Analyse how digital systems change voting, campaigning, participation, governance, conflict, crime, surveillance and policy, evaluate their impacts on specific people and communities, and apply the political context to unseen examples.
Each is in the Digital Society glossary, with every other term in the subject.
Action taken by individuals or groups to bring about political or social change, such as campaigning, protesting, organising boycotts or raising awareness.
The use of algorithms, automation and big data, such as bots, fake accounts and targeted advertising, to spread propaganda on digital platforms.
The use of cyberattacks by non-state groups to cause serious harm, such as loss of life or damage to critical infrastructure, in order to spread fear and achieve political aims.
The use of cyberattacks by a state, or groups acting for it, to damage, disrupt or spy on another state's computer systems, infrastructure or information as part of a conflict.
A law that sets rules for how organisations collect, store, use and share personal data, and gives individuals rights over their data, such as the right to see it, correct it or have it deleted.
The use of digital systems by governments to monitor, control and repress their populations, for example through mass surveillance, censorship, disinformation and internet shutdowns.
The use of digital systems by governments to deliver public services, share information and interact with citizens and businesses, for example through online tax returns, digital identity cards and public service portals.
Describe how digital systems are used in voting, campaigning, formal and informal political participation, political advertising and propaganda.
Outline the organisation and role of local, regional, national and global governing institutions, NGOs and non-state political actors in a digital society.
Explain how digital systems change conflict and war, including cyberwarfare, drones, autonomous weapons and terrorism.
Explain how digital systems are involved in crime and lawbreaking, and in policing it.
Distinguish between targeted surveillance and mass surveillance, and between public policy and private policy.
Analyse the impacts and implications of political uses of digital systems for specific people and communities through the concepts of power, expression, space, systems, and values and ethics.
Evaluate contested claims about digital systems and democracy, including claims about microtargeting, echo chambers and internet shutdowns.
Discuss the Cambridge Analytica and Facebook case, and apply the same method to unseen real-world examples in the political context.
The political context covers the ways that people and communities organise themselves, take part in decisions and govern their societies. Digital systems now shape almost every part of political life, from how votes are cast and counted to how governments watch their citizens and how wars are fought.
The context draws on most of the course content. Campaigns run on data (3.1) and on the algorithms (3.2) that rank and target messages; protest movements depend on networks (3.4) and social media; propaganda uses old and new media (3.5), including
With a free account, Augment remembers where you stopped and what you have practiced.
The use of electronic systems to cast or count votes, including electronic voting machines at polling stations and remote internet voting from a voter's own device.
An environment, online or offline, in which people mainly meet views that repeat and reinforce their own, because they choose like-minded sources and contacts.
The use of hacking for political purposes, such as defacing websites, leaking documents or launching denial-of-service attacks against governments or companies.
An intentional disruption of internet or mobile data services by a government or on its orders, making them unavailable or unusable for a specific population or area, usually to control the flow of information.
A weapon that, once activated, can select and attack targets, including people, without further human intervention.
Attempts by organised groups, such as companies, trade associations, unions and campaign groups, to influence the decisions of lawmakers and officials through direct contact, research, events and public campaigns.
The monitoring of a whole population, or a large part of it, without individual suspicion, for example by collecting the communications data of all users of a network or scanning every face in a public place.
The use of data about individuals to divide voters into small groups and send each group a different message designed to appeal to its particular interests, fears or characteristics.
A non-profit organisation that is independent of government and works for a social, political, humanitarian or environmental cause, for example by campaigning, providing services or monitoring governments and companies.
An individual or organisation that has political influence but is not part of a government, such as a multinational company, an armed group, a hacker collective, a religious organisation or a wealthy individual.
Organised activity by candidates, parties or groups to persuade people to support them, to vote or to back a cause, through speeches, advertisements, events, canvassing and online content.
Any activity by which people try to influence who governs or what governments and other powerful organisations decide, from voting and joining a party to signing petitions, protesting and campaigning online.
The growing distance between political groups, both in their views and in how much they dislike and distrust each other.
The use of algorithms that analyse past crime data to forecast where crimes are likely to happen or who is likely to be involved, so that police can direct their resources.
Communication designed to influence people's beliefs and actions in support of a political cause, often by appealing to emotion, repeating simple messages and presenting selected or misleading information.
Classifying people by personality traits, values and attitudes, rather than only by demographic data such as age and location, often in order to tailor messages to them.
A rule, usually made under the authority of a law, that controls how organisations or individuals behave, together with the bodies and processes that monitor and enforce it.
Low-effort online support for a cause, such as liking, sharing or changing a profile picture, which may make people feel they have helped without leading to real change.
A social media account controlled wholly or partly by software, which posts, likes or shares content automatically while appearing to be a real person.
An organisation that employs people to run many fake or anonymous accounts in order to spread propaganda, attack opponents and create a false impression of public opinion.
