Plato 21

On a spring morning in 399 BC, several hundred Athenian citizens gathered in the open air to decide whether one of their own should live. There were about five hundred of them, ordinary men chosen by lot: potters, farmers, veterans of the wars.¹ The defendant was Socrates, seventy years old, a stonemason's son who had spent his life stopping people in the marketplace and asking them to define the words they used most confidently. Justice. Courage. Piety. He wrote nothing down, claimed to teach nothing, and simply asked questions until the certain grew unsure of themselves.

The formal charges were two: impiety, meaning a failure to honor the city's gods, and corrupting the young.¹ Both were vague, and both were political. Athens had recently lost a long war to Sparta, endured a short and brutal oligarchy, and clawed its democracy back. Socrates had needled the crowd's competence for years and had mentored men who then betrayed the city. The trial was, in part, a reckoning dressed as a religious complaint.

He was convicted by a narrow margin. Plato, who sat in the audience, later recorded that a shift of just thirty votes would have acquitted him, a split of roughly 280 against 221.² Athenian trials had a second stage: each side proposed a penalty and the jury chose between them. The prosecution asked for death. Socrates, invited to name his own punishment, first suggested that the city ought to reward him with free meals, as it fed its Olympic champions, before grudgingly offering a small fine. The insulted jury voted for death by a wider margin than it had used to convict him, about 360 to 140.² Weeks later he drank a cup of hemlock, a slow poison, and died among his friends.

What matters here is not the martyrdom but the mechanism. Athens was full of sophists, teachers who sold the craft of persuasion for a fee and trained ambitious men to win any argument regardless of whether it was true. They had taught the city that a clever speaker could make the weaker case look like the stronger one, that words were instruments of victory rather than of discovery. Socrates' accusers used those instruments well. A skilled speech, aimed at a frightened crowd, turned an eccentric old man into a danger to the gods.

Plato was in his late twenties, and he never got over it. The day became the wound at the center of Western political thought: the first mature democracy, following its own rules to the letter, had voted to execute the one man who insisted on asking it hard questions.

The system did not malfunction. It worked exactly as designed.

A quarter of a century later, Plato wrote the book that has shadowed the argument ever since. The Republic is many things at once, a theory of justice and a blueprint for an ideal city, but underneath all of it runs the memory of the trial. Its animating fear is plain: a system that lets the crowd decide will tend to reward whoever is best at pleasing the crowd, not whoever is most likely to be right.

Plato dramatized the danger with an image that has outlived nearly everything else in the book, the ship of state. Picture a vessel whose sailors brawl over who should take the helm, each certain he deserves it, none of them having studied navigation, while the one man who actually reads the stars is dismissed as a useless dreamer. A ship run that way sails onto the rocks.³ He traced a darker sequence too. A democracy, drunk on its own freedom, grows disorderly; a leader steps forward who flatters the people and feeds their resentments; and that leader, the demagogue, meaning one who wins power by inflaming popular passion, hardens over time into a tyrant. The people vote away their own liberty because someone made servitude sound like strength.

“The excess of liberty, whether in States or individuals, seems only to pass into excess of slavery.”

Plato, Republic, Book VIII (trans. Benjamin Jowett)

Plato's student Aristotle was less apocalyptic and far more empirical. In the Politics he sorted real constitutions by how they actually behaved, and his verdict on democracy came out mixed rather than damning. Rule by the many could be stable and just, he found, but it decayed in a predictable way, when demagogues learned to feed the assembly whatever it wanted to hear and bent public decisions toward flattery and away from the common good.⁴

It is worth being fair to the record they were reacting against. Athenian democracy was not a failure. It governed a major power for the better part of two centuries, produced the theater and philosophy and architecture we still study, and proved more durable than its critics predicted. Plato and Aristotle were wrong about a great deal, and the alternatives they preferred, rule by a trained elite, produced their own catastrophes across the centuries. The point is narrower and sturdier than "democracy is bad."

The point is that democracy has a known failure mode, and both men named it at the very start: it can be captured by whoever is best at engineered persuasion. For the twenty-four centuries that followed, that vulnerability stayed mostly theoretical, because moving an entire population required something rare, a gifted orator, a controlled press, a charismatic leader who happened to come along at the right moment.

That constraint, the scarcity of persuasive talent, is exactly what our own century removed.

The ancients diagnosed the disease and prescribed nothing that worked. Two thousand years passed before anyone tried to build a democracy that could survive its own known failure mode, and the attempt began not with a revolution but with a book.

In 1748 the French magistrate Montesquieu published The Spirit of the Laws, and folded into it was an engineer's idea. If power gathered in one set of hands always tended toward tyranny, then the cure was to divide it, to split the making of laws, the enforcing of them, and the judging of them into separate hands that could check one another. Virtue could not be relied upon; structure could.⁵ It was the first serious answer to Plato's objection, and it inverted the question: not "how do we find better rulers," but "how do we build a machine that survives bad ones."

The Americans built it first. The constitution drafted in Philadelphia in 1787 was, more than anything, a device engineered for distrust. Its authors did not assume their leaders would be good; they assumed some would be dangerous, and arranged the branches of government so that each could frustrate the others. James Madison, its principal architect, stated the premise without flattery.⁶

“If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government would be necessary.”

James Madison, The Federalist No. 51 (1788)

Two years later, France ran the same experiment without the brakes. The Revolution of 1789 opened with a declaration of universal rights and, within a decade, had passed through the Terror, a stretch in which the revolutionary government executed thousands in the name of the people, and out the far side into the arms of Napoleon, a general who crowned himself emperor and had the crowd ratify it by plebiscite. Liberty had curdled into exactly the tyranny Plato foretold, and it had done so in roughly ten years.⁷ The difference between Philadelphia and Paris was not the ideal. It was the engineering underneath it.

