The US government’s recent ban of Israeli technology firm NGO Group’s Pegasus spyware has significant implications for Australian efforts to regulate digital technologies in the face of new online national security threats.

Putting human rights and democratic freedoms at the centre of US foreign policy was one of Joe Biden’s key election promises. His administration has honoured that promise by blacklisting NSO Group for selling its Pegasus software to governments that used it to abuse those principles. This move put the increasing challenge for states to regulate cyber and digital technologies squarely in the middle of US policy decisions and strategy.

This is a strong statement to the international community, especially given the US’s historical support for Israel. For Australia, it’s particularly significant given Canberra and Washington’s renewed commitment to working together to maintain security in the Indo-Pacific region through the AUKUS agreement, plus their longstanding cooperation as members of the Five Eyes intelligence-sharing arrangement. Australia’s new cross-border communications act, or ‘Cloud Act’, which enables data sharing with partners like the US based on common values, highlights the importance of Australia and the US seeing eye to eye on ethical regulation of digital technology.

Israel is already lobbying the US to remove the ban, arguing that Pegasus is critical to its foreign policy. NSO Group maintains that Pegasus is a national security tool for governments to stop transnational organised crime and violent extremist groups from using the ‘dark’ parts of the internet to conduct business.

The Australian government is not an existing or prospective client for Pegasus. But it used the same justification as NSO Group to pass a swathe of bills significantly increasing the powers of police and intelligence agencies to spy on Australians. In addition to the Cloud Act, legislation was enacted that enables agencies to access encrypted data and to alter data. The speed with which these bills passed the parliament, the uncertain safeguards against scope creep and the rushed consultation with industry sparked serious concerns. The use of the encryption law by the Australian Federal Police in Operation Ironside also raised concerns that Australia could become a policing partner of choice due to the expanded powers and undemocratic government overreach the legislation has allowed. The AFP’s refusal to say how the law’s powers were used further damaged public trust.

Certain conditions and warrants are necessary for Australian agencies to use these laws; it’s not an authoritarian free-for-all in the way Viktor Orban’s government used Pegasus to ‘wage war’ on the media in Hungary. But by overriding Australians’ civil liberties based on arguments about countering unprecedented threats to national security, the government is building a legal framework to enable policing of the internet that’s disturbingly similar to how Pegasus enables spying through the ability to access, decrypt and even alter data in online accounts and apps on devices.

Australia’s laws don’t allow devices to be remotely activated for audio recording. But given the justifications for the powers that have been granted—that new, exceptional threats justify new, exceptional measures—that may yet come.

The problem is not finding new strategies and tools to police cyberspace; those are needed. But when we legalise new security powers based on the argument that a threat landscape is ‘unprecedented’ and ‘exceptional’, it’s difficult to then define what other threats are similarly ‘exceptional’ and what is justified by ‘exceptional circumstances’. We saw this with the pseudo-legal framework built by the George W. Bush administration to allow widespread use of torture during the ‘war on terror’. That policy has been widely condemned on the basis of ethics, international and US domestic laws, and even of yielding actionable intelligence.

If the Morrison government is as serious as the Biden administration is about protecting civil liberties in the digital age, it should spend as much effort on building legal frameworks to regulate and govern the fourth industrial revolution according to democratic principles as it does on policing it. Where is Australia’s equivalent of the European Union’s regulations on data protection and privacy for digital tech, given how quickly we’ve passed these policing bills?

And why is the new artificial intelligence ethics framework for government and business entirely voluntary, when AI products are already being used by Queensland Police to risk-profile possible domestic violence offenders? And that’s despite the well-known limitations of available algorithms to accurately screen police data without exacerbating human bias and discrimination. With the threat this poses to already overpoliced communities, where are the hastily passed bills to protect democratic rights in an age where emerging technologies pose flashy ‘solutions’ with their own ethical problems on implementation?

It’s easy to applaud Washington’s decision to ban Pegasus. But are we not hurtling down a similar path, to the same place, propelled by the same ‘exceptional threat’ argument?

