which severely limits the available pool of media sources. The global expansion and influence of US internet companies, particularly Facebook, for example, has rightly received substantial attention and scrutiny over the past few years. Much of that scrutiny has come from, and will continue to come from, independent media, academia and civil society.

However, the same scrutiny is often lacking when it comes to Chinese tech and social media companies. The sheer capacity of China’s giant tech companies, their reach and influence, and the unique party-state environment that shapes, limits and drives their global behaviour set them apart from other large technology companies expanding around the world.

This project seeks to:

  1. Analyse the global expansion of a key sample of China’s tech giants by mapping their major points of overseas presence.
  2. Provide the public with an analysis of the governance structures and party-state politics from which those companies have emerged and with which they’re deeply entwined.

The data and map is available here: https://chinatechmap.aspi.org.au/

Methodology

To fill this research gap, ICPC sought to create an interactive global database to provide policymakers, academics, journalists, government officials and other interested readers with a more holistic picture of the increasingly global reach of China’s tech giants.

A complete mapping of all Chinese technology companies globally would be impossible within the confines of our research. ICPC has therefore selected 12 companies from across China’s telecommunications, technology, internet and biotech sectors:

  • Alibaba
  • Baidu
  • BGI
  • China Electronics Technology Group (CETC)
  • China Mobile
  • China Telecom
  • China Unicom
  • Hikvision (a subsidiary of CETC)
  • Huawei
  • Tencent
  • Wuxi
  • ZTE

This dataset will continue to be updated during 2019. This research relied on open-source information in English and Chinese. This has included company websites, corporate information, tenders, media reporting, databases and other public sources.

The size and complexity of these companies, and the speed at which they’re expanding, means this dataset will inevitably be incomplete. For that reason, we encourage researchers, journalists, experts and members of the public to contribute and submit data via the online platform in order to help make the dataset more complete over time.

China’s tech firms & the CCP

The CCP’s influence and reach into private companies has increased sharply over the past decade.

In 2006, 178,000 party committees had been established in private firms.12 By 2016, that number had increased sevenfold to approximately 1.3 million.13 Today, whether the companies, their leadership, and their employees like it or not, the CCP is present in private and public enterprise. Often the activity of party committees and party-building activity is linked to the CCP’s version of the concept of ‘corporate social responsibility’14—a concept that the party has explicitly politicised. For instance, in the publishing industry, corporate social responsibility includes political responsibility15 and protecting state security.16 Internet and technology companies are believed to have the highest proportion of CCP party committees in the private sector.17

This expanding influence and reach also extends to foreign companies. For example, by the end of 2016, the CCP’s Organisation Department claimed that 70% of China’s 100,000 foreign enterprises possessed party organisations.18 Expanding the party’s reach and role inside private enterprises appears to have been a priority since party chief Jiang Zemin’s ‘Three Represents’ policy, which opened party membership to businesspeople, became CCP doctrine in 2002.

All the companies mapped as a part of this project have party committees, party branches and party secretaries. For example, Alibaba has around 200 party branches;19 in 2017 it was reported that Tencent had 89 party branches;20 and Huawei has more than 300.21

Sometimes, the relevance and significance of the CCP’s presence within technology companies is dismissed or trivialised as merely equivalent to the presence of government relations or human resources departments in Western corporations. However, the CCP’s expectations of these committees is clear.22 The CCP’s constitution states that a party organisation ‘shall be formed in any enterprise … and any other primary-level work unit where there are three or more full party members’.23 Article 32 outlines their responsibilities, which include encouraging everyone in the company to ‘consciously resist unacceptable practices and resolutely fight against all violations of party discipline or state law’. Article 33 states that party committees inside state-owned enterprises are expected to ‘play a leadership role, set the right direction, keep in mind the big picture, ensure the implementation of party policies and principles, and discuss and decide on major issues of their enterprise in accordance with regulations’.24

The establishment and expansion of party committees in private enterprises appears to be one of the ways in which Beijing is trying to reduce financial risks and exercise control over the economy. Because entities ‘cannot be without the party’s voice’ and ‘must safeguard the state-owned assets and interests from damage’,25 the party committees are expected to weigh in on major decisions and policies, including the appointment and dismissal of important cadres, major project investment decisions and large-scale capital expenditures.26 

Although this guidance is longstanding practice in state-owned enterprises, it also appears to be taking root in private enterprises. Conducting a review of corporate disclosures in 2017, the Nikkei Asian Review identified 288 companies listed in China that ‘changed their articles of association to ensure management policy that reflects the party’s will’.27 In 2018, 26 publicly listed Chinese banks revised their articles of association to support party committees and the establishment of subordinate discipline inspection committees. Many of the revised articles reportedly include language requiring party consultation before major decisions are made.28

This control mechanism is explicit in the party’s vetting of business leaders. For example, although he’s not a party member, Baidu CEO Robin Li is a member of the Chinese People’s Political Consultative Conference, the country’s primary ‘united front’ body.29 The party conducts a comprehensive assessment of any of the business executives brought into official advisory bodies managed by the United Front Work Department, the Chinese People’s Political Consultative Conference and the National People’s Congress. Two of the four criteria – which relates to a business person’s political inclinations – include, their ‘ideological status and political performance’, as well as their fulfillment of social responsibilities. And second, their personal compliance with laws and regulations.30

Enabling & exporting digital authoritarianism

The crown jewel of Chinese foreign policy under Xi Jinping is the Belt and Road Initiative (BRI), which is to be a vast global network of infrastructure intended to enable the flow of trade, people and ideas between China and the rest of the world.31 Technology, under the banner of the Digital Silk Road, is a key component of this project.

China’s ambitions to influence the international development of technological norms and standards are openly acknowledged.32 The CCP recognises the threat posed by an open internet to its grip on power—and, conversely, the opportunities that dominance over global cyberspace could offer by extending that control.33

In a 2017 article published in one of the most important CCP journals, officials from the Cyber Administration of China (the top Chinese internet regulator) wrote about the need to develop controls so that ‘the party’s ideas always become the strongest voice in cyberspace.’34 This includes enhancing the ‘global influence of internet companies like Alibaba, Tencent, Baidu [and] Huawei’ and striving ‘to push China’s proposition of internet governance toward becoming an international consensus’.

Officials from the Cyberspace Administration of China have written that ‘cyberspace has become a new field of competition for global governance, and we must comprehensively strengthen international exchanges and cooperation in cyberspace, to push China’s proposition of Internet governance toward becoming an international consensus.’35 China’s technology companies are specifically referenced as a part of this effort: ‘The global influence of Internet companies like Alibaba, Tencent, Baidu, Huawei and others is on the rise.’36

Western technology firms have attracted heated criticism for making compromises in order to engage in the Chinese market, which often involves constraining free speech or potentially abetting human rights abuses.37 This attention is warranted and should continue. However, strangely, global consumers have so far been less critical of the Chinese firms that have developed and deployed sophisticated technologies that now underpin the CCP’s ability to control and suppress segments of China’s population38 and which can be exported to enable similar control of other populations.

The ‘China model’ of digitally enabled authoritarianism is spreading well beyond China’s borders. Increasingly, the use of technology for repression, censorship, internet shutdowns and the targeting of bloggers, journalists and human rights activists are becoming standard practices for non-democratic regimes around the world. 

In its 2018 Freedom on the net report, Freedom House singled out China as the worst abuser of human rights on the internet. The report also found that the Chinese Government is actively seeking to export its moral and ethical norms, expertise and repressive capabilities to other nations. In addition to the Chinese Government’s efforts, Freedom House specifically called out the role of the Chinese tech sector in facilitating the spread of digital repression. It found that Chinese companies:

have supplied telecommunications hardware, advanced facial-recognition technology, and data analytics tools to a variety of governments with poor human rights records, which could benefit Chinese intelligence services as well as repressive local authorities. Digital authoritarianism is being promoted as a way for governments to control their citizens through technology, inverting the concept of the internet as an engine of human liberation.39

Reporters Without Borders has also sounded the alarm over the involvement of Chinese technology companies in repressing free speech and undermining journalism. As part of an extensive report on the Chinese Government’s attempts to reshape the world’s media in its own image, it concluded that:

From consumer software apps to surveillance systems for governments, the products that China’s hi-tech companies try to export provide the regime with significant censorship and surveillance tools … In May 2018, the companies were enlisted into the China Federation of Internet Societies (CFIS), which is openly designed to promote the Chinese Communist Party’s presence within them. Chinese hi-tech has provided the regime with an exceptional influence and control tool, which it is now trying to extend beyond China’s borders.40

Pushing back against both the practices of digital authoritarianism and the norms and values that underpin such practices requires a clear-eyed understanding of the way they’re being spread. For example, a study of the BRI has found that the ways in which some BRI projects, including digital projects, are structured create serious concerns about the erosion of sovereignty for host nations, such as when a recipient government doesn’t have full control of the operations, management, digital infrastructure or data being generated through those projects.41

Sovereign governments are, of course, ultimately responsible for their actions. For some, particularly Western governments, this includes being transparent and accountable in their use of technology for surveillance and information control. And, if they aren’t, the media, civil society and the public have avenues to hold them to account. However, companies also have responsibilities in this space, which is why many sensitive and dual-use technologies are subject to export controls. The need for companies to be held accountable for how new technologies are used is particularly acute in developing countries, where the state may be less able or less willing to do so because of challenges arising from governance, legislative and regulatory capacity, transparency and corruption.

The following case studies have been selected as illustrations of the ways in which Chinese technology companies, often with funding from the Chinese Government, are aiding authoritarian regimes, undermining human rights and exerting political influence in regions around the world.

Surveillance cities: Huawei’s ‘smart cities’ projects

An important and understudied part of the global expansion of Chinese tech companies involves the proliferation of sophisticated surveillance technologies and ‘public security solutions’.42 Huawei is particularly dominant in this space, including in developing countries where advanced surveillance technologies are being introduced for the first time.

Through this research and as of April 2019, we have mapped 75 Smart City-Public Security projects, most of which involve Huawei.43 Those projects—which are often euphemistically referred to as ‘safe city’ projects—include the provision of surveillance cameras, command and control centres, facial and licence plate recognition technologies, data labs, intelligence fusion capabilities and portable rapid deployment systems for use in emergencies.

The growth of Huawei’s ‘public security solution’ projects has been rapid. For example, the company’s ‘Hisilicon’ chips reportedly make up 60% of chips used in the global security industry.44 In 2017, Huawei listed 40 countries where its smart-city technologies had been introduced;45 in 2018, that reach had reportedly more than doubled to 90 countries (including 230 cities). Because of a lack of detail or possible differences in definition, this project currently covers 43 countries.46

This research has found that, in many developing countries, exponential growth is being driven by loans provided by China Exim Bank (which is wholly owned by the Chinese Government).47 The loans, which must be paid back by recipients,48 are provided to foreign governments, and it’s been reported in academia and the media that the contractors used must be Chinese companies.49 In many of the examples examined, Huawei was awarded the primary contract; in some cases, the contract was managed by a Chinese state-owned enterprise and Huawei played a ‘sub-awardee’ role as a provider of surveillance equipment and services.50

Smart-city technologies can impart substantial benefits to states using them. For example, in Singapore, increased access to digital services and the use of technology that exploits the ‘internet of things’ (for traffic control, health care and video surveillance) has led to increased citizen mobility and productivity gains.51

However, in many cases, Huawei’s safe-city solutions focus on the introduction of new public security capabilities, including in countries such as Ecuador, Pakistan, the Philippines, Venezuela, Bolivia and Serbia. Many of those countries rank poorly, some very poorly, on measures of governance and stability, including the World Bank’s governance indicators of political stability, the absence of violence, the control of corruption and the rule of law.52

Of course, the introduction of new public security technologies may have made cities ‘safer’ from a crime prevention perspective, but, unsurprisingly, in some countries it’s created a range of political and capacity problems, including alleged corruption; missing money and opaque deals;53 operational and ongoing maintenance problems;54 and alleged national security concerns.55

Censorship and suppression: aiding authoritarianism in Zimbabwe

The example set by the Chinese state is increasingly being looked to by non-democratic regimes—and even some democratic governments—as proof that a free and open internet is neither necessary nor desirable for development. ‘If China could become a world power without a free Internet, why do African countries need a free internet?’ one unnamed African leader reportedly asked interviewers from the Department of Media Studies at the University of Witwatersrand.56 

The business dealings of Chinese technology companies in Zimbabwe, for example, are closely entwined with the CCP’s support for the country’s authoritarian regime. China is Zimbabwe’s largest source of foreign investment, partly as a result of sanctions imposed by Western countries over human rights violations by the regime. Zimbabwean President Emmerson Mnangagwa’s first visit outside of Africa after his election was to China, where he thanked President Xi Jinping and China for supporting Zimbabwe against Western sanctions and called for even deeper economic and technical cooperation between the two nations.57

Chinese companies play a central role in Zimbabwe’s telecommunications sector. Huawei has won numerous multimillion-dollar contracts with state-owned cellular network NetOne, some of which have been the subject of corruption allegations.58 Several of Huawei’s Zimbabwe projects have been financed through Chinese Government loans.59

ZTE also has a significant footprint in the country (and has also been the subject of corruption allegations).60 This has included a $500 million loan, in partnership with China Development Bank, to Zimbabwe’s largest telco, Econet, in 2015.61 ZTE has previously provided equipment, including radio base stations, for Econet’s 3G network.62 Zimbabwean telecommunications providers currently owe millions of dollars to Huawei and ZTE, as well as Ericsson, which reportedly led to network disruptions in March 2019.63

The CCP and Chinese companies haven’t just helped to cushion Zimbabwe’s leaders against the impact of sanctions. They’re also providing both a model and means for the regime’s authoritarian practices to be brought forward into the digital age, both online and offline.