The political context divides into four areas, each involving different digital systems, but the same questions apply to all of them. Who gains power, who loses it, who is held accountable, and whose rights are affected? The context map sets the four areas beside the content and concepts that most often explain them.
Political topics are often contested, so a useful habit is to describe each digital system precisely and to present the claims of different stakeholders fairly before reaching a judgement. "Social media influenced the election" is too vague to analyse; "a party bought Facebook advertisements shown only to voters aged 18 to 24 in three marginal constituencies" names the system, the data and the people involved.
Political processes are the activities through which people choose representatives, influence decisions and compete for power, from elections and campaigns to petitions, lobbying and protests.
Voting is the formal way in which citizens choose representatives or decide questions in a referendum. A fair election needs every eligible voter to be able to vote, secret ballots, an accurate count, and losers who accept the result because they trust the process. Digital systems can strengthen or weaken each of these conditions.
The two forms raise different issues. A voting machine in a polling station is supervised by officials, so secrecy and the voter's identity are protected in the usual way. Internet voting removes the polling station, which makes voting easier but makes it much harder to be sure who is voting and that nobody is pressuring them.
India runs the largest elections in the world, and it uses electronic voting machines (EVMs) in every constituency. EVMs were first trialled in a by-election in Kerala in 1982 and were used in all 543 parliamentary constituencies for the first time in 2004. Each machine is a stand-alone, battery-powered device with no network connection, which limits the risk of remote hacking. Since 2019 every EVM has been paired with a voter-verifiable paper audit trail (VVPAT) unit, which prints a slip showing the chosen candidate behind a small window, as the photograph shows.
The paper trail matters because it gives an independent record to check the electronic count against. In April 2024 India's Supreme Court rejected petitions asking for a return to paper ballots or for every VVPAT slip to be counted. Some opposition parties still argue that the sample checked is too small.
Brazil moved to electronic voting in 1996 and has run fully electronic national elections since 2000. Results are usually known within hours, but the machines produce no paper record for each voter. Before the 2022 election, President Jair Bolsonaro repeatedly claimed without evidence that the machines could be manipulated. In 2023 Brazil's electoral court barred him from standing for office for eight years, ruling that he had abused his power by attacking the voting system in a meeting with foreign ambassadors.
Estonia introduced internet voting, called i-voting, in local elections in 2005 and in parliamentary elections in 2007. Voters log in with their national electronic ID card or mobile ID, which proves their identity with encryption keys. During the advance voting period, they can vote as many times as they like online, and only the last vote counts. This rule is designed to protect against coercion: a voter who is forced to vote one way can change the vote later in private. A paper vote at a polling station cancels any online vote.
The bar chart shows how quickly i-voting became normal in Estonia. Supporters point to convenience for citizens abroad, people with disabilities and rural voters. Critics, including independent security researchers, argue that a voter's computer could be infected with malware, that ordinary citizens cannot easily verify the system, and that trust in it divides along party lines. Few countries have followed Estonia. Switzerland suspended its trials in 2019 after researchers found serious flaws in the system offered by its postal service.
Campaigns have always tried to reach the right voters with the right message. Digital systems change the scale and precision of this work. Parties now build databases that combine electoral registers with polling data, past contact with canvassers, and information bought from data brokers. Algorithms then score each voter, for example by how likely they are to vote and how persuadable they seem.
Campaigns also use digital media to reach voters directly, without passing through journalists. In Brazil's 2018 election, supporters of several candidates spread content through large WhatsApp groups. Because the messages are encrypted end to end, the platform could not check or remove false content, and WhatsApp responded by limiting how many chats a message could be forwarded to.
Microtargeting depends on targeted advertising tools built for commerce. A campaign can upload a list of email addresses to a social media platform and show an advertisement only to those people, or to people who resemble them. It can also test hundreds of versions of an advertisement and keep the ones that perform best.
Supporters argue that microtargeting makes campaigns more efficient and helps small parties reach their voters without expensive television advertising. Critics argue that it fragments public debate. When each group sees a different message, opponents and journalists cannot see or challenge what is being said, and a party can make contradictory promises to different groups. The evidence on how much microtargeting changes votes is mixed: some studies find small effects, and others find that tailoring messages to personality adds little to well-chosen general messages.
Participation is usually divided into formal and informal forms. Formal participation follows official, institutional channels. Informal participation takes place outside those channels but may still have strong political effects. The table compares them.
