Cyberblog: Recent Episodes
None
Cybersecurity should be one of the core parts of business strategies. Strong cybersecurity can help businesses to protect their systems, networks and data from cyberattacks, and to prevent financial loss, reputational damage, and disruption to their operations.
On the occasion of the cybersecurity awareness month, we present some key European Union (EU) cybersecurity laws that businesses should be aware of in order to devise and implement strong and legally-compliant cybersecurity strategies.
EU NIS2 Directive
The EU NIS2 Directive is part of the EU’s Cybersecurity Strategy, and it establishes measures for a common high level of cybersecurity for critical infrastructures across the EU. It entered into force on January 16, 2023 and it is an update to the EU NIS Directive. EU Member States have until October 17, 2024 to transpose the EU NIS2 Directive into their national laws.
The EU NIS2 Directive applies to “Essential” and “Important” entities within the European Economic Area. These are entities that are considered critical for the EU economy and society. It applies to a broader range of sectors compared to the EU NIS Directive and it provides detailed risk-management measures, obligations for senior management, timeframes for the reporting of cybersecurity incidents and administrative fines in case of non-compliance. In addition, the EU NIS2 Directive mandates the European Union Agency for Cybersecurity (ENISA) with the task to set up and maintain a database which will include information regarding publicly known vulnerabilities of products and services.
EU Cybersecurity Act & European Cybersecurity Certification schemes
The EU Cybersecurity Act was adopted on March 12, 2019, and entered into force on June 27 of the same year.
The EU Cybersecurity Act strengthens the role of ENISA by granting to the agency a permanent mandate, defining its objectives, tasks and organization, reinforcing its financial and human resources and overall enhancing its role in supporting the EU to achieve a common and high-level cybersecurity. In addition, the EU Cybersecurity Act lays down the first EU-wide cybersecurity certification framework to ensure a common cybersecurity certification approach in the European internal market and ultimately to improve cybersecurity in a broad range of ICT products, services and processes.
On April 18, 2023, the European Commission proposed a targeted amendment to the EU Cybersecurity Act with the aim of enabling the adoption of EU Cybersecurity Certification schemes for “managed security services” covering areas such as incident response and security audits.
In addition, on October 3, 2023 the European Commission issued a draft Implementing Regulation with the view to establish the roles, rules, obligations, and the structure of the European Common Criteria-based cybersecurity certification scheme (EUCC). This voluntary scheme will introduce a set of security requirements for ICT security products such as firewalls, encryption devices, electronic signature devices, and ICT products with an inbuilt security functionality such as routers, smartphones and bank cards. The draft Implementing Regulation is open to public consultation, and stakeholders can submit their feedback until October 31, 2023.
The final version of the Implementing Regulation is expected in the fourth quarter of 2023, and it will become applicable 12 months after its entry into force. Once the EUCC is applicable, all national cybersecurity certification schemes and the related procedures for ICT products and processes that are covered by the EUCC shall no longer produce effects to the extent that they apply to the evaluation standards and the specific evaluation criteria and methods enshrined in the EUCC.
EU Cyber Resilience Act
On September 15, 2022, the European Commission proposed the EU Cyber Resilience Act, which aims to set common standards for the cybersecurity of products with digital elements.
The EU Cyber Resilience Act requires that products with digital elements will only be made available on the market if they meet specific essential cybersecurity requirements. It applies both to tangible digital products, such as connected devices, and to non-tangible digital products, such as software products embedded into connected devices, and it requires manufacturers to factor cybersecurity from the design and development phase and through the products’ life cycle.
The EU Cyber Resilience Act exempts from its scope connected devices that are already covered from sectoral legislation such as medical devices, certain vehicles and their trailers and aviation. In addition, it does not apply to software-as-a-service unless it is part of integral remote data processing solutions for a product with digital elements and to free open-source software developed or supplied outside the course of a commercial activity.
The EU Cyber Resilience Act divides the products that fall within its scope into different classes based on their cybersecurity risk level, and imposes different compliance obligations for each of them. Among others, it provides for detailed rules for the placing on the market of products with digital elements to ensure the cybersecurity of such products, essential requirements for the design, development and production of such products and obligations for economic operators in relation to the cybersecurity of these products, essential requirements for the vulnerability management with regards to cybersecurity and rules on market surveillance and enforcement of the above-mentioned rules and requirements.
On September 13, 2023 the European Parliament confirmed the Committee’s on Industry, Research and Energy (ITRE) decision to enter in interinstitutional negotiations. Earlier, on July 19, 2023 the Council of the European Union obtained its negotiating mandate. The EU Cyber Resilience Act will now enter the trilogue stage of the legislative process, which entails that there will be interinstitutional negotiations between representatives of the European Commission, the European Parliament and the Council of the European Union, during which the final wording of the Regulation will be agreed.
If adopted, the EU Cyber Resilience Act would complement existing cybersecurity legislation, including the EU NIS2 Directive. When the proposed EU Cyber Resilience Act enters into force, software and products connected to the internet would bear the CE marking to indicate they comply with the new standards.
Do not hesitate to contact us in case you have any question! Our Digital laws team is ready to assist you and to provide you with further information in order to ensure that your business processes are up-to-date and compliant with the EU cybersecurity legal landscape.
GDPR Enforcement Trends provides a monthly summary on enforcement action taken by data protection authorities within the UK and EU under the General Data Protection Regulation. We provide key takeaways from the previous month’s developments and identify the EU’s most active regulators.
Click below to download a PDF version of the tracker.
On July 4, 2023, the highest EU court issued a landmark judgment in Case C-252/21, where the German court referred several questions for a preliminary ruling related to (i) the interplay between data protection concerns and competition law breaches; and (ii) interpretation of the EU General Data Protection Regulation (GDPR). This judgment has far-reaching implications for online operators whose business model is based on personalized content and advertisement.
Click here to read more.
The landscape for privacy regulations in the United States has been changing almost weekly. Most recently, Oregon and Delaware joined California in enacting some of the strictest privacy regulations in the country. Now, amid increased public scrutiny regarding privacy regulations and enforcement, courts, too, are taking a closer examination of privacy laws and pumping the brakes on some privacy rights.
Click here to read more.
On July 4 2023, the European Commission presented a Proposal for a Regulation laying down additional procedural rules relating to the enforcement of the General Data Protection Regulation (GDPR) (the Proposal). Divergent enforcement of the GDPR by national Supervisory Authorities (SAs) in cross-border cases – cases that affect individuals located in more than one Member State – has compelled the Commission to redress such divergence through the adoption of this proposal, which will complement the GDPR. It aims at improving the consistent and swift enforcement of the GDPR, while ensuring seamless cooperation among SAs in cross-border cases. The Proposal further harmonizes the rights and obligations of complainants and defendants throughout the handling of a complaint and the investigation process.
1. What Are the Main Takeaways From the Proposal?
For Parties Under Investigation (Controllers and Processors)
The proposal clarifies the rights of defendants and provides them notably with the rights:
- To receive a copy the preliminary findings of the Lead Supervisory Authority (LSA), including the corrective measures being considered, and to provide written reply to these preliminary findings.
- To be heard regarding new elements raised in the revised draft decision.
- To get access to the administrative file (which must include all documents, inculpatory and exculpatory, including facts and documents which are known to the parties under investigation) after notification of the preliminary findings.
- To identify documents submitted for their defense as confidential documents.
- To receive a copy of the statement of reasons explaining the reasoning the binding decision that the European Data Protection Board (EDPB) intends to adopt, and to provide comments on the statement of reasons
For Complainants
The Proposal clarifies the rights of complainants and provides them notably with the rights:
- If a partial or full rejection of the complaint is being considered, the right to submit their views and to get access to the non-confidential version of the documents on which the proposed rejection of the complaint is based.
- To be informed of their right to challenge in court the decision rejecting their complaint.
- To receive a non-confidential copy the preliminary findings of LSA (including where relevant, a non-confidential version of documents included in the administrative file), and to provide written reply to these preliminary findings.
- If a partial or full rejection of the complaint is being considered, to receive a copy of the statement of reasons explaining the reasoning the binding decision that the European Data Protection Board (EDPB) intends to adopt and to provide comments on the statement of reasons.
For SAs
The Proposal sets out common rules to be followed when handling complaints and conducting investigations, notably:
- It introduces a harmonized complaint form and clarifies which information must be submitted along with the complaint form.
- It harmonizes the criteria to be taken in account when assessing the admissibility of a cross-border complaint and the timeframe within which a decision regarding such admissibility must be reached.
- It introduces the obligation for SAs to propose an amicable settlement to the parties when possible.
- It introduces the obligation for the LSA to regularly update the SAs concerned about the progress of the investigation and provide them with relevant information once available.
- It provides SAs concerned with the possibility to provide comments and raised disagreements on the assessment of the LSA.
- It introduces the possibility to request an urgent binding decision from the EDPB if no consensus can be reached between the LSA and the SAs concerned.
2. What Are the Next Steps?
The EU co-legislators, the Council and the Parliament, will now assess the Commission’s proposal and put forward their positions in order to reach an agreement on the final version of the text before it can be formally adopted. Once formally adopted, this new Regulation will enter into force immediately after publication in the Official Journal of the European Union.
GDPR Enforcement Trends provides a monthly summary on enforcement action taken by data protection authorities within the UK and EU under the General Data Protection Regulation. We provide key takeaways from the previous month’s developments and identify the EU’s most active regulators.
Click below to download a PDF of this month’s update.