Innovation by authoritarian nations in the ‘grey zone’ is becoming one of the most serious challenges facing contemporary democracies. It has long been recognised that future conflicts might be won before any shots are fired. But knowing that is cold comfort, because authoritarian states are continually evolving their capacity to develop and deploy offensive tools in their cyber-enabled, information and hybrid warfare arsenals.

Meeting this challenge requires democratic nations, including Australia, to reconceptualise how they think about strategy: its core purposes, its main instruments and capabilities, and what success or failure looks like. Democracy’s authoritarian rivals—chiefly China and Russia—play by different rules, have different ideas about vulnerabilities and strengths, and measure outcomes in broad wholistic rather than tight linear terms.

Strategy is a long game and democracies must overcome their tendency to view conflict as an end-state with a precipitating cause, rather than an ongoing phenomenon. Australian Defence Force chief Angus Campbell highlighted this, in a 2019 speech to an ASPI conference on future conflict, by tracing General Valery Gerasimov’s stages of war. Importantly, Campbell noted that Western powers tended to only react when a crisis point had been reached—when the war was already half-won.

Although there’s disagreement about a ‘Gerasimov doctrine’, much like China’s ‘three warfares’, authoritarian states do seem more suited than democracies to longer-term political warfare. Authoritarian leaders don’t have to face periodic elections (or if they do, the outcome is hardly in doubt), which aids continuity in strategic planning and execution. But beyond government structures, both Russia and China have long invested in weaponising political, economic, psychological and social tools for use in grey-zone activities.

This includes using civilian assets for quasi-military means, like China’s military–civil fusion efforts, or Russia’s use of ‘little green men’ and the Wagner PMC group as a transnational proxy defence asset. It also extends to using economic levers as strategic instruments, as witnessed by Beijing’s investment campaigns in the South Pacific, and the Kremlin’s manipulation of gas dependencies in Europe. In the information domain, reflexive control—getting your adversary to act in a way that suits your interests without being aware of it—is coupled with other hybrid tactics like adapting international law, mobilising diasporas, and employing useful idiots and cyber-proxies to spread misinformation and disinformation.

A longer view of conflict gives authoritarian states escalation control, allowing them to dictate the tempo of strategic interaction, and to achieve their objectives by presenting others with a fait accompli—as in the South China Sea and Crimea.

It’s false to argue that the West is helpless against such behaviour. But to combat it more effectively it must learn to intervene earlier, put more effort into ensuring a united approach, seize control of narratives, and be prepared to more frequently use coercive economic and other non-kinetic measures. All of these are necessary from an early stage, rather than eventually offering up sanctions and reprimands as responses to bad behaviour that has already accomplished its objectives. Democracies must act more strategically, and more proactively.

A common lament is that democracies lack freedom of action compared with authoritarian states in countering grey-zone activities because they’re bound by laws and norms. But assuming that the West’s challengers would forever be content to play by those laws and norms too, rather than sidestepping, adapting or ignoring them, remains a glaring oversight. Democracies must be flexible and adaptive.

Russia’s ability, with seeming impunity, to take over Crimea, attempt to kill dissidents abroad, co-opt politicians, bomb munitions depots in the Czech Republic, and launch adaptive cyberattacks and information operations against NATO members serves as a force multiplier. It suggests Russia is strong and assertive while democracies are flat-footed, reactive and incapable of firm united responses. It’s a similar story when Beijing changes the maritime geography of the South China Sea, targets diaspora communities with transnational repression, buys influence in Australian society, and undermines the multilateral trading order with its deliberately bilateral Belt and Road Initiative.

This underscores the need for democracies to find ways to be adaptive without compromising their core values. Indeed, to alter an adversary’s behaviour in the grey zone—to deter it—will require a dynamic process with a variety of partners, rather than a static one in which the game and the players are fixed.

That doesn’t mean that laws and norms are useless, or that the West should abandon them. But it does mean that they’ll be increasingly unreliable as instruments to constrain behaviour, especially in a more fluid environment where varied interpretations of law will allow states to forum-shop to advance their interests.