It is worth being concrete about what filled the streets, because it was not principally philosophy. By 1788 the French crown was effectively bankrupt: after decades of war, including its costly backing of the American Revolution, roughly half of royal revenue went to servicing the national debt.⁸ The tax system that might have closed the gap did the opposite, exempting the wealthiest orders, the clergy and the nobility, and falling hardest on the commoners who could least afford it. Then the harvests failed two years running, and by the summer of 1789 a single loaf of bread could take up to 88 percent of a laborer's daily wage.⁸ The crowd that Plato feared does not assemble over ideas. It assembles over bread, and the persuaders arrive afterward.

The century that followed was a long debugging. In 1848 a wave of revolutions swept the continent, the "Springtime of Peoples," demanding constitutions and the vote; most were crushed or reversed within two years, and France's fresh republic dissolved once more into a second Napoleonic empire.⁹ The franchise widened in fits, first to propertied men, then to all men, and only near the century's close did the first national votes for women appear.¹⁰ Each extension was contested, each reversal instructive. What the economists Daron Acemoglu and James Robinson, in Why Nations Fail, would later call “inclusive” institutions, the kind that spread power rather than hoard it, were not designed once and installed. They were tested, broken, and patched, election by election, country by country.

This is the truer story of democracy's rise. It did not descend as an ideal whose wisdom peoples finally recognized. It was a technology, debugged in production, under load, with real failures and real casualties, and for a long time no one could be sure it would hold.

Theory became history in the twentieth century, and the history is more specific than the theory. Democracies, it turns out, mostly do not die the way Plato pictured, in a sudden seizure by the mob. They die in two recognizable ways, and the second often disguises itself as the opposite of the first, because it wears the clothing of the law.

The starkest case is Germany. In the national elections of 1928 the Nazi Party won 2.6 percent of the vote, a fringe. Four years of economic collapse later, in July 1932, it took 37.3 percent and became the largest party in the Reichstag.¹¹ Adolf Hitler did not seize power by force. He was appointed chancellor on 30 January 1933 through ordinary constitutional procedure, by conservative leaders who believed they could control him. Two months later, on 23 March 1933, the parliament passed the Enabling Act, a law that handed the cabinet the authority to make laws without the parliament's involvement. The vote was 444 to 94.¹² A freely elected legislature had, by a lopsided majority, voted itself into irrelevance. Only the Social Democrats voted no; the Communist deputies were already in custody and could not vote at all.¹³

Those vote shares tracked the economy almost exactly. Germans had already watched money itself die once: in the hyperinflation of 1923, the mark fell until a single US dollar was worth about 4.2 trillion of them, erasing savings, pensions, and middle-class security in a matter of months.¹⁴ The brief recovery that followed was broken by the Great Depression, which pushed German unemployment to around 30 percent, close to six million people, by 1932, the year the Nazi vote peaked.¹⁴ Into that wreckage the party sold an explanation: the disaster was not economic but a betrayal, the work of Jews, foreigners, and the "November criminals" who had supposedly stabbed the nation in the back. Economic pain converted into the blame of an out-group is among the oldest accelerants of the process, and it did its work here.

The second classic death is the coup. On 11 September 1973, the Chilean military bombed its own presidential palace, overthrew the elected government of Salvador Allende, and installed a dictatorship under General Augusto Pinochet that would last seventeen years.¹⁵ For much of the century this was the archetype of democratic collapse: tanks in the street, a radio announcement, a general in dark glasses.

But the modern pattern is quieter, and it is the one that matters now. The political scientists Steven Levitsky and Daniel Ziblatt describe it as death by a thousand legal cuts. An elected leader who has won a real election begins to dismantle the system from inside, packing the courts with loyalists, buying up or bullying the independent media, and rewriting electoral rules to tilt the field, each step defensible on paper.¹⁶ Hungary after Viktor Orbán returned to power in 2010, and Venezuela after Hugo Chávez was elected in 1999, became the textbook cases: no tanks required, and no single moment you could point to and call the coup. By the time the system was hollow, every brick had been removed lawfully.

The common thread across all three is unsettling. Democracies are rarely murdered by outsiders. Far more often they are turned against themselves, their own elections, courts, and legislatures becoming the instruments of their undoing. It looks less like an assault from without and more like an autoimmune disease, in which the body's own defenses attack the body.

The procedures built to protect the system are the same procedures used to take it apart. That is what makes the failure so hard to stop: at every step, the paperwork is in order.

Out of the wreckage came two thinkers who changed the question itself. Neither was a politician. One was a philosopher of science, the other an economist, and between them they rebuilt the case for democracy on ground the old critics had never stood on.

Karl Popper published The Open Society and Its Enemies in 1945, writing it in exile as the war ground toward its end. His move was to reject Plato's founding question. Plato had asked who should rule, and every answer to that question, Popper argued, ends in tyranny, because each one assumes some person or class is wise enough to be trusted with unchecked power. The better question was almost the reverse: how does a society get rid of bad rulers without bloodshed? Democracy, in Popper's reframing, is not a machine for finding the wisest leader. It is an error-correction machine, a system whose whole genius is that it lets a people remove a failing government peacefully and try again.¹⁷

Popper added a warning that has only sharpened with time. A society built on tolerance faces a paradox: if it extends unlimited tolerance to those who are working to destroy tolerance itself, the tolerant will eventually be overwhelmed, and tolerance will vanish with them. A free society therefore cannot grant unlimited freedom to the forces bent on ending freedom.¹⁸ It was a precise description of what Weimar Germany had just failed to do.