The Zimbabwean Government has been considering draconian new laws to restrict social media since at least 2016, when the official regulator issued an ominous warning to internet users against ‘generating, passing on or sharing such abusive and subversive materials’.64 In the same year, a law was passed to allow authorities to seize devices in order to prevent people using social media.65

In early 2019, the government blocked social media and imposed internet shutdowns in response to protests against fuel price increases. Information Minister Energy Mutodi stated that ‘social media was used by criminals to organize themselves … this is why the government had to … block [the] internet,’ as he announced plans for forthcoming cybercrime laws to criminalise the use of social media to spread ‘falsehoods’.66

The government has openly been looking to China as a model for controlling social media,67 including by creating a cybersecurity ministry, which a spokesperson described as ‘like a trap used to catch rats’.68

Parts of this ‘trap’ reportedly come from China. In 2018, it was reported that China, alongside Russia and Iran, had been helping Zimbabwe to set up a facility to house a ‘sophisticated surveillance system’ sold to the government by ‘one of the largest telecommunications companies’ in China.69 Given the description and context, it seems plausible that this company may be Huawei or ZTE.

‘We have our means of seeing things these days, we just see things through our system. So no one can hide from us, in this country,’ said former Intelligence Minister Didymus Mutasa.70 

The government is increasingly looking to expand its surveillance from the online space into the real world. It’s signed multiple agreements with Chinese companies for physical surveillance systems, including a highly controversial planned national facial recognition system with Chinese company CloudWalk.71

It’s also interested in developing its own indigenous facial recognition technology, and is working with CETC subsidiary Hikvision to do it.72 Hikvision is already supplying surveillance cameras for police and traffic control systems.73 In 2018, Zimbabwean authorities signed a memorandum of understanding with the company to implement a ‘smart city’ program in Mutare. This included the donation of facial recognition terminals equipped with deep-learning artificial intelligence (AI) systems.

In a media statement, the government stated: 

The software is meant to be integrated with the facial recognition hardware which will be made locally by local developers in line with the government’s drive to grow the local ICT sector making Zimbabwe to be the number one country in Africa to spearhead the facial recognition surveillance and AI system nationwide in Zimbabwe.74

National ID programs: Venezuela’s ‘Fatherland Card’

Chinese tech companies are involved in national identity programs around the world. One of the most concerning examples is playing out amid the political and humanitarian crisis in Venezuela. A Reuters investigation in 2018 uncovered the central role played by ZTE in inspiring and implementing the Maduro regime’s ‘Fatherland Card’ program.75 The Fatherland Card (Carnet de la Patria) records the holder’s personal data, such as their birthday, family information, employment, income, property owned, medical history, state benefits received, presence on social media, membership of a political party and history of voting.

Although the card is technically voluntary, without it Venezuelans can be denied access to government-subsidised food, medication or gasoline.76 In the midst of Venezuela’s political crisis, registering for a ‘voluntary’ card is no choice at all for many. In fact, people in Caracas are queuing for hours to get hold of one, despite the risks of handing over personal data to the increasingly unstable and repressive Maduro regime.77

According to Reuters, ZTE was contracted by the government to build the underlying database and accompanying mobile payment system. A team of ZTE employees was embedded with Cantv, the Venezuelan state telecommunications company that manages the database, to help secure and monitor the system. ZTE has also helped to build a centralised government video surveillance system.

There are concerns that the card program is being used as a tool to interfere in the democratic process. During the 2018 elections, observers reported kiosks being set up near or even inside voting centres, where voters were encouraged to scan their cards to register for a ‘fatherland prize’.78 Those who did so later received text messages thanking them for voting for Maduro (although they never did get the promised prize).

Authorities claim that the cards record whether a person voted, but not whom they voted for. However, an organiser interviewed by Reuters claimed to have been instructed by government managers to tell voters that their votes could be tracked. Regardless of the truth of the matter, even the rumours that the government may be watching who votes for it—or, perhaps more pertinently, against it—could be expected to influence the way people vote.

In the context of the current crisis, this technologically enabled population control takes on an even sharper edge. Cyberspace has emerged as a key battleground in the struggle between the Maduro regime and the Venezuelan opposition led by Juan Guaidó.

In addition to selective social media blocks79 and total internet shutdowns,80 there’s also evidence of more insidious attacks. For example, a website set up by the opposition to coordinate humanitarian aid delivery was subject to a DNS hijacking attack, including the theft of the personal data of potentially thousands of pro-opposition volunteers.81

Cantv, Venezuela’s government-run telecommunications company, is reportedly ‘dependent on agreements with ZTE and Huawei to supply equipment and staff and … Cantv sends its employees to China to receive training.’82 These deals are financed through the Venezuela China Joint Fund. China is known as something of an international leader in DNS blocking and manipulation, and the Chinese Government is strongly supporting the Maduro regime, including by targeting social media users in China who post or share content critical of Maduro.83

Shaping politics and policy in Belarus

In some parts of the world, Chinese technology companies are helping shape the politics and policy of new technologies through the development of high-level relationships with national governments. This is particularly concerning in the case of non-democratic countries.

Often referred to as ‘Europe’s last dictatorship’, Belarus has been under the control of authoritarian strongman Aleksandr Lukashenko since 1994.84 In recent years, ties with China have come to play an increasingly significant role not only in Belarus’s delicate diplomatic relations with its powerful neighbours, but also in its very indelicate domestic policies of violent repression. This has included the use of digital technologies for mass surveillance and the targeted persecution of activists, journalists and political opponents.85

Huawei has been supplying video surveillance and analysis systems to the Lukashenko regime since 2011 and border monitoring equipment since at least 2014.86 Also in 2014, Huawei’s local subsidiary, Bel Huawei Technologies, launched two research labs for ‘intellectual remote surveillance systems’. Through the labs, Huawei provides ‘laboratory-based training … for the specialists of Promsvyaz, Beltelekom, HSCC and other organisations’.87

Over the past several years, collaboration between the Belarusian Government and Chinese technology companies has expanded rapidly, in line with Belarus’s engagement with the BRI and with deepening diplomatic and economic ties between Lukashenko’s regime and the CCP.88

In March 2019, Belarus unveiled a draft information security law. ‘It is purely our own product. We didn’t borrow it from anyone,’ State Secretary of the Security Council Stanislav Zas told Belarusian state media.89

A day later, China’s ambassador to Belarus spoke to the same outlet about how ‘Belarusian and Chinese companies [have] managed to establish intensive cooperation in the area of cyber and information security’, and about the desire of both countries to ‘expand cooperation in the sphere of cybersecurity’.90

‘Both countries have good practice in this field. We are going to even deeper cooperate [sic] and share experience,’ the Chinese ambassador said. 

Huawei has played an especially prominent role in this process at multiple levels. It has continued and expanded the training it provides to Belarusians, including sending students to study in China and signing an agreement with the Belarusian State Academy of Communications for a joint training centre.91

Huawei is also exerting political and policy influence. In May 2018, the company released its National ICT priorities for the Republic of Belarus.92 The proposal includes recommendations for ‘public safety’ technologies, such as video surveillance and drones, and a citizen status identification system.

‘Belarus has not yet widely deployed integrated police systems, and thus can refer to the solution adopted in Shenzhen,’ the document notes. This is likely to be a reference to the facial recognition program implemented by Shenzhen police to ‘crack down on jaywalking’.93

During a meeting with the chairman of Huawei’s board, Guo Ping, for the launch of the plan, then Belarusian Prime Minister Andrei Kobyakov expressed his hope that: the accumulated experience and prospects of cooperation will play an important role in the development of information and communication technologies in Belarus and in making friendship between our countries stronger. The Belarusian government counts on further effective interaction and professional cooperation.94

Controlling information flows—WeChat and the future of social messaging

Launched in 2011, WeChat quickly became China’s dominant social network but has largely struggled to build up a significant user base overseas. Still, of the social media super-app’s 1.08 billion monthly active users,95 an estimated 100–200 million are outside China.96

Southeast Asia provides the most fertile ground for WeChat outside of China: the app has 20 million users in Malaysia; 17% of the population of Thailand use it;97 and it’s the second most popular messaging app in Bhutan and Mongolia.98

The potential for WeChat to substantially grow its user base overseas remains, particularly as it hits a wall in user growth in China99 and overseas expansion becomes more of an imperative. To the extent that it’s being used outside of mainland China, WeChat poses significant risks as a channel for the dissemination of propaganda and as a tool of influence among the Chinese diaspora.

WeChat is increasingly used by politicians in liberal democracies to communicate with their ethnic Chinese voters, which necessarily means that communication is subject to CCP censorship by default.100

In one instance, in September 2017 Canadian parliamentarian Jenny Kwan posted a WeChat message of support for Hong Kong’s Umbrella Movement – a series of pro-democracy protests that took place in 2014 – only to have it censored by WeChat.101

In 2018, Canadian police received complaints about alleged vote buying taking place on WeChat.102 A group called the Canada Wenzhou Friendship Society was reportedly using the app to offer voters a $20 ‘transportation fee’ if they went to the polls and encouraging them to vote for specific candidates.

Because WeChat is one of the main conduits for Chinese-language news, censorship controls help Beijing to ensure that news sources using the app for distribution report only news that serves the CCP’s strategic objectives.103

WeChat is not only a significant influence and censorship tool for the CCP, but also has the potential to facilitate surveillance. An Amnesty International study ranking global instant messaging apps on how well they use encryption to protect online privacy gave WeChat a score of 0 out of 100.104 Content that passes through WeChat’s servers in China is accessible to the Chinese authorities by law.105

Enabling human rights abuses in China: Uyghurs in Xinjiang

Many of the repressive techniques and technologies that Chinese companies are implementing abroad have for a long time been used on Chinese citizens. In particular, the regions of Tibet and Xinjiang are often at the bleeding edge of China’s technological innovation.

The complicity of China’s tech giants in perpetrating or enabling human rights abuses—including the detention of an estimated 1.5 million Chinese citizens106 and foreign citizens107—foreshadows the values, expertise and capabilities that these companies are taking with them out into global markets. 

From the phones in people’s pockets to the tracking of 2.5 million people using facial recognition technology108 to the ‘re-education’ detention centres,109 Chinese technology companies—including several of the companies in our dataset—are deeply implicated in the ongoing surveillance, repression and persecution of Uyghurs and other Muslim ethnic minority communities in Xinjiang.

Many of the companies covered in this report collaborate with foreign universities on the same kinds of technologies they’re using to support surveillance and human rights abuses in China. For example, CETC—which has research partnerships with the University of Technology Sydney,110 the University of Manchester111 and the Graz Technical University in Austria112—and its subsidiary Hikvision are deeply implicated in the crackdown on Uyghurs in Xinjiang. CETC has been providing police in Xinjiang with a centralised policing system that draws in data from a vast array of sources, such as facial recognition cameras and databases of personal information. The data is used to support a ‘predictive policing’ program, which according to Human Rights Watch is being used as a pretext to arbitrarily detain innocent people.113 CETC has also reportedly implemented a facial recognition project that alerts authorities when villagers from Muslim-dominated regions move outside of prescribed areas, effectively confining them to their homes and workplaces.114

Huawei provides the Xinjiang Public Security Bureau with technical support and training.115 At the same time, it has funded more than 1,200 university research projects and built close ties to many of the world’s top research institutions.116 The company’s work with Xinjiang’s public security apparatus also includes providing a modular data centre for the Public Security Bureau of Aksu Prefecture in Xinjiang and a public security cloud solution in Karamay. In early 2018, the company launched an ‘intelligent security’ innovation lab in collaboration with the Public Security Bureau in Urumqi.117

According to reporting, Huawei is providing Xinjiang’s police with technical expertise, support and digital services to ensure ‘Xinjiang’s social stability and long-term security’. 

Hikvision took on hundreds of millions of dollars worth of security-related contracts in Xinjiang in 2017 alone, including a ‘social prevention and control system’ and a program implementing facial-recognition surveillance on mosques.118 Under the contract, the company is providing 35,000 cameras to monitor streets, schools and 967 mosques, including video conferencing systems that are being used to ‘ensure that imams stick to a “unified” government script’.119 

Most concerningly of all, Hikvision is also providing equipment and services directly to re-education camps. It has won contracts with at least two counties (Moyu120 and Pishan121) to provide panoramic cameras and surveillance systems within camps.

