Skating on Stilts

Skating on Stilts -- the award-winning book

Now available in traditional form factor from Amazon and other booksellers.

It's also available in a Kindle edition.

And for you cheapskates, the free Creative Commons download is here.

272. Supply chain illuminati

What is the federal government doing to "illuminate" its supply chain and then excise compromised hardware and software? That’s what we ask Harvey Rishikof, coauthor of “Deliver Uncompromised,” and Joyce Corell, who heads the Supply Chain and Cyber Directorate at the National Counterintelligence and Security Center. There’s no doubt the problem is being admired to a fare-thee-well, and some evidence it’s also being addressed. Listen and decide!

In the News Roundup, Nate Jones and I disagree about the Second Circuit ruling that President Trump can’t block his critics on Twitter. We don’t disagree about that ruling, but I’m a lot more skeptical than Nate that it will be applied to that other famous Washington tweeter, Alexandria Ocasio-Cortez.

GDPR still sucks, but now it bites, too. Matthew Heiman explains just how bad the bite was for Marriott and British Airways.

Gus Hurwitz reprises how much – or little – we know about the FTC and Facebook. We won’t know much, he says, until we answer the question, “Where’s the complaint?”

Talk about hard supply chain issues. Congress banned Chinese surveillance cameras from the federal supply chain by law.  But passing a law turns out to be a lot different from actually, you know, getting rid of them.

For a change of pace, Gus and I rag on the US Patent and Trademark Office for its petition asking the Supreme Court to overturn a Fourth Circuit ruling that adding “.com” to a generic term makes it trademarkable. You tell ‘em, USPTO! It’s not like adding “.com” to a word has the same creativity and distinctiveness as adding “i” in front of “phone” or “pod.”

Nate and I spar over whether Section 301 can be used to retaliate against France for its 3% digital tax.

Matthew tells us that the Trump Administration isn’t sharing details on classified cyberattack rules with Congress, and after a modicum of mockery, we actually find ourselves agreeing with Congress’s demand to be briefed on the rules.

Finally, in quick hits, I flag the hypocrisy of social justice campaigners who love the idea of privacy until it gets in the way of doxxing people they disagree with -- plus the surprising ways that GDPR has enabled personal data breaches on an industrial scale.

Download the 272nd Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

271. Is social media a disease, and how do we treat it?

This week I interview Glenn Reynolds, of Instapundit and the UT Knoxville law school, about his new book, The Social Media Upheaval. In a crisp 64 pages, Glenn analogizes social media to a primeval city, where new proximity produces periodic outbreaks of diseases that more isolated people never experienced; traces social media’s toxicity to the desperate pursuit of engagement; and proposes remedies both for individual users and for society as a whole.  All that plus thoughtful advice on dietary supplements and deadlifts!

In the news roundup, Matthew Heiman dissects a recent Third Circuit ruling that Amazon can be held strictly liable for products it markets for third parties. Unlike Matthew, I am largely persuaded by the court’s ruling on products liability – but Matthew and I both have doubts about its use of section 230 of the Communications Decency Act to protect Amazon from “failure to warn” liability.

Maury Shenk and Nick Weaver review the progress of the War on Facial Recognition. Opponents have rolled out the ultimate weapon of the modern left:  OMG, ICE is using it! But facial recognition is still winning the war, mostly because its opponents are peddling undifferentiated fear of a technology that’s already being used for many very different purposes, from anonymously tracking shoppers moving through a store (where the store doesn’t need to know the shoppers’ identities) to boarding planes (where the airline damn well better know the passengers’ identities, and the tech only has a couple of hundred faces to match).

Matthew and Nick consider China’s seizing and installing spyware on travelers’ devices. Turns out, China’s practice isn’t all that different from most government efforts to extract data from phones, except that the Chinese leave their code on Android devices, enabling security researchers to reverse engineer China’s deepest fears. And what does China fear most? Japanese heavy metal, apparently. Almost makes you feel a bit of empathy for Beijing…

Maury also highlights Big Tech’s concerns about the UK’s particularly aggressive proposal for an online “duty of care.”

Nick and I follow the problem of fake cancer cures being advertised on Facebook and YouTube down the usual ratholes – who should be responsible in the first place, and why does Silicon Valley think that algorithms will ever be able to discipline such content?

This Week in the US China trade war: No one seems to know exactly what President Trump’s concessions at the G-20 meeting amount to, but more and more US tech companies have decided that moving 30% of their tech sourcing out of China is a good idea no matter how the trade war ends. This war isn’t good for US companies, but it’s really not good for China’s. Which, come to think of it, is what President Trump has said from the start.