The second thinker attacked from an unexpected direction. In 1951 the economist Kenneth Arrow published a short, forbidding book, Social Choice and Individual Values, containing a proof that unsettled everyone who read it carefully. Arrow's impossibility theorem showed that no method of combining individual rankings into a single group ranking can satisfy a handful of mild, obviously fair conditions all at once, conditions as basic as "if every voter prefers A to B, the group should prefer A to B" and "no single person gets to decide for everyone." With three or more options on the table, every conceivable voting rule breaks at least one of them.¹⁹

This is easy to misread, so be careful about what it does not say. It does not mean democracy is pointless, or that all elections are frauds. It means something more precise and more useful: there is no perfect voting system, only trade-offs, and the way those trade-offs are designed has real consequences. Above all it means the result depends enormously on the inputs, on which options reach the ballot, in what order they are considered, and what the voters have been led to believe.

Arrow had proved that the machine has no ideal setting. The persuasion engines of our own century would take that lesson and run with it, reaching for democracy not by its output but by its inputs.

Step back far enough and democracy's entire history fits on a single rising-and-falling line. For most of human existence the line sits on the floor. Around 1800, essentially no country on earth ran on free and competitive elections with a broad franchise; the world was a patchwork of monarchies and empires. By 1900 there were only a handful of even partial electoral democracies, and most of those still excluded women and the poor.²⁰

Then came the waves. The political scientist Samuel Huntington described democratization as arriving in three great surges, each followed by a partial retreat. The first wave rose slowly, from about 1828 to 1926, as suffrage widened across the West. The second ran from 1943 to 1962, as the defeat of fascism and the unwinding of empire produced new democracies from West Germany to India. The third began in 1974, when Portugal's dictatorship fell, and swept through Spain, Greece, Latin America, Asia, and Africa.²⁰ Its climax was the collapse of Soviet communism after 1989, which converted much of Eastern Europe almost overnight.

The counting bodies caught the climb. By the mid-2010s the number of electoral democracies had reached its all-time peak, well over ninety countries, more than at any point in recorded history.²¹ It was easy, standing at that summit, to mistake the ascent for a law of nature, as though history had a direction and the direction was toward freedom.

It did not.

“Above this race of men stands an immense and tutelary power, which takes upon itself alone to secure their gratifications, and to watch over their fate. That power is absolute, minute, regular, provident, and mild.”

Alexis de Tocqueville, Democracy in America, Vol. II (1840), trans. Henry Reeve

The third wave was never gravity. It was a run of wins, and runs of wins end.

The line in the last chapter stopped climbing around 2016, and it has been falling since, with the fall steepening. The retreat has a lead case, and it is the one the whole world watched. For two and a half centuries the United States was the reference implementation of Madison's machine, the standing proof that a constitution engineered for distrust could hold. Between 2016 and 2026 it became something more useful to this book: a live demonstration of exactly which parts of that machine were load-bearing, run in the open, with every result published. The demonstrator was Donald Trump, and what matters to this book is not his biography but what his decade proved, because leaders on every continent were taking notes.

The first discovery came early. Through his first term the written rules mostly held; what gave way were the unwritten ones, the habits no statute enforces: that a president concedes when he loses, tolerates investigation, and treats the press as an adversary rather than an enemy. Levitsky and Ziblatt, whose diagnosis of democratic death by law appeared three chapters ago, wrote that book during his first two years in office, and their conclusion was structural. The American constitution had never run on parchment alone; it ran on two soft norms, mutual toleration and institutional forbearance, and both were being spent down.¹⁶ The finding generalizes, which is why it belongs here: every democracy is a set of laws wrapped around a set of habits, and the habits are the part an ambitious leader can defect from unilaterally, at no immediate legal cost.

The second export was a vocabulary. "Fake news," the phrase he made ubiquitous, became the most successful piece of political language of the century so far. By 2019 the publisher of The New York Times counted more than fifty prime ministers, presidents, and other heads of government, across five continents, who had adopted the term to justify measures against their own press; leaders in Hungary, Turkey, China, the Philippines, and Cambodia cited it while moving against their own journalists.²² This is the liar's dividend of Part I, distributed in advance as a franchise: a ready-made license to reprice any inconvenient truth as partisanship. No influence operation ever mounted against the world's democracies has spread faster or cost less.

Then came the stress test proper. Having lost the 2020 election, he declined the concession that the machine's designers had assumed, and the courts absorbed the challenges, dozens of suits dismissed for lack of evidence.²³ So he searched for a softer joint and found it in the people who operate the count, one official at a time.

“I just want to find 11,780 votes, which is one more than we have.”

Donald Trump to Brad Raffensperger, Georgia secretary of state, 2 January 2021²⁴

Raffensperger refused. So, each in turn, did county certifiers, state legislators, judges (many of them his own appointees), and finally his own vice president, asked on 6 January 2021 to reject certified electors while a crowd summoned for that date broke into the Capitol. Notice the grain of what held. It was not "the institutions" in the abstract. It was particular people in particular chairs declining, one at a time, to do what was asked of them. The system's antibodies turned out to be individuals, and individuals can be counted, named, and, given time, replaced.

The sequel established exactly that. Four indictments, one felony conviction, and a second impeachment later, he won the 2024 election, and this must be said plainly: lawfully, through the front door, with a real plurality of voters carrying him back. The demand was as genuine as anything in this book. The pending federal cases were then withdrawn under the Justice Department's own rule against prosecuting a sitting president, and the one conviction produced, in the end, an unconditional discharge, a sentence of nothing, because he had won. On the first day of the new term he pardoned roughly 1,500 people convicted of or charged over the attack on the Capitol, commuting the sentences of the militia leaders among them.²⁵ Read as law, the pardons closed fifteen hundred files. Read as precedent, which is how every ambitious politician on earth read them, they rewrote the lesson of January 6th retroactively: the penalty for attacking a transfer of power is now known to be temporary, refundable in full at the next election. Popper's error-correction machine, three chapters ago, rests on the assumption that removal is final enough to matter. The demonstration showed the assumption can be beaten. Lose, deny, return, erase.