Like laws, appealing to common values should be done with clear eyes rather than rosy spectacles. In many cases, coalitions to counter authoritarian states will be based on shared threat perceptions, rather than a sense of kinship that some potential allies don’t share (and even sometimes resent). In its recent integrated review, the UK has abandoned the term ‘rules-based order’, stressing that while it seeks to work with democracies, it also will also cooperate pragmatically with those with different values. We shouldn’t fear this. If liberal democratic theory is correct, then the shared habits learned through cooperation will reinforce stability, not undermine it.

Although Australia is a leader in recognising the threat of grey-zone activities, especially in terms of combatting foreign interference, democracies have often been slow to realise that building resilience goes beyond government. Protecting Australia from such pressures can’t be done by regulation and legislation alone. For democracies to successfully insulate themselves from cyber-enabled information warfare, attacks on critical infrastructure, attempts to undermine and fragment their societies, and efforts to marginalise them from their allies requires a whole-of-society effort.

Leaders must shore up public trust in government and democratic institutions and avoid instrumentalising disinformation for political purposes, and civil society must promote information hygiene. The business, industry and education sectors need to become engaged stakeholders in ensuring transparency over hostile foreign influence and cyberattacks.

There are no easy ways to generate democratic resilience, but it is a crucial endeavour. Information sharing—rarely a strong suit for siloed government departments and businesses wary of negative press—will need to become the norm rather than the exception.

Counter-hybrid fusion centres, net assessment capabilities and other long-range tools and methodologies will be critical to building knowledge about vulnerabilities, identifying threat vectors, and devising appropriate countermeasures. So too will the experience of other nations with potentially useful models. These might include the Swedish notion of ‘total defence’, or Singapore’s ‘six pillars’ (incorporating military, civil, economic, social, digital and psychological components).

Taken together, a longer-term view of strategy characterised by earlier intervention, a flexible and adaptive approach to coalitions and partnerships, and a more integrated effort to unify governments with societies are the keys for democracies to effectively meet grey-zone challenges.

The task is not easy, but pursuing it may also help democracies rediscover that their supposed weaknesses—responsiveness, openness to change and the ability to build trust—are their greatest strengths.

Half of Myanmar’s population is under the age of 30, and many of these young people have benefited from their country’s fragile, imperfect democratic transition over the past decade. They know the military’s return to power could reverse hard-won gains in human development and fundamental freedoms. Their future is at stake.

So are their lives. On 27 March, General Min Aung Hlaing used the occasion of Armed Forces Day to claim that the military would protect the people and promote democracy. In fact, it turned out to be the bloodiest day since the military coup on 1 February.

And yet, as a father clutching his dying son poignantly noted, ‘On this day, both lives and futures are being lost.’ With their prospects vanishing before their eyes, tens of thousands of young people have taken to the streets across Myanmar. They are refusing to live without hope.

But the country’s backsliding is already being felt acutely. In addition to Covid-19, Myanmar is confronting a compounding economic crisis. The World Bank’s recent regional forecast shows GDP on track to shrink by 10% in 2021, compared to 6.8% growth in 2019 and 1.7% growth in 2020, when the country was reeling from the pandemic.

Late last year, the United Nations Development Programme’s household vulnerability survey signalled that poor households are being pushed further below the poverty line, while many vulnerable households are being dragged towards it. Even previously financially secure households are facing massive shocks from business closures and loss of employment.

On the streets of Yangon, Mandalay and other cities, Myanmar’s citizens have come to experience these crises in the starkest of terms, with countless personal tragedies unfolding behind the data. Young people are watching employment opportunities disappear as investment plummets. International buyers and factory owners are questioning the viability of their local operations, given the lack of worker safety and security. Unable to guarantee continued production and reliable logistics, many businesses have halted operations entirely. With these closures, even more young people will lose their jobs and meagre livelihoods.

The internet is the lifeblood of this generation, but it has been restricted severely. The suppression of information, free speech and internet access threatens to push Myanmar back into isolation from the rest of the world. But this is happening at a time when a whole generation of young people have come to know what it’s like to enjoy better jobs, freedom of speech, access to information and improved education.