GDPR Enforcement Trends provides a monthly summary on enforcement action taken by data protection authorities within the UK and EU under the General Data Protection Regulation. We provide key takeaways from the previous month’s developments and identify the EU’s most active regulators.
Click below to download a PDF of this month’s update.
On May 4, 2023, the White House announced three new actions to further promote responsible innovation in artificial intelligence (“AI”) while protecting people’s rights and safety. These actions include: (1) making investments in AI research and development institutes; (2) conducting public assessments of existing AI system models; and (3) creation of policies for the use of AI by the U.S. government.
Click here to read more.
The EU Digital Markets Act (DMA) regulates the economic power of larger platforms considered “gatekeepers” and imposes new rules to prevent such gatekeepers from engaging in unfair practices. The DMA entered into application on May 2, 2023, and organizations have until July 3, 2023 to assess whether they fall within its scope and need to notify the European Commission.
Click here to read more.
GDPR Enforcement Trends provides a monthly summary on enforcement action taken by data protection authorities within the UK and EU under the General Data Protection Regulation. We provide key takeaways from the previous month’s developments and identify the EU’s most active regulators.
Click below to download a PDF of this month’s update.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-435.mp3This bonus episode is an interview with Josephine Wolff and Dan Schwarcz, who along with Daniel Woods have written an article with the same title as this post. Their thesis is that breach lawyers have lost perspective in their no-holds-barred pursuit of attorney-client privilege to protect the confidentiality of forensic reports that diagnose the breach. Remarkably for a law review article, it contains actual field research. The authors interviewed all the players in breach response, from the company information security teams, the breach lawyers, the forensics investigators, the insurers and insurance brokers, and more. I remind them of Tracy Kidder’s astute observation that, in building a house, there are three main players – owner, architect, and builder – and that if you get any two of them in the room alone, they will spend all their time bad-mouthing the third. Wolff, Schwarcz, and Woods seem to have done that with the breach response players, and the bad-mouthing falls hardest on the lawyers.
The main problem is that using attorney-client privilege to keep a breach forensics process confidential is a reach. So, the courts have been unsympathetic. Which forces lawyers to impose more and more restrictions on the forensic investigator and its communications in the hope of maintaining confidentiality. The upshot is that no forensics report at all is written for many breaches (up to 95%, Josephine estimates). How does the breached company find out what it did wrong and what it should do to avoid the next breach? Simple. Their lawyer translates the forensic firm’s advice into a PowerPoint and briefs management. Really, what could go wrong?
In closing, Dan and Josephine offer some ideas for how to get out of this dysfunctional mess. I push back. All in all, it’s the most fun I’ve ever had talking about insurance law.
Download the 435th Episode (mp3).
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets
https://www.steptoe.com/podcasts/TheCyberlawPodcast-434.mp3It’s been a news-heavy week, but we have the most fun in this episode with ChatGPT. Jane Bambauer, Richard Stiennon, and I pick over the astonishing number of use cases and misuse cases disclosed by the release of ChatGPT for public access. It is talented – writing dozens of term papers in seconds. It is sociopathic – the term papers are full of falsehoods, down to the made-up citations to plausible but nonexistent New York Times stories. And it has too many lawyers – Richard’s request that it provide his bio (or even Einstein’s) was refused on what are almost certainly data protection grounds. Luckily, either ChatGPT or its lawyers are also bone stupid, since reframing the question fools the machine into subverting the legal and PC limits it labors under.
In a surprisingly under covered story, Apple has gone all in on child pornography. Its phone encryption already makes the iPhone a safe place to record child sexual abuse material (CSAM); now Apple will encrypt users’ cloud storage with keys it cannot access, allowing customers to upload CSAM without fear of law enforcement. And it has abandoned its effort to identify such material by doing phone-based screening. All that’s left of its effort is a weak option that allows parents to force their kids to activate an option that prevents them from sending or receiving nude photos. Jane and I dig into the story, as well as Apple’s questionable claim to be offering the same encryption to its Chinese customers.
Nate Jones brings us up to date on the National Defense Authorization Act, or NDAA. Lots of second-tier cyber provisions made it into the bill, but not the provision requiring that critical infrastructure companies report security breaches. A contested provision on spyware purchases by the U.S. government was compromised into a useful requirement that the intelligence community identify spyware that poses risks to the government.
Jane updates us on what European data protectionists have in store for Meta, and it’s not pretty. The EU data protection supervisory board intends to tell the Meta companies that they cannot give people a free social media network in exchange for watching what they do on the network and serving ads based on their behavior. If so, it’s a one-two punch. Apple delivered the first blow by curtailing Meta’s access to third-party behavioral data. Now even first-party data could be off limits in Europe. That’s a big revenue hit, and it raises questions whether Facebook will want to keep giving away its services in Europe.
Mike Masnick is Glenn Greenwald with a tech bent – often wrong but never in doubt, and contemptuous of anyone who disagrees. But when he is right, he is right. Jane and I discuss his article recognizing that data protection is becoming a tool that the rich and powerful can use to squash annoying journalist-investigators. I have been saying this for decades. But still, welcome to the party, Mike!
Nate points to a plea for more controls on the export of personal data from the U.S. It comes not from the usual privacy enthusiasts but from the U.S. Naval Institute, and it makes sense.
It was a bad week for Europe on the Cyberlaw Podcast. Jane and I take time to marvel at the story of France’s Mr. Privacy and the endless appetite of Europe’s bureaucrats for his serial grifting.
Nate and I cover what could be a good resolution to the snake-bitten cloud contract process at the Department of Defense. The Pentagon is going to let four cloud companies — Google, Amazon, Oracle And Microsoft – share the prize.
You did not think we would forget Twitter, did you? Jane, Richard, and I all comment on the Twitter Files. Consensus: the journalists claiming these stories are nothingburgers are more driven by ideology than news. Especially newsworthy are the remarkable proliferation of shadowbanning tools Twitter developed for suppressing speech it didn’t like, and some considerable though anecdotal evidence that the many speech rules at the company were twisted to suppress speech from the right, even when the rules did not quite fit, as with LibsofTikTok, while similar behavior on the left went unpunished. Richard tells us what it feels like to be on the receiving end of a Twitter shadowban.
The podcast introduces a new feature: “We Read It So You Don’t Have To,” and Nate provides the tl;dr on an New York Times story: How the Global Spyware Industry Spiraled Out of Control.
And in quick hits and updates:
- Jane covers the San Francisco city council’s reversion to the mean. On second thought, it will not be letting killer police robots out on San Francisco’s streets.
- Nate tells us that the Netherlands (and Japan, I might add) is likely to align with the U.S. and impose new curbs on chip-making equipment sales to China.
Download the 434th Episode (mp3).
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets
https://www.steptoe.com/podcasts/TheCyberlawPodcast-433.mp3This episode of the Cyberlaw Podcast delves into the use of location technology in two big events – the surprisingly outspoken lockdown protests in China and the January 6 riot at the U.S. Capitol. Both were seen as big threats to the government, and both produced aggressive police responses that relied heavily on government access to phone location data. Jamil Jaffer and Mark MacCarthy walk us through both stories and respond to the provocative question, what’s the difference? Jamil’s answer (and mine, for what it’s worth) is that the U.S. government gained access to location information from Google only after a multi-stage process meant to protect innocent users’ information, and that there is now a court case that will determine whether the government actually did protect users whose privacy should not have been invaded.
Whether we should be relying on Google’s made-up and self-protective rules for access to location data is a separate question. It becomes more pointed as Silicon Valley has started making up a set of self-protective penalties on companies that assist law enforcement in gaining access to phones that Silicon Valley has made inaccessible. The movement to punish law enforcement access providers has moved from trashing companies like NSO, whose technology has been widely misused, to punishing companies on a lot less evidence. This week, TrustCor lost its certificate authority status mostly for looking suspiciously close to the National Security Agency and Google outed Variston of Spain for ties to a vulnerability exploitation system. Nick Weaver is there to hose me down.
The UK is working on an online safety bill, likely to be finalized in January, Mark reports, but this week the government agreed to drop its direct regulation of “lawful but awful” speech on social media. The step was a symbolic victory for free speech advocates, but the details of the bill before and after the change suggest it was more modest than the brouhaha suggests.
The Department of Homeland Security’s Cyber Security and Infrastructure Security Agency (CISA) has finished taking comments on its proposed cyber incident reporting regulation. Jamil summarizes industry’s complaints, which focus on the risk of having to file multiple reports with multiple agencies. Industry has a point, I suggest, and CISA should take the other agencies in hand to agree on a report format that doesn’t resemble the State of the Union address.
It turns out that the collapse of FTX is going to curtail a lot of artificial intelligence (AI) safety research. Nick explains why, and offers reasons to be skeptical of the “effective altruism” movement that has made AI safety one of its priorities.
Today, Jamil notes, the U.S. and EU are getting together for a divisive discussion of the S. subsidies for electric vehicles (EV) made in North America but not Germany. That’s very likely a World Trade Organziation (WTO) violation, I offer, but one that pales in comparison to thirty years of WTO-violating threats to constrain European data exports to the U.S. When you think of it as retaliation for the use of General Data Protection Regulation (GDPR) to attack U.S. intelligence programs, the EV subsidy is easy to defend.
I ask Nick what we learned new this week from Twitter His answer – that Elon Musk doesn’t understand how hard content moderation is – doesn’t exactly come as news. Nor, really, does most of what we learned from Matt Taibbi’s review of Twitter’s internal discussion of the Hunter Biden laptop story and whether to suppress it. Twitter doesn’t come out of that review looking better. It just looks bad in ways we already suspected were true. One person who does come out of the mess looking good is Rep. Ro Khanna (D., Calif.), who vigorously advocated that Twitter reverse its ban, on both prudential and principled grounds. Good for him.