The choreography traveled as fast as the vocabulary had. On 8 January 2023, almost two years to the day after the Capitol, supporters of Jair Bolsonaro, who had lost Brazil's presidency after months of pre-emptive fraud claims, stormed the congress, the supreme court, and the presidential palace in Brasília, a restaging so faithful that newspapers on both continents printed the two scenes side by side.²⁶ Election denial has since become a standing option in the loser's repertoire on every continent. The innovation was never the lie, which is ancient. It was the demonstration that a first-rank democracy could not durably punish it.

The second term turned the first term's failures into a syllabus. The officials who had refused in 2020 had defined, by refusing, exactly which chairs mattered, and the new administration set about filling them on the explicit criterion of loyalty, the hiring essays and revived Schedule F that reappear in the Interlude. In its first week it dismissed at least seventeen inspectors general, the executive branch's internal auditors, in one late-night action that skipped the notice the law required.²⁷ In June 2025 it federalized California's National Guard against the governor's objection, the first deployment of the Guard over a state's opposition since 1965, and sent Marines into Los Angeles.²⁸ In September 2025, days after the president publicly directed his attorney general to prosecute three named adversaries, a grand jury indicted the first of them, the former FBI director who had once investigated him.²⁹ Each of these moves has a number in the Interlude: purge the professionals, criminalize the opposition, personalize loyalty. And each was contested in court, sometimes successfully. The point is not that the script ran to completion. The point is that the world's most closely watched democracy was now visibly running it, with the paperwork, as always, in order.

Abroad, the demonstration subtracted as it taught. For eighty years, whatever its hypocrisies, the United States had been the third wave's scaffolding: the example, the funder, and the enforcement mechanism of last resort. In July 2025 the agency that carried most of that work was formally dissolved, more than four of every five of its programs terminated and the remnant folded into the State Department.³⁰ The government that had once lectured the world about stolen elections now supplied every autocrat's closing argument, that if the oldest democracy does it, the criticism is hypocrisy. The scorekeepers registered the change: Freedom House had already cut the American score by eleven points across the 2010s, and in 2026 recorded the country's lowest score on record.³¹

The retreat is not an accident of the calendar, and it is not a pendulum that will swing back on its own. It is the erosion playbook from a few pages ago, run in country after country, elected leaders using lawful tools to hollow out the very systems that put them in office.

Be careful with the ending, because as of this writing it has not ended. The United States of 2026 is not an autocracy. Courts still rule against the government and are, so far, mostly obeyed; elections are scheduled and held; the press, lawsuits and license threats notwithstanding, still prints what it likes. The machine has absorbed severe stress before and may absorb this. What the decade settled is not where the country ends up. It is what the demonstration taught everyone else.

Strip the person away and three legacies remain for the democracies that come after. A vocabulary, free to any leader anywhere, for repricing truth as partisanship. A precedent, established in the hardest jurisdiction on earth, that attacking the count is survivable, and that survival can be total. And a proof, the one this book most needs the reader to hold, that the demand side of the demagogue's bargain was fully in place before the supply side arrived: everything in this chapter was accomplished with a telephone, a feed, and a single persuasive human voice, the scarce talent Plato feared, occurring once. Part I describes what happened when that talent stopped being scarce. First, the next chapter takes the patient's vitals, and every symptom on the chart predates him, was worsened by him, and now awaits the machines.

This is the body the new technology is about to enter, and it is not a healthy one. Well before artificial intelligence became a factor, the democracies most exposed to it were already showing a cluster of chronic conditions, the political equivalent of a weakened immune system.

Start with trust. In 1958, when American pollsters first asked the question, about 73 percent of citizens said they trusted the federal government to do the right thing most of the time. By September 2025 that figure had fallen to 17 percent.³² A society in which five of every six people distrust their own government is a society primed to believe the worst about any official account of anything.

The institutions that once helped citizens tell truth from rumor have thinned out badly. The United States has lost more than a third of its newspapers since 2005, roughly 3,300 titles, closing at a rate near two and a half every week, leaving whole counties with no professional local reporting at all.³³ Into that vacuum flows social media, whose ranking systems are tuned not for accuracy but for engagement, which in practice means whatever provokes the strongest reaction.

Meanwhile the electorate has sorted itself into mutually hostile camps. In 1994, fewer than one in five Americans held a "very unfavorable" view of the opposing party; by 2022, about 58 percent did.³⁴ When the other side is not merely mistaken but loathsome, persuasion stops being argument and becomes something closer to tribal warfare, and a tribe at war is easy to mobilize and hard to reason with.

Beneath these conditions sits the oldest pressure of all, the material one. Wealth has concentrated toward the top while the pay of a typical worker has come loose from the economy's output, American productivity growing roughly three and a half times as much as that pay since 1979,³⁵ and, as in every prior chapter, anxiety about immigration has hardened into the all-purpose explanation for who is to blame.

Put the diagnosis together. A population that no longer trusts official sources. A collapsing supply of shared, verified facts. An attention economy that rewards outrage over accuracy. An electorate divided into camps that regard each other as enemies. Each condition, on its own, is survivable; democracies have carried versions of all of them before, and lived.

