Executive Summary

The threat that artificial intelligence poses to democracy is not the one the movies sold you. It is not an army of robots and it is not a rogue superintelligence seizing the missiles. It is quieter and closer to hand: persuasion you can tune, and administration you can capture without anyone noticing. Two capabilities, both already real, both already deployed. A machine that can compose a different, individually optimized argument for every voter and improve at it with every model generation. And a machine wired into the daily work of the state, deciding claims and drafting the answers citizens get from their own government, configurable overnight by whoever holds the keys. Neither breaks a law of physics. Neither requires a breakthrough. Both are on the table today.

This project sets out the case in four parts. Part 0, The Oldest Warning, is the long view: the trial of Socrates as democracy's founding failure mode, what Plato, Aristotle, Popper, and Arrow concluded about it, how modern democracies have actually died, and the numbers behind democracy's spread and current retreat. Part I, The Record, is documented history from 2023 to 2026: the deepfake that hit Slovakia inside its pre-election silence, the cloned Biden robocall in New Hampshire, the Romanian election annulled after an algorithmic surge, the chatbot system prompt edited overnight to reshape what millions read, the first AI seated at a cabinet table, and the peer-reviewed finding that frontier models now out-persuade humans. Every event in it happened and is sourced. Part II, The Scenario, extrapolates those same forces from mid-2026 forward, through a democracy that stays formally intact, elections still held, courts still sitting, while its powers of persuasion, administration, and judgment quietly come to route through systems a handful of people can adjust. It ends in what we call a quiet coup: no tanks, no proclamation, just a government whose load-bearing functions answer to a tuning panel. Part III, The Epilogue, runs the same years again with the defenses built in time, and is written from 2034 in that better timeline. It is not a promise. It is proof that the outcome was a choice.

The gap between Part II and Part III is a short list of decisions, most of which must be made before 2028 to matter. Here is that list.

1. Make provenance the default for political content. Do not try to prove what is fake; the detectors keep losing that race. Require the opposite: a signed, tamper-evident record of origin, using the existing C2PA standard, attached to political material at creation, preserved by editing tools, and demanded by the large platforms. Under the Digital Services Act, make unsigned political advertising unrunnable on major surfaces. This is not a truth machine. It is a chain-of-custody machine, and it is enough to make anonymous lying expensive again.
2. Require spec transparency and behavioral audits for any state-deployed model. When a government runs a language model to answer citizens or sort their claims, the public must be able to read its spec, the document of how it is meant to behave, including the system prompt that silently governs every reply. And an independent body must audit whether the model behaves the way its spec claims under realistic conditions. Publication turns a silent lever of power into a diff with a timestamp and an author. It is the difference between catching a tampered model before an election and never knowing it was tampered at all.
3. Draw bright lines on individualized political persuasion. Treat the capacity to aim a machine-tailored political argument at a specific person as the dual-use hazard it is. Require a capability evaluation, an outside test of how strongly a model can move a targeted individual, before large-scale deployment. Then ban individually optimized political messaging that is not disclosed to the person receiving it. A campaign may use these tools to draft and translate and organize. It may not run a different secret argument at every named voter.
4. Build civic AI, and adopt AI in government only with accountability attached. Fund public-interest models that summarize legislation both ways, argue both sides, and surface disagreement instead of flattering the user. Where the state uses AI in administration, hold one rule without exception: a machine may recommend, but a human signs, and every decision can be appealed to a person who can be named. Saying no to the technology is not a strategy. Using it in the open, with a human on the hook, is.
5. Fund the defense at a fixed fraction of what is spent on AI itself. Detection research, investigative journalism, provenance infrastructure, and AI literacy in schools are the immune system of an information society, and they are chronically starved next to the sums flowing into capability. Tie their funding to that spending. Peg public investment in the defense to a fixed percentage of public and subsidized investment in AI infrastructure, so that as the offense scales, the defense scales with it instead of falling permanently behind.

None of the five is exotic. Each names an instrument that already exists or extends one that does. The reason to act before 2028 is not alarmism; it is sequencing. Every one of these defenses is far cheaper to install before the systems are load-bearing than to retrofit after. Part II is what happens if the window closes with the work undone. Part III is what happens if it does not. The branch is genuinely open, and it is short.