These developments shaped younger cohorts’ values and aspirations, instilling them with a sense of civic consciousness. Their expectations reflect the real possibilities that they had previously seen ahead of them: the potential of a different future from the one their parents had known.

History offers stark reminders of what the young are likely to face. In 1950, Myanmar’s per capita income was higher than that of Malaysia or Thailand. But the following decades of ‘closed-door’ policies resulted in severe underinvestment in the economy and public goods and services, with deep and corrosive effects on human capital. Military rule turned Myanmar from one of the most promising economies in Asia into one of its worst performers.

The parents and grandparents of today’s young people know what it was like back then, and their bitter experience has been recounted to their children and grandchildren. Young Myanmar doesn’t want the clock turned back. They will not be silenced. The 19-year-old taekwondo champion and dancer Kyal Sin (also known as Angel) was wearing an ‘Everything will be OK’ T-shirt when security forces gunned her down in Mandalay. Thousands of young people like her continue to stand on the streets each day, full of defiant optimism as they face the military and courageously demand the country they want and deserve.

As UN Secretary-General Antonio Guterres has stressed, there is only one way forward. The security forces must stop the violence, the generals must return Myanmar to the democratic path by respecting the results of last year’s election (which the National League for Democracy won decisively) and all political prisoners must be freed.

Only then can there be progress on reforms to deliver fair economic development and human rights—including freedom of movement, the right of safe return for refugees and citizenship—and on controlling the spread of the virus. Only a society that invests in its very humanity can be at peace with itself.

As artificial intelligence technologies become more powerful and deeply integrated in human systems, countries around the world are struggling to understand the benefits and risks they might pose to national security, prosperity and political stability.

These efforts are still very much a work in progress. Australia is developing a whole-of-government AI action plan, led by the Department of Industry, Science, Energy and Resources. The department released a discussion paper this year and finalised its call for submissions in November.

In line with the department’s brief, the paper concentrates on the economic potential of AI, while acknowledging the need for a human-centred, ‘responsible’ AI regime. That reflects a push internationally to conceptualise AI in terms of digital human security and human rights.

But AI technologies also have serious implications for national security and geopolitics, which need to be thoroughly explored in any discussion of what an AI framework for Australia might look like.

In any discussion of AI, it’s important to note that definitions of the technology are not settled and the applications are vast. But most definitions circle around the idea of machine learning, the ability of a digital technology not just to automate a function, but to learn from interactions with its environment and optimise a function accordingly.

The AI systems that we need to think about in national security terms include surveillance and profiling, the persuasive AI that pervades digital social networks, predictive algorithms and autonomous systems. It is also important to think about the control of the entire AI supply chain, from the human source of the datasets that AI technologies need to learn from, to research and development and technology transfers, and the effects of AI systems on societies.

But the AI geopolitical picture is now a contested tangle of state rivalry, multinational monopoly growth and public anxiety.

That AI is deeply embedded in the discourse of geopolitical competition is well established. The belief that AI will be the key to military, economic and ideological dominance has found voice in a proliferation of grand AI mission statements by the US, China, Russia and other players.

Whether an AI advantage will deliver pre-eminent power to any one nation is arguable. National control over AI technology still remains elusive in a world of globalised R&D collaboration and supply chains and transnational digital technology companies.

But the perception, at least, has driven intense national economic competition over establishment of global AI-powered monopolies in almost every sector—energy, infrastructure, health, online gaming, telecommunications, news, social media and entertainment—and the enormous data-harvesting power that goes with them.

Governments are also racing to develop AI military technologies like autonomous lethal weapons and swarming technology as well as the AI-enhanced surveillance, communications and data-exploitation capabilities they hope will give their military forces the decisional edge on the battlefield.

At the same time, countries are trying to unwind the globalisation of AI technology in order to control R&D collaboration and technology transfers. Individual nations and alliance systems are beginning to champion their own versions of AI norms and technology bases.

In the process, the huge datasets held by governments, corporations and various data brokers have become a strategic asset. They are coveted as the raw fuel needed to train machine-learning algorithms.