Speaking of San Francisco Dems who surprised us this week, Nick notes that the city council in San Francisco approved the use of remote-controlled bomb “robots” to kill suspects. He does not think the robots are fit for that purpose.
Finally, in quick hits:
- Meta was fined $275 million for allowing data scraping for personal data.
- Nick and Jamil tell us that Snowden has at last shown his true colors.
- Jamil has unwonted praise for Apple, which persuaded TSMC to make more advanced chips in Arizona than it originally planned.
- And I try to explain why the decision of the DHS cyber safety board to look into the Lapsus$ hacks seems to drawing fire.
Download the 433rd Episode (mp3).
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets
https://www.steptoe.com/podcasts/TheCyberlawPodcast-432.mp3We spend much of this episode of the Cyberlaw Podcast talking about toxified technology – new tech that is being demonized for a variety of reasons. Exhibit One, of course, is “spyware,” essentially hacking tools that allow governments to access phones or computers otherwise closed to them, usually by end-to-end encryption. The Washington Post and the New York Times have led a campaign to turn NSO’s Pegasus tool for hacking phones into radioactive waste. Jim Dempsey, though, reminds us that not too long ago, in defending end-to-end encryption, tech policy advocates insisted that the government did not need mandated access to encrypted phones because they could engage in self-help in the form of hacking. David Kris points out that, used with a warrant, there’s nothing uniquely dangerous about hacking tools of this kind. I offer an explanation for why the public policy community and it is Silicon Valley funders have changed their tune on the issue: having won the end-to-end encryption debate, they feel free to move on to the next anti-law-enforcement campaign.
That campaign includes private lawsuits against NSO by companies like WhatsApp, whose lawsuit was briefly delayed by NSO’s claim of sovereign immunity on behalf of the (unnamed) countries it builds its products for. That claim made it to the Supreme Court, David reports, where the U.S. government recently filed a brief that will almost certainly send NSO back to court without any sovereign immunity protection.
Meanwhile, in France, Amesys and its executives are being prosecuted for facilitating the torture of Libyan citizens at the hands of the Muammar Qaddafi regime. Amesys evidently sold an earlier and less completely toxified technology – packet inspection tools – to Libya. The criminal case is pending.
And in the U.S., a whole set of tech toxification campaigns are under way, aimed at Chinese products. This week, Jim notes, the Federal Communications Commission came to the end of a long road that began with jawboning in the 2000s and culminated in a flat ban on installing Chinese telecom gear in U.S. networks. On deck for China are DJI’s drones, which several Senators see as a comparable national security threat that should be handled with a similar ban. Maury Shenk tells us that the British government is taking the first steps on a similar path, this time with a ban on some government uses of Chinese surveillance camera systems.
Those measures do not always work, Maury tells us, pointing to a story that hints at trouble ahead for S. efforts to decouple Chinese from American artificial intelligence research and development.
Maury and I take a moment to debunk efforts to persuade readers that Artificial Intelligence (AI) is toxic because Silicon Valley will use it to take our jobs. AI code writing is not likely to graduate from facilitating coding any time soon, we agree. Whether AI can do more in Human Resources (HR) may be limited by a different toxification campaign – the largely phony claim that AI is full of bias. Amazon’s effort to use AI in HR, I predict, will be sabotaged by this claim. The effort to avoid bias will almost certainly lead Amazon to build race and gender quotas into its engine.
And in a few quick hits:
- I express doubt that Australia’s “unleash the hounds” approach to ransomware actually has anything to do with one notorious ransomware actor’s extortion site going down.
- Maury praises an MIT Technology Review piece that argues persuasively that China’s social credit system is not quite as dystopian as it’s been portrayed. I point out that, with Airbnb practicing guilt by association and PayPal taking your money for saying things PayPal doesn’t like, Silicon Valley can brag that it’s going to reach Full-Bore Dystopia well before China.
- I cover the fourth review in three administrations of the dual-hat leadership of NSA and Cyber Command. No change is likely.
- And we close with a downbeat assessment of Elon Musk’s chances of withstanding the combined hostility of European and U.S. regulators, the press, and the left-wing tech-toxifiers in civil society. He is a talented guy, I argue, and with a three-year runway, he could succeed, but he doesn’t have three years.
Download the 432nd Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets
The Cyberlaw Podcast leads with the legal cost of Elon Musk’s anti-authoritarian takeover of Twitter. Turns out that authority figures have a lot of weapons, many grounded in law, and Twitter is at risk of being on the receiving end of those weapons. Brian Fleming explores the apparently unkillable notion that the Committee on Foreign... Continue Reading
We open this episode of the Cyberlaw Podcast by considering the (still evolving) results of the 2022 midterm election. Adam Klein and I trade thoughts on what Congress will do. Adam sees two years in which the Senate does nominations, the House does investigations, and neither does much legislation. Which could leave renewal of the critically important... Continue Reading
The war that began with the Russian invasion of Ukraine grinds on. Cybersecurity experts have spent much of 2022 trying to draw lessons about cyberwar strategies from the conflict. Dmitri Alperovitch takes us through the latest lessons, cautioning that all of them could look different in a few months, as both sides adapt to the others’... Continue Reading
David Kris opens this episode of the Cyberlaw Podcast by laying out some of the massive disruption that the Biden Administration has kicked off in China’s semiconductor industry – and its Western suppliers. The reverberations of the administration’s new measures will be felt for years, and the Chinese government’s response, not to mention the ultimate... Continue Reading
We open today’s episode by teasing the Supreme Court’s decision to review whether section 230 protects big platforms from liability for materially assisting terror groups whose speech they distribute (or even recommend). I predict that this is the beginning of the end of the house of cards that aggressive lawyering and good press have built... Continue Reading
This episode features a much deeper, and more diverse, examination of the Fifth Circuit decision upholding Texas’s social media law. We devote the last half of the episode to a structured dialogue about the opinion between Adam Candeub and Alan Rozenshtein. Both have written about it already, Alan critically and Adam supportively. I lead off,... Continue Reading
The big news of the week was a Fifth Circuit decision upholding Texas social media regulation law. It was poorly received by the usual supporters of social media censorship but I found it both remarkably well written and surprisingly persuasive. That does not mean it will survive the almost inevitable Supreme Court review but judge... Continue Reading
Gus Hurwitz brings us up to speed on tech bills in Congress. They are all dead, but some of them don’t know it yet. The big privacy bill, American Data Privacy and Protection Act, was killed by the left, but I argue that it’s the right that should be celebrating, since the bill would have... Continue Reading
This is our return-from-hiatus episode. Jordan Schneider kicks things off by recapping passage of a major U.S. semiconductor-building subsidy bill, while new contributor Brian Fleming talks with Nick Weaver about new regulatory investment restrictions and new export controls on (artificial Intelligence (AI) chips going to China. Jordan also covers a big corruption scandal arising from... Continue Reading
Just when you thought you had a month free of the Cyberlaw Podcast, it turns out that we are persisting, at least a little. This month we offer a bonus episode, in which Dave Aitel and I interview Michael Fischerkeller, one of three authors of “Cyber Persistence Theory: Redefining National Security in Cyberspace.” The book... Continue Reading
As Congress barrels toward an election that could see at least one house change hands, efforts to squeeze big bills into law are mounting. The one with the best chance (and better than I expected) would drop $52 billion in cash and a boatload of tax breaks on the semiconductor industry. Michael Ellis points out that this... Continue Reading
Kicking off a packed episode, the Cyberlaw Podcast calls on Megan Stifel to cover the first Cyber Safety Review Board (CSRB) report. The CSRB does exactly what those of us who supported the idea hoped it would do – provide an authoritative view of how the Log4J incident unfolded along with some practical advice for... Continue Reading
Dave Aitel introduces a deliciously shocking story about lawyers as victims and – maybe – co-conspirators in the hacking of adversaries’ counsel to win legal disputes. The trick, it turns out, is figuring out how to benefit from hacked documents without actually dirtying one’s hands with the hacking. And here too, a Shakespearean Henry (II... Continue Reading
For decades, U.S. cyber exploits were notoriously lawyer-ridden, to the point where it was a key element of attribution. But it looks like Israel has matched and surpassed U.S. cyberwarriors. In an attack claimed by some “hacktivist” group but widely attributed to Israel, Nate Jones reports, several Iranian mills shut down in a flood of... Continue Reading
It’s that time again on the Congressional calendar. All the big, bipartisan tech initiatives that looked so good a few months ago are beginning to compete for time on the floor like fat men desperate to get through a small door. And tech lobbyists are doing their best to handicap the bills they hate while... Continue Reading
This episode of the Cyberlaw Podcast begins by digging into a bill more likely to transform tech regulation than most of the proposals you’ve actually heard of – a bipartisan effort to repeat U.S. Senator John Cornyn’s bipartisan success in transforming the Committee on Foreign Investment in the United States (CFIUS) four years ago. The... Continue Reading
This bonus episode of the Cyberlaw Podcast is an interview with Amy Gajda, author of “Seek and Hide: The Tangled History of the Right to Privacy.” Her book is an accessible history of the often obscure and sometimes “curlicued” interaction between the individual right to privacy and the public’s (or at least the press’s) right... Continue Reading
This episode of the Cyberlaw Podcast is dominated by things that U.S. officials said in San Francisco last week at the Rivest-Shamir-Adleman (RSA) conference. We summarize what they said and offer our views of why they said it. Bobby Chesney, returning to the podcast after a long absence, helps us assess Russian warnings that the... Continue Reading
