In the run-up to Iran’s elections last month, the popular audio chat app Clubhouse had a visitor, the country’s foreign minister, Mohammad Javad Zarif. Thousands of Iranians gathered on the invitation-only app to hear one of the country’s most influential politicians speak for hours.
At the same time, social media apps like Twitter and Instagram were full of conversations about the upcoming election. On encrypted messaging apps like Telegram and WhatsApp, more critical conversations were taking place and anti-regime activists were organizing.
These digital tools were empowering activists, inside and outside the country, and offering citizens a window into the workings of government and the unfiltered opinions of others. But the government was peering back.
At the same time as political activity was flourishing, someone inside Iran was running a vast, online surveillance program, in complete secrecy.
In June, Kaspersky, a cybersecurity and software company, announced that it had uncovered a sophisticated cyberespionage campaign against Iranian citizens. The group, which researchers dubbed “Ferocious Kitten,” specifically targeted anti-government dissidents and had the ability to infect phones and computers and capture photographs, passwords and keystrokes. The campaign had been running undetected for six years.
Kaspersky did not directly point the finger at the Iranian government, but the powerful Islamic Revolutionary Guard Corps is known to run cyberspies and has proven adept at developing surveillance tools. The targets of “Ferocious Kitten” appeared to be those hostile to the regime — precisely those using other digital tools to organize ahead of the elections.
This is the political challenge of the digital age. As new and emerging technologies have proliferated, they have empowered individuals and communities. At the same time, they have handed immense power to states and a handful of private companies.
In the political arena, this tension is particularly acute — indeed, it is more like a political arms race, but with the majority of the new technological arsenal being handed to the side that already wields immense power.
Digital tools like the encrypted messenger apps Telegram, WhatsApp and Signal have given activists the ability to organize and communicate in secret, away from the eyes of repressive governments. Virtual private networks allow them to hide their online footprints.
Elsewhere, small organizations are using the power of artificial intelligence to scour video archives for evidence of human rights abuses. In Berlin, in the same building as the open-source intelligence organization Bellingcat, a group called Mnemonic is gathering vast archives of digital evidence of Syrian atrocities, which may prove useful for future prosecutions.
At the same time, states and private companies that work closely with states have gained immense technological weapons in the digital age.
States have the technology to recognize voices and faces, and even the way people walk, not only close up, for example at airports, but over great distances and in crowds. They can monitor dissidents, online and in real life, tracking them, listening to their phone calls, reading messages and stealing private videos for blackmail — even surreptitiously switching on phones to record targets unaware. Artificial intelligence can scan vast quantities of data to seek out specific phrases in text and even use mathematical probability to predict what individuals might do.
As the recent revelations that the Israeli-made “Pegasus” software was used to hack into smartphones of journalists, politicians and human rights activists demonstrate, this technology is being shared and traded. As with Iran’s Ferocious Kitten, Pegasus operated for years in secret.
The spoils of the digital age are not being shared symmetrically. One side is getting more powerful every day.
This fundamental asymmetry of benefits from technology compounds the already inherent asymmetry of power in nation-states, in that governments already wield the traditional tools of control, in the police, the courts and the army. If it seems as if the digital age has weakened governments, and particularly repressive governments, that is only an illusion. Yes, the vast outpouring of people power of the Arab Spring, facilitated by technology, collapsed long-powerful regimes. But as Syria, and now Tunisia, show, the inherent power of governments to control armies and laws allow them to push back
Xinjiang is a particularly illustrative example. There, not only does the government wield traditional forms of control, because it has the organizational ability to build detention centers and the police to round up citizens and incarcerate them, but also has constructed a high-tech prison beyond these detention centers, from gates in cities controlled by facial recognition software to the ability to track the movements of millions of people via their cellphone positions to vast databases of information that can be sifted by AI for patterns deemed “harmful.”
Such tools can also be deployed abroad. Despite the publicity surrounding Russian interference in the 2016 U.S. presidential election, the use of digital tools by nation-states and the shadow operations they enable are still in their infancy. We are, in truth, only at the beginning of this murky new world, which will in time hand vast powers to governments and companies with sufficient resources to utilize them.
It is the convergence of different strands of technology and multiple digital tools that, combined with the money and manpower only governments have, will enable them to better exploit this digital revolution. Individuals, however well armed, will simply be unable to compete.
To see the potential scale, take two entirely separate scenarios and slam them together.
The ability of Russian bots to influence elections has never been quantified. Any interference may have swayed millions of American voters or practically none. What is quantifiable is the level of influence required, the critical mass of voters that need to be persuaded to change the result.
That number is astonishingly small. The Washington Post argued that the 2016 election was effectively decided by just over 100,000 people in three states — or, 0.09%, not even one-tenth of a percent.
Now consider the highly unusual GameStop saga from January this year, when a group of small investors communicating via Reddit managed to pump up the stock price for the video game retailer in such a way that institutional investors on Wall Street who had bet against the company suffered huge losses.
The lesson of the “Reddit revolt” is that even relatively few investors acting at the right moment can hit major institutions hard. Very hard.
By one estimate, institutional investors lost $6.12 billion over the saga — including a loss of nearly $3 billion in one day alone. Another estimate put the losses as high as $20 billion.
Those are the kinds of numbers — small voter margins, vast financial losses — that might tempt a nation-state or a company to utilize digital tools for a disinformation campaign.
Here’s how it might work. Take the disinformation and astroturfing campaign allegedly run by Russia, finesse it with AI able to mimic the writing style of specific individuals learned by sifting through years of their tweets, and throw in some deep-fake images of the self-same individuals created from the hundreds of photographs on their Instagram — or even from videos surreptitiously gleaned from their phones by software similar to the Pegasus spyware.
Multiply that by tens of thousands, or millions, and you have an army. Now imagine that, instead of bots or compromised social media accounts, this army was made up of real people, all of whom believed they were having conversations with their real contacts. Many would, of course, remain unpersuaded or decline to take the requested action. But AI enables the same conversation to be had a million different ways, and only a small percentage need respond.
Deploy that army at a critical, irreversible moment — for example, an election night or the day of a company’s initial public offering — and a nation-state would have an immensely powerful and deniable weapon that could collapse a company or elect a leader.
All that technology already exists and is being used daily for small scams — low-level text message phishing or romantic “catfishing,” where people are tricked into believing they are in romantic relationships but are actually dealing with fictitious profiles. What is missing is the ability to deploy such methods on a vast scale — and only a nation-state could mobilize sufficient resources.
Technology has always been used for control, and digital technology is no different. What is different is the scale of influence and control that the technology offers and that it can be used in such all-encompassing ways that the control may not even be noticeable.
At the heart of this century’s new technology is the promise that humans can be freed from the limits of the physical world, including their physical bodies. Techno-utopians, of the sort that still staff the tech companies of Silicon Valley, believe access to technology could shrink the world and weaken the power of states to control information.
That belief is hopelessly naïve. If anything, new digital tools have handed immense power to governments willing to use them to repress their people or interfere abroad. The development of these tools is only accelerating. Authoritarian governments now have undreamed-of powers to spy, monitor and harass, and even build virtual prisons of communities or echo chambers of information.
Technology may offer activists crumbs of digital power, but it is giving governments the ability not merely to build the walls of their modern bastilles far higher but also to halt the people before they ever even think of storming them.