Governments have been actively exploring the ways in which these datasets can be weaponised, how they might be used to create cyber weapons targeting critical infrastructure, influence the information systems of another country, build better profiles of its elites for influence targeting and form a clearer picture of the internal dynamics of a political system.

As these uses continue to be experimented with, how datasets are collected and where they are housed is becoming a national security issue. The decision by the US and others to ban Huawei and break up TikTok can be seen at least partially in this context.

But as the competition for the AI edge heats up, the initial excitement and uncritical embrace of this technology has darkened to a mood of profound unease.

Democratic governments are being forced to grapple with the fact that the AI algorithms that run social media platforms operate to maximise user engagement and encourage behavioural change which can then be sold to advertisers. And these learning algorithms have supercharged the possibilities for what some analysts have termed ‘sharp power’—the manipulation of public sentiment through computational propaganda, disinformation and conspiracism by foreign actors and their domestic proxies.

Deep fakes—synthetic media created with the help of machine learning—can be fun but are becoming another tool in the burgeoning disinformation arsenal. AI-generated disinformation was reportedly used by China to interfere in the Taiwanese presidential election in January, and by partisan operatives to discredit Democratic candidate Joe Biden’s son Hunter ahead of the US election. ​

The past year has at times seemed like a laboratory for demonstrating the malignant effects of AI-driven communications platforms on politics. The corrosive effect on credible governance and institutional legitimacy, in the case of the US, has threatened democratic norms, the ability of the government to mount a credible pandemic response and its reputational power abroad.

Further, the increasing AI-enabled convergence of the physical and digital worlds is constantly creating new infrastructure vulnerabilities. The development of 5G ‘smart cities’—the mass automation of public infrastructure via sensors and learning algorithms—will open up even more avenues for surveillance, data weaponisation and criminal cyber activity, and will provide foreign adversaries with further means to reach into societies at the granular level. The recent discovery of a massive cyber intelligence campaign against US security systems, enabled through a US government software contractor, is a reminder of what’s possible here.

All of this has governments and publics around the world signalling alarm, if not outright panic, about the destructive power of AI platforms. As the year comes to a close, the US has launched anti-trust actions against Google, which will almost certainly survive into a Biden administration. The EU has opened an investigation into anti-competitive conduct by Amazon. This alarm is no longer confined to democratic countries. China is drawing up new anti-trust measures squarely aimed at is own AI behemoths of Alibaba, Tencent and Baidu.

This fight between states and global platforms will be a defining feature of the next decade, as will be the fight for public trust in AI technologies. China’s pioneering work in deploying state-directed, AI-enhanced surveillance provides an illustration of a chilling totalitarian vision of intimate control of individual citizens through their dependence on integrated digital smart systems.

As citizens feel more and more powerless against the growing use of AI, they will increasingly push both governments and platforms to be more ambitious in designing technologies and enforceable regulatory regimes that are centred on the public interest.

By engaging transparently with the high risk to security, democracy and social cohesion inherent in many AI applications, Australia has the opportunity to develop innovative policy that could help set standards internationally.

On 10 November, a journalist with the right-wing news network One America News (OAN) tweeted the unsubstantiated claim that voting technology used in Michigan and Georgia had ‘glitched’ for Joe Biden. Her tweet was retweeted by President Donald Trump.

The post was dutifully marked by Twitter as a ‘disputed’ claim about election fraud. But on YouTube and Facebook, OAN’s claim didn’t receive the same treatment.

Dominion Voting Systems, whose equipment was used in several states, had some technical difficulties on election day. But the suggestion that the technology switched votes to the president-elect has been debunked multiple times.

Yet this falsehood is one of many seeking to cast doubt on the legitimacy of the election in the hyperactive and interconnected ecosystem of cable news, conservative news websites and social media. Conspiracies about dead voters now flow quickly from politicians on Fox News to YouTube. Rumours about switched votes spread from web forums to right-wing blogs to YouTube, and to the president’s own Twitter account.

But despite the quick way such ideas metastasise, social media platforms seem to have largely been moderated during the election as separate islands, with their own domestic rules and norms. Twitter, for example, added a warning label to the OAN reporter’s tweet as part of its policy to add context to disputed claims about the election. At last check, the post had been retweeted more than 71,000 times. Twitter moderators also added the label to an OAN tweet that contained a link to her report on YouTube.