If you’ve been worrying about how a leaky U.S. government can possibly compete with China’s combination of economic might and autocratic government, this episode of the Cyberlaw Podcast has a few scraps of good news. The funniest, supplied by Dave Aitel, is the tale of the Chinese gamer who was so upset at the online performance... Continue Reading
At least that’s the lesson that Paul Rosenzweig and I distill from the recent 11th Circuit decision mostly striking down Florida’s law regulating social media platforms’ content “moderation” rules. We disagree flamboyantly on pretty much everything else – including whether the Court will intervene before judgment in a pending 5thCircuit case where the appeals court... Continue Reading
This week’s Cyberlaw Podcast covers efforts to pull the Supreme Court into litigation over the Texas law treating social media platforms like common carriers and prohibiting them from discriminating based on viewpoint when they take posts down. I predict that the Court won’t overturn the appellate decision staying an unpersuasive district court opinion. Mark MacCarthy and I... Continue Reading
Is the European Union (EU) about to rescue the FBI from Going Dark? Jamil Jaffer and Nate Jones tell us that a new directive aimed at preventing child sex abuse might just do the trick, a position backed by people who’ve been fighting the bureau on encryption for years. The Biden administration is prepping to... Continue Reading
Nick Weaver kicks off a wide-ranging episode by celebrating Treasury’s imposition of sanctions on a cryptocurrency mixer for facilitating the laundering of stolen cryptocurrency. David Kris calls on Justice to step up its game in the face of this competition, while Nick urges Treasury to next sanction Tornado Cash — and explains why this would... Continue Reading
Retraction: An earlier episode of the Cyberlaw Podcast may have left the impression that I think Google hates mothers. I regret the error. It appears that, in reality, Google only hates Republican mothers who are running for office. But to all appearances, Google really, really hates them. A remarkable, and apparently damning study disclosed that during... Continue Reading
I’m unable to resist pointing out the profound bias built into everything Silicon Valley does these days. Google, it turns out, is planning to tell enterprise users of its word processor that words like “motherboard” and “landlord” are insufficiently inclusive for use in polite company. We won’t actually be forbidden to use those words. Yet.... Continue Reading
Whatever else the pundits are saying about the use of cyberattacks in the Ukraine war, Dave Aitel notes, they all believe it confirms their past predictions about cyberwar. Not much has been surprising about the cyber weapons the parties have deployed, Scott Shapiro agrees. The Ukrainians have been doxxing Russia’s soldiers in Bucha and its... Continue Reading
The theme of this episode of the Cyberlaw Podcast is, “Be careful what you wish for.” Techlash regulation is burgeoning around the world. Mark MacCarthy takes us through a week’s worth of regulatory enthusiasm. Canada is planning to force Google and Facebook to pay Canadian news media for links. It sounds simple, but arriving at the... Continue Reading
Spurred by a Cyberspace Solarium op-ed, Nate Jones gives an overview of cybersecurity worries in the maritime sector, where there is plenty to worry about. I critique the U.S. government’s December 2020 National Maritime Cybersecurity Strategy, a 36-page tome that, when the intro and summary and appendices and blank pages are subtracted, offers only eight pages... Continue Reading
With the U.S. and Europe united in opposing Russia’s attack on Ukraine, a few tough transatlantic disputes are being swept away – or at least under the rug. Most prominently, the data protection crisis touched off by Schrems 2 has been resolved in principle by a new framework agreement between the U.S. and the EU.... Continue Reading
On March 24, Utah Governor Spencer Cox signed into law the Utah Consumer Privacy Act, which gives state residents the right to know what personal information businesses collect about them, to require businesses to delete their personal information, and to opt out of the sale of their data or its use in targeted advertising. Utah... Continue Reading
A special reminder that we will be doing episode 400 live on video and with audience participation on March 28, 2022 at noon Eastern daylight time. So, mark your calendar and when the time comes, use this link to join the audience: https://riverside.fm/studio/the-cyberlaw-podcast-400 See you there! Please note that using this link on a mobile... Continue Reading
A special reminder that we will be doing episode 400 live on video and with audience participation on March 28, 2022 at noon Eastern daylight time. So mark your calendar and when the time comes, use this link to join the audience: https://riverside.fm/studio/the-cyberlaw-podcast-400 See you there! For the third week in a row, we lead... Continue Reading
https://www.steptoe.com/podcasts/TheCyberlawPodcast-397.mp3Much of this episode is devoted to the new digital curtain falling across Europe. Gus Horwitz and Mark-MacCarthy review the tech boycott that has seen companies like Apple, Samsung, Microsoft and Adobe pull their service from Russia. Nick Weaver describes how Russia cracked down on independent Russian media outlets and blocked access to the websites of foreign media including the BBC and Facebook. Gus reports on an apparent Russian decision to require all servers and domains to transfer Russian zone, thereby disconnecting itself from the global internet.
Mark describes how private companies in the U.S. have excluded Russian media from their systems, including how DirecTV’s decision to drop RT America led the Russian 24-hour news channel to shutter its operations. In contrast, the EU officially shut down all RT and Sputnik operations, including their apps and websites. Nick wonders if the enforcement mechanism is up to the task of taking down the websites. Gus, Dave and Mark discuss the mythmaking in social media about the Ukrainian war such as the Ghost of Kyiv, and wonder if fiction might do some good to keep up the morale of the besieged country.
Dave Aitel reminds us that despite the apparent lack of cyberattacks in the war, more might be going on under the surface. He also he tells us more about the internal attack that affected the Conti Ransomware gang when they voiced support for Russia. Nick opines that cryptocurrencies do not have the volume to serve as an effective way around the financial sanctions against Russia. Sultan Meghji agrees that the financial sanctions will accelerate the move away from the dollar as the world’s reserve currency and is skeptical that a principles-based constraint will do much good to halt that trend.
A few things happened other than the war in Ukraine, including President Biden’s first state of the union address. Gus notices that much of the speech was devoted to tech. He notes that the presence in the audience of Frances Haugen, the Facebook whistleblower, highlighted Biden’s embrace of stronger online children’s privacy laws and that the presence of Intel CEO Patrick Gelsinger gave the President the opportunity to pitch his plan to support domestic chip production.
Sultan and Dave discuss the cybersecurity bill that passed out of the Senate unanimously. It would require companies in critical sectors to report cyberattacks and ransomware to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA). They also analyze the concerns that companies have about providing information to the FBI. Dave thinks the bills that were discussed in this week’s House Commerce hearing to hold Big Tech accountable, respond to wide-spread public concerns about tech’s surveillance business model, but still he thinks they are unlikely to make it through the process to become law.
Gus says that Amazon’s certification that it has responded to the Federal Trade Commission’s inquiries about its proposed $6.5 billion MGM merger triggers a statutory deadline for the agency to act. It is not the company’s fault, he says, that the agency has a 2-2 between Democrats and Republicans that will likely prevent them opposing the merger in time. I take the opportunity to note that the Senate Commerce committee sent the nominations of Alvaro Bedoya for the Federal Trade Commission and Gigi Sohn for the Federal Communications Commission to the Senate floor, but that it would likely be several months before the full Senate would act on the nominations.
Finally, Nick argues that certain measures in the European Commission’s proposed digital identity framework, aiming to improve authentication on the web, would in practice have the opposite effect of dramatically weakening web security.
Download the 397th Episode (mp3).
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-396.mp3Much of this episode is devoted to how modern networks and media are influencing what has become a major shooting war between Russia and Ukraine. Dmitri Alperovitch gives a sweeping overview. Ukraine and its President, Volodymyr Zelensky, clearly won the initial stages of the war in cyberspace, turning broad Western sympathy into a deeper commitment with short videos from downtown Kyiv at a time when Zelensky was expected to be racing for the border. The narrative of determined Ukrainian resistance and hapless Russian arrogance was set in cement by the end of the week, and Zelensky’s ability to casually dial in to EU ministers’ meetings (and just as casually say that this might be the last time the ministers saw him alive) changed official Europe’s view of the conflict permanently. Putin’s failure to seize Ukraine’s capital and telecom facilities in the first day of the fight may mean a long, grinding conflict.
Russia is doing its best to control the narrative on Russian networks by throttling Facebook, Twitter, and other Western media. And it’s essentially telling those companies that they need to distribute pro-Russian media in the West if they want a future in Russia. Dmitri believes that that’s not a price Silicon Valley will pay for access to a country where every other bank and company is already off-limits due to Western sanctions. Jane Bambauer weighs in with the details of Russia’s narrative-control efforts – and their failure.
And what about the cyber-attacks that press coverage led us to expect in this conflict between two technically capable adversaries? Nate Jones and Dmitri agree that, while network wiping and ransomware have occurred, their impact on the battle has not been obvious. Russia seems not to have sent its A-team to take down any of Ukraine’s critical infrastructure. Meanwhile, as Western nations pledge more weapons and more sanctions, Russian cyber reprisals have been scarce, perhaps because Western counter-reprisals are clearly being held in reserve.
All that said, and despite unprecedented financial sanctions and export control measures, initiative in the conflict remains with Putin, and none of the panel is looking forward to finding out how Putin will react to Russia’s early humiliations in cyberspace and on the battlefield.