Formal participation | Informal participation | |
|---|---|---|
Examples | Voting, standing as a candidate, joining a party, contacting a representative, submitting to a public consultation, official e-petitions | Protests, boycotts, hashtag campaigns, online activism, citizen journalism, hacktivism |
Digital systems | Online voter registration, government petition sites, e-consultation platforms, party apps | Social media, encrypted messaging, livestreaming, crowdfunding sites |
Strengths | Direct link to decision makers; recognised as legitimate | Open to people without formal power, such as young people and non-citizens; fast to organise |
Limits | Can be slow; can exclude people without the right to vote | Influence on decisions is uncertain; may face repression |
The boundary between the two is not fixed. The UK Parliament runs an official e-petition site. A petition that reaches 10,000 signatures receives a government response, and one that reaches 100,000 is considered for a debate in Parliament. A petition in 2019 asking the government to revoke the notice of the UK's withdrawal from the European Union gathered more than six million signatures, which shows how an informal surge of online feeling can enter a formal channel.
Lobbying is a normal part of democratic politics, because lawmakers need information from the people affected by their decisions, but it becomes a concern when some groups have far more resources than others. Technology companies are now among the largest lobbyists in Washington and Brussels. One 2021 estimate by two European transparency groups put the digital industry's annual lobbying spending in the European Union at about €97 million, more than any other sector.
Digital systems also allow "grassroots" lobbying, in which large numbers of ordinary people contact lawmakers. In January 2012 Wikipedia's English edition went dark for a day in protest against two US anti-piracy bills, SOPA and PIPA; millions of people contacted Congress, and both bills were shelved. The campaign was backed by powerful companies, which shows how corporate lobbying and public activism can combine.
Digital systems lower the cost of organising: a group chat or a hashtag can coordinate thousands of people within hours. The climate movement Fridays for Future grew from one student's school strike in Sweden in August 2018 into global strikes coordinated through Instagram, X and WhatsApp. Organisers estimated that about four million people took part in the global climate strike of 20 September 2019.
During the 2019 protests in Hong Kong, leaderless activists voted on plans in the online forum LIHKG and coordinated through large Telegram channels. An app called HKmap.live, which showed police positions reported by users, was removed from Apple's App Store in October 2019 after criticism from Chinese state media. Through the concept of power, the case shows that platform companies can decide which tools activists are able to use.
Leaderless digital movements are hard to stop by arresting a few leaders and can grow very fast. Without organisations that make decisions, however, they can find it hard to negotiate, agree on demands or keep going once attention fades.
The loose collective Anonymous is the best-known hacktivist group. After Russia's full-scale invasion of Ukraine in February 2022, accounts linked to Anonymous declared a "cyber war" on the Russian government, and Ukraine's government asked volunteers to join an "IT Army" coordinated on Telegram to attack Russian websites. Supporters see hacktivism as civil disobedience; governments treat it as cybercrime, and attacks can harm ordinary users of the targeted services.
At the opposite extreme, slacktivism is low-effort online support for a cause, such as liking, sharing or changing a profile picture, which may make people feel they have helped without leading to real change. The word combines "slacker" and "activism" and is usually critical. The Kony 2012 video, about the Ugandan rebel leader Joseph Kony, was viewed tens of millions of times within days of its release, but the campaign's day of real-world action a few weeks later attracted few people, and Kony was never captured.
Political advertising is paid communication that promotes a candidate, party or cause. Most democracies regulate it, for example by limiting spending, but online advertising challenged these rules because it can be bought quickly, shown to tiny groups and paid for from abroad.
Twitter banned political advertisements worldwide in 2019 (the ban was later lifted). Google limited election advertisements to targeting by age, gender and general location. Meta and Google created public libraries of political advertisements, showing who paid and how much. In the European Union, a regulation on the transparency and targeting of political advertising began to apply in October 2025; it requires labels and limits targeting based on sensitive personal data. Meta and Google both stopped selling political advertisements in the EU rather than adapt their systems to the new rules.
Propaganda is much older than digital systems. It is not always false, but it is one-sided and aims to persuade rather than inform. It overlaps with disinformation, which is deliberately false, and it spreads alongside misinformation, which is false information shared without intent to deceive.
Computational propaganda is the use of algorithms, automation and big data to spread propaganda on digital platforms. Researchers at the Oxford Internet Institute found organised social media manipulation campaigns in 81 countries in 2020, up from 70 the year before. Such campaigns are run by government agencies, political parties and, increasingly, private firms hired to do the work.
The flow diagram shows how computational propaganda is amplified. An organised source creates the message, fake accounts post it, and automated accounts like and share it. Platform algorithms that rank content by engagement then show it to real users, whose sharing can turn it into a trend that news media report.
Two tools are central to this process. A social bot is a social media account controlled wholly or partly by software, which posts, likes or shares automatically while appearing to be a real person. A troll farm is an organisation that employs people to run many fake or anonymous accounts in order to spread propaganda, attack opponents and create a false impression of public opinion.
The best-documented troll farm was the Internet Research Agency (IRA) in Saint Petersburg, funded by the businessman Yevgeny Prigozhin, which ran Facebook pages aimed at different groups of US voters. Facebook told the US Congress in 2017 that up to 126 million Americans may have seen IRA content. In February 2018, a US grand jury indicted 13 Russian individuals and three organisations, including the IRA.
