fr4nç01s

Adversarial Thinking On Democracy

Today, we’ll dive into the world of political science and constitutional law, applying adversarial thinking to the concept of democracy. We’ll explore how democracies and especially their constitutions can be vulnerable to attacks, and how those attacks can be executed without triggering alarms.

Seventy percent. That is the share of democratic backsliding episodes in the post-1994 period. But what is a democratic backsliding ? Democratic backsliding is, at its most basic, “the state-led debilitation or elimination of the political institutions sustaining an existing democracy”.¹

Just governments, using the tools democracy gave them, to quietly dismantle it. No military coup, no tanks. Political scientists call this democratic erosion. In cybersecurity, we have a name for the same technique.

“Scholars agree that contemporary democracies tend to erode gradually and under legal disguise”.^{2 1} Analysing 75 episodes of autocratization of democracies and using data covering all autocratization episodes affecting democracies from 1900 to 2017, Lührmann & Lindberg produced the following chart.

In cybersecurity, this is called Living Off the Land; attackers who avoid custom malware, avoid loud exploits, and instead abuse the legitimate tools already present on the system. The goal is the same: gain privileges, persist, and never trigger the alarm. In the next section, we apply this framework to Hungary, one of the most documented cases of democratic erosion in the third wave.

Case Study: Hungary

In April 2010, Fidesz won 53% of the vote and was awarded 68% of parliamentary seats, a conversion made possible by Hungary’s existing electoral law, designed in 1990 as a mixed electoral system that structurally favoured larger parties, producing disproportionate seat shares. A two-thirds parliamentary majority in Hungary is not a governing margin, it is the threshold required to amend the constitution. But one safeguard to the constitution remained, a requirement that any entirely new constitution would need four-fifths approval. Fidesz identified a logical flaw, the amendment procedure did not protect itself from the very majority it was designed to constrain and used a two-thirds vote to delete the four-fifths rule. Then wrote a new constitution alone.^{3 4}

This exploited a logical flaw in the amendment procedure itself. But it raised a question: are there people who audit constitutions for vulnerabilities?

The answer is yes and no. The Venice Commission exists to provide legal advice on constitutional law to its member states.⁵ They use a tool called the Rule of Law Checklist, a vulnerability checklist for constitutional democracies, structured as questions rather than assertions.⁶

In security, a principle I kept returning to was this: to defend effectively you must stop looking at your own perimeter and start looking at the enemy’s incentives and processes.⁷ Is that mentality applicable to democracy?

The Hungary case suggests it should be. The Venice Commission’s Rule of Law Checklist is a serious and carefully constructed instrument, and some adversarial thinking does exist in constitutional theory. But it seems to remain marginal. The dominant approach still asks whether protections exist, not whether those protections can be circumvented, captured, or deleted.

That is the end of this first analysis. Applying adversarial thinking to non-trivial systems have been really simulating, especially diving into the details of political science and constitutional law, two fields I had no prior knowledge of. I had a great next idea of modeling constitution as software and try to analyze the control flow of it (to check for potential vulnerabilities), but I think I’ll save that for another time. For now, I hope this was an interesting read and that it sparked some thoughts on how we can apply adversarial thinking to other domains.