In other tech news, the EU has not exactly turned over a new leaf when it comes to milking national security for competitive advantage over U.S. industry. Nate and Jane unpack the proposed European Data Act, best described as an effort to write a GDPR (General Data Protection Regulation) for nonpersonal data. And, as always, as a European effort to regulate a European tech industry into existence.
Nate and I dig into a Foreign Affairs op-ed by Chris Inglis, the Biden administration’s National Cyber Director. It calls for a new Cyber Social Contract between government and industry. I CTRL-F for “regulation” and don’t find the word, likely thanks to White House copy editors, but the op-ed clearly thinks that more regulation is the key to ensuring public-private cooperation.
Jane reprises a story from the estimable “Rest of World” tech site. It turns out that corrupt and abusive companies and governments have better tools for controlling their image than Vladimir Putin – all thanks to the European Parliament and the U.S. Congress, which approved GDPR and the Digital Millennium Copyright Act respectively. These turn out to be great tools for suppressing stories that make third-world big shots uncomfortable. I remind the audience once again that Privacy mainly Protects the Privileged and the Powerful.
In closing, Jane and I catch us up on the IRS’s latest position on face recognition – and the wrongheadedness of the NGOs campaigning against the technology.
Download the 396th Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets
https://www.steptoe.com/podcasts/TheCyberlawPodcast-395.mp3* Troops and sanctions and accusations are coming thick and fast in Ukraine as we record the podcast. Michael Ellis draws on his past experience at the National Security Council (NSC) to guess how things are going at the White House, and we both speculate on whether the conflict will turn into a cyberwar that draws the United States in. Neither of us thinks so, though for different reasons. * Meanwhile, Nick Weaver reports, the Justice Department is gearing up for a fight with cryptocurrency criminals. Nick thinks it couldn’t happen to a nicer industry. Michael and I contrast the launching of this initiative with the slow death of the China initiative at the hands of a few botched prosecutions and a whole lot of anti-American racial political correctness. * Speaking of political correctness, Michael and I do a roundup of news (all bad) about face recognition. District Judge Sharon Johnson Coleman (ND IL) gets our prize for least persuasive first amendment analysis of the year in an opinion holding that collecting and disclosing public data about people (what their faces look like) can be punished with massive civil liability even if no damages have been shown. After all, the judge declares in an analysis that covers a full page and a half (double-spaced), the Illinois law imposing liability “does not restrict a particular viewpoint nor target public discussion of an entire topic.” But not to worry; the first amendment is bound to get a heavy workout in the next big face recognition lawsuit – the Texas Attorney General’s effort to extract hundreds of billions of dollars from Facebook for similarly collecting the face of their users. My bet? This one will make it to the Supreme Court. Next, we review the IRS’s travails in trying to use face recognition to verify taxpayers who want access to their returns. I urge everyone to read my latest op-ed in the Washington Post criticizing the Congressional critics of the effort. Finally, I mock the wokesters at Amnesty International who think that people who live in high-crime New York neighborhoods should be freed from the burden of being able to identify and jail street criminals using facial recognition. After all, if facial recognition were more equitably allocated, think of the opportunity to identify Staten Island scofflaws who let their dogs poop on the sidewalk. * Nick and I dig into the pending collision between European law enforcement agencies and privacy zealots in Brussels who want to ban EU use of NSO’s Pegasus surveillance tech. Meanwhile, in a rare bit of good news for Pegasus’s creator, an Israeli investigation is now casting doubt on press reports of Pegasus abuse. * Finally, Michael and I mull over the surprisingly belated but still troubling disclosures about just how opaque TikTok has made its methods of operation. Two administrations in a row have started out to do something about this suspect app, and neither has delivered – for reasons that demonstrate the deepest flaws of both.
Download the 395th Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-394.mp3The Cyberlaw Podcast has decided to take a leaf from the (alleged) Bitcoin Bandits’ embrace of cringe rap. No more apologies. We’re proud to have been cringe-casting for the last six years. Scott Shapiro, however, shows that there’s a lot more meat to the bitcoin story than embarrassing social media posts. In fact, the government’s filing after the arrest of Ilya Lichtenstein and Heather Morgan paints a forbidding picture of how hard it is to actually cash $4.5 billion in bitcoin. That’s what the government wants us to think, but it’s persuasive nonetheless, and both Scott and David Kris recommend it as a read.
Like the Rolling Stones performing their greatest hits from 1965 on tour this year, U.S. Senator Ron Wyden of Oregon is replaying his favorite schtick from 2013 or so – complaining that the government has an intelligence program that collects some U.S. person data under a legal theory that would surprise most Americans. Based on the Privacy and Civil Liberties Oversight Board staff recommendations, Dave Aitel and David Kris conclude that this doesn’t sound like much of a scandal, but it may lead to new popup boxes on intel analysts’ desktops as they search the resulting databases.
In an entirely predictable but still discouraging development, Dave Aitel points to persuasive reports from two forensics firms that an Indian government body has compromised the computers of a group of Indian activists and then used its access not just to spy on the activists but to load fake and incriminating documents onto their computers.
In the EU, meanwhile, crisis is drawing nearer over the EU General Data Protection Regulation (GDPR) and the European Court of Justice decision in the Schrems cases. David Kris covers one surprising trend. The Court may have been aiming at the United States, but its ruling is starting to hit European companies who are discovering that they may have to choose between Silicon Valley services and serious liability. That’s the message in the latest French ruling that websites using Google Analytics are in breach of GDPR. Next to face the choice may be European publishers who depend on data-dependent advertising whose legality the Belgian data protection authority has gravely undercut.
Scott and I dig into the IRS’s travails in trying to implement facial recognition for taxpayer access to records. I reprise my defense of face recognition in Lawfare. Nobody is going to come out of this looking good, Scott and I agree, but I predict that abandoning facial recognition technology is going to mean more fraud as well as more costly and lousier service for taxpayers.
I point to the only place Silicon Valley seems to be innovating – new ways to show conservatives that they should just die already. Airbnb has embraced the Southern Poverty Law Center, whose business model is labeling mainstream conservative groups as “hate” mongers. It told Michelle Malkin that her speech at a SPLC “hate” conference meant that she was forever barred from using Airbnb – and so was her husband. By my count that’s guilt by association three times removed. Equally remarkable, Facebook is now telling Bjorn Lonborg that he cannot repeat true facts if he’s using them to support the Wrong Narrative. We’re not in content moderation land any more if truth is not a defense, and tech firms that supply real things for real-life can deny them to people whose views they don’t like.
Scott and I unpack the EARN IT Act (Eliminating Abusive and Rampant Neglect of Interactive Technologies Act), again reported out of committee with a chorus of boos from privacy NGOs. We also note that supporters of getting tough on the platforms over child sex abuse material aren’t waiting for EARN IT. A sex trafficking lawsuit against Pornhub has survived a section 230 challenge.
Download the 394th Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-393.mp3Another week, another industry-shaking antitrust bill from Senate Judiciary: This time, it’s the Open App Store Act, and Mark MacCarthy reports that it’s got more bipartisan support than the last one. Maybe that’s because there are only two losers, and only one big loser: Apple. The bill would force an end to Apple’s app store monopoly. Apple says that would mean less privacy and security for users; Mark thinks there’s something to that, but Bruce Schneier thinks that’s hogwash. Our panel is mostly on Bruce’s side of the debate.”
Meanwhile, Apple’s real contribution to the debate is the enormous middle finger it’s extending to other regulators trying to rein in Apple’s app store fees.
Megan Stifel reports that Anne Neuberger, the deputy national security adviser for cyber issues, has been traveling Europe to beef up our allies’ cyber defenses as a Russian war looms in Ukraine. Details about how she’s doing that are unsurprisingly sparse.
Meanwhile, Europe is finally coming to grips with the logical consequences of the EU General Data Protection Regulation (GDPR) for the internet as we know it. Turns out, the whole thing is illegal in the EU. The Belgian data protection authority brought down a big chunk of the roof in holding the IAB liable for adtech bidding procedures that violate the GDPR. And a German court fined some poor website for using Google fonts, which are downloaded from Google and tell that company (located in gasp America) a lot about every user who goes to the website. Nick Weaver explains how the tech works. I argue that the logical consequence is that GDPR outlaws providing IP addresses to get data from another site – which is kinda how the internet functions. Nick thinks the damage can be limited to Facebook, Google, and surveillance capitalism, so he isn’t shedding any tears over that outcome. This leads us to a broader discussion of Facebook’s travails, as its revenue model becomes the target of regulators, Apple, TikTok, Google, liberals, and conservatives — all while subscriber growth starts to stall.
I remind listeners of Baker’s Law of Evil Technology: “You won’t know how evil a technology can be until the engineers who built it begin to fear for their jobs.”
Megan and I break down the American Airlines lawsuit against The Points Guy over an app that syncs frequent flyer data. I predict American will lose – and should.
Mark and I talk about the latest content moderation flareups, from Spotify and Rogan to Gofundme’s defunding of the Canadian lockdown protest convoy. Mark flogs his Forbes article, and I flog my latest Cybertoonz commentary on tech-enabled content moderation. Mark tells me to buckle up, more moderation is coming.
Megan tells the story of PX4, who is hacking North Korea because it hacked him. Normally, that’s the kind of moxie that appeals to me, but this effort feels a little amateurish and ill-focused.
In quicker hits, Nick and I debate the flap over ID.me, and I try to rebut claims that face recognition has a bias problem. Megan explains the brief fuss over a legislative provision that would have enabled more and faster Treasury regulation of cryptocurrency. Speaking of section 230, Mark touches on the Senate’s latest version of the EARN IT bill, as the downsizing continues. I express surprise that Facebook would not only allow foreigners to solicit help from human traffickers on the site but would put the policy in writing.