Future strategic implications

The degree to which nations and communities around the world are coming to rely on Chinese technology companies for critical services and infrastructure, from laying cables to governing their cities, has significant strategic implications both now and for many years into the future:

  • Undermining democracy: Perhaps the greatest long-term strategic concern is the role of Chinese technology companies – and technology companies from other countries that aid or engage in similar behaviour – in enabling authoritarianism in the digital age, from supplying surveillance technologies to automating mass censorship and the targeting of political dissidents, journalists, human rights advocates and marginalised minorities. The most challenging issue is the continued export around the world of the model of vicious, ubiquitous surveillance and repression being refined now in Xinjiang.
  • Espionage and intellectual property theft: The espionage risks associated with Chinese companies are clearly laid out in Chinese law, and the Chinese state has a well-established track record of stealing intellectual property.122 This risk is only likely to increase as ‘smart’ technology becomes ever more pervasive in private and public spaces. From city-wide surveillance to the phones in the pockets of political leaders (or, in a few years, the microphones in their TVs and refrigerators), governments, the private sector and civil society alike need to seriously consider how to better protect their information from malicious cyber actors.
  • Developing technologies: Chinese companies are leading the field in research and development into a range of innovative, and strategically sensitive, emerging technologies. Their global expansion provides them with key resources, such as huge and diverse datasets and access to the world’s best research institutions and universities.123 Fair competition between leading international companies to develop these crucial technologies is only to be expected, and Chinese tech companies have made enormous positive contributions to the sum total of human knowledge and innovation. However, the strategic, political and ideological goals of the CCP—which has directed and funded much of this research—can’t be ignored. From AI to quantum computing to biotechnology, the nations that dominate those technologies will exercise significant influence over how the technologies develop, such as by shaping the ethical norms and values that are built into AI systems, or how the field of human genetic modification progresses. Dominance in these fields will give nations a major strategic edge in everything from economic competition to military conflict.
  • Military competition: In cases of military competition with China, the Chinese Government would of course seek to leverage, to its own advantage, its influence over Chinese companies providing equipment and services to its enemies. This should be a serious strategic consideration for nations when they choose whether to allow Chinese companies to be involved in the build-out of critical infrastructure such as 5G networks, especially given the CCP’s increasing assertiveness and coercion globally.

This issue is particularly acute for countries already experiencing tensions over China’s territorial claims in regions such as the South China Sea. For example, in 2016, after a ruling by a UN-backed tribunal dismissed Chinese claims, suspected Chinese hackers attacked announcement and communications systems in two of Vietnam’s major airports, including a ‘display of profanity and offensive messages in English against Vietnam and the Philippines’.124 A simultaneous hack on a Vietnamese airline led to the loss of more than 400,000 passengers’ data. Vietnam’s Information and Communications Minister said that the government was ‘reviewing Chinese technology and devices’ in the wake of the attack.125 Cybersecurity firm FireEye says that it’s observed persistent targeting of both government and corporate targets in Vietnam that’s suspected to be linked to the South China Sea dispute.126

5G infrastructure build outs should be an area of particular concern. An article in the China National Defence Report in March 2019127 discusses the military applications for China of 5G in the move to ‘intelligentised’ warfare. ‘[A]s military activities accelerate towards extending into the domain of intelligentization, air combat platforms, precision-guided munitions, etc. will be transformed from ‘accurate’ to ‘intelligentized.’ 5G-based AI technology will definitely have important implications for these domains,’ write the authors, who appear to be researchers affiliated with Xidian University and the PLA’s Army Command Academy.

Conclusion

Chinese companies have unquestionably made important and valuable contributions to the technology industry globally, from contributing to cutting edge research and pushing the boundaries of developing technologies, to enabling access to affordable, good quality devices and services for people around the world. They are not going anywhere, and they are going to continue to play a vital role in the ways in which governments, companies and citizens around the world connect with one another.

At the same time, however, it is important to recognise that the activities of these companies are not purely commercial, and in some circumstances risk mitigation is needed. The CCP’s own policies and official statements make it clear that it perceives the expansion of Chinese technology companies as a crucial component of its wider project of ideological and geopolitical expansion. The CCP committees embedded within the tech companies and the close ties (whether through direct ownership, legal obligations or financing agreements including loans and lucrative contracts) between the companies and the Chinese government make it difficult for them to be politically neutral actors, as much as some of the companies might prefer this. There is also a legitimate question about whether global consumers should demand greater scrutiny of Chinese technology firms that facilitate human rights abuses in China and elsewhere.

Governments around the world are struggling with the political and security implications of working with Chinese corporations, particularly in areas such as critical infrastructure, for example in 5G, and in collaborative research partnerships that might involve sensitive or dual-use technologies. Part of this struggle is due to a lack of in-depth understanding of the unique party-state environment that shapes, limits and drives the global behaviour of Chinese companies. This research project aims to help plug that gap so that policymakers, industry and civil society can make more informed decisions when engaging China’s tech giants.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.


ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.


It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

The work of ICPC would be impossible without the financial support of our partners and sponsors across government, industry and civil society. ASPI is grateful to the US State Department for providing funding for this research project.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.


© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. Sarah Cook, ‘China’s cyber superpower strategy: implementation, internet freedom implications, and US responses’, written testimony to House Committee on Oversight and Government Reform, Freedom House, 28 September 2018; Kania et al., ‘China’s strategic thinking on building power in cyberspace: a top party journal’s timely explanation translated’, online. ↩︎
  2. , online. ↩︎
  3. Samantha Hoffman, Elsa Kania, ‘Huawei and the ambiguity of China’s intelligence and counter-espionage laws’, The Strategist, 13 September 2018, online. ↩︎
  4. Constitution of the Communist Party of China, revised and adopted on 24 October 2017, online. ↩︎
  5. People’s Republic of China Company Law, online. ↩︎
  6. Hoffman & Kania, ‘Huawei and the ambiguity of China’s intelligence and counter-espionage laws’. ↩︎
  7. Chris Buckley, Amy Qin, ‘Muslim detention camps are like “boarding schools,” Chinese official says’, New York Times, 12 March 2019, online; Fergus Ryan, Danielle Cave, Nathan Ruser, Mapping Xinjiang’s ‘re-education’ camps, ASPI, Canberra, 1 November 2018, online. ↩︎
  8. ‘China: not free: 88/100’, Freedom on the net 2018, Freedom House, Washington DC, 2018, online. ↩︎
  9. Jun Mai, ‘Xi Jinping renews “cyber sovereignty” call at China’s top meeting of internet minds’, South China Morning Post, 3 December 2017, online. ↩︎
  10. Josh Rogin, ‘White House calls China’s threats to airlines “Orwellian nonsense”’, Washington Post, 5 May 2018, online. ↩︎
  11. Samantha Hoffman, Social credit: technology-enhanced authoritarian control with global consequences, ASPI, Canberra, 28 June 2018, online. ↩︎
  12. Wu Jiao, ‘Party membership up in private firms’, China Daily, 17 July 2007, online. ↩︎

Taking Australian diplomacy digital

What’s the problem?

Australia’s Department of Foreign Affairs and Trade (DFAT) now has a presence on the main digital platforms, but it is yet to master digital diplomacy: using these powerful new communication tools and platforms to better conduct its core mission of persuasion, influence and advocacy. There’s too much use of new media channels to transmit old media content, a tendency to duck rather than address difficult issues, and a failure to engage within the digital life cycle of a news story.

Data analytics and the integration of digital tools into mainstream diplomatic campaigns are both lacking. Beyond this, there’s a need to rethink how Australia does diplomacy in the digital age.

DFAT needs to find better ways to communicate with its stakeholders, using digital tools. It needs to recognise that increasingly statecraft is playing out in the cyber and information domains, and invest more in equipping itself to engage in those domains—even when such online engagement brings risk. 

DFAT must also reconceive its overseas presence and embrace some of the agility and nimbleness of the tech world in doing so.

What’s the solution?

DFAT needs to start treating digital diplomacy as core tradecraft, rather than optional add-on. It should provide compulsory digital training for all outgoing heads of mission and encourage healthy internal competition and innovation. It should pilot more sophisticated data analytics tools and integrate digital tools into regular diplomatic campaigns. It should develop and pilot a new stream of diplomatic reporting that’s punchier and timelier, and reaches a broader audience on hand-held devices.

DFAT should create new positions of ambassador to Silicon Valley and ambassador to the Chinese tech giants based in Beijing. It should experiment more with ‘pop-up’ diplomatic posts, pilot one-person posts and encourage innovation and experimentation in the conduct of digital diplomacy, conceiving of embassies as hubs and connectors for a broad set of interactions. 

Finally, DFAT needs to adopt some of the nimbleness and agility of the tech world in how it conducts Australia’s external policy. Failure to do so means the field is left to others.

Introduction

Australia’s DFAT has come a long way in a short time in its embrace of digital tools and technology.

DFAT, and most of our embassies around the world, now have a significant social media presence, often across several platforms (Figure 1). There has been an explosion of Twitter feeds, Facebook pages, Instagram accounts, and even blogs and YouTube channels,1 adding colour to what was (and remains) a rather lifeless website-only presence. In this, DFAT has been helped by political leaders who have embraced these tools as a means of modern-day communication.

After coming late to the game,2 DFAT now has a decent digital presence when benchmarked against other foreign ministries worldwide. It’s certainly not in the top 10, but it is credible.3

Figure 1: DFAT’s social media presence

Digital, but not yet doing digital diplomacy

However, in the rush to embrace digital media, there’s a danger that some of the bigger questions have gone begging, and that ends have been confused with means. Doing digital diplomacy well not only requires having the requisite digital platforms—it entails using them strategically and effectively to advance a diplomatic agenda.

This is where DFAT is struggling: it has gone digital, but it isn’t yet doing digital diplomacy. Having a large number of social media accounts and a growing crop of followers or friends isn’t sufficient. The test of success is whether those factors are being properly utilised to bring Australian diplomacy from the analogue into the digital age.

A changed operating environment

The essence of diplomacy hasn’t changed. Its main purpose remains the facilitation of communication between states and the exertion of influence (on other states or the international system) to protect and advance national interests. But what has changed vastly, almost beyond recognition, is the operating environment of diplomacy.

Even as recently as a decade or two ago—well within the professional lifespan of most of Australia’s senior diplomats—diplomacy as a profession, and hence DFAT as an institution, enjoyed several natural monopolies. First, there was the monopoly on information. It wasn’t that long ago that diplomats would fax press clippings or transcribe news articles and send them back to their capitals.

At a time when news on developments within other countries was scarce, and almost impossible to access remotely, diplomats stationed abroad were a vital—sometimes the only—source of information for capitals hungry for such intelligence.

Second, there was the monopoly on communication. In the era before modern modes of communication, the bulk of interactions between states took place through the medium of their diplomats. Leaders would meet or talk occasionally, but usually the challenge of making direct contact meant most communication was, of necessity, passed through ambassadors or envoys.

Third, there was the monopoly on representation. When communication with capitals was slow and difficult, and it could take several weeks to get an answer, diplomats abroad were expected to make decisions and improvise within a wide area of policy discretion.

These natural monopolies guaranteed relevance for foreign ministries, DFAT included, and sheltered them from competition. A government simply couldn’t run a foreign policy without a foreign ministry and its overseas diplomatic missions. Modern-day technology, however, has eroded most of these natural monopolies.

Diplomats no longer enjoy a monopoly on information. Leaders and decision-makers in capitals can readily access and follow most news from abroad, usually on demand, and from a variety of sources. Nor do diplomats enjoy a monopoly on communication. Today, leaders and senior officials are just as likely to communicate directly with their counterparts in another country—by phone, email, text message or, increasingly, an encrypted chat service—rather than through their diplomats.4

Finally, the monopoly on representation has ended. Diplomats are now expected to check nearly everything of significance with their capitals first, and modern communications mean they can (and are expected to) obtain revised instructions on how to handle an issue almost instantaneously.

Disruption, disintermediation and the digital pivot

The end result is that diplomacy has become a much more competitive space. Diplomats are being disintermediated by new technology and communication advances. States are increasingly able to understand, communicate and negotiate directly with other states, without the need for the intermediating service of diplomats. With the disruption of much of the traditional role of diplomats, the challenge for foreign ministries today is to pivot: to find new ways to generate value and ensure relevance in a much more contested field. And this is where digital tools can prove so important.

One of the main purposes of national security agencies is to deliver a strategic effect: to shape the behaviour and decision-making of foreign countries and their leaderships. Defence forces do this through alliances and partnerships, their force posture, deployments, joint exercises and military diplomacy (and, in extremis, through the threat or use of force). Development agencies do it through the direction and composition of their aid spending. Intelligence agencies do it through the collection of sensitive information, espionage and disruption.

In diplomacy, words are the bullets. A strategic effect is delivered through persuasion, influence, argument and advocacy directed towards a foreign population, nation or group of key actors or decision-makers. For this task, new communication tools—and especially social media—are a potential boon for diplomats.5 They allow diplomats to engage directly with the public or segments of the public in their country of posting, often in a targeted fashion. They provide the tools to deliver a message or engage in debate directly, rather than through traditional platforms.6 And they allow real-time interaction with a rapidly evolving media cycle, including the ability to rebut falsehoods, contest narratives, correct mistakes and provide the public with additional context to media reporting.

This is especially important now that political power is highly dispersed (partly the result of digital media giving each person a loudspeaker). To be an effective diplomat today requires more than just the formal engagement of your host government. If you want to be effective and shape the course of decision-making, then you need to be monitoring and engaging with those who shape the decision-making environment of political leaders within a society. That might include the media, business and industry groups, civil society, pressure and lobby groups, religious organisations, politically active diasporas and social media ‘influencers’. While this may be less true in autocratic countries, even there—thanks to social media and digital platforms—civil society has a voice that it previously lacked, and a means with which it can be directly engaged.7 Knowing and understanding the terrain of local opinion, and how to engage and shape it—the ‘last three feet’ of diplomacy8—is the unique value proposition of today’s diplomat and something that only a local, informed and networked presence can provide.