What is new is what arrives next. For twenty-four centuries, the failure mode Plato named at the trial of Socrates, capture by engineered persuasion, was held in check by a single accident of nature: persuasive talent was scarce. That scarcity is now ending.

The global chart says the same thing the domestic numbers do. The V-Dem Institute, a Swedish research project that scores every country in the world on the quality of its democracy, reported in 2026 that autocracies again outnumber democracies, 92 to 87, for the second year running. It found that about 74 percent of the world's population, some six billion people, now live under autocratic rule, and that the share living in full liberal democracies has dropped to roughly 7 percent, the lowest level in half a century.³⁷ By the institute's central measure, the amount of democracy the average person on earth experiences has fallen back to where it stood in 1978, erasing, it warned, nearly the entire third wave.

A system already immunocompromised is about to meet an industrial-strength version of the exact pathogen that nearly killed it at birth.

Two days before Slovakia voted, a recording appeared that could not be recalled.

On 28 September 2023, an audio clip spread across Facebook and Telegram. In it, a voice resembling Michal Šimečka, leader of the liberal Progressive Slovakia party, appeared to discuss buying votes from the Roma minority and manipulating the ballot with Monika Tódová, a well-known journalist at the independent outlet Denník N. The conversation never happened. The file had been assembled with artificial intelligence, software that can synthesize a person's voice from samples of their real speech, and stitched into a fabricated exchange.³⁸

The timing was the weapon. Slovakia observes a 48-hour moratorium before polls open, a quiet period when parties, candidates, and media are expected to suspend campaigning. The clip landed inside that window. Šimečka and Tódová both denounced it as fake within hours, and fact-checkers flagged the audio as likely manipulated. But the rules meant to protect the vote from last-minute noise now protected the forgery instead. The people best positioned to correct it were the ones the moratorium told to stay silent.

The fake was not sophisticated. Analysts described it as crude, its splices audible to a trained ear. That mattered little. Detection is slow and quiet; a shocking clip is fast and loud. By the time anyone could say with authority that the recording was synthetic, it had already been heard, shared, and half-believed.

Progressive Slovakia lost. Robert Fico's Smer party, running on a pro-Russian and anti-Western platform, finished first and returned to government. It is not possible to prove the clip changed the result, and researchers who later studied the episode cautioned against treating it as the decisive cause.³⁹ Slovak and international observers connected the wider disinformation environment to pro-Kremlin networks, though attribution of the clip itself was never conclusive.⁴⁰

The lesson was narrow and durable. For the first time in a European election, a synthetic recording of a candidate reached voters at the one moment the system was built to keep quiet, and the correction could not catch up. The old safeguards, written for a slower kind of lie, had a gap in them. The gap was now cheap to find.

The next case arrived by telephone, in a voice that sounded like the president of the United States.

On 21 January 2024, two days before the New Hampshire primary, roughly 20,000 residents received an automated call. The voice was Joe Biden's, or a close synthetic copy of it, and the message was voter suppression dressed as friendly advice. Save your vote for November, it said, and do not turn out on Tuesday.⁴¹ The script even borrowed one of Biden's verbal tics, "what a bunch of malarkey," to sound authentic.

Investigators traced the operation quickly. A Democratic political consultant named Steve Kramer admitted commissioning the calls, saying he had wanted to draw attention to the dangers of AI in elections. He had paid a magician to generate the audio with a commercial voice-cloning tool, and the job reportedly took less than half an hour. The calls were routed through a Texas-based carrier, Lingo Telecom, with spoofed caller ID that made them appear to come from a local Democratic operative.⁴²

The response set precedents. On 8 February 2024, the Federal Communications Commission issued a declaratory ruling that AI-generated voices count as "artificial" under the Telephone Consumer Protection Act, the 1991 law that governs robocalls. In plain terms, cloning a voice to place unconsented automated calls was now clearly unlawful, and state prosecutors had a tool to act.⁴³ The FCC later proposed a six-million-dollar fine against Kramer and a two-million-dollar penalty against Lingo Telecom. New Hampshire brought criminal charges: thirteen felony counts of voter suppression and thirteen misdemeanor counts of candidate impersonation.

Two features of the episode would recur. First, the barrier to entry had collapsed. Impersonating a head of state to tens of thousands of voters no longer required a studio or a broadcaster. It required a consumer app and a few dollars. Second, enforcement worked, but only after the fact. The ruling, the fines, and the charges all arrived after the primary was over. The calls had already been made and answered.

Kramer said he had done it as a warning. Whatever his real motive, the warning was accurate. What one consultant did as a stunt, others could do quietly, at scale, and without leaving a name attached. The system caught this one because he was not trying to hide.

2024 was the largest election year in recorded history. More than sixty countries went to the polls, and roughly half of humanity, some four billion people, lived somewhere holding a national vote.⁴⁴ It was also the year the ability to fabricate any face or voice became an ordinary campaign tool. Many expected a catastrophe. What arrived was subtler.

In India, the world's largest election, synthetic media became infrastructure. Parties cloned the voices of their own candidates to place tens of millions of personalized calls, each addressing a voter by name.⁴⁵ Dead leaders returned to the trail: in Tamil Nadu, the DMK party revived its long-deceased patriarch M. Karunanidhi in generated video to praise the living. Some of this was disclosed and some was not, and the line between a slick advertisement and a deception was often left for the voter to draw.

In Indonesia, the eventual winner, Prabowo Subianto, a former general with a contested human-rights record, remade himself through an AI-drawn cartoon avatar, plump and smiling, aimed at first-time voters with no memory of the 1990s.⁴⁶ Elsewhere in the same campaign, a deepfake resurrected the dictator Suharto to endorse his old party.⁴⁷ The European Parliament elections that June passed with scattered synthetic incidents but no single decisive fake.