Political polarisation is the growing distance between political groups, both in their views (ideological polarisation) and in how much they dislike and distrust each other (affective polarisation). An echo chamber is an environment, online or offline, in which people mainly meet views that repeat and reinforce their own, because they choose like-minded sources and contacts. It differs from a filter bubble, in which an algorithm narrows what a person sees without them choosing it.
The research is more mixed than the popular story. In 2023 a team of academics working with Meta published studies of tens of thousands of Facebook and Instagram users during the 2020 US election. Switching users from an algorithmic feed to a chronological feed for three months reduced the time they spent on the platforms but did not measurably change their levels of polarisation. Other research shows that polarisation in the USA began rising before social media. The most defensible claim is that platforms can amplify existing divisions, especially through content that provokes anger, rather than create them alone.
Governing bodies are the institutions that make, carry out and enforce collective decisions. They operate at several levels and share influence with organisations that are not governments.
The nested diagram shows four levels of governing institutions, with NGOs and non-state actors acting on all of them. Digital issues cross these levels constantly: a single platform may be regulated by a city, a national government, a regional bloc and a global standards body at the same time.
Level | Organisation and role | Digital examples |
|---|---|---|
Local | City, district or municipal councils provide services such as transport, housing and waste collection | Decide Madrid (2015) and Barcelona's Decidim (2016) let residents propose and vote on spending; FixMyStreet lets residents report local problems such as potholes |
Regional | Groups of states that agree common rules, or regions within a state | The EU's General Data Protection Regulation and Digital Services Act; the African Union's Malabo Convention on cybersecurity and data protection (in force 2023) |
National | Governments, parliaments and courts that make and enforce laws for a country | Estonia's X-Road, which links public databases so citizens give each piece of information to the state only once; national laws on data, platforms and cybercrime |
Global | International organisations created by states, which set standards and coordinate action | The International Telecommunication Union (ITU), the UN agency for digital technologies; Interpol's cybercrime work; the UN Global Digital Compact (2024) |
E-government can make services faster, cheaper and available at any time. In the UN's E-Government Survey, published every two years, small and highly connected countries such as Denmark and Estonia rank near the top.
The benefits depend on access. People without devices, connectivity or digital skills, often older, poorer or rural citizens, can find themselves pushed out of services that used to be available at a counter. Through the concept of systems, linking government databases also means that one breach can expose a whole population's data.
The internet crosses borders, but laws stop at them, and no single body governs it. Some governments, including those of the USA and many European countries, favour a "multistakeholder" model in which companies, engineers and civil society share decisions. Others, including China and Russia, argue for "cyber sovereignty", in which each state controls the internet within its borders. Through the concept of space, the dispute is whether cyberspace is shared or divided into national territories.
NGOs use digital systems in three main ways. First, they campaign. In 2010 a Greenpeace video linking Nestlé's KitKat bars to rainforest destruction for palm oil spread widely online, and within two months Nestlé committed to removing deforestation from its supply chain. Second, they gather evidence. Amnesty International's Decoders project has asked thousands of online volunteers to examine satellite images and documents, and its Security Lab carries out forensic checks on phones suspected of being infected with spyware. Third, they monitor and advocate on digital rights. Access Now, founded in 2009, coordinates the #KeepItOn coalition, which records internet shutdowns around the world.
NGOs are not neutral observers. They have their own aims and funders, and their claims should be checked like any other source. Governments sometimes accuse foreign-funded NGOs of interference, and several countries have passed laws restricting them.
Digital systems have increased the political power of some non-state actors, especially large technology companies. When Twitter, Facebook and YouTube suspended the accounts of US President Donald Trump in January 2021 after the attack on the US Capitol, private companies removed a head of state's main channel of communication. Some people welcomed the decision as a response to incitement; others, including several European leaders, worried that such power should belong to democratic institutions rather than to companies.
War has given another example. In February 2022 SpaceX activated its Starlink satellite internet service in Ukraine, and the Ukrainian armed forces came to depend on it. Its owner, Elon Musk, later said that in 2022 he had refused a Ukrainian request to activate the service near Crimea for an attack on Russian ships, which meant that a private individual had made a decision with military consequences. Other non-state actors include armed groups that run their own media channels, hacker groups that are loosely connected to states, and private firms that sell spyware or disinformation services to governments.
Authoritarian governments combine several digital tools: censorship blocks content, surveillance identifies critics and state-backed propaganda fills the space that independent media leave. These tools are also traded. A 2019 study by the Carnegie Endowment for International Peace found that at least 75 countries were using AI surveillance technologies. Chinese companies were the largest suppliers, but firms based in the USA, Europe and Japan also sold such systems.