A credible but flawed digital presence

DFAT and the Australian network of embassies and high commissions abroad now have, on the whole, a credible digital presence—the tools needed to conduct those last three feet of diplomacy. This is necessary but not sufficient. The challenge is to fully utilise these platforms to conduct DFAT’s core business, which is diplomacy. And here, there’s still quite some way to go. There’s not yet a wholesale recognition and appreciation of how the advocacy landscape has changed. As a result, and with a few stand-out exceptions, most of DFAT’s digital channels suffer from the same three ailments.

First, there’s too much use of new media channels to transmit old media content. Digital media are a different format; they speak to a different audience, and require different—and more engaging—content. Good digital content is pithy, impactful and tailored, but too little of DFAT’s digital content meets that test. Using new media channels to transmit old media content (press releases and the like) ruins both.

Second, there’s a pronounced tendency for DFAT’s digital platforms to duck the difficult issues. There’s a place for building brand Australia, promoting tourism and spruiking soft news stories about Australia on digital platforms, but public and cultural diplomacy can’t be the sum total of our digital effort, or else we risk being (in the words of one insightful commentator) ‘all gums, no teeth’.9 Tempting as it is, there’s no point in running dead or lying low when a controversial issue is unfolding. This is exactly when digital platforms come to the fore and the credibility of your digital presence is tested. Too often, when a storm of controversy is raging all around them, DFAT’s digital channels bury their heads in the sand, go radio-silent, or promulgate the Panglossian fiction that all is well. If Australian nationals are set to be executed in a foreign country, or there are suggestions that the Chinese are building a military base in the southwest Pacific, or if a candidate for the Philippines presidency jokes about the sexual assault and murder of an Australian missionary, then we should expect that the relevant Australian digital diplomatic platform will have something worthwhile to say about it— to articulate our views and interests on an important issue.10 Likewise for major world events. The message must obviously reflect diplomatic realities, but to say nothing in such scenarios is simply not credible. It also lacks a prized trait of the digital age—authenticity—and so diminishes the value of the platform and treats readers as fools.

Figure 2: Twitter feed from selected foreign ministries on 12 June 2018, date of the US – North Korea summit in Singapore

Closely linked to this is a frequent failure to respond within the digital life cycle of a news story. Time differences and clearances may make this challenging, but our senior diplomats abroad have enough judgement and common sense to be trusted—indeed encouraged—to speak publicly on most issues within their patch without having every word approved by Canberra.11

Third, there’s a lack of personality in much of DFAT’s digital content. Part of the appeal of social media is its authenticity and directness—the idea that you get to know the person behind the message and can interact with them directly. But most of DFAT’s digital media content attempts to uphold the traditional division between public and private spheres. It’s stiff and aloof, and frequently non-responsive to attempts to engage. That’s an approach that may remain suitable to traditional diplomatic settings, but it jars in the flat, non-hierarchical, informal world of digital.

Operating in a new information domain: opportunities and threats

If used as part of a comprehensive strategy, the new digital world provides many opportunities to reinforce traditional diplomacy. The UK used digital tools to complement traditional diplomacy in its successful assembly of a broad coalition to respond to Russia’s apparent use of chemical weapons on UK territory, in Salisbury (Figure 3). Canada deployed a multifaceted digital campaign to support its objectives as G7 chair (notably, its initiative to tackle the problem of ocean plastics). Russia is an adept practitioner, frequently taking to digital channels to muddy the waters, promote alternative theories and create distractions when under international pressure (Figure 4). These countries have each integrated digital platforms into the prosecution of mainstream diplomatic priorities and campaigns, realising that digital tools can have a potentiating effect in support of a diplomatic campaign. In Australia, we’re yet to do this properly: we maintain an unhelpful separation between the digital realm and the mainstream diplomatic realm.

Figure 3: Part of the UK’s digital diplomatic effort to hold Russia accountable for Salisbury

Figure 4: Twitter feed from the Russian Embassy in London

Professional data analytics can be a powerful tool for this new diplomacy. Big data and network analyses can help identify online influencers and force amplifiers; track how narratives spread among online publics, and thus help to shape or combat them; allow communications that are tailored to the preferences and attributes of specific online communities; and support the rollout of sophisticated, multiphase campaigns. Most major corporate outfits use such tools, as do the diplomatic services of many foreign countries. The UK Foreign Office even has an internal ‘Head of Data Science’ position.12

Australia needs to get similarly professional and move beyond the simple counting of ‘likes’ and ‘followers’ as the metrics of digital impact.

Just as digital tools bring new opportunities to diplomacy, so they also bring new threats. They are changing the nature of statecraft, and the information domain is growing in importance as a theatre for contest between states. ‘Control of the narrative’—about what happened, about who’s at fault, about where justice lies, about what’s ‘real’ and what’s ‘fake’—is at the heart of this contest (Figure 5).

Diplomats have an important role to play here, in combating misrepresentations, squashing rumours and misinformation, and promoting their own country’s analysis and policy. Effective digital tools and good data analytics will be vital to this effort.13

Figure 5: The information domain is becoming a new theatre of state competition: textbook ‘trolling’ by two of its most capable practitioners

Similarly, today’s digital age means that disinformation, propaganda and rumours designed to influence or destabilise another country’s political system can be launched almost instantaneously, from across the globe, timed for maximum impact, and targeted towards a narrow audience (Figure 6). Unlike overt steps or traditional covert action, such measures are low-cost, low-risk and highly deniable. Russian state interference in the 2016 US presidential elections is likely to be just the tip of this iceberg.14 Although defending against such attacks is primarily the work of intelligence and cybersecurity agencies, we should expect our diplomats to be alert to the risk of such attacks and attuned to the tell-tale fingerprints. But they need to have the tools and the digital literacy to recognise, understand and engage with such information-warfare and ‘active measures’ campaigns.

Figure 6: Content identified by Twitter as originating from and spread by the Russian Internet Research Agency during the 2016 US presidential election.
Source: Update on Twitter’s review of the 2016 US election, 31 January 2018, Twitter, online.

Moving beyond social media

DFAT’s use of digital tools needs to extend far beyond social media, however. In the consular sphere, the department now does a good job in engaging with the travelling public through the digital Smartraveller platforms, but it is yet to modernise how it communicates with some of its main clients within the government. 

The Australian diplomatic network’s main form of communication remains the classified diplomatic cable or telegram. This was once one of the best—indeed one of the only—ways of communicating information and analysis from abroad in a timely and secure fashion. But while modern technology has since moved on, and the pace of events with it, the cable system has remained frozen in time. For the demands of the modern ship of state, it’s too slow, too cumbersome and too difficult to access to be of much operational use. It’s thoroughly analogue, is largely internally focused and has a steadily shrinking readership and impact.

DFAT’s continued reliance on this system as its primary means of communication needlessly restricts its audience and increasingly deals it out of policy influence in Canberra, where many of the national security agencies don’t access or don’t bother to read DFAT’s cables. The department is completely out of sync with the working habits and preferences of today’s governing class, and how they wish to receive information. It doesn’t connect easily or widely to other agencies. Consequently, DFAT’s analysis and advice from its overseas network—one of its main value propositions—is underutilised and undervalued, with implications for policy influence, credibility and the contest for finite government resources.

DFAT must create and foster new methods of communication that are timelier, more accessible and more relevant. There should be different information products for different purposes and different audiences, and the cable system should be only one of several ways in which our diplomats convey information and analysis. As just one suggestion, why not create the equivalent of an encrypted Telegram group or closed Twitter feed that allows non-sensitive but time-critical reporting from across the diplomatic network, with a smattering of judgement and analysis, to be accessed by decision-makers in news-feed style from their handheld devices? Figure 7 shows what it could look like: daily headline take-outs from across our diplomatic network, designed for decision-makers without the time, ability or appetite to wade through the cable system (but with links to more comprehensive analysis). There would still be a place for more detailed reporting and analysis (perhaps accessed via links to a secure cloud-based site), but that, too, should be in a form that reflects the habits and preferences of the readership. Newspapers have made the painful transition away from print and towards new media. DFAT should walk the same path.

Figure 7: Illustrative example of a sample DiploFeed from 2018 (fictional infographic only—does not represent the views of DFAT or its posts)

Rethinking diplomacy

We need to rethink how we do diplomacy in the digital age. A diplomatic presence shouldn’t always have to mean an embassy or a chancery, with all the expense and infrastructure and security overlay that entails. Modern-day communication tools are so powerful that we should rightly expect our diplomats to operate more self-sufficiently, just as foreign correspondents do. There are many parts of the world where Australia would benefit from greater diplomatic representation—we have one of the smallest diplomatic footprints of any country in the OECD, after all 15 —but where we have none because the entry costs to establish a full embassy are so high. Digital tools have brought those barriers to entry down. There should no longer be a minimum viable size for an embassy. We should consider an ‘embassy-lite’ or one-person post in countries where we could do with a presence but can’t justify a fully fledged embassy. With DFAT’s ‘pop-up embassy’ in Estonia, Australia has made a small start down this path. We should continue.16

Similarly, we must assess whether states and international organisations are the only external actors that are worthy of a dedicated diplomatic presence. We should look at creating dedicated ambassadors to the tech giants of Silicon Valley, as France and Denmark have done.17 The FAANGs— Facebook, Apple, Amazon, Netflix and Google—are now immensely important international actors in their own right. Together, their market capitalisation is US$3 trillion, but it’s their business model and ubiquity as much as their size that make them key actors for states. We have issues at stake with each of them—from privacy to taxation, from counterterrorism to cyber-interference and national security capabilities. Similarly for the major Chinese tech giants, the BATs (Baidu, Alibaba and Tencent), whose enduring influence might prove to be greater and about which we know and understand far too little.

Why not have ambassadors dedicated to building and managing these critical relationships, which are surely as important as our relationships with some of the smaller countries where we maintain a diplomatic presence?

In order to modernise diplomacy, Australia needs to begin envisaging the diplomatic network in a different way. Whereas in the past the government provided the network and infrastructure for traditional diplomatic interactions, the erosion of that monopoly means this network is at risk of becoming an underutilised asset. The flag and the chancery, the titles and the flummery, still count for a lot, as do the local networks, contacts and expertise, but how do we get more out of those assets?

The answer lies in broadening our conception of an embassy. We should be using our overseas presence as a platform and enabler to advance our interests across a much broader spectrum, and for a much broader set of stakeholders. Trade, economic and commercial diplomacy have always been traditional partners in this respect, but we need to look much further afield. How can we use the overseas network to support collaboration in innovation and research? How can we use our embassies to keep Australia on the cutting edge of public policy? What value or perspectives from overseas can be brought to bear on some of the major challenges in Australian domestic policy? These areas will depend on the complementarities and opportunities that exist, but they shouldn’t be treated as the poor cousins of traditional diplomatic work. The challenge is to conceive of the embassy as a facilitator of productive interaction and a broker of relationships—a creative hub of networks—and to find creative, non-traditional ways to use the overseas network to advance Australian national interests across the full spectrum.

Finally, DFAT needs to adopt some of the nimbleness and agility of the tech world. The bureaucracy is still far too slow to adopt reform and changes, partly because it insists on any changes happening wholesale, only after painstaking deliberation, and in a culture that focuses debilitatingly on downside risk and punishes failure. Why not encourage internal innovation, meaning different ways of delivering the same product? Promote experimentation and differential approaches. Test new platforms and business models. Run some pilots, iterate and adjust, gather the evidence, and see what works best. Don’t insist on homogeneity. Tolerate some screw-ups and failures and learn from them.18 This is the secret to innovation and continuous improvement, and it’s essential if our diplomatic services are to keep pace with the modern world.

Recommendations

  1. Commission an independent review of DFAT’s digital diplomacy efforts.19 The review should examine the department’s digital capabilities, assess the digital operating environment for Australian diplomacy, and make recommendations to improve Australia’s digital diplomacy effort.
  2. Treat digital diplomacy as core tradecraft, rather than optional add-on. Provide compulsory digital platform training for all outgoing heads of mission.
  3. Encourage healthy internal competition and innovation. Generate a monthly scorecard highlighting the best digital performers and posts. Promote and celebrate the successes.
  4. Pilot more sophisticated data analytics tools to analyse and measure impact, reach and engagement—and adjust tactics accordingly. Appoint a Chief Data Scientist to harness and employ data in the service of diplomacy.
  5. Develop and pilot a new stream of diplomatic reporting that’s punchier and timelier and reaches a broader audience on hand-held devices.
  6. Create new positions of ambassador to Silicon Valley (based in San Francisco) and ambassador to China’s tech giants (based in Beijing).
  7. Increase avenues to engage the Chinese public via Chinese social media platforms. This expansion should include dedicated Weibo accounts for the positions of Prime Minister and Foreign Minister.20
  8. Run a pilot of ‘embassy-lite’ or one-person posts. They’ll be more substantial and enduring than the ‘pop-up embassy’ in Estonia but still substantially lighter in footprint than a fully fledged diplomatic mission.
  9. Encourage innovation and experimentation in the conduct of digital diplomacy. Highlight and champion successes. Learn from (but don’t punish) the inevitable failures. Use DFAT’s Innovation XChange in this task, but broaden its focus beyond the aid program and extend its remit into mainstream diplomacy.
  10. Recognise that our overseas network is an underutilised asset. Find creative but non-traditional ways to use it to advance Australian national interests. Conceive of embassies as hubs and connectors for a broad set of interactions. Highlight and promote the strong performers (sending the cultural signal to others).
  11. Create a Twitter account for the Secretary of DFAT to internally signal the importance of digital diplomacy, to provide a further mouthpiece for Australian interests, and to give the public insight into the important work that Australia’s diplomatic service does every day.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.