Finally, if you’re looking for tough government action against contractors with bad cybersecurity, CBP is your agency.  It has cut ties with Perceptics, the firm that was breached by Boris the Bullet-Dodger, and seems to be readying a debarment proceeding that will cut the firm off from future government contracts. Matthew and I speculate that there may be something more behind this harsh remedy – perhaps a lack of prompt contractor candor about the breach. Whatever the context, though, this proceeding is likely to set a precedent that haunts government contractors long into the future. 

Download the 271st Episode (mp3). 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

270. China’s cyber offense comes of age

The theme this week is China’s growing confidence in using cyberweapons in new and sophisticated ways, and the US struggle to find an answer to China’s growing ambition in this sphere. Our interview guest, Chris Bing of Reuters, talks about his story on Chinese penetration of managed service providers like HP Enterprise – a penetration that allowed APT10 access to hundreds of other companies that rely on managed service providers for most of their IT. Most chilling for the customers are strong suggestions that the providers often didn’t provide notice of the intrusions to their customers – or, worse, that the providers’ contracts may have prevented their customers from launching quick and thorough investigations when their own security systems detected anomalous behavior originating with the providers. After this episode, a lot of CISOs will be rereading their managed service contracts.  Chris also tells the story of an apparent “Five Eyes” intrusion into Yandex, the big Russian search engine.

Returning to China, in our News Roundup Nate Jones covers the latest in the US-China trade war before diving into a Wall Street Journal article (by Kate O’Keeffe) that I call the Rosetta Stone for the last two years of cyber policymaking. Looking for the unifying theme in the lobbying fight over FIRRMA, the president’s executive orders on cyber, and sanctions on companies like Sugon? Look no further than AMD, particularly its accommodation of China’s ambitions in chip manufacture and the Pentagon’s desperate effort to thwart its plans. Nate and I also consider a possible new US requirement that domestic 5G equipment be made outside China.

What is China planning to do with all that cyber power? Jordan Cannon lays out one possibility, focusing on a little-followed story in which China seems to have taken an election-tilting page straight out of Vladimir Putin’s textbook. And Nate covers a newly patient Chinese hacking cadre willing to compromise a dozen telcos for years just to collect metadata on as few as twenty telco customers.

Speaking of metadata, David Kris explains why Congress is more exercised over NSA’s access to American phone metadata than China’s. Congress took the view that NSA should not collect the metadata of innocent Americans, even if it only searched the data when it had a legal basis for doing so. Instead, Congress constructed a new Section 215 program that depended on each telco to do searches of data that remained in its hands. Unsurprisingly, the telcos have done that badly, sending the wrong data to NSA on more than one occasion. Naturally, Congress now blames NSA for “overcollecting.” Don’t hold your breath waiting for an apology from the Congressional cranks who got us into this mess.

Are you a conservative comforting yourself with the idea that Silicon Valley censorship is just a creature of platform monopoly that can be cured by more competition? Guess again. Two more conservative-hostile moves by Silicon Valley show that competition isn’t likely to end virtue signaling in the Valley. After Google banned Project Veritas’s video exposé of YouTube for, uh, privacy – that’s it, privacy – violations, its distant No. 2 competitor Vimeo responded to the competitive opportunity by also banning the video for, uh, defamation or something. And when Twitter competitor Parler offered a home to conservatives, Apple reportedly threatened (at least briefly) not to distribute the app unless it kicked some unspecified bad actors off the service.

Meanwhile, two Silicon Valley platforms that really do depend on at least a few conservative voices were singing that famous C&W song, “I hate you. I need you. And I hate that I need you.” (Okay, I made that up, but there really should be a Taylor Swift song with those lyrics.) Anyway, the needy haters of Silicon Valley have been searching for ways to show their contempt for people they’re afraid to shut down completely, and now they've found it. Reddit “quarantined” their wildly popular subreddit, r/the_donald, over posts the moderators said they’d never seen and had never been reported to them. And Twitter announced that it planned to salve its SJW conscience while still profiting from Trump’s tweets by attaching disapproving labels to them. Nate tries to hose me down, but it’s too late.

Finally, in breaking news from 1993, David reports that the Trump Administration is considering an encryption crackdown but can’t choose between a toothless statement of principles and a feckless proposal of legislation that will not pass. I offer the suggestion that the statement of principles could be enough to undercut Silicon Valley’s campaign to stop encryption controls in countries like Australia, the UK, and Germany. That’s where controls will eventually come from, David and I agree. If so, I’m looking forward to hearing all those folks who told us that GDPR was just the voice of civilization calling across the Atlantic say the same about European encryption mandates.