But on YouTube itself, where the approach to election misinformation has been called ‘light touch’, OAN’s video about the claim appeared without any warning notice and was viewed almost 204,000 times. While YouTube says it removes videos that ‘mislead people about voting’—such as those publicising the wrong voting date—views on the outcome of the election are allowed.

The YouTube video travelled further still. It was shared on OAN’s Facebook page, where it received more than 18,000 interactions in the form of reactions, comments and shares, according to the insight tool CrowdTangle.

Before the election, Facebook said it would attach ‘an informational label’ to content that discussed issues of legitimacy of the election, but one did not appear on OAN’s YouTube clip on Facebook. Overall, the YouTube link received more than 40,000 interactions on Facebook. Just under half of those took place on public pages, suggesting it was also shared widely in private Facebook groups, which are difficult for researchers to access.

This inconsistency, while not surprising, is increasingly problematic. The spread of disinformation aimed at discrediting the results of the US election has again underscored that a disjointed approach is ineffective at mitigating the problem, with potentially disastrous consequences for democratic institutions. In an environment where a video removed from YouTube spreads on Facebook—not to mention TikTok, Parler or dozens of other platforms—some may demand a uniform approach.

The platforms do collaborate on some law enforcement and national security issues. For example, all three companies are part of initiatives to share hashes—unique fingerprints for images and video—to stop the spread of violent imagery and child exploitation material.

But coordinated efforts on disinformation have largely focused on removing foreign and state-backed disinformation campaigns. Domestic misinformation and disinformation, which became the main challenge during the US election, rarely evokes similarly unified efforts from the big three, at least publicly.

Pressure is intensifying for the platforms to ‘do something’. Yet forcing all of the major companies to work together and take the same approach could result in what Evelyn Douek, a lecturer at Harvard Law School, has called ‘content cartels’.

Decisions about what stays online and what gets removed often lack accountability and transparency, and, in some forms, coordination could help power accrue to already very powerful companies—especially if there’s no independent oversight or possibility of remediation. ‘The pressure to do something can lead to the creation of systems and structures that serve the interests of the very tech platforms that they seek to rein in’, Douek has argued.

A circuit breaker is needed to stop the cross-platform spread of deceptive or misleading claims, but even the coordinated removal of posts and videos about issues like election fraud raises concerns about false positives and censorship. And if such an approach were applied globally, the platforms could draw criticism for imposing American norms of speech in other countries.

In any case, given the now embedded use of disinformation as a campaigning tool, a where-goes-one-goes-all approach to domestic disinformation is unlikely to be legislated. Any such measure would be interpreted by critics as collusion against a political party or message, even if it’s only labels on disputed posts. And it’s not clear that such interventions even work to halt the spread of misinformation.

The clash of local sensibilities with universal content moderation practices isn’t deterring some countries from developing national regulatory regimes. Australia, for example, is developing a voluntary code on misinformation with digital platforms. The European Union also has a code of practice on disinformation.

But around the world, claims of conspiracy often flow from the very top of government through friendly media channels. Those statements are then digested, edited and posted on YouTube, and the cycle begins again.

Content moderation is therefore only a partial answer to institutional and social failures. Companies like Facebook and YouTube shouldn’t be let off the hook, but better and more moderation can’t be the only way to halt the erosion of trust in elections.

As Douek has pointed out, what we consider a legitimate political campaign and what we consider manipulative is partly a social question, and not one for the platforms alone. That’s because at the centre of these problems are individuals. People’s political loyalties and desires, expressed by their clicks and shares, have helped spread the baseless idea of a voting machine ‘glitch’—albeit people who were being worked on by a fast-moving system of politicians, pundits, mainstream media and social media algorithms in a way that’s calculated to capture their emotions and attention.

And it works. Over the past seven days according to CrowdTangle, posts with the phrase ‘election glitch’ have received more than a million interactions on yet another Facebook-owned platform caught up in the disinformation cycle—Instagram.