The most direct tool is to switch the internet off. An internet shutdown is an intentional disruption of internet or mobile data services by a government or on its orders, making them unavailable or unusable for a specific population or area, usually to control the flow of information. A shutdown can cover a whole country, a single region, or only certain platforms, and it can block access completely or slow it until it is unusable.
The bar chart shows the scale of the problem. In 2024 Access Now recorded at least 296 shutdowns in 54 countries in its first report (304 after revision), and in 2025 at least 313 in 52 countries. Myanmar recorded the most in 2024 and 2025, and India was the leading country for several years before that. In 2024 conflict was linked to 103 shutdowns and protests to 74; in 2025 conflict was linked to 125. Long regional shutdowns have lasted for months: mobile internet in Indian-administered Kashmir was restricted from August 2019 to February 2021, and the Tigray region of Ethiopia was cut off for about two years from November 2020.
YouTubeGovernments justify shutdowns as ways to stop violence, the spread of rumours or cheating in national school tests. Critics, including the UN Human Rights Council, argue that blanket shutdowns are rarely necessary or proportionate. They cut off emergency calls, journalism, schooling, health services and online payments, and they can hide human rights abuses.
Digital systems have changed how wars are fought and who takes part, adding new battlefields, such as computer networks, and new weapons, such as malware and drones.
Cyberattacks can target critical infrastructure, the systems a society depends on, such as power grids, water supply, banks, hospitals and communication networks. Three examples show how this has developed.
Year | Attack | What happened | Why it matters |
|---|---|---|---|
2007 | Estonia | Waves of denial-of-service attacks disabled government, bank and media websites for weeks, during a dispute with Russia over a Soviet war memorial | First attack on a whole country's online services; NATO later set up its cyber defence centre in Tallinn |
2010 | Stuxnet | Malware spread by USB drives damaged up to about 1,000 centrifuges at Iran's Natanz uranium enrichment plant by altering the speed of their motors | First known digital weapon to cause physical damage; widely reported to be a joint US–Israeli operation, though neither state has confirmed this |
2015 | Ukraine power grid | Attackers attributed to the Russian group "Sandworm" took remote control of control systems and cut power to about 230,000 people for up to six hours | First publicly confirmed cyberattack to cause a power cut |
Cyberattacks are cheap compared with missiles, can be launched from anywhere and are hard to attribute with certainty, so a state can deny responsibility. Malware can also spread beyond its target. NotPetya, an attack on Ukraine in 2017 attributed to Russian military intelligence, spread worldwide and caused damage that a White House assessment put at more than $10 billion, including to shipping, pharmaceutical and logistics companies far from the conflict.
The war that began with Russia's full-scale invasion of Ukraine in 2022 is sometimes called the first large-scale drone war. Both sides use very large numbers of small, cheap first-person-view (FPV) drones, many built from commercial parts, to watch and attack targets. Ukraine's government has raised money for drones through the United24 crowdfunding platform, so citizens at home and abroad pay directly for equipment. Because the radio signals that guide drones are often jammed, both sides are developing drones that can finish their approach to a target without a human operator.
A UN panel of experts reported that in 2020 a Turkish-made Kargu-2 drone may have attacked retreating fighters in Libya autonomously. The use of LAWS raises three main concerns. Can a machine reliably tell combatants from civilians, as international humanitarian law requires? Who is accountable if it kills unlawfully? And does removing soldiers from danger make war easier to start? In December 2023 the UN General Assembly passed its first resolution on LAWS by 152 votes to 4, with 11 abstentions, but states remain divided on whether to ban them or only regulate them.
Terrorism is the use or threat of violence against civilians to create fear and achieve political aims. Terrorist groups use digital systems in the same ways as other organisations: to spread messages, recruit members, raise money and coordinate action. The group known as Islamic State (ISIS) ran a sophisticated media operation from 2014, using social media to reach potential recruits around the world. Twitter announced in 2016 that it had suspended more than 125,000 accounts linked to the group.
The term is contested. Most experts distinguish cyberterrorism, which would have to cause harm comparable to physical terrorism, from the far more common use of the internet by terrorists for propaganda and organisation. No cyberattack by a terrorist group is known to have caused deaths, but the risk grows as more infrastructure is connected to networks.
Governments and platforms have responded with new forms of cooperation. After the attack on two mosques in Christchurch, New Zealand, in March 2019, New Zealand's Prime Minister Jacinda Ardern and France's President Emmanuel Macron launched the Christchurch Call, a voluntary commitment by governments and technology companies to remove terrorist and violent extremist content. The Global Internet Forum to Counter Terrorism, founded by large platforms in 2017, shares digital fingerprints (hashes) of known terrorist content so that each member can block copies. Since 2022 an EU regulation has required platforms to remove terrorist content within one hour of a removal order. Critics warn that automated removal can also delete evidence of war crimes and legitimate reporting, and that definitions of "terrorism" can be stretched to cover peaceful opposition.