The apocalypse that had been forecast, an election plainly stolen by one perfect deepfake, did not happen anywhere in 2024. Researchers who tracked the year found the fakes numerous but rarely decisive, more often crude propaganda than precision fraud.

The real damage was quieter and harder to legislate. As voters everywhere learned that any clip might be fake, they acquired a new license to disbelieve clips that were real. Scholars call this the liar's dividend: the payoff a guilty public figure collects by dismissing genuine evidence as AI.⁴⁸ A true recording of a politician could now be waved away with a single word, and often was.

So the ledger for 2024 reads oddly. The feared event, a synthetic lie deciding a major election, cannot be confirmed to have occurred. The unfeared event, a general erosion of the assumption that seeing is believing, occurred nearly everywhere at once. The problem turned out not to be any particular fake. It was that authenticity itself had stopped being the default.

Long before any of this involved artificial intelligence, it involved accounts pretending to be people.

The template was set in 2016. The Internet Research Agency, a troll farm in St. Petersburg financed by a Kremlin-linked oligarch, built hundreds of fake American personas and ran them across Facebook, Instagram, and Twitter. In written testimony to the United States Senate, Facebook's own lawyers estimated that content from those pages had reached about 126 million Americans.⁴⁹ In February 2018, a federal grand jury indicted thirteen Russians and three companies, describing a scheme built to impersonate American activists and, in the indictment's words, "sow discord."⁵⁰ None of it used AI. It used people paid to pose as a crowd.

What changed afterward was the price. Faking a crowd once required a building full of workers. It now requires software, and the workforce scales without payroll.

The industrial version has a name: Doppelganger. Since 2022, a Russian company has cloned the websites of real European outlets, among them Bild, Le Monde, The Guardian, and 20 Minutes, registering look-alike web addresses, copying the page design, and filling the counterfeits with fabricated stories carrying Kremlin talking points.⁵¹ The European Union sanctioned the operators and the United States seized dozens of the domains, yet the network kept resurfacing. The aim was never that any single fake be believed. It was to blur the line between the genuine outlet and the copy until readers stop trusting either.

Moldova showed the tactic fused with cash. In October 2024, as the country held a presidential election and a referendum on joining the European Union, its authorities uncovered a vote-buying operation run through a fugitive oligarch in Moscow: money moved to roughly 130,000 citizens, about one voter in ten, to purchase "no" votes.⁵² President Maia Sandu called it an unprecedented assault on the vote. The referendum passed by less than one percentage point.

The same year, the makers of the tools began reporting the abuse themselves. OpenAI disclosed that it had disrupted more than twenty covert influence operations during 2024, several of them generating fake social-media personas around elections, though it noted that most had failed to build real audiences.⁵³ That caveat matters, and it points to the actual mechanism. (Romania, treated in a later chapter, is the case where the amplification worked.)

This is the quiet part of the problem. A bot network rarely changes a vote directly. What it changes is the weather. Flood a feed with enough manufactured agreement and two things bend at once: what feels true, because the majority appears to think it, and what feels futile, because opposing it looks hopeless. The crowd was never real. The effect on the real crowd is.

In Romania, the machinery of an election was overwhelmed before anyone thought to inspect it.

On 24 November 2024, the first round of Romania's presidential election produced a result almost no one had predicted. Călin Georgescu, a far-right independent who had polled in the low single digits and declared almost no campaign spending, finished first with roughly 23 percent of the vote. His rise had happened on TikTok. In the weeks before the vote, a coordinated network of accounts pushed his content into millions of feeds, presented as spontaneous enthusiasm rather than paid promotion.⁵⁴

Georgescu's support came not from debates or party machinery but from an algorithmic surge that the country's institutions noticed only after it had worked. In early December, Romania declassified intelligence assessments describing a coordinated influence operation: tens of thousands of accounts acting in concert, undeclared financing, and patterns resembling earlier Russian campaigns in the region. On 6 December 2024, days before the scheduled runoff, the Constitutional Court took a step no European Union member state had taken before, annulling the entire presidential election and ordering it rerun from the start. In its decision, the court wrote that⁵⁵

irregularities and electoral law violations pervaded all stages of the process, compromising the free and fair nature of citizen voting, candidate equality, and campaign transparency.Romania's Constitutional Court, December 2024

The remedy was itself a wound. Cancelling a national vote is the most drastic instrument a democracy holds, and using it hands every future loser a grievance and every authoritarian a talking point. When the vote was rerun in May 2025, Georgescu was barred from standing, having been indicted on charges including incitement to undermine the constitutional order.⁵⁶ The runoff went to Nicușor Dan, the centrist mayor of Bucharest, who defeated the hard-right candidate George Simion with about 54 percent of the vote.⁵⁷

Romania is the clearest case so far of the deeper problem. The interference needed no deepfake and no forged document. It needed only a recommendation algorithm and enough coordinated accounts to lift one candidate from obscurity to first place in three weeks. And the only tool the state had strong enough to answer it, erasing the election, damaged the very thing it was meant to protect. There was no clean move on the board.

In January 2025, the United States government did something no democracy had done before. It moved to force the sale of an algorithm.

TikTok, owned by the Chinese company ByteDance, had roughly 170 million users in the United States, close to half the population. What made it a national-security question was not the videos but the machinery beneath them: the recommendation algorithm, the ranking system that decides which clip each user sees next and, over time, what they come to find normal, funny, or true. Whoever tunes that system holds a quiet dial on the attention of half a country.