It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

We thank all of those who contribute to the ICPC with their time, intellect and passion for the subject matter. The work of the ICPC would be impossible without the financial support of our various sponsors.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. Department of Foreign Affairs and Trade (DFAT), Social media, Australian Government, no date, online. ↩︎
  2. See, for instance, Fergus Hanson, ‘DFAT the dinosaur needs to find Facebook friends’, The Australian, 23 November 2010, online. ↩︎
  3. See twiplomacy, online, for rankings across a number of dimensions. ↩︎

Top US China specialist Peter Mattis announced as ASPI distinguished fellow

The Australian Strategic Policy Institute (ASPI) is pleased to announce Peter Mattis – Research Fellow in China Studies at the Victims of Communism Memorial Foundation – as a distinguished ASPI fellow for 2019.

Peter will be spending the next month at ASPI working with the Institute’s different China specialists on a range of research projects.

Peter will also be a keynote speaker at ASPI’s inaugural China masterclass being held on 15 April in Canberra (almost sold out) and 17 April in Melbourne (tickets still available).

Executive Director Peter Jennings says: “ASPI is delighted to attract someone of Peter’s analytical calibre to spend a full month at our institute. Peter has made an enormous contribution to building the world’s knowledge of how the Chinese Communist Party, the People’s Liberation Army (PLA) and China’s intelligence systems operate – both at home and around the world. Peter’s work spans across a broad range of topics, from better understanding PLA activity in cyberspace, to Chinese party-state influence operations, espionage and military modernisation. ASPI is looking forward to hosting Peter so that he can continue some of this important work over the next month”

Peter was formerly a Fellow in the China Program at The Jamestown Foundation where he edited China Brief and was an international affairs analyst for the US Government. He received his M.A. in Security Studies from the Georgetown University School of Foreign Service and earned his B.A. in Political Science and Asian Studies from the University of Washington in Seattle. He also previously worked as a Research Associate at the National Bureau of Asian Research in its Strategic Asia and Northeast Asian Studies programs.

Peter is in Australia from now until 18 April. For media enquiries please contact reneejones@aspi.org.au / 0400 424 323

Agenda for change – 2019

In 2018, many commentators pronounced the rules-based global order to be out for the count. This presents serious challenges for a country such as Australia, which has been an active contributor and clear beneficiary of that order. The government that we elect in 2019’s federal election will be faced with difficult strategic policy choices unlike any we’ve confronted in the past 50 years.

This volume contains 30 short essays that cover a vast range of subjects, from the big geostrategic challenges of our times, through to defence strategy; border, cyber and human security; and key emergent technologies.

The essays provide busy policymakers with policy recommendations to navigate this new world, including proposals that ‘break the rules’ of traditional policy settings. Each of the essays is easily readable in one sitting—but their insightful and ambitious policy recommendations may take a little longer to digest.

Previous Agenda for change publications are also available here: 2016 and 2013.

Launch Event

Building a Safer Internet – Advocate, Validate, Educate

5 February is Safer Internet Day, a global initiative in some 140 countries to raise awareness of emerging online issues. At ASPI’s International Cyber Policy Centre we are pleased to support this initiative.

A safer internet is at the core of what we do. We engage with international and national media on unfolding incidents, events and developments. We regularly organise public events on pressing issues in the online environment that shape strategic policy direction. And we have become very active in the area of capacity-building and exercises: in the Asia-Pacific region and in Australia.

On the occasion of Safer Internet Day 2019, ASPI’s International Cyber Policy Centre is introducing a 3-year project that looks at improving the security of the Australian internet through the adoption of international security standards. These standards are technical means to ensure a secure exchange of information over the Internet. Adoption is voluntary and non-binding and is reliant on goodwill and incentives.

“The Internet Society (ISOC) promotes an open, globally-connected, secure and trustworthy Internet. The use of open standards developed by open processes such as that of the Internet Engineering Task Force (IETF), the premier Internet standards body, plays an important role in achieving this. We welcome initiatives such as these which take a multi-stakeholder approach and aim to strengthen everyday users’ ability to be safe and secure online”, said Rajnesh Singh, Chief, Asia-Pacific Regional Bureau at the Internet Society.

With support from auDA, the policy authority and self-regulatory body for the .au domain space, the International Cyber Policy Centre will develop a public test tool. This tool will validate websites, email accounts and connections against standards that are considered international good practice.

Cameron Boardman, CEO of auDA said: “We are really excited about this cooperation with ASPI. It allows us to build bridges between strategic policy makers, businesses and end-users, and our stakeholders – domain name registrars and operators in the IT industry”.

This initiative draws on examples that International Cyber Policy Centre experts have observed elsewhere and from the Centre’s membership of the Global Forum on Cyber Expertise.

“This initiative by ASPI is a great example of expertise and experience being shared across the global community. The GFCE Internet Infrastructure Initiative aims to share global good practices making best use of state-of-the-art global open internet standards, with support from the Internet.nl portal”, says Maarten Botterman, GFCE project leader.

A safe internet is a community-wide and multi-stakeholder effort. Whether its government, industry, the tech community, civil society or the user-consumer, we all have our own rights and duties. This project will enhance opportunities for proper due diligence by users and consumers, small businesses as well as internet service providers.

Stakeholder consultations meetings are scheduled for February and March 2019; as follows:

MELBOURNE CONSULTATION
Date: Friday 22nd February 2019
Time: 11:00 hrs – 13:00 hrs
Venue: Joint Cyber Security Centre
Level 32, 600 Bourke Street, Melbourne

CANBERRA CONSULTATION
Date: Friday March 1st 2019
Time: 11.00hrs – 13.00hrs
Venue: ASPI Offices
40 Macquarie St, Barton
ACT 2600

SYDNEY CONSULTATION
Date: Monday 4th March 2019
Time: 10:00 hrs – 12:30 hrs
Venue: Joint Cyber Security Centre
Level 25, Tower 2, Darling Park
201 Sussex Street, Sydney

If you would like to participate in building a safer internet, please contact ASPI here.

Australia’s cybersecurity future(s)

It’s January 2024. Does Australia still have the internet?

Introduction

Australia wants to create a future for cyberspace that’s open, free and secure, but that future is not assured. According to Dr Tobias Feakin, the Ambassador for Cyber Affairs, ‘Australia’s vision … and our ambitions across the broad spectrum of cyber affairs are impossible to achieve alone.’1 Key drivers are outside of the country’s control. The government can—and should—advance a positive vision, but Australia might not get its way.

What if the future of cybersecurity looks different from what we hope or expect? This is a hard question to answer. Day-to-day concerns demand our immediate attention, and, when we think about the future, we tend to extrapolate from current trends. As a result, we’re shocked or surprised by discontinuous change, and woefully unprepared to face new realities. The risk is particularly acute in cybersecurity, in which rapidly changing technologies combine with diverse social and political forces to create unexpected consequences. Therefore, as difficult as it is to rethink our assumptions about the future, failing to do so could be dangerous.

This report uses scenario analysis to examine one such future: a world where cyberspace is fragmented in the year 2024. Contrary to the ambition of Australia’s International Cyber Engagement Strategy, cyberspace is neither open nor free in this scenario. We analyse what that implies for cybersecurity. In particular, we examine the challenges and opportunities that Australian policymakers may face in the future and wish they had planned for in our present.

We conclude that Australia will be caught in the fray if the internet breaks apart. While this scenario isn’t all bad, Australia could be forced to fend for itself in an increasingly dangerous neighbourhood. The scenario isn’t a forecast or prediction. It’s a compelling narrative to provoke new thinking and critical discussion about what Australia must do now to prepare for different cybersecurity futures.

Our approach is as follows. First, we explain the methodology. Second, we identify the forces of change that drive this scenario. Third, we interact these drivers to describe one possible world in 2024. Finally, we highlight the strategic choices and challenges that this scenario raises for Australia.

Scenario analysis

Scenario analysis is a methodology for critical thinking about alternative futures. It was pioneered at RAND in the 1950s by Herman Kahn in his attempt to ‘think the unthinkable’ about thermonuclear war. The method was further developed by Pierre Wack and Ted Newland at Royal Dutch Shell, where scenario analysis was credited with anticipating the possibility of oil shocks during the 1970s.2 It’s now commonly used in industry and government. For instance, scenario analysis informs the US National Intelligence Council’s quadrennial Global trends report.3 It’s also applied by the Center for Long-Term Cybersecurity at the University of California, Berkeley, in reports on Cybersecurity futures 2020 and Asian cybersecurity futures.4

The goal of scenario analysis is to ask and, ideally, answer ‘what if’ questions about how different drivers of change—social, political, economic, technological—could combine to produce discontinuities and thus different possible worlds. This approach is forward looking. We apply it to imagine Australia’s cybersecurity environment circa 2024. It may be unsettling. Following best practice, we sought to simplify and then exaggerate the drivers of change in order to throw an alternative and perhaps undesirable future into sharp relief. Nevertheless, scenario analysis is still rooted in reality.

The propositions behind this qualitative analysis are plausible, the narrative is internally consistent, and the results reflect expert consultation.

This report breaks from the norm of scenario analysis by focusing on one of many possible futures.

Our focus is not predictive, however. We do not argue that internet fragmentation is probable or likely to play out as per this scenario. We do suggest that this kind of future is significant because it challenges Australia’s preferred vision for an open, free and secure cyberspace. Fragmentation is also a significant concern in internet policy.5 Furthermore, while it may be a single scenario, a fragmented world contains different environments or ecosystems, and analysing that diversity helps compensate for our focus on only one potential future. The challenges and opportunities of such a future therefore warrant special consideration (just as other scenarios warrant further research). Rather than fight the scenario, we encourage you to ask: What would Australia need to decide and do differently for cybersecurity if it confronts this world in 2024?

Drivers of change

Our scenario depicts the interplay or interaction effects of three hypothetical drivers for change: Asia online, tech giants, and great-power conflict. While none is certain, each premise is plausible. More importantly, the resulting scenario is not a linear extrapolation or forecast based on any single trend. It’s the combination of drivers that could contribute to internet fragmentation and result in a cybersecurity environment markedly different from today’s.

Asia online

First, the number of users, devices and applications in Asia grows substantially over the next five years. We imagine that internet penetration in the region grows faster than expected, jumping from less than 50% today to more than 80%, so that more than 3.5 billion people are online in Asia. As a result, there are as many people online in this region come 2024 as the total number of internet users around the world in 2019. By 2024, Asia is also home to more than 15 billion connected devices.

We assume that this rapid expansion of connectivity is unrivalled in other regions. It roughly correlates to Asia’s youthful and growing population, as well as its economic power as the new centre of the global economy. However, economic and political opportunities remain unevenly distributed over the next five years, as is the region’s digital transformation. Most web traffic in Asia is mobile, but connection speeds vary greatly across the urban–rural divide, and economic growth hasn’t reduced economic inequality.

Tech giants

Second, we posit large and locked-in technology platforms as another driver for change. Although new applications flourish over the next five years, we assume that the underlying technology stacks, layers or platforms upon which those applications are built resemble a few large tectonic plates. And those platforms are increasingly dominated by a handful of huge corporations.

Tech giants dominate the user experience, software development and hardware. For most people in 2024, ‘cyberspace’ is difficult to distinguish from megabrands such as Google, Apple, Facebook, Amazon and Microsoft, or, similarly, Alibaba, Tencent, Baidu, Sina Weibo and Huawei. These companies also dominate the marketplace for talent. Regardless of where they work, most software developers work with toolkits and application program interfaces that plug into a dominant platform. Proprietary software developed by tech giants enjoys a home-field advantage over apps built by third-party providers. Industry concentration shapes hardware and telecommunications infrastructure as well, including the ‘internet of things’ (IoT). On the one hand, we imagine that connected devices are ubiquitous and produced by a plethora of manufacturers in 2024. On the other hand, in many markets, many of these connections are mediated by platforms, hubs and bridges dominated by the ‘Big 10’ tech giants.

Great-power conflict

The third driver is strategic competition and conflict between great powers. We posit a multipolar world in 2024. No great-power concert has emerged to manage territorial conflicts or the myriad state and non-state cyber operations. The US remains the only superpower with global reach, but that reach is rivalled by China’s, especially in the Pacific and Indian oceans. US power projection into the region is further limited by budget constraints (accentuated by an ongoing recession), as well as costly commitments to fighting in the Middle East and deterring a weak but assertive Russia. While NATO endures, nationalism and populism have fuelled extreme swings in American and European politics, fraying the alliance. ANZUS endures as well, but the US lacks a coherent strategy towards Asia in 2024. As a result, the US military posture isn’t supported by consistent political and economic policies.