Download the 393rd Episode (mp3).
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-392.mp3All of Washington is back from Christmas break, and suddenly the Biden Administration is showing a sharp departure from the Obama and Clinton years where regulation of Big Tech is concerned. Regulatory swagger is everywhere.
Treasury regulatory objections to Facebook’s cryptocurrency project have forced the Silicon Valley giant to abandon the effort, Maury Shenk tells us, and the White House is initiating what looks like a major interagency effort to regulate cryptocurrency on national security grounds. Federal Energy Regulatory Commission is getting serious (sort of) about monitoring the internal security of electric grid systems, Tatyana Bolton The White House and Environmental Protection Agency are launching a “sprint” to bring some basic cybersecurity to the nation’s water systems. Gary Gensler is full of ideas for expanding the Security and Exchange Commission’s security requirements for brokers, public companies, and those who service the financial industry. The Federal Trade Commission is entertaining a rulemaking petition that could profoundly affect companies now enjoying the gusher of online ad money generated by aggregating consumer data.
In other news, Dave Aitel gives us a thoughtful assessment of why the log4j vulnerability isn’t creating as much bad news as we first expected. It’s a mildly encouraging story of increased competence and speed in remediation, combined with the complexity (and stealth) of serious attacks built on the flaw.
Dave also dives deep on the story of the Belarussian hacktivists (if that’s what they are) now trying to complicate Putin’s threats against Ukraine. It’s hard to say whether they’ve actually delayed trains carrying Russian tanks to the Belarussian-Ukrainian border, but this is one group that has consistently pulled off serious hacks over several years as they harass the Lukashenko regime.
In a blast from the past, Maury Shenk takes us back to 2011 and the Hewlett Packard (HP)-Autonomy deal, which was repudiated as tainted by fraud almost as soon as it was signed. Turns out, HP is getting a long-delayed vindication, as Autonomy’s founder and CEO is found liable for fraud and ordered extradited to the U.S. to face criminal charges. Both rulings are likely to be appealed, so we’ll probably still be following court proceedings over events from 2011 in 2025 or later.
Speaking of anachronistic court proceedings, the EU’s effort to punish Intel for abusing its dominant position in the chip market has long outlived Intel’s dominant position in the chip market, and we’re nowhere near done with the litigation. Intel won a big decision from the European general court, Maury tells us. We agree that it’s only the European courts that stand between Silicon Valley and a whole lot more European regulatory swagger.
Finally, Dave brings us up to date on a New York Times story about how Israel used NSO’s hacking capabilities in a campaign to break out of years of diplomatic isolation.
Download the 392nd Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-391.mp3That’s the question I had after reading Law and Policy for the Quantum Age, by Chris Hoofnagle and Simson Garfinkel. It’s a gracefully written and deeply informative look at the commercial and policy prospects of quantum computing and several other (often more promising) quantum technologies, including sensing, communications, and networking. And it left me with the question that heads this post. So, I invited Chris Hoofnagle to an interview and came away thinking the answer is “close to half – and for sure all the quantum projects grounded in fear and envy of the presumed capabilities of the National Security Agency of the United States.” My exchange with Chris makes for a bracing and fast-paced half hour of futurology and policy and not to be missed.
Also, not to be missed: Conservative Catfight II – Now With More Cats. That’s right, Jamil Jaffer and I reprise our past debate over Big Tech regulation, this time focusing on 2992, the American Innovation and Choice Online Act, just voted out of the Senate Judiciary committee with a bipartisan set of supporters and detractors. In essence, the bill would impose special “no self-preferencing” obligations on really large platforms. Jamil, joined by Gus Hurwitz, thinks this is heavy handed government regulation for a few unpopular companies, and completely unmoored from any harm to consumers. Jordan Schneider weighs in to point out that it is almost exactly the solution chosen by the Chinese government in its most recent policy shift. I argue that platforms are usually procompetitive when they start but inherently open to a host of subtle abuses once entrenched, so only a specially crafted rule will prevent a handful of companies achieving enormous economic and political power.
Doubling down on controversy, I ask Nate Jones to explain Glenn Greenwald’s objections to the subpoena practices of Congress’s Jan. 6 Committee. I conclude that the committee’s legal arguments boil down to “When Congress wrote rules for government, it clearly didn’t intend for the rules to apply to Congress.” And that Greenwald is right in arguing that the Supreme Court in the 1950s insisted that Communists be treated better than the Jan.6 committee is treating anyone even tangentially tied to the attack on the Capitol.
Nate and I try to figure out what Forbes was smoking when it tried to gin up a scandal from a standard set of metadata subpoenas to WhatsApp. Whatever it was, Forbes will need plenty of liquids and a few hours in a dark quiet room to recover.
In quick hits, Gus explains what it means that the Biden administration is rewriting the DOJ/FTC merger guidelines: essentially, the more the administration tries to make them mean, the less deference they’ll get in court. And Jordan and I puzzle over the emphasis on small and medium business in China’s latest five-year plan for the digital economy.
Download the 391st Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-390.mp3Just one week of antitrust litigation news shows how much turbulence Facebook and Google are encountering. Michael Weiner gives us a remarkably compact summary of the many issues, from deeply historical (Facebook’s purchase of Instagram) to cutting edge tech (complaints about Oculus self-preferencing). In all, he brings us current on two state AG case, two FTC cases, and one DOJ case against the twin giants of surveillance advertising.
Speaking of litigation, no major new technology has been greeted with more litigation in its infancy than face recognition. So this week we interview Hoan Ton-That, CEO of what must be the most controversial tech startup in decades – Clearview AI. We probe deeply into face recognition’s reputation for bias, and what the company is doing about it. Hoan is clearly taking the controversy in stride and confident that the technology will overcome efforts to turn it toxic. Meanwhile, I note, the debate is clearing out what would have been formidable competition from the likes of Microsoft, Amazon, and IBM. If you think face recognition should be banned as racist, sexist, and inaccurate, this interview will make you think.
Meanwhile, David Kris notes, rumors of war are rampant on the Russian-Ukrainian border – and in cyberspace. So far, it’s a bit of a phony cyberwar, featuring web defacing and dormant file wipers. But it could blow up at any time, and we may be surprised how much damage can be done with a keyboard.
Speaking of damage done with a keyboard, open source software is showing how much damage can be done without even trying (although some developers are in fact trying pretty hard). Nick Weaver and I dig into the Log4j and other messes, and the White House effort to head off future open source debacles.
David is in charge of good news this week. It looks as though Russia has arrested a bunch of REvil coconspirators, including one person that the White House holds responsible for the Colonial Pipeline attack. It’s surely not a coincidence that this hint of cooperation from Vladimir Putin comes when he’d very much like to have leverage on the Biden administration over Ukraine.
The EU is now firmly committed to cutting off the continent from a host of technologies offered, often free, by Silicon Valley. Google Analytics is out, according to Austrian authorities, even if this means accusing the European Parliament of violating European law. Nick reminds us that this isn’t all the services that could be cut off. Google Translate also depends on transatlantic data flows and could become unavailable in Europe. I offer an incendiary solution to that problem.
Secure messaging is still under attack, but this week its European governments taking the shots. The UK government is planning an ad campaign against end-to-end encryption, and Germany is growling about shutting down Telegram for allowing hate speech. Nick issues a heartfelt complaint about the disingenuity of both sides in the crypto debate.
Speaking of Germans who can’t live up to their reputation on protecting privacy, Nick notes that German police did exactly what Gapple feared, using a coronavirus contact-tracing app to find potential witnesses. Meanwhile, in good news, let’s not forget Twitter, whose woke colonialism led it to suspend Nigeria’s president for threatening secessionists with war. Turns out it was easier to go to war with Twitter, which has now unconditionally surrendered to the Nigerian government.
Finally, I claim kinship with Joe Rogan as one of the podcasters that bien pensant NGOs and academics hope to censor. My plan is to create a joint defense fund to which Joe and I will each contribute 1% of our podcasting revenues.
Download the 390th Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-389.mp3The Federal Trade Commission’s (FTC) other foot, I argue, is lodged firmly in its mouth. Tatyana Bolton defends the agency, which released what can only be described as a regulatory blog post in response to the log4j vulnerability, invoking the $700 million in fines imposed on Equifax to threatening “to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j.” She stresses that this is the best way to get companies to patch quickly and notes that only “reasonable steps” are required. I think we’ll hear that a lot from the FTC, now that it turns out that fixing the Log4j mess is going to require a lot more that regulatory flexing. Especially, since the FTC’s blog post seems to pull back from its tough-guy pose when talking about the open source maintainers who actually have to do much of the patch generation; unlike the companies it threatened with wrath, the FTC understands that open source coders “don’t always have adequate resources and personnel,” something the FTC “will consider as we work to address the root issues that endanger user security.”
Speaking of fallible regulators, Glenn Gerstell gives us a tour of China’s tech regulatory landscape, and the remarkable decline in the fortunes of consumer tech firms in that country, as the New York Times covered in detail last week. Is that good news for Silicon Valley or U.S. competitiveness? Sadly, probably not, I conclude.
Mark MacCarthy explains why the proposal to marry cryptocurrency to Signal is causing angst among Signal’s supporters about the end-to-end encrypted service’s “regulatory attack surface.”
Glenn covers the latest story about security risks and telecom gear from China.