Laws, regulations and policies, made by governments and by private organisations, decide what counts as a crime, what surveillance is allowed and what platforms must do.
Digital systems are involved in crime in three ways. They are the target of crime, as in hacking and ransomware. They are the tool of crime, as in online fraud and the sale of illegal goods on the dark web. They also produce evidence of crime, such as location records, messages and CCTV footage.
Organised crime has become transnational. In parts of Southeast Asia, criminal groups run "scam compounds" in which trafficked workers are forced to carry out online fraud against victims worldwide; the UN human rights office estimated in 2023 that at least 120,000 people in Myanmar and about 100,000 in Cambodia were held in such operations.
In 2020 French and Dutch police infiltrated EncroChat, an encrypted phone network used mainly by criminal groups, and read messages from tens of thousands of users for months. In the UK alone, the operation had led to more than 3,100 arrests by 2023. Critics questioned the legality of hacking a whole network and of using the evidence in court.
Predictive policing promises to use limited police resources more efficiently. Its critics argue that it can reproduce bias. If a neighbourhood was heavily policed in the past, more crimes were recorded there, so the algorithm sends more officers there, who record more crimes. This feedback loop keeps targeting the same communities, often poorer and minority ones. In 2020 the city of Santa Cruz, California, banned predictive policing, and the Los Angeles Police Department stopped using the PredPol software. Through the concept of values and ethics, the debate sets possible gains in safety against fairness and the presumption of innocence.
Surveillance is the monitoring of people's behaviour, communications or movements, usually by an organisation with power over them. Monitoring is a broader word that also covers checking systems or conditions, such as network traffic.
Targeted surveillance, in contrast, follows a specific suspect, usually with a warrant from a judge. Human rights law generally allows targeted surveillance that is necessary and proportionate, but is far more critical of collecting everyone's data in case it proves useful.
Case | Type | Who was watched | Main issue |
|---|---|---|---|
NSA and GCHQ programmes, revealed by Edward Snowden (2013) | Mass surveillance by democracies | Communications data of millions of people at home and abroad | Secrecy and legality; led to the USA FREEDOM Act (2015), which ended the bulk collection of Americans' phone records |
Xinjiang, China | Mass surveillance combined with detention | Uyghurs and other mainly Muslim minorities, through checkpoints, phone scans, facial recognition and a police data platform | Use of surveillance to control an ethnic and religious group, as a UN human rights office assessment found in 2022; China says the measures counter terrorism and extremism |
Pegasus spyware (Pegasus Project, 2021) | Targeted surveillance, allegedly misused | Phones of journalists, activists and politicians in several countries; a leaked list of about 50,000 numbers included that of France's president | Tools sold for fighting crime used against political opponents |
Governments argue that surveillance is needed to prevent terrorism and serious crime. Critics argue that mass surveillance treats everyone as a suspect, is vulnerable to misuse by future governments, and creates a chilling effect, in which people who have done nothing wrong avoid lawful speech or protest. Through the concept of power, surveillance increases the control of those who watch over those who are watched. A central question is accountability: whether courts, parliaments and a free press can check how the powers are used.
Policy is a broader idea: a set of principles that guides decisions. Public policy is made by governments and public bodies, through laws, regulations, guidance and funding. Private policy is made by organisations for themselves and the people who use their services, through terms of service, community standards, internal rules and professional codes. In digital systems, private policies often affect more people than many national laws, because a single platform's rules apply to billions of users.
The EU's General Data Protection Regulation (GDPR), applied from May 2018, is the most influential example; companies anywhere that handle the data of people in the EU must follow it, and fines can reach 4% of global turnover. Many countries have adopted similar laws, including Kenya (2019), Brazil (in force 2020), China (2021) and India (2023). By the early 2020s, according to the UN Conference on Trade and Development, a clear majority of the world's countries had data protection laws. Laws on paper do not always mean protection in practice: some regulators have few staff, and some laws give governments wide exceptions for security.
The EU's Digital Services Act (DSA), adopted in 2022, is an example of public policy aimed directly at platforms. It applies to all online platforms in the EU but sets the strictest duties for "very large" platforms and search engines with more than 45 million monthly users in the EU. These must assess and reduce "systemic risks", including risks to elections and civic debate, give researchers access to data, keep public repositories of advertisements and explain how their recommender systems work. Fines can reach 6% of global annual turnover. In December 2025 the European Commission issued its first fine under the DSA, €120 million against X, for misleading verification checkmarks, an inadequate advertisement repository and restrictions on researchers' access to data.
Supporters argue that the DSA brings democratic accountability to companies that shape public debate. Critics, including the US government and the companies themselves, argue that it gives officials too much influence over lawful speech.