Meanwhile, China has continued to rise. The Middle Kingdom is a middle-income country in 2024, with a nearly $15 trillion economy. Its One Belt, One Road and Digital Silk Road initiatives have established Chinese infrastructure, standards and platforms in several neighbouring economies. However, this economic and strategic agenda is resisted by India in the south and Russia in the north, along with European and American interests in Africa and Oceania. We posit that the Chinese economy has not dipped into recession, although its officially reported growth rate of 3% in the last quarter of 2023 is viewed with considerable scepticism. In China, as elsewhere, economic angst and nationalism have increased variability in foreign policy and contributed to competition and conflict in the region.

2024: Fragmented world, fragmented internet

In this scenario, Asia comes online but cyberspace fragments by 2024. Years of mounting tensions between the US, China, Russia and Western Europe have combined with entrenched platform technologies to result in a world where the internet—singular—is a thing of the past. The ‘World Wide Web’ is anachronistic. Instead, there are several weakly connected internets, each of which contains content and services that are largely inaccessible from outside the same country, region or bloc. There are tunnels through these walled gardens, but few users beyond specialists, spies and criminals have the skill or inclination to use them. Most users’ online access and experience is mediated and monitored by whichever tech giants enjoy official sanction in their local market. In most places, ‘social media’ are just media, and the IoT is just things.

The world’s largest internets are American and Chinese. Access to each correlates with physical proximity to the US or China, coupled with the broader user base of their respective tech giants. In particular, the American internet is accessible in most of the Western Hemisphere (corresponding to the American and Latin American regional internet registries). It’s also accessible in Western Europe, but tensions across the Atlantic have combined with divergent data protection and antitrust regulations, fuelling the emergence of a continental internet in the remnants of the European Union. Russia’s national internet is effectively cordoned off by internal information controls (heightened following the death of Vladimir Putin), combined with external blocking of untrusted traffic (Russian IP addresses being equated with criminal or intelligence operations and rejected by most border routers). National networks have also emerged in North Korea, Saudi Arabia and Venezuela. In addition to indigenous applications, the governments that regulate these and similar shards of cyberspace typically contract with Chinese or American firms to build platforms that are closed and customised for local censorship and surveillance.

Figure 1: Internets of the region, 2024

Enter the dragon

Like the Belt and Road Initiative, or the Nine-Dash Line, geography is a notable feature of the Chinese internet in 2024, which is portrayed as several concentric circles. Domestic services and content sit at the centre, behind the Great Firewall. China’s ‘Social Credit’ system hasn’t proved particularly effective in regulating behaviour offline; a goth-like fashion trend dubbed ‘false negative’ has even emerged to frustrate facial recognition. Nevertheless, China has become a nearly cashless society, and both big data and artificial intelligence are used to effectively monitor most online activity. The incidence of malware has decreased dramatically, and domestic cyber incident response is well coordinated.

Some cybersecurity experts worry that foreign intelligence services are exploiting the backdoor access required by China’s regulation of commercial encryption, yet the government denies any such allegation.

Outside the Great Firewall, similar services and content are available to those individuals, organisations and countries that use the platforms provided by China’s tech giants (or their local affiliates). Many do, particularly in Asia. By default, users in this second ring give their data to Chinese service providers.

Most of that information is stored on servers inside China. The outermost ring consists of custom networks that China has built but for which—purportedly—it has handed information controls over to the client, such as for the heavily restricted mobile apps recently launched in North Korea.

The Western Front

For many users in the US, the American internet in 2024 appears similar to the World Wide Web in 2019. A similar set of tech giants from Silicon Valley and Seattle dominate the market. Their proprietary platforms seem to seamlessly integrate users’ digital lives. Toddlers are frequently reported to perceive voices such as Google Home and Amazon Echo as disembodied members of their families. Data breaches of personally identifiable information are so common as to rarely make news; occasionally, car fleets and wired housing developments that have been bricked by cyberattacks make headlines. Net neutrality remains contentious and partisan. Demands from law enforcement for data collected by bystanders’ wearable tech during the Denver bombing in 2022 have ignited another round of debate over encryption (a debate joined by lobbyists for fintech and cryptocurrencies).

Lobbying by tech giants, fractious domestic politics and anti-statist ideology limit US federal regulations on cybersecurity. One exception is wireless broadband. A government-sponsored, industry-led consortium has rolled out a mobile network called US5G. Chinese companies are banned from building this infrastructure. Likewise, Chinese and Russian cybersecurity software is banned from use on US Government computers. The Security and Exchange Commission has also imposed reporting requirements on cryptocurrencies and initial coin offerings. Domestic information sharing has improved modestly after years of concerted attacks against critical infrastructure, but individual users still have little recourse, and the quality of cyber insurance is variable. US diplomats pay lip service to ideas such as ‘internet freedom’ and ‘cyber norms’ when they criticise authoritarian regimes, but the promotion and practice of the American internet abroad is largely determined by the commercial strategies of its tech giants.

Figure 2: The US5G logo

Fault lines

Asia is a contested zone in 2024. The US and China vie for power in the region while Chinese and American firms compete for market share. Unfortunately, the US and China appear caught in the ‘Thucydides trap’, as the rising and ruling powers jostle near the brink of armed conflict.6 War was narrowly averted in 2022 following a naval skirmish in the South China Sea that killed 65 sailors and marines aboard American and Chinese warships. Patriotic hacking—both state-sanctioned and self-radicalised—during this incident was intense and occasionally destructive. Since then, submarines have been reported patrolling undersea cables in the Pacific. In addition, real and imagined instances of Chinese and American firms facilitating offensive cyber operations by military and intelligence agencies have driven yet another wedge between their rival internets.

On the one hand, countries in the Indo-Pacific enjoy more choice than those in the Western Hemisphere, since the American and Chinese internets are both viable options in this region. Some countries are choosing to bandwagon with China. In 2024, Alibaba, Tencent, Baidu, Sina Weibo and Huawei are providing a bundle of telecommunication, media, IoT and financial services called WeConnect. This bundle has proved remarkably popular in Malaysia, for instance, and among the Chinese diaspora across Asia. WeConnect has also increased internet access in Myanmar and Cambodia by an order of magnitude: millions of their people have leapfrogged from having no phones to using Chinese smartphones overnight. In contrast, Japan uses the American internet as a matter of policy, and most users in Indonesia and the Philippines remain locked into Facebook and Google. India is non-aligned (despite the prevalence of American platforms), and Pakistan is hedging its bets (despite widespread adoption of WeConnect). Competition and choice between American and Chinese internets are fuelling digital innovation across the region.

On the other hand, innovation in this scenario is not improving global integration. Choosing one internet increasingly means forgoing access to others. Chinese and American cybersecurity standards are not compatible. Nor is compatibility of much interest to the tech giants. Years of national tariffs, investment restrictions, divergent regulations and export controls have limited their sales in the others’ domestic markets. Combined with the US5G network, these policies have forced American firms to shift away from Chinese suppliers. Similarly, the ‘Made in China 2025’ initiative has made Chinese tech giants more self-sufficient. The US–China skirmish in 2022 accelerated the disintegration of once highly integrated supply lines and manufacturing. When competing for customers in Asia, the tech giants are incentivised to collude within their own internet and exclude foreign rivals.

Moreover, the range of choice in this region comes at considerable cost. While some aspects of cybersecurity have improved inside Chinese and American internets, those improvements are lost in the mixing zones between them. Cheap, outdated and counterfeit technologies are most vulnerable, enabling cybercrime in 2024 to cost Asia as much as $3 trillion per year. Ransomware, DDoS by IoT botnets, cryptocurrency fraud, industrial espionage, election interference—all are common, especially at the local level. Diverse technology limits the spread or scale of most attacks, but it also provides criminals with many smaller targets of opportunity outside the Great Firewall. Jumbled laws across different jurisdictions also provide safe haven for state and non-state actors to launch attacks and hide ill-gotten gains. In this scenario, data protection isn’t imagined to be a top priority for hundreds of
millions of people who are coming online for the first time. Even more than the American internet, the Chinese internet in 2024 owes its success to users willing to forgo privacy in exchange for access and convenience. The appetite for adopting digital technologies in this contested environment is a recipe for legal and illegal innovation alike.

Moving forward: strategic choices and challenges for Australia

The world that we describe would have serious implications for Australian cybersecurity. At least three lessons stand out in our analysis.

Australia will be caught in the fray

In this scenario, China remains the primary pillar of the Australian economy and the US remains Australia’s security guarantor. Australia won’t want to take sides, and with good reason. But the digital economy may prove more sensitive to geopolitical tension than other markets, in which case Australia could face tough choices in cyberspace sooner rather than later.

The costs of choosing either an American or a Chinese internet could be significant, though not equal. Not choosing could be costly as well. While a mediating, brokering or hedging strategy may prove the lesser evil, it may also make Australia the target of intense pressure. Domestic affairs could become a microcosm of fierce regional competition. Potential outcomes include foreign surveillance, censorship and the manipulation of Australian markets, networks and politics. Chinese platforms are particularly suspect, but American technologies aren’t above reproach. How will federal, state and local governments respond in March 2024, for example, if mass student protests in Melbourne are manipulated through WeConnect? How much more difficult will whole-of-government policies and operations be, even at the federal level, if the tensions between cybersecurity and economics become increasingly pronounced?

29 November 2023

Australian Fintech Firm Shuttered:
US Alleges Data Manipulated by China

The Sydney-based cryptocurrency exchange TransPacific Ledger (TPL) was forced to shut down last night, less than a day after the discovery of data irregularities in trading worth more than $1.5 billion.

TPL suspended operations after the firm was implicated in the crash of blockchain backed indexes in the United States. Trading data brokered by TPL may have been manipulated in high-speed transactions between the US and China.

A darling of the Sydney start-up scene, TPL had been seen as a trusted and profitable intermediary between American and Chinese financial markets. ‘We have a sales office in Hong Kong, we’re fully licensed in Australia, and we comply with all US regulations,’ said TransPacific CEO Ed Jones in an interview last month.

However, US cryptocurrency exchanges crashed on Monday when irreconcilable discrepancies were reported across several ledgers. ‘TPL appears to be the common link,’ according to the White House press secretary, ‘but China is behind the bad data.’ US intelligence officials point to recent advancements in Chinese quantum computing, claiming that these computers could hack the authentication protocols behind blockchain. ‘Maybe this was an experiment that got out of hand,’ said one anonymous source.

Beijing brusquely rejected these claims. ‘False accusations accomplish nothing,’ according to one government spokeswoman. Prominent voices in Chinese media are now blaming unnamed criminals in Australia and demanded their immediate extradition.

The Australian Securities and Investments Commission is working with the Australian Signals Directorate in its investigation. Neither agency was available for comment. The ASX lost 5% after news about TPL broke on Tuesday.

Please note: the above is a fictional article created by the authors for the purpose of this report.

By straddling both internets, both networks could be used to push and pull divisions in Australian government and society. Moreover, even if Australia tries to straddle the US and China, other countries in Oceania may decide differently. For instance, how will Canberra respond if Papua New Guinea, Bougainville and Solomon Islands bargain to adopt the Chinese internet in 2024 unless Australia increases development assistance to expand and maintain their undersea cables? In this scenario, Australia will have to decide how much it’s willing to pay for its preferred strategy, both at home and around the neighbourhood.

Internet fragmentation isn’t all bad everywhere

As costly as straddling or choosing between American and Chinese internets would be for Australia, this isn’t a doomsday scenario. Some aspects of cybersecurity stand to improve inside each network. Harmonised standards and coordination across like-minded jurisdictions could improve incident response, information sharing (including vulnerability disclosure), patching and attribution. Technological diversity may increase at the regional and global levels, limiting the scale of any given platform and thus the extent to which attacks spread beyond any given country, region or bloc. Trust inside these networks may improve as well. For example, this scenario imagines that the average American in 2024 is relatively confident about US5G (despite expert debate about whether this network is demonstrably more secure than the Chinese alternative). Real or imagined, these security gains may make joining one club or another an attractive prospect for Australia.

Granted, the security gains inside each network are offset by friction between them. Australian policymakers will also bristle at claims by China, Russia and other authoritarian regimes that strict censorship and surveillance improve the security of their respective internets. Nevertheless, fragmentation or disintegration need be neither chaotic nor absolute. For better or worse, cross-fertilisation and ideological hypocrisy will occur as well, with American companies mirroring some of the practices used by their Chinese counterparts and vice versa.

Thursday, January 4, 2024

Mastercard and Walmart introduce a Social Credit System

Dismissing comparison to China, Walmart claims new system will help its consumers “live better” and “save money” during the US recession.

Please note: the above is a fictional article created by the authors for the purpose of this report.

Australia lives in a dangerous neighbourhood

The concurrent great-power transition and digital transformation of the region could be more turbulent than in any period in recent history. Tech giants will shape this transformation, but their commercial interests diverge from the public interest in Australian cybersecurity. In contrast to powerful corporations, international organisations such as the International Telecommunication Union appear even less impactful than usual in this scenario. Even multi-stakeholder organisations such as ICANN could be coopted or captured by commercial and geopolitical interests.