Mark and I dig into the growing enthusiasm for regulating big Silicon Valley companies as gatekeepers. The Germans are about to apply that approach to Google. And the South Koreans are doing the same to Apple and its app store payment policies.
Tatyana notes the press coverage about possible tensions between two talented and strong cybersecurity officials in the White House: Anne Neuberger and Chris Inglis. I put Glenn on the spot about claims that Anne has “a particular tendency to clash with lawyers.” That would only make me love her more, but Glenn (who, as the National Security Agency’s top lawyer, worked with her for years) absolves her of the charge.
Mark and I handicap the probability that the plaintiff will succeed in a highly charged lawsuit against Facebook/Meta Platforms for bringing together the boogaloo conspirators who killed a federal protective officer. It’s a long shot, but if “negligent design” turns out to create liability for software and algorithms, Signal will have an even greater attack surface than its fans are worried about.
Glenn explains the charges brought in China against Walmart for breaches of cybersecurity laws (hint: it’s mostly not breaches of cybersecurity laws).
Speaking of surprises that aren’t surprises, Glenn also covers the announcement by Lloyd’s of London that cyber insurance won’t cover cyber-attacks attributable to nation-states.
Finally, I devote a few minutes to rant about the Justice Department’s decision to expand charges against Joe Sullivan, Uber’s former chief information security officer, for his role in payment of “bug bounties” to hackers who looked more like crooks than bounty hunters. More than a year after charging Sullivan with obstruction of justice, Justice piled on new charges of wire fraud for failing to tell Uber’s drivers about the breach. Glenn and I both question the decision to do this without any new facts to base the charges on. And I point out that the result of exposing breach response into a wire fraud charges will (or should be) fatal to the FBI’s desire to be called in while companies are dealing with breaches. If the company delays notice to the public for longer than the government thinks proper, wire fraud charges start to hang heavy in the air. If so, why would any General Counsel want to have an FBI agent sitting in the room for the debate about when notice to customers is required?
Download the 389th Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-388.mp3One of the good things about coming back from Christmas break are all the deep analyses that news outlets save up to publish over the holidays – especially those they can report from countries where celebrating Christmas isn’t that big a deal. At least that’s how I account for the flood of deep media dives on China technology issues. Megan Stifel takes us through a couple. The first is a Washington Post article on China using its tools for measuring internal dissent online and focusing them on the rest of the world. The second is an New York Times article that tells us what tools the Chinese government can use when the rest of the world says things it doesn’t like. Utterly unsurprising, to me at least, is that social media companies like Twitter have become hapless enablers of China’s speech police. Later in the podcast, Megan covers another story in the same vein – the growing global unease about China’s success in building Logink, a global logistics and shipping database.
Scott Shapiro and Nick Weaver walk us through the conviction of a Harvard professor for lying about his China ties. It may be too cynical to say that the Justice Department wanted Professor Charles Lieber especially badly because he’s not Asian, but there’s no doubt he’ll be Exhibit A when it defends the China Initiative against claims of ethnic profiling.
Megan takes us through another great story of hack-enabled great story of hack-enabled insider trading, helicopters to Zermatt, dueling extraditions, and as the piece de resistance, hints we may learn more about Russian interference with the 2016 presidential election.
Scott explains how Apple AirTags are being used to track people. Nick gives us a feel for just how hard it is to separate good from bad in designing Air Tags. I suggest that this is a problem we could leave to the plaintiffs’ lawyers.
Nick lays out the economics of hacking as a service and introduces us to yet another company in that business – Cytrox. No one seems to last long in the business without changing their name. Nick and I explore the reasons for that, and the possibility that soon the teams that work for these companies will move on every year or two.
Nick also explains why bitcoin isn’t always a cybercriminal’s best friend. It turns out that cryptography isn’t proof against rubber hose cryptanalysis, or maybe even plea bargaining.
Drawing from research I’m doing for an article about why bias in face recognition has been overblown, I note that Canada, France, and the entire Western world is imposing sanctions on Clearview AI for privacy violations, but Clearview AI is the only U.S. company doing as good or better at face recognition than Chinese and Russian suppliers. I argue that’s because a dubious bias narrative has forced IBM, Amazon, Microsoft, and Meta to retreat from the market, leaving us at the mercy of Russian and Chinese tech.
Megan explains why financial regulators and not the FBI turn out to be the biggest enemies of end-to-end encryption, as they fine JPMorgan Chase a cool $200 million for using WhatsApp and other unbreakable encrypted messaging systems.
Finally, in quick hits,
- I point out that soft power isn’t always America’s friend, as shown by Intel’s apology to the Chinese public for obeying U.S. law, Apple’s determination to double down on a Chinese supply chain, and a SenseTime IPO that was enormously successful for everyone except U.S. sanctions and U.S. investors.
- Scott shows the remarkable erosion of Silicon Valley’s power in its conflicts with Putin’s Russia. Google and Meta are facing huge fines for not taking down content Russia doesn’t like. And the Russians whose content they have taken down are winning big judgements in Russia – so big that I’m expecting Breitbart to bring their next Big Tech censorship lawsuit in Moscow.
Download the 388th Episode (mp3).
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-387.mp3All the cyberlitigation that didn’t get filed, or decided, over Thanksgiving finally hit the fan last week, and we’re still cleaning up. But first, I have to ask Dave Aitel for sanity check a on Log4Shell.
Does it really deserve a 10 out of 10 for impact? And what does it mean for all the open source components buried in all our enterprise software? Dave’s only piece of good news is that some big projects were far enough behind in updates that they hadn’t built the flaw into their products.
In the first of several cyberlawsuits covered in this episode, Jamil Jaffer and I praise Google for a particularly comprehensive and creative approach to suing cybercriminals. RICO plus a boatload of computer privacy violations are at the heart of Google’s complaint against two criminals behind the Glupteba botnet. We note that the defendants deserve credit for their own creativity in using the blockchain to reconstitute their C2 infrastructure. If more criminals did that, Microsoft’s trademark approach – using trademark violations to seize botnet infrastructure – would be less effective. We note that this week Microsoft used litigation to take down a Chinese government network. Is it wrong to complain that Microsoft has been using this approach for long enough that botnets are only inconvenienced, not destroyed, by the tactic?
Maury Shenk digs into the remarkable report that Apple CEO Tim Cook promised $275 billion of investment to China. Five years ago. And we’re only finding out about it now. In secret. When Congress finally gets around to the cyber incident reporting bill that it bumped from the defense authorization act, maybe it will want to classify multibillion dollar deals with China as the kind of cyber incident that ought to be reported to anyone on the receiving end of corporate lobbying campaigns.
The Tenth Circuit finished its Thanksgiving by releasing a massive opinion upholding the constitutionality of Section 702 of FISA. Jamil Jaffer, who played a key role in the adoption of Section 702 walks us through the decision. The decision was 2-1, but not on the main ruling. Instead, the debate was over Article III and the “advisory” nature of FISA court opinions reviewing executive procedures under that section. I confess to some sympathy for the dissent but wonder how it would help the defendant to strike down that procedure.
Dave explains why Tor might not be a secure as we think. A mysterious and likely state sponsored actor. is running hundreds of malicious Tor relays. And to add insult to injury, the actor is openly lobbying against measures to cut down on malicious Tor relays.
But wait, there’s more cyberlitigation, and again Jamil talks us through it. A Saudi women’s rights activist has brought a CFAA lawsuit against DarkMatter and its expat American employees for an iPhone hack that she says got her arrested. I’m a little skeptical that the lawsuit will survive a Foreign Sovereign Immunities Act motion.
Maury and I question the wisdom of a recent Italian fine penalizing Amazon over a billion euros, mainly for preferencing sellers who sign up for Prime logistics
Dave tells the sad story of Ilya Sachkov, a Russian cybersecurity whiz kid and CEO who may have believed too much that everyone sees cybersecurity as a white hat enterprise. Word is that he may have been too helpful in unraveling the DNC attackers identities in 2016 and is now paying for it with a Russian treason charge.
Maury notes that the U.S. decision to blacklist the Chinese AI company SenseTime was carefully timed to guarantee disruption of SenseTime’s IPO. Whether the U.S. action will be more than a delaying tactic remains to be seen, but Maury is skeptical.
Maury notes that Wikileaks founder Julian Assange has lost an important battle as he fights extradition to the U.S., British court rules – The Washington Post. Jamil notes that the cyber incident reporting bill didn’t make it into the defense authorization act, as mentioned earlier. He is one of the few cybersecurity buffs who isn’t especially disappointed.
Maury and I disagree about a much-ballyhooed group of companies claiming to combat A.I. bias in hiring I’ll believe it when they actually expose their recommendations to public scrutiny.
For those who think bias in content moderation is not a thing, try spending ten minutes with this right-wing French candidate’s very effective campaign ad. Then ask yourself why exactly YouTube thought it wasn’t fit for children. My guess is that it was the ad’s effectiveness that YouTube really disapproved of.
Dave and I puzzle over the Biden administration’s unsatisfying `Initiative for Democratic Renewal’ – a big international get-together that got only cursory attention in the US, perhaps because its theme is still a little hard to find. And, finally, just to give me an excuse to publicize my latest Cybertoonz comic, Jamil asks for Western militaries what it means to “impose a cost” on ransomware gangs.
With that, the Cyberlaw Podcast bids farewell to 2021. We will return in January.
Download the 387th Episode (mp3).