Private policy can change political life directly. Platforms' community standards decide what counts as hate speech, election misinformation or terrorist content, and their content moderation systems enforce those rules. Companies also make policy decisions about whom they will sell to. In June 2020, after protests over police violence in the USA, IBM left the general facial recognition business, Amazon paused police use of its Rekognition software, and Microsoft said it would not sell facial recognition to US police until a federal law was in place.
Professional codes guide individuals within a profession. The ACM Code of Ethics asks computing professionals to avoid harm and respect privacy; journalists follow codes such as the International Federation of Journalists' Global Charter of Ethics, which requires them to protect sources and correct errors. Such codes have no force of law, but professional bodies can expel members who break them.
Public policy | Private policy | |
|---|---|---|
Made by | Governments, parliaments, regulators, courts | Companies, platforms, professional bodies |
Examples | GDPR, DSA, UK Online Safety Act (2023), national cybercrime laws | Meta's Community Standards, X's rules, app store guidelines, the ACM Code of Ethics |
Legitimacy | Comes from democratic or legal processes (in democracies) | Comes from contracts and users' choice to use the service |
Enforcement | Fines, court orders, criminal penalties | Removing content, suspending accounts, expelling members |
Main concern | Can be slow to adapt; can be used to restrict freedom | Made without public accountability; can change suddenly |
Cambridge Analytica was a political consulting firm founded in 2013 as part of SCL Group, a British company that described itself as an election management agency. It was funded largely by the US billionaire Robert Mercer, and Steve Bannon, who later became chief strategist to President Trump, was a vice president. The firm promised campaigns that it could use data to understand voters' personalities and target them with messages that matched their psychology.
The case became public on 17 March 2018, when The Observer, The Guardian and The New York Times published accounts by a former employee, Christopher Wylie. They showed that the firm had obtained data from tens of millions of Facebook users without their knowledge.
The data flow diagram shows how a personality quiz on Facebook became a political targeting tool.
The app. In 2014 Aleksandr Kogan, a psychology researcher at the University of Cambridge, built a Facebook app called "thisisyourdigitallife" through his company Global Science Research (GSR). About 270,000 people were paid to take its personality quiz and logged in with their Facebook accounts.
The platform rules. At that time, version 1 of Facebook's Graph API (the interface through which apps receive data) allowed an app to collect information not only about the people who used it but also about their Facebook friends, including their likes. Facebook announced the end of this access in April 2014 and closed it in 2015, but data already collected stayed with developers.
The scale. Through friends of the quiz takers, the app gathered data on up to 87 million people, about 70.6 million of them in the USA. The quiz takers had agreed to share data for academic research; their friends had agreed to nothing.
The transfer. GSR passed the data to SCL and Cambridge Analytica, which broke Facebook's rules for developers. Facebook learned of this in December 2015 and asked for the data to be deleted, but did not check that it was, or tell the users affected.
The models. The firm aimed to use psychographic profiling, which classifies people by personality traits, values and attitudes, rather than only by demographic data such as age and location. Research published in 2013 by Michal Kosinski and colleagues had shown that Facebook likes could predict personality traits and political views with some accuracy. The firm combined such predictions with voter files and consumer data.
The messages. Cambridge Analytica worked for the US presidential campaigns of Ted Cruz and Donald Trump in 2015–2016. The intention was to microtarget voters with messages tailored to their predicted personalities, for example messages about safety for anxious voters.
Facebook lost more than $100 billion in market value within days. Its chief executive, Mark Zuckerberg, testified to the US Congress in April 2018 and apologised. Cambridge Analytica and SCL closed in May 2018. A Channel 4 News investigation had filmed executives claiming that the firm had worked on Uhuru Kenyatta's election campaigns in Kenya in 2013 and 2017; the firm said the footage was misleading.
Regulators responded. The UK Information Commissioner's Office (ICO) fined Facebook £500,000, the maximum possible under the law in force before the GDPR. In 2019 the US Federal Trade Commission fined Facebook $5 billion and imposed new privacy controls, and the Securities and Exchange Commission fined it $100 million for misleading investors. In 2022 Meta agreed to pay $725 million to settle a class action by US users. Facebook also tightened access for apps and began requiring political advertisers to verify their identity and show who paid.
YouTubePeople and communities | Impacts and implications |
|---|---|
Facebook users whose data was taken | Loss of control over personal data without consent; most never used the app; risk that the same data could be used again |
Voters in the USA and elsewhere | Exposure to messages they could not see were targeted at them; loss of trust in elections and platforms |
Voters in countries such as Kenya | Campaigns by foreign firms with little local regulation; concern about data-driven tactics in elections already marked by ethnic division |
Facebook (Meta) | Fines, loss of trust, closer regulation; changes to the platform that limited developers and researchers |
Lawmakers and regulators | New evidence for stronger data protection and platform rules; the GDPR began to apply two months later, in May 2018 |
Power. Through the concept of power, the case shows how much control a platform has over the data of its users. Facebook designed an interface that let one person's consent unlock the data of hundreds of friends, and it decided how strictly to enforce its own rules. Cambridge Analytica sought influence over voters who could not see how, or why, they were being targeted. The response showed the power of governments and regulators, but also its limits: the UK fine was small for a company of Facebook's size.