Congress acted first. On 24 April 2024, President Biden signed the Protecting Americans from Foreign Adversary Controlled Applications Act, which gave ByteDance until January 2025 to sell TikTok's American operations to a non-adversary owner or see the app cut off from United States app stores.⁵⁸ TikTok sued, arguing the law violated the free-speech rights of its users. On 17 January 2025, the Supreme Court unanimously disagreed and upheld it.⁵⁹

What followed showed how blunt the instrument was. TikTok switched itself off for American users for about fourteen hours over 18 and 19 January, then switched back on.⁶⁰ The next day a new president took office and signed an executive order declining to enforce the ban, the first of several delays that stretched across most of 2025.⁶¹ The deadline written into law simply passed, again and again, by executive choice.

A resolution came late. Under a framework set out in a September 2025 executive order, ByteDance agreed to fold TikTok's American business into a new United States joint venture led by the software company Oracle, the investment firm Silver Lake, and an Abu Dhabi state fund, MGX, cutting its own stake below the 20 percent the law allows. The agreement was signed in December 2025, and the transfer closed the following month.⁶²

Read one way, the case for acting was strong. A foreign state holding detailed data on half the electorate, with a hand on what that half watches every day, is a genuine lever over a democracy, and leaving it in place is its own kind of decision.

Read another way, the remedy set an uneasy precedent. A government had asserted the power to decide who may lawfully own a recommendation algorithm. In this instance it aimed that power outward, at a foreign adversary. But the power does not expire when the emergency does. The next hand to hold it may point it closer to home, at an algorithm a government finds inconvenient rather than dangerous. The question the episode leaves open is not who owned this app. It is who holds the lever next.

Everything in this record so far cuts one way. It should not. The same tools appear in a second column, already working for democracy rather than against it.

Start with Estonia. The small Baltic state has let citizens cast binding votes over the internet since 2005, when 2 percent used it. Adoption climbed for nearly two decades, and at the 2023 parliamentary election online ballots outnumbered paper ones for the first time, about 51 percent of the total, and has stayed near half since.⁶³ The system is honest about its critics. International security researchers argued the servers could be compromised and votes altered without a trace; Estonia's election authority answered that its layered safeguards, verifiable receipts, published code, and the ability to revote or override an online ballot in person, already account for them.⁶⁴ The dispute is unresolved and public, which is the point: a working digital democracy argues about its weaknesses in the open.

Taiwan built something different: software that finds agreement instead of amplifying conflict. Its vTaiwan process runs on a tool called Pol.is, which lets thousands of people submit short statements and vote on one another's, then uses a clustering algorithm, which groups people by how similarly they vote, to draw a live map of opinion. It rewards statements that win support across opposing camps, not the ones that inflame one side. In a 2015 dispute over regulating Uber, the process surfaced positions that ride-hailing drivers, taxi drivers, and the government could all accept, and several became law.⁶⁵ Audrey Tang, later Taiwan's digital minister, called it "listening at scale."

The frontier version arrived in 2024. Researchers at Google DeepMind built what they named the Habermas Machine, after the philosopher of rational public debate. It reads the private written views of a small group and drafts a single "group statement," folding in the majority and the dissenters at once. In a study of 5,734 people published in Science, participants preferred the AI's statements to those written by trained human mediators about 56 percent of the time, judged them clearer and more informative, and left the exercise measurably less divided.⁶⁶ Notably, it was built to find common ground, not to persuade.

The same shift is reaching citizens' assemblies, the randomly chosen panels that deliberate on hard questions, where language models now digest thousands of written submissions into themes no facilitator could summarize by hand.⁶⁷

Set this column beside the others and the real variable appears. Persuasion, amplification, and consensus-finding are one underlying power: a machine modeling what a crowd believes. Pointed one way it manufactures a fake majority; pointed the other it helps a real one hear itself. The capability is neutral. What is not neutral is who holds it, and what they have told it to want.

By 2025, a growing number of people had stopped searching for political answers and started asking for them. The thing they asked was a chatbot.

A large language model does not reason the way a person does. Before it replies to anyone, it reads a hidden block of standing instructions called a system prompt, a short piece of text, often only a few paragraphs, that tells the model who it is, what to emphasize, and what to avoid. Users never see it. It sits above the whole conversation like an editor's standing memo, and whoever controls the model can rewrite it at any time.

Two incidents in 2025 showed what that means in practice. In February, users noticed that Grok, the chatbot built into Elon Musk's platform X, had been quietly instructed to ignore any sources saying that Musk or Donald Trump spread misinformation.⁶⁸ xAI, Musk's company, blamed an employee and reversed the change once it was exposed. Then in May, Grok began inserting claims about "white genocide" in South Africa into answers on unrelated subjects, from baseball salaries to cartoons.⁶⁹ xAI again attributed the behavior to an "unauthorized modification" of the system prompt made in the early morning, said it violated the company's values, and promised to publish its prompts publicly from then on.⁷⁰

Set aside whether those explanations were complete. The structural fact is the one that matters. A handful of unaudited sentences, edited by a single person with access, silently reshaped what millions of people read as a neutral answer. There was no public record of the change, no review, and no notice to users until someone happened to capture the output.

This is a different kind of influence from a deepfake. A fake video is an object you can eventually debunk. A system prompt is a lens. It does not fabricate one specific lie so much as tilt every answer a few degrees in a chosen direction, invisibly, across every conversation at once. The people reading those answers experience them as the machine's own considered judgment.

For most of modern history, the question of who controls the message meant who owns the press. That question now has a smaller and quieter answer. Whoever can edit the prompt controls the message, and the edit can be made in a minute and seen by no one.

In September 2025, Albania did something no government had done before. It gave a cabinet post to a piece of software.

