When we think about democracy, we picture voting booths, open discussion and debate, and trusted institutions. But behind every ballot and every piece of information lies an infrastructure that often remains invisible: the Internet. Just as bridges and power lines hold up our physical society, cybersecurity underpins the functioning of our democratic life. Cybersecurity is fundamentally about people, rights, and trust in institutions. Just as citizens trust their votes will be counted, they must also trust that their data is safe and that civil society can operate freely.
We recently convened a panel called “Cybersecurity is the Backbone of Democracy” for the 92nd Street Y, as part of the Newmark Civic Life Series, known for conversations with leading experts exploring pro-democracy efforts at this critical moment in the US and around the world, supported by Craig Newmark Philanthropies.
We gathered to make a compelling case: cybersecurity is not just a technical issue—it is fundamental to the survival of democratic systems. Moderated by Michael Daniel (Cyber Threat Alliance), the discussion brought together Phil Reitinger (Global Cyber Alliance), Oktavía Hrund Guðrúnar Jóns (Quad9), Francesca Bosco (CyberPeace Institute), and Jocelyn Woolbright (Cloudflare).
Cybersecurity Is Not Just a Tech Problem
Phil Reitinger opened with a critical reminder: most cybersecurity challenges are not technical at all. “We know what works,” he noted, outlining that GCA works across borders and sectors to address systemic cybersecurity risks that threaten individuals, businesses, and societies. “The issue is implementing it—balancing costs, organizational priorities, and leadership.” Too often, cybersecurity gets siloed as an IT issue. In reality, it needs to be treated as a core business and governance function, as essential as finance or operations.
Francesca Bosco expanded on this point: cybersecurity is fundamentally about people. When hospitals, election systems, or civic organizations are attacked, it’s not just downtime, it’s an erosion of trust in the very institutions that sustain democracy. Protecting data and systems is ultimately about protecting rights, voices, and the fabric of civic life.
The Infrastructure We Take for Granted
For most people, the Internet is as expected as water or electricity. But Oktavía Hrund Guðrúnar Jóns explained the staggering complexity and fragility of that infrastructure. As a nonprofit recursive DNS resolver operating in more than 115 countries, Quad9 blocks up to a billion verified threats daily, while running on the dedication of a tiny staff and global partners.
“The Internet works because of countless quiet, constant efforts,” Jóns explained. Much like seatbelts or road safety standards, core Internet functions should be universal, reliable, and publicly accessible. Cybersecurity must be treated as a public good, not a luxury available only to those who can afford it.
Civil Society at the Frontlines
The panel emphasized that some of the most at-risk organizations are those least equipped to defend themselves. Francesca Bosco described NGOs, small municipalities, rural hospitals, election watchdogs, and human rights groups as “target-rich but resource-poor.” They carry sensitive data, operate in high-risk environments, and provide essential services, making them prime targets for criminals, state actors, and disinformation campaigns.
To counter this, the CyberPeace Institute mobilizes CyberPeace Builders, a network of volunteer experts who donate their skills to, currently, over 590 nonprofits in more than 120 countries via about 1,580 volunteers. Bosco was clear: this is not charity, it’s a strategic investment in protecting society.
Jocelyn Woolbright shared how Cloudflare’s Project Galileo similarly supports civil society. Originally launched to defend journalists and free speech groups, it now provides free cybersecurity services to more than 3,000 organizations in 111 countries, including election offices and voting rights groups. “A vulnerable Internet leads to a vulnerable democracy,” she said. “Cybersecurity is an investment in resilience.”
Elections, Trust, and Information Integrity
If democracy runs on trust, then information is its currency. Reitinger underscored how elections depend entirely on the flow of information—about candidates, policies, and the counting of votes. Any disruption to the accuracy, integrity, or availability of that information directly undermines confidence in the democratic process.
Bosco illustrated this with a case study: an NGO running a rural voter awareness campaign was hacked on the eve of an election. Its website was defaced, supporter data leaked, and false information spread, eroding public trust and potentially suppressing turnout. The harm is not just immediate confusion, but long-term damage to democratic resilience. Cybersecurity is what protects trust, voice, and participation. Without it, disinformation and disruption eat away at legitimacy itself.
For Woolbright, the takeaway is clear: “Protecting the digital infrastructure of elections is as important as protecting the ballot boxes themselves.” From campaign security to protecting election-night reporting systems, the ability of citizens to access reliable information directly shapes democratic legitimacy.
A Call for Sustainable Support
As the conversation turned to solutions, all panelists agreed: nonprofits are essential to the functioning of a secure Internet, yet they operate on shoestring budgets. “A big part of our job is begging and passing the hat,” Reitinger admitted. Despite providing critical infrastructure, nonprofit defenders of the Internet are chronically underfunded.
To address this, organizations have launched the Common Good Cyber Fund, a collaborative effort backed by governments and nonprofits to sustainably finance core Internet security services and civil society protections. As Reitinger put it: “It shouldn’t just be those who can pay who get cybersecurity. It’s a fundamental human right.”
Cloudflare’s model offered a complementary perspective. By embedding free protections into its core business, the company demonstrates that private-sector actors can align mission and market success while supporting the broader ecosystem.
Building a Resilient Future
In their closing reflections, panelists stressed that democracy’s digital resilience requires more than technical fixes. It is about culture, trust, and collective responsibility. As Jóns put it: “Security is culture. When our processes are secure, we can trust them. And when we can trust them, democracy thrives.”
The panel’s message was urgent but hopeful: cybersecurity is the hidden backbone of democracy, and defending it demands collaboration across governments, nonprofits, companies, and individuals. From keeping NGOs online to protecting election results, the stakes are nothing less than the survival of open and free societies.
As technology becomes ever more woven into civic life, the challenge is clear: build digital resilience not as an afterthought, but as a foundation. Because without cybersecurity, democracy itself is at risk.
You can watch the full panel here: https://www.92ny.org/event/cybersecurity-is-the-backbone-of-democracy