Values and ethics. The central ethical issue is informed consent. The quiz takers consented to an academic study, not to political targeting, and their friends were never asked. A consequentialist might argue that the harm was limited if the targeting had little effect; a rights-based view holds that taking people's data without consent is wrong whatever the outcome. The case also raised the question of whether manipulating voters through their psychological weaknesses is compatible with a free and fair election.
Systems. Through the concept of systems, the harm came from the way several elements fitted together: a permissive platform interface, an academic project, a commercial firm and an advertising system built for precise targeting. No single element was unusual, but together they produced an outcome that none of the users expected.
The effects of Cambridge Analytica on elections remain uncertain. Its own executives conceded in 2017 that psychographic methods had not been used in the Trump campaign, and political scientists doubted that predicting personality from likes was accurate enough to change votes. The ICO's three-year investigation, which ended in 2020, concluded that the firm's methods relied on widely used techniques and found no evidence that it had been involved in the 2016 UK referendum on EU membership beyond initial enquiries.
The case was nevertheless significant, because Facebook's own interface allowed the data collection and the platform did little to check what happened to the data afterwards. A balanced judgement is that the scandal mattered less as proof that elections were manipulated and more as evidence of a system in which personal data could be gathered at huge scale and used for politics with little transparency or accountability. Its lasting impact lies in the regulation and platform changes it helped to bring about, although critics argue that microtargeting and data-driven campaigning continue in less visible forms.
The same method works for any unseen example in the political context. The table sets out six steps and the questions to ask at each one.
Step | Questions to ask |
|---|---|
1. Identify the digital system | What are the inputs, processes and outputs? Which content area does it belong to (data, algorithms, networks, media, AI, robots)? Who designed it, who runs it, who pays? |
2. Place it in the political context | Is it about political processes, governing bodies, conflict, or laws and policies? Which level of government is involved? |
3. Map the people and communities | Who uses it directly? Who is affected indirectly? Who holds power over it? Whose rights are at stake? |
4. Trace impacts and implications | What are the positive and negative impacts? Which were intended and which unintended? What are the short-term and long-term implications? |
5. Apply concepts | Which concept gives the most insight: power, expression, space, systems, change, identity, values and ethics? |
6. Evaluate | Under what conditions are the benefits greater than the harms? Whose claims are strongest, and what evidence would change the judgement? |
Naming the inputs and outputs in step 1 makes it easier to see who controls the digital system in step 5, and step 6 turns a list of impacts into a judgement with conditions.
The second question uses two short sources in the style of the source-based paper.
Source A (written for this practice): "The temporary suspension of mobile internet in the northern districts was necessary to stop the spread of false rumours that were inciting violence between communities. Services will be restored as soon as calm returns. Public safety must come first." (Statement by a national ministry of communications, 2025; a scenario.)
Source B (written for this practice): "For eleven days we could not call an ambulance through the usual apps, pay suppliers or send our children's homework. Shops that depend on mobile money closed. The rumours spread anyway, by word of mouth and text message, and nobody could check them." (Interview with a shop owner in an affected district, published by a digital rights NGO, 2025; a scenario.)
A comparison of two sources is rewarded for a point-by-point structure that refers to both sources throughout, rather than two separate summaries.
I can distinguish between electronic voting machines and internet voting, using India's EVMs, Brazil's machines and Estonia's i-voting as examples.
I can explain how digital campaigning and microtargeting work, and evaluate claims about their effects on voters.
I can distinguish between formal and informal political participation, with digital examples of each.
I can explain lobbying, political movements, activism, hacktivism and slacktivism, with a real-world example of each.
I can define propaganda and computational propaganda, and explain how social bots and troll farms amplify messages.
I can distinguish between echo chambers and filter bubbles, and discuss the evidence on social media and political polarisation.
I can outline the organisation and role of local, regional, national and global governing institutions in a digital society.
I can explain the roles of NGOs and non-state political actors, including technology companies.
I can explain digital authoritarianism and use Access Now data to describe trends in internet shutdowns.
I can explain how cyberwarfare, drones, autonomous weapons and terrorism involve digital systems, using examples such as Stuxnet and the war in Ukraine.
I can explain how digital systems are involved in crime and in policing, including predictive policing.
I can distinguish between targeted and mass surveillance, and evaluate arguments about surveillance by governments.
I can distinguish between public and private policy, and evaluate a data protection law, the Digital Services Act or a professional code.
I can analyse the Cambridge Analytica case through at least two concepts and reach a balanced judgement on its significance.
I can apply the six-step method to an unseen real-world example in the political context.