Tough Choices

Australia isn’t helpless in this environment, but it should prepare to help itself. Looking back, policymakers in 2024 may wish that preparation had started in 2019. Options include redoubling Australian efforts to champion an open, free and secure cyberspace in order to avoid the future imagined here. Advancing regional leadership, investing in capacity building and taking assertive action on shared interests may prove helpful. At the same time, however, policymakers should consider tough choices about cybersecurity in a less benign environment: 

  • Is Australia prepared to play hardball, not only with the US and China, but also with commercial tech giants, in order to advance its national interest?
  • If forced to take sides or straddle the great powers, how should Australia choose, and how can it mitigate the costs of doing so?
  • Even if there’s no defining moment (for example, President Trump or President Xi declaring ‘You’re either with us, or against us’), is muddling through on issues such as encryption in Australia’s national interest, especially if incremental decisions aggregate into a decisive choice?
  • What, if anything, can Australia do to help the next billion users in Asia come online in ways that improve rather than undermine critical aspects of cybersecurity?
  • And will a laissez-faire or, alternatively, compliance-driven approach to domestic cybersecurity suffice or prove lamentable in the years ahead?

These are important questions to answer, regardless of whether or not the scenario that we describe comes to pass. Scenario analysis doesn’t need to provide accurate predictions in order to provoke strategic thinking about the future of Australian cybersecurity.

Acknowledgements

This report was produced in collaboration between the Sydney Cyber Security Network and ASPI’s International Cyber Policy Centre. It was made possible thanks to a research grant provided by the Sydney Policy Lab. We also thank our research assistant Bryce Pereira, as well as the other experts and visionaries who provided helpful comments and feedback.

@SydneyCyber – https://sydney.edu.au/arts/our-research/centres-institutes-and-groups/sydney-cybersecurity-network.html

ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society. It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

We thank all of those who contribute to the ICPC with their time, intellect and passion for the subject matter. The work of the ICPC would be impossible without the financial support of our various sponsors.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2018

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. Department of Foreign Affairs and Trade, Australia’s International Cyber Engagement Strategy, Australian Government, October 2017, 7. ↩︎
  2. For background, see Pierre Wack, ‘Scenarios: Shooting the Rapids – How Medium-Term Analysis Illuminated the Power of Scenarios for Shell Management,’ Harvard Business Review (1985), 139-150; Peter Schwartz, The Art of the Long View: Planning for the Future in an Uncertain World, Doubleday, New Your 1991; Naazneen H. Barma, Brent Durbin, Eric Lorber, and Rachel E. Whitlark, ‘“Imagine a World in Which”: Using Scenarios in Political Science’, International Studies Perspectives 17 (2016), 117-135. ↩︎
  3. For example, see National Intelligence Council, Global trends: paradox of progress, January 2017 ↩︎
  4. Center for Long-Term Cybersecurity, Cybersecurity futures 2020, online; Jonathan Reiber, Arun M Sukumar, Asian cybersecurity futures: opportunities and risk in the rising digital world, Center for Long-term Cybersecurity ↩︎
  5. Among others, see William J Drake, Vinton G Cerf, Wolfgang Kleinwachter, Internet fragmentation: an overview, Future of the Internet Initiative White Paper, World Economic Forum, January 2016, online; Scott Malcomson, Splinternet: how geopolitics and commerce are fragmenting the World Wide Web, OR Books, New York, 2016; Davey Alba, ‘The world may be heading for a fragmented “splinternet”’, WIRED, 7 June 2017 ↩︎
  6. Graham Allison, ‘The Thucydides trap: are the US and China headed for war?’, The Atlantic, 24 September 2015 ↩︎

Online Influence and Hostile Narratives in Eastern Asia – Report

ASPI’s International Cyber Policy Centre wrote a report for the NATO Strategic Communications Centre of Excellence that examined online influence and hostile narratives in Asia.

Eastern Asia — which we define as including East and Southeast Asia — is a region of increasing geopolitical competition with many racial, cultural and societal fractures. With the rapid expansion of inexpensive internet access, these fractures and tensions mean that many states in the region are both vulnerable to, and a source of, hostile information activities that are being used to achieve strategic goals both inside and outside the region.

This report documents examples of hostile information activities that have originated in Eastern Asia and have been targeted in the following countries:

  • Taiwan
  • The Hong Kong-based protest movement
  • West Papua
  • The Philippines

Because these activities often target social media, they have been difficult for law enforcement and national security organizations to police. Across the globe, countries are pursuing different methods of tackling the spread of hostile information activities with differing degrees of success. These approaches can range from law enforcement, temporary internet shutdowns, and attempts to legislate against ‘fake news’ or disinformation, through to wider societal media literacy initiatives.

Read this report, authored by ASPI International Cyber Policy Centre researcher Hannah Smith, here.

Introducing integrated E-Government in Australia

Foreword

With the 2016 distributed denial of service attack on Australia’s first fully digital Census and Centrelink’s 2017 automated debt-recovery system glitches still fresh in our minds, it would be easy to pause in the pursuit of digitising government services.

The reality, however, is that there are compelling benefits to expediting government digital transformation, and the case for change is not simply one of customer convenience.

Deloitte Access Economics has estimated that the federal and state governments conduct 811 million citizen transactions each year. It calculated that lifting the share of transactions performed digitally from 60% to 80% over a 10-year period would lead to government productivity benefits worth $17.9 billion, plus a further $8.7 billion in benefits to citizens. 

But the benefits of integrated digital government services extend even beyond time and resources saved. Data is the fuel for many new business models and, according to OECD measures, right now Australia performs only moderately well compared to international peers, particularly in relation to the availability of open government data.

The OECD has estimated that adopting more data driven decision-making in government has potential output and productivity benefits of 5% to 6% in the US, while improving data quality and access by 10% could increase labour productivity by an average of 14%. That can have additional flow-on effects across the economy. Almost 2 million people are employed in the three levels of government in Australia, meaning that 16% of the country’s 12.5-million-strong workforce is employed in the public sector.

This represents a strategic capability, enabling knowledge and skills transfer across the broader economy. Based on previous productivity gains from technology take-up, that can have significant benefits for Australia’s output. Further adoption of digital technologies across the economy has the potential to add an extra $66 billion to Australia’s GDP over the next five years alone.

So the case for change is clear; the question is really about how to do it. How do we maximise the opportunities, while best protecting citizens’ data and privacy? This policy brief is intended to start that conversation.

Yohan Ramasundara
President, Australian Computer Society

What’s the problem?

Australia was an early leader in the digitalisation of government services, and some Australian Government departments and state governments have continued to innovate and deliver enhanced services online. However, in the global context, Australia has now fallen behind and has so far failed to adopt an integrated approach to e-government that joins up all government services across all three tiers of government. For citizens, this makes life harder than it needs to be and consumes time that could be spent on other things.

For businesses, it increases transaction costs. Although existing user interfaces are logical and user-friendly, there’s still a limited amount of third-stage e-services enabling two-way interactions between citizens and governmental institutions.1 Critical missing pieces inhibiting the flourishing of e-services are a properly functioning digital identity ecosystem and a digital signature.2

What’s the solution?

The Australian Government should launch a consultation with the states and local governments to develop an integrated approach to e-government that joins up all services from all three tiers of government. The model will need to be customised to Australia’s unique circumstances but should be designed to reduce business transaction costs, allow citizens to engage seamlessly with the federal, state and local governments and prioritise citizens’ control and ownership of their data.

A decentralised architecture should be used to ensure there’s no single point of failure and to allow easy and secure integration with existing digital government platforms. The federal government should provide essential enabling systems: 

  • a digital identity (eID)—one has already been developed by Australia Post, and a second is being built, but significant work is needed to allow eID to take root
  • the legal, organisational and technical preconditions for a digital signature—legislation should ensure that the digital signature has equal legal weight to a traditional handwritten signature
  • secure data exchanges between different government IT systems.

Introduction

Integrated Australian e-government would mean that less of citizens’ and businesses’ time would be wasted engaging with government. A digital signature would make official transactions simple: signing contracts or submitting applications could be done in moments. Mindless hassles when moving between jurisdictions (such as swapping licences from one state to another) would evaporate overnight; there would be no need to conduct 100-point identity checks in person, and time-consuming visits to physical government offices would become a thing of the past. In Estonia, where e-government is a national passion, officials estimate that these efficiencies lift annual GDP by 2%.3

While many government departments already have user-friendly online portals, and some states have begun integrating several services within single online platforms (such as Service NSW and Service Victoria4), Australia has yet to attempt a citizen-centric approach that makes citizen and business engagement with all three tiers of government seamless. It also lacks critical enabling systems. The major building blocks needed to achieve an integrated approach to e-government are an integrated government back office and a simple, easy-to-use and secure eID and digital signature. 

That isn’t to downplay the practical challenges of joining up three tiers of government that have historically resisted cooperation or the attention to detail needed to address cybersecurity challenges. Joined-up e-government is nonetheless essential to a high-functioning 21st-century economy and should be attempted.

E-government in Australia

Australia was initially quick to join the global e-government trend, and even developed an international reputation as an early leader in this area (peaking around 1999).5 However, a joined-up approach to e-government wasn’t achieved.6 The success of some large departments, such as the Australian Taxation Office and Centrelink, has depended more on a joined-up ‘front end’ rather than an integrated back end that allows citizens to engage with government seamlessly.7

A national identification scheme (the Australia Card) was proposed in the 1980s. However, the Australia Card Bill generated significant public concerns about privacy and was defeated in the Senate.8 In 2006, Prime Minister John Howard made another attempt with the Access Card,9 before it too was shut down by the Rudd government in 2007.

The Electronic Transactions Act 1999 meant that when entities were required under federal law to give information in writing, provide a signature or produce a document, they could do it electronically.

However, the Australian Government and state and territory governments exempted a large volume of legislation from the operation of the Act. While the Act was an enabler, it didn’t create a ‘unique and un-forgeable identifier that can be checked by the receiver to verify authenticity and integrity and provide for non-repudiation’.10

At the end of the 1990s, the Department of Communications, Information Technology and the Arts was a central player in the coordination of e-government. Two units were created within the department: the Office for Government Online and the National Office for the Information Economy (NOIE), which provided advice and support to the government on internet-specific matters.11 Some of the functions of the NOIE were subsequently taken over by the Australian Government Information Management Office, which was established in April 2004.

However, government departments and agencies had variable reputations, and innovative cross-government projects usually originated from the biggest departments.12 To an extent, that’s still the case, but with more coordination. In general, the major electronic players (such as the Tax Office and Centrelink) and innovative state governments were leading the field, advising central agencies and driving central initiatives.13

In 2016, the federal government established a new agency to manage the government’s digital and ICT agendas: the Digital Transformation Agency (the successor to the Digital Transformation Office, launched in 2015). The agency aims to integrate digital delivery across the federal government and also enhance the transparency of the government’s ICT and digital projects. It covers strategic and policy leadership on whole-of-government and shared ICT and digital service delivery, including ICT procurement policy.14 The Digital Transformation Agenda, coordinated by the agency, foresees agencies and departments delivering ‘a range of initiatives that will provide benefits to all users and improve their digital experience’, including Single Touch Payroll; My Health Record; health payments; trusted digital authentication and verification; whole-of-government platforms; grants administration; and a streamlined online business registration service.15

The Trusted Digital Identity Framework outlines a consistent approach to digital identity in Australia and will be an important component of any integrated approach to e-government.16 Some $92.4 million in funding was secured in the 2018–19 federal budget17 to create the infrastructure that will underpin an eID (Govpass), and the government is aiming to roll out pilot services to half a million users by the end of June 2019.18 This will largely duplicate an eID recently launched by Australia Post called Digital iD. The challenges to the widespread rollout and adoption of eID in Australia are dealt with in a previous Policy Brief.19

States and local councils also deliver a range of services online. A leading actor is the New South Wales Government, which offers a single sign-on service for secure access to government transactions; more than 1.5 million customers have already signed up.20 Victoria is another leader. In May 2016, it released the Victorian Government Information Technology Strategy, which outlines steps the government is taking to improve the security of information and infrastructure critical to the proper functioning of e-government.

At the local government level, the City of Sydney is contributing to the open data movement by making accessible to the public an ever-growing range of data in a number of formats. The datasets provide information on environmental sustainability, transport, arts and culture, facilities, parks and more.21 Opening up data facilitates the creation and management of open services for the private and community sectors, increases transparency and stimulates the economy. It also decreases the number of information requests and reduces administrative workload.

An integrated approach to e-government in Australia

An integrated approach to e-government in Australia would require detailed consultations across all three tiers of government, and with business and the public. However, several principles derived from the experience of others can help frame the approach. 

The once-only principle

The once-only principle (OOP) is central to joined-up government. The EU addressed this in its eGovernment Action Plan 2016–2020, where the foundations for the EU Digital OOP are laid out.22 The OOP requires that individuals and businesses shouldn’t have to supply the same information more than once to public entities (for example, when notifying a change of address). This requires the existence of public-sector interoperability at different levels: organisational, legal and technical. The conceptual model of the new European Interoperability Framework foresees interoperability levels as integral parts of integrated public service governance, meaning that different public administrations work together to meet citizens’ needs and provide public services in a seamless way.23

A decentralised approach

Facilitating secure data exchanges and interoperability between different government agencies doesn’t require the creation of a single database (a so-called superdatabase) that consolidates all data from other databases. In fact, doing that poses serious security risks. A decentralised approach enables different databases and IT solutions in the three tiers of government to ‘talk’ to each other securely and solves the problem of how to integrate the myriad different government databases and systems that already exist. Four key elements underpin this secure exchange:

  • the identification of both the sender and the receiver of the data
  • the encryption of data exchanged to ensure the data is unreadable in case someone intercepts it
  • the time stamping of data transactions
  • a legal audit trail via archiving and logging of electronic records.