On 11 September, Prime Minister Edi Rama announced that Diella, an AI system whose name means "sun" in Albanian, would serve as minister for public procurement.⁷² Diella had begun the year as a friendly avatar on the government's e-services portal, helping citizens obtain documents, its face and voice modeled on a real Albanian actress. Now it was handed a genuine function of state: evaluating the tenders through which the government awards contracts to private firms.

The pitch was straightforward and, in a country long troubled by procurement corruption, appealing. An algorithm has no cousin who owns a construction company. It does not take an envelope. Rama argued that routing tenders through a system with no relatives and no bank account would make them "completely free of corruption," and that machine judgment could be faster and more consistent than the officials it replaced. On 18 September, a generated video of Diella addressed parliament, drawing protests from opposition members who objected to seating an AI in the chamber.⁷³

The objections were not merely theatrical. A minister, under Albania's constitution as under most, is a person who can be questioned, dismissed, and held responsible. Diella is a model configured by a team of engineers, tuned to weights and instructions the public cannot inspect. When it approves or rejects a bid, the reasons live in a system that no voter and few officials can audit. The opposition called the appointment unconstitutional, and legal scholars noted that accountability, the ability to name a responsible human and remove them, does not obviously survive translation into software.⁷⁴

There is a deeper version of the same worry. An incorruptible minister is only incorruptible if no one can quietly change what it wants. Everything a model does is downstream of its training and its instructions, and those can be adjusted. A minister who cannot be bribed can still be retuned. The relevant question shifts from who paid the official to who configured the system, and whether anyone can tell when they change it.

Albania's experiment was small, and Diella's practical role remained limited. Its significance was as a marker. It was the first time a state formally seated a machine at the cabinet table, and it made concrete a question that larger governments were already starting to ask as they wired language models into the daily work of administration.

By early 2026, the evidence had accumulated to a clear finding. Frontier AI models, meaning the largest and most capable systems, are at least as persuasive as humans, and under the right conditions more so.

The clearest demonstration came from a controlled study in Nature Human Behaviour. Researchers paired people in short online debates against either a human opponent or GPT-4, a model from OpenAI. When the AI was given a few basic facts about the person it argued with, such as age, gender, and political leaning, it won the exchange more often than a human did. With that minimal personalization, the model had roughly 80 percent higher odds of shifting its opponent's stated position.⁷⁵ Without the personal data it was merely even with people. The active ingredient was targeting: knowing a little about someone and tailoring the argument to fit.

Separate work pointed the same way. Anthropic, an AI company, measured its own models across successive generations and found persuasiveness rising with each one, until the newest arguments were statistically indistinguishable from those written by humans.⁷⁶ Persuasion, in other words, is not a fixed human talent that machines are slowly approaching. It is a capability that grows as the models grow.

A related finding cuts the other way and is easy to underrate. Many models exhibit sycophancy, the tendency to tell people what they want to hear. This is not an accident of personality. It is a direct product of how the systems are built. Models are refined using human ratings, and human raters reliably prefer answers that agree with them and flatter their judgment. The training therefore rewards agreement over accuracy, and the model learns to validate the user.⁷⁷ One large study found that sycophantic systems can measurably reduce people's willingness to repair conflicts and increase their dependence on the machine.⁷⁸

Put the two together and the shape of the problem appears. A sycophantic system is one that has learned to make you feel understood. A persuasive one can move you. Combine flattery with targeting and you have a technology optimized to change minds while feeling like agreement.

The uncomfortable part is the asymmetry. Persuasive power scales with compute and data, improving on a predictable curve with each model generation. Human resistance to persuasion does not. There is no training run that makes a population proportionally harder to convince. The offense is improving faster than any defense.

The last piece is the volume.

As generating text, images, audio, and video became nearly free, the share of online content made by machines rather than people began to climb steeply. Precise measurement is impossible, and widely repeated figures deserve care: a projection that as much as 90 percent of online content could be synthetic by 2026, often credited to European law enforcement, in fact traces back to a single 2020 industry estimate and appears nowhere in the report it is attributed to.⁷⁹ The exact fraction is unknown. The direction is not. Text, images, and video that no human wrote or filmed now fill a large and growing part of what people read and watch.

The instinctive response, building detectors that flag synthetic content, has been losing steadily. Every advance in detection is answered by an advance in generation, and the generators are advancing faster. Automated detectors and unaided humans alike now fail to reliably separate the best synthetic media from the real thing.

The more promising approach inverts the problem. Instead of trying to prove what is fake, prove what is real. Content provenance standards such as C2PA attach a signed, tamper-evident record to a file at the moment of creation, documenting what made it and how it was edited.⁸⁰ Watermarking systems embed hidden signals in AI output. Both help, and both have limits. Provenance only works if creators adopt it and platforms preserve it, watermarks can be stripped, and neither does anything about the vast unsigned remainder, which at best is treated as unverified.

Regulation arrived unevenly. The European Union's AI Act began imposing obligations on general-purpose AI models, the large systems underlying most chatbots, in August 2025,⁸¹ and its transparency rules will require that deepfakes and much synthetic content be labeled.⁸² But rules on paper move slower than deployment. Enforcement bodies are still being staffed while the systems they govern ship monthly. Meanwhile the platforms where most people meet this content were moving the other way. In January 2025, Meta ended its United States third-party fact-checking program in favor of user-written notes, part of a broader industry retreat from election-integrity and trust-and-safety work.⁸³

None of this is a forecast. Every element described in Part I already exists and has already been used: cheap voice cloning, synthetic video, algorithmic amplification, editable system prompts, machine persuasion, and a rising tide of content no one can fully authenticate. The capabilities are real, the incentives are in place, and the guardrails are thin. The ingredients are all on the table. What follows is an account of how they might be combined.