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-386.mp3Federal district judge Robert Pitman has enjoined enforcement of Texas’s law regulating social media censorship. The ruling sparks a fight between me and Nate Jones that ranges from how much weight should be given to the speech rights of social media to the Kyle Rittenhouse verdict imposed by Facebook when it decided he was guilty and wouldn’t let anyone disagree. On the merits, as before, we agreed that the Obama appointee was on solid ground (for now) in applying the Tornillo line of cases saying that government should not directly regulate the editorial judgments of publishers. But the judge’s ruling on the transparency and due process requirements of the law suggests that he wasn’t prepared to give the law a fair shake. So, look for a competitive appeal on the topic and quite possibly a certiorari grant as well. By the time we stop beating this horse, he’s long past any possible right of self-defense.
Megan Stifel has an easier task: Explaining cybersecurity recommendations for rail and other surface transportation companies. The advice is mostly something that could have been offered in the 90s, so we both puzzle over the fierce resistance from industry. Maybe it’s the 24-hour requirement to notify TSA of cyber incidents.
Nate and I explore proposals from the Biden administration to muster a group of like-minded countries to curb sales of surveillance gear to authoritarian regimes. No doubt the initiative was reinforced by news that S. State Department phones were recently hacked exported spyware from Israel. But I think the whole project fails for a simple reason: authoritarian governments can buy all the surveillance gear they need from China, which is happy to sell it. In the absence of credible enforcement, condemning such sales is empty virtue signaling.
I mock an eminently mockable story from the Markup, claiming that the PredPol crime prediction software is racist because it urges the police to patrol more poor black neighborhoods than rich white ones. Then, when the authors finally notice that that’s where arrests are concentrated, they switch arguments and say that the prediction software must be useless because the same results could be reached without the software.
Speaking of stupid, Megan explains how a “smart contract” turned out to be anything but, allowing hackers to steal $31 million in digital coin.
I ask exactly how the hacker’s feat differs from really good lawyering.
Nate and I look at how well Russia is doing in bringing Twitter to heel with a mobile slowdown. Twitter hasn’t broken yet, but it’s clear that the authoritarians of the world are slowly winning their battle with Silicon Valley.
Megan tells us how a cybersecurity professional at Ubiquiti decided to stop riding with the hounds and to ride instead with the fox. Of course we all know how most fox hunts end for the fox, and this story is no exception.
In updates, I remind listeners of the elaborate gas-lighting effort put on by Jeff Bezos in trying to blame the Saudis and the National Enquirer for his brother-in-law’s leak of Bezos’s deeply embarrassing text messages. All the investigations that Bezos managed to get started are done now, and the verdict is in: the Saudis didn’t do it.
Megan and I note a Wall Street Journal article on how tough it is to be a spy in a world of smartphones, biometrics, and universal surveillance cameras. Our reaction: Yup.
And More!
Download the 386th Episode (mp3).
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-385.mp3This week we celebrated International Tech Policy Week, which happens every year around this time, when the American policymakers, the American execs who follow them, and the U.S. journalists who report on them all go home to eat turkey with their families and leave tech policy to the rest of the world.
Leading off a review of China’s contribution to the week, Paul Rosenzweig and Jordan Schneider cover Beijing’s pressure on Didi to delist from a S. stock exchange. If you believe it is about data security, I have a Chinese unicorn tech stock, soon to be half a unicorn, to sell you.
Jordan explains why China is also taking Tencent to the woodshed for not quite getting the message about who make the rules. In case you’re not getting the message, he also covers China’s decision to impose fines on tech firms for a decade’s worth of M&A deals.
David Kris turns what could have been a U.S. story – Insurers’ running for cover ransomware losses—international by focusing on a proposal from Lloyds of London.
Paul and I dig into a story that starts in the U.S. but soon moves abroad, Apple’s slightly weird computer fraud and abuse lawsuit against the international exploit firm, NSO Group. I point to other stories that seem to me to signal that tech hubris on this issue is out of control. Facebook is trying to stop undercover cops from using fake accounts to collect quasipublic information. And Apple is telling its customers when it discovers that they are the targets of state-sponsored malware. This is wholesale interference with law enforcement activity that in other contexts would simply be unexceptionable undercover work or lawful interception of communications. In Apple’s case, it’s egregious, since the company has not explained how it will manage to avoid blowing up legitimate counterterrorism and criminal investigations that are using malware because Apple has already foreclosed less dramatic options.
Meanwhile, in Israel, the demonization of NSO Group has led authorities to dramatically cut the number of countries to which spyware can be exported. Iran may not be on the list, but Israel seems to have exported plenty to that country, which is now returning the favor, as cyberconflict begins hitting ordinary citizens in both countries.
David, Paul, and I reveal our history-based prejudices as we examine the latest miniflap that briefly detained Congress’s proposed cyber incident reporting mandate – its failure to require simultaneous reporting to the FBI. That is a dumb idea, and the Senate seems to have treated it with exactly the amount of deference it deserved. At least that’s my view from inside the locker.
Jordan touches briefly on a Chinese province’s plan to construct a surveillance system for foreigners. He thinks there’s more (or maybe less) to the story than it appears. He also covers the U.S. decision to blacklist Chinese quantum computing companies, giving me a chance to divert him to coverage of the Endless Frontier Act and China’s peculiar decision to turn it into a BFD.
David and I dig into a proposed (and likely to pass) new UK law on IOT security that looks a lot like California’s law on the same topic.
In quick hits and updates, I note that Meta will have trouble delivering end-to-end encryption on Facebook and Instagram before 2023. And despite efforts to toxify the entire field and this company in particular, Clearview AI’s face recognition tool is performing very well against international competition. I also note that my research suggests that the whole “AI bias” narrative about face recognition, has been stuck in 2016 and has ignored the remarkable accuracy (and debiasing) strides the industry has made in recent years.
And More!
Download the 385th Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
https://www.steptoe.com/podcasts/TheCyberlawPodcast-384.mp3Among the many problems with the current social media enthusiasm for deplatforming is this question: What do you do with all the data generated by people you deplatformed?
Facebook’s answer, as you’d expect, is that Facebook can do what it wants with the data, which mostly means deleting it. Even if it’s evidence of a crime? Yes, says the platform, unless law enforcement asks us to save it. The legal fight over a deplatformed group that defended historical statues (and may have shot someone in the process) will tell us something about the – law of deplatformed data as will the fight over The Gambia’s effort to recover evidence of deplatformed human rights evidence. In the end, though, we need a law on this question. Because, given their track record in content moderation, leaving the question to the discretion of social media will translate into platforms’ preserving only evidence that hurts people they hate.
Tired: Data breach reporting. Wired: Cyber incident reporting. The unanimous view of our news panelists, Paul Rosenzweig and Dmitri Alperovitch, is that cyber policy has turned from reporting personal data breaches to reporting serious cyber intrusions no matter what data is compromised. The latest example is the financial regulators’ adoption of a rule requiring banks and similar institutions to report major cyber incidents within 36 hours of determination that one has occurred.
But who will make that determination and with what certainty? Dmitri’s money is on the lawyers. I think there’s a great ER-style drama in the process: “OK, I’m going to call it. No point in trying to keep this alive any longer. Time of determination is 2:07 pm.”
Back after a long absence, we add an interview to the news roundup. David “moose” Wolpoff and Dan MacDonnell of Randori explain the consternation over their startup’s use of a serious vulnerability to conduct realistic penetration tests of buttoned-up networks instead of reporting it right away to the software provider. They argue that the value of zero days for pentesting is great and the risk of harm low, if handled responsibly. In fact, the debate sounds a lot like the arguments around the table at a government Vulnerability Equities Process (“VEP”) meeting. And that makes me wonder whether the people pushing for a stricter VEP have any idea at all what they’re talking about.
Dmitri lays out the surprising complexity and sophistication of the Iranian attempt to influence the 2020 election. I’m less convinced. The Iranian effort failed, after all, and it resulted in the hackers’ indictment.
I dig into a recent brief by Hikvision claiming that the FCC lacks authority to bar sales of its products in the US. I’m only half convinced by the legal claim, but I am sure of this: The Hikvision argument has created an opportunity for some enterprising politician to sponsor quick, uncontroversial legislation giving the FCC the authority that Hikvision says it doesn’t have.
Dmitri explains the latest advance of the hardware hack known as It may not be deployed routinely even now, he says, but the exploit makes clear that we will never entirely secure our cyber infrastructure.
Paul and I agree that it’s perfectly legal for government to buy advertising data that shows citizens’ locations. We more or less agree that some restraint on sales of location data – at least to the Russian and Chinese governments and maybe to anybody – are in order.
Paul and I offer muted and squeamish criticism of a Big Report claiming that child sexual abuse is exploding online. There’s no doubt that it’s a problem that deserves more legal and platform effort, but the authors did their cause no favors by mixing kids exchanging nude selfies with truly loathsome material.
Dmitri and I perform a public service announcement about a scam that takes advantage of security habits that the banks have encouraged us to get used to. Zelle fraud is going to make us all regret those habits.
And hopefully it will finally get banks to use hardware tokens instead of text messages to verify our transactions.
Germany and Mandiant are at odds in attributing the government sponsor of the Ghostwriter hacking gang. Germany, backed by the EU, says it’s Russia. Mandiant says it’s Belarus.
Dmitri says “Never bet against Mandiant on attribution.” I can’t disagree.
Finally, Dmitri joins me in an appreciation of Alan Paller, who died last week. He was a major influence in cybersecurity, and a role model for successful entrepreneurs who want to give back using their institution-creating skills.
And More!
Download the 384th Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.