In Estonia, X-Road (Figure 1) is a distributed information exchange platform that makes it possible for different systems to communicate across the entire governmental sector.24

Figure 1: Estonia’s X-Road

A digital identity

Digital identity is central to e-government. It serves two main functions: proving one’s identity in the virtual space and verifying virtual transactions. Given the administrative division of Australia into six states and two territories, specific cross-border solutions promise added efficiencies. The EU has taken steps in the direction of cross-border electronic identification and trust services. Its eIDAS Regulation (no. 910/2014) ensures that people and businesses are able to use their own national eID schemes to access public services in other EU countries where such schemes are available. It also ensures the legal validity of digital interactions; that is, they have the same legal status as traditional paper-based transactions. The EU case highlights the need to provide a predictable regulatory environment to enable secure and seamless electronic interactions between businesses, citizens and public authorities. With Australia Post’s Digital iD and Govpass, Australia is laying the foundation for a national eID, although some major questions remain to be addressed.

Privacy

Addressing privacy concerns through a citizen-driven e-government model is important in winning public support for integrated e-government, especially given the history of the failed Australia Card and scandals such as eCensus. Mutual trust is the key to interactions in which the government collects information about citizens and citizens provide their own data to the government. The principles of confidentiality, integrity and accessibility of data are all critical. Building trust between citizens and authorities is at the core of a working e-government model, so considerable emphasis should be put on communicating with citizens about how and for what reason their data will be processed by the government.

One lesson learned from abroad is the value of placing citizens in the driving seat. In Estonia, for example, every time a citizen’s personal data is accessed by a government agency, the individual user can see that access via a log and contest it if they believe it to be improper. Another example from Estonia is related to the right to choose whether to use digital identity or not. Those who do not want to use their digital identity can still use a physical service centre. Australia is also planning an opt-in approach to its new digital identity; however, it may become de facto compulsory if private-sector organisations are able to insist as a condition of service that it’s used (for example, to use online banking). Were that to eventuate, it would raise concerns about anonymity and the ability to not share information.

A joined-up back office

In order to provide easily accessible e-government services across all tiers of government, a joined-up back office is central. So far, the success of some major agencies, such as the Tax Office and Centrelink, depends more on a joined-up ‘front-end’ (the interface between the user and the back office). As Catherine Garner has noted: ‘Improving Australia’s cross-agency collaboration and integration will provide efficient, dynamic systems with greater personalisation and support Australia on its journey to become an e-government leader’.25

Evaluating outcomes from government-funded services

The ability to evaluate outcomes of publicly funded services is an important means of measuring the effectiveness of the government services being provided to citizens. Applying strict privacy and information security practices, there would be value in evaluating outcomes from government spending at the population level, rather than on a simple agency-by-agency basis. There would be community benefits in having the secure, de-identified evidence base made available for approved service improvement and evaluation of government-funded programs and policies.

Other issues

In addition to these guiding principles, Australia will need to resolve a number of other important issues. In summary, they include the need to:

  • ensure secure data exchange and security of data
  • manage the integration process and metadata related to systems and services (a clearly defined and regulated approval process, for example via the Office of the Australian Information Commissioner, is needed for adding new components or new services to ensure smooth integration and the maintenance of security and privacy standards)
  • ensure the right of all citizens using e-government services to easily access information about how government is using their data
  • ensure the right of citizens to decide who can access their data
  • ensure the right of citizens to decide whether or not to use their eID.

Lessons learned from abroad

To implement integrated e-government in Australia, work is needed at several organisational, legislative and technical levels. A few conceptual questions were important when Estonia was developing integrated e-government:

  • The question of how to identify people, businesses and real estate had to be addressed. In order to enable trustable and secure data exchanges between different databases and information systems, some identifiers for people, businesses and cadastral units are needed. In Estonia, ID numbers of people and businesses and also cadastral numbers are regulated by law and implemented in all databases and information systems. This is the precondition for secure and trustable data exchanges between different systems.
  • The digital ID and digital signature are issued by the same process.26 Private keys (for use by the public key infrastructure) are generated by crypto-processor (chip) and aren’t downloadable.27 The eID and digital signature constitute a part of the government-issued and guaranteed infrastructure, which is used by both the private and the public sectors.
  • While an eID is obligatory if a citizen wants to use e-government services, the citizen isn’t obliged to use their digital identity (they can use non-eID-based systems if they prefer).
  • Finally, the citizen is the owner of their own data.28 They can control the use of the data managed by the government. The use of personal data is strictly regulated by law. Everyone can restrict the use of their data by blocking access to it if the law doesn’t specify otherwise.

Another lesson from Estonia concerns back-office integration. Several conceptual agreements underpinned the design of the country’s e-government architecture:

  • Decentralisation: The system is decentralised. There’s no single point of failure, and the central management of the system doesn’t ‘see’ the data, but only whether the system is working.
  • Ease of implementation: The system should be easy to implement. Government institutions shouldn’t need to change their existing systems and processes. Training on the integration of the systems should be offered to all technical experts working in e-government back offices.
  • Neutrality of technology platforms: The integration of systems doesn’t mean that all technical systems use the same platform. Usually, governments use a range of proprietary software platforms as well as open-source solutions and technologies developed by different vendors. Integrated e-government should accommodate those variances.29
  • Security of transactions: Integrity, confidentiality and non-repudiation (the assurance that a party to a contract or a communication can’t deny the authenticity of their signature on a document or the sending of a message that originated from them) should be guaranteed.30
  • Security of data and services: Data and services should be secured so they can be transferred via public networks. The use of the public internet should be enabled, and the development of separate (usually very expensive) government data networks should be avoided.
  • Agile planning and implementation: It’s necessary to avoid large, complex projects and instead develop a comprehensive general architecture that can be divided into small components, while still giving due consideration to security requirements.

Recommendations

We make the following recommendations for the further development of e-government in Australia.

  • Avoid large e-government projects. Agile development can minimise risks, enable faster results and avoid implementation challenges.
  • Establish a properly functioning secure eID and digital signature for each citizen. The eID should be simple and user-friendly, issued by government (similarly to passports) and guaranteed by law. It should be used for both e-government services and business e-services.
  • Back-office integration should be coordinated centrally but done in a decentralised way, enabling secure data exchange between systems connected via the internet. The integration platform should enable the integration of different technical platforms in different locations, in different legal environments and with different organisational set-ups. The integration platform should be as simple as possible and not require changes to existing back-office processes and systems. Process redesign can be done step by step.
  • A citizen-centric model is important to win public support for integrated e-government. It should allow people to control their private data and provide legal guarantees, supported by organisational and technical frameworks. Building trust takes time, so carefully planned communication between the government and citizens is critical, including building up and publicising a track record of competent and secure service delivery. This can be assisted by following basic design concepts and data protection principles when designing the eID and the back-office integration of IT systems.

Integrated e-government offers major benefits to businesses and citizens. It reduces the time and costs associated with transacting with government and with each other and makes life easier. A thoughtful approach to designing integrated e-government (such as decentralisation) will also mean that the risks of a data breach won’t be increased. Australia’s geography and population size don’t present any technical obstacles to rolling out a world-class e-government system.

The move to create digital identities in Australia also suggests growing political momentum to take a more holistic approach to e-government. If it’s citizen-centric, it could help win public support, too.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.


© The Australian Strategic Policy Institute Limited 2018
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.

  1. The online sophistication ranking assesses service delivery against a five-stage maturity model: information; one-way interaction; two-way interaction; transaction; and targeting/automation. The fourth and fifth stages can be referred to as ‘full online availability’. For more information, see Capgemini, IDC, Rand Europe, Sogeti, DTi, Digitizing public services in Europe: putting ambition into action, 9th benchmark measurement, report for the European Commission, December 2010 ↩︎
  2. The release of the South Australian Government’s digital driver’s licence is a useful case study, highlighting what’s possible, but also the critical missing piece for nationally consistent electronic identity and digital signatures, which inhibits the flourishing of e-services. See Department of Planning, Transport and Infrastructure, South Australian driver’s licences to go digital, South Australian Government, 22 September 2017 ↩︎
  3. Charlemagne, ‘Estonia is trying to convert the EU to its digital creed’, The Economist, 6 July 2017 ↩︎
  4. Along with the Australian Computer Society, both the NSW and Victorian governments contributed funding towards this research and the visit to Australia by Dr Arvo Ott. ↩︎
  5. P Chen, RK Gibson, W Lusoli, SJ Ward, ‘Australian governments and online communication’, in S Young (ed.), Australian government communication, Cambridge University Press, Cambridge, 2007. ↩︎
  6. The Australian Management Advisory Committee’s 2004 Connecting government report defined the concept of whole-of-government in the Australian Public Service as follows: ‘Whole-of-government denotes public services agencies working across portfolio boundaries to achieve a shared goal and an integrated government response to particular issues. Approaches can be formal or informal. They can focus on policy development, program management, and service delivery.’ ↩︎
  7. P Dunleavy, H Margetts, S Bastow, J Tinkler, ‘Australian e-government in comparative perspective’, Australian Journal of Political Science, 2008, 43(1):13–26 ↩︎
  8. G Greenleaf, ‘The Australia Card: towards a national surveillance system’, Law Society Journal, 1987, 25(9), online; R Clarke, ‘Just another piece of plastic for your wallet: the “Australia Card” scheme’, Prometheus, 1987, 5(1):29–45. ↩︎
  9. Office of the Access Card, How will the card benefit you?, Australian Government, no date. ↩︎
  10. Attorney-General’s Department, The Electronic Transactions Act 1999, information sheet, no date. ↩︎
  11. Also, in 1997 the new Liberal–National government launched a major central government outsourcing initiative in order to improve private-sector involvement in government. The aim was to outsource IT across the whole federal government. All departments and agencies were forced to outsource their IT operations to one of the largest international IT corporations with an Australian presence. In 2001, following critical reports from the Australian National Audit Office, the initiative was replaced by more conventional procurement methods. However, the same contractors continued to be important players, consolidating the IT market and leaving little expertise within the government, except for the largest departments. See Dunleavy et al., ‘Australian e-government in comparative perspective’. ↩︎
  12. For instance, the Australian Taxation Office enables individual taxpayers and their agents to use the ‘e-Tax’ electronic tax return lodgement facility to prepopulate their tax returns with data provided through Medicare Australia and Centrelink. Dunleavy et al., ‘Australian e-government in comparative perspective’. ↩︎
  13. Dunleavy et al., ‘Australian e-government in comparative perspective’. ↩︎
  14. Eden Estopace, ‘Australia creates new digital agency to oversee government’s ICT projects’, EGov Innovation, 1 January 2016. ↩︎
  15. Digital Transformation Agency (DTA), ‘Whole-of-government transformation vision’, in Digital Transformation Agenda, Australian Government, no date ↩︎
  16. DTA, ‘Consultation’, in Trusted Digital Identity Framework ↩︎
  17. Australian Government, Budget 2018–19, Budget paper no. 1, 1–22 ↩︎
  18. Michael Keenan, ‘Delivering Australia’s digital future’, transcript, 13 June 2018 ↩︎
  19. Fergus Hanson, Preventing another Australia Card fail: unlocking the potential of digital identity, ASPI ICPC, October 2018 ↩︎
  20. Ping Identity, ‘More than 3 million sign up to NSW’s unified SSO portal’, 2018 ↩︎
  21. City of Sydney, City of Sydney open data portal ↩︎
  22. European Commission, EU-wide digital once-only principle for citizens and businesses: policy options and their impacts, 1 February 2017 ↩︎
  23. European Commission, The new European Interoperability Framework, 13 July 2018, online. The DTA also has a ‘tell us once’ principle; DTA, Digital Transformation Agenda ↩︎
  24. For more information about X-Road in Estonia, see Information System Authority, Data Exchange Layer X-Road, Republic of Estonia, 21 February 2017, online; and ‘X-Road’, Cybernetica, online. One video on e-Estonia is ‘Living in a digital society: e-Estonia’, YouTube, 21 May 2015 ↩︎
  25. Catherine Garner, ‘Can Australia lead the world in e-government?’, The Canberra Times, 27 September 2016 ↩︎
  26. More information on eID in Estonia is accessible at ID, online; and ‘Estonian e-identity corner stone: state issued national ID card’, YouTube, 10 July 2013 ↩︎
  27. Key generation is performed on the user’s card and not by a central facility. ↩︎
  28. Under the Archives Act, all data and information held by the government is owned by the government. Intellectual property may be owned by the originator of the data, but not the object within which it’s contained. Legislative changes are in train to expand the definition so that it isn’t just property based. Legal dilemmas beyond the scope of this paper include whether access approval can be separate from ownership and how far that extends. Another is what happens to and who owns personal data if someone dies. ↩︎
  29. Integrated e-government inherently presents a large and attractive target for attack. To mitigate this, the basic systems participating as servers in this environment must meet ASD EPL levels of security compliance, preferably at EAL4+ and OSLSPP. OSLSPP enables full separation of data and processes with high trust. ↩︎
  30. For some systems, such as those using Windows XP, this wouldn’t be possible to guarantee. ↩︎