Download the 270th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

269. A McLaughlin Group for cybersecurity

Our interview guests this week are Dick Clarke and Rob Knake, who have just finished their second joint book on cybersecurity, The Fifth Domain. We talk about what has changed and what they got right and wrong in their original book. Clarke and Knake offer surprising flashes of optimism from about the state of cybersecurity today, and the book itself is an up-to-date survey of the policy environment. Best of all, they have the courage to propose actual policy solutions to problems that others just admire. I disagree with about half of their proposals, so much light and some heat are shed in the interview, which I end by bringing back the McLaughlin Group tradition of rapid-fire questions and an opinionated "You're wrong" whenever the moderator disagrees. C'mon, you know the arguments are really why you listen, so enjoy this one!

In the News Roundup, Gus Hurwitz covers the Supreme Court's ruling on when a forum is subject to First Amendment limits. Short takeaway: There is not a single Justice who thinks Silicon Valley's platforms are public fora subject to the First Amendment. Sen. Hawley (R-MO) comes in for some mockery as a result, which prompts me to invite him to defend himself on a future episode (not so much because the First Amendment applies to this podcast but because it would be fun).

Matthew Heiman spells out the strategy behind Facebook's proposed cryptocurrency. He thinks it's all about the data; I think it's all about WeChat. Whatever the motive, every regulatory body in Europe and the US has descended on the company to extract concessions – or perhaps to kill the currency outright, as our own Nick Weaver has proposed.

Maury Shenk reports on the US government's threat to limit Indian H-1B visas if India persists in its extreme data localization policies. I suggest that the fight may be as much about terrorism finance as protectionism.

This Week behind the Silicon Curtain: Apple is considering moving 15-30% of its production capacity out of China. Matthew and I agree that that's easier said than done, but the move is inevitable.

Gus lays out the difficulties that YouTube has had meeting the child protection requirements of COPPA and the FTC's growing interest in changing YouTube's approach to videos aimed at kids.

Is China's social credit rating system a Potemkin village? Bloomberg seems to think so, but Maury has his doubts. So, if you thought you could stop fearing the system and start laughing at it, better think again.

Finally, This Week in Karma: The medical billing firm whose cybersecurity failings resulted in multiple medical data breaches has filed for bankruptcy, evidently the result of liabilities arising from the breach.

Download the 269th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

268: “Treason” at the New York Times

We interview David Sanger, whose recent New York Times article on US intrusions into the Russian grid was condemned as “a virtual act of treason” in a presidential tweet. Turns out that national security officials, contacted before the story ran, didn’t ask the Times to hold the story. Understandably. If you’re signaling to Putin that his grid will be at risk as long as he puts ours at risk, a front-page story in the New York Times is a pretty good way to get the word out.

We’re starting to see a lot more casualties in the New Code War between the US and China. Broadcom has issued a $2 billion warning that has shaken the global chip sector. And Hollywood is whistling past the graveyard if it thinks that China is going to stop squeezing US film profits in China. And the adjustment to a divided global tech market keeps finding new pain points. Turns out that even the F-35 depends on a Chinese supply chain.

Speaking of security holes, Nick Weaver breaks down the cause and significance of the Rowhammer exploit and its latest sibling, RAMBleed. And to complete the paranoia segment of the show, Nick explains just how easy it is to use LinkedIn to build a network of people with clearances who can be compromised by a nonexistent woman.

Should Silicon Valley face an antitrust breakup that might produce more viewpoint competition? Mark MacCarthy breaks down a speech given by the Justice Department’s antitrust chief, pointing out that conservatives crusading to make viewpoint competition part of antitrust analysis got a little more comfort than usual from the speech.

Or should Silicon Valley lose its immunity under Section 230 of the Communications Decency Act because of its high-handed treatment of conservatives? David Benger tells us that the DC Circuit does see a limit to the Section 230 immunity – but a pretty distant one. Mark points out that Congress might itself cut back on the doctrine – but only, I note, if it’s willing to violate the US-Canada-Mexico trade deal.

Finally, Nick and I have different takes on what I call the overhyped breach of the week, in which a Customs and Border Protection subcontractor lost photos of thousands of travelers. Turns out it wasn’t much of a breach for the agency, but it was a potentially devastating breach for its subcontractor.

Download the 268th Episode (mp3).

 

267. “Call me a fascist again and I’ll have you censored all over the world.”

We kick off Episode 267 with Gus Hurwitz reading the runes to see whether the 50-year Chicago winter for antitrust plaintiffs is finally thawing in Silicon Valley. Gus thinks the predictions of global antitrust warming are overhyped. But he recognizes we’re seeing an awful lot of robins on the lawn: The rise of Margrethe Vestager in the EU, the enthusiasm of state AGs for suing Big Tech, and the piling on of Dem presidential candidates and the House of Representatives. Judge Koh’s Qualcomm decision is another straw in the wind, triggering criticism from Gus (“an undue extension of Aspen Skiing”) and me (“the FTC needs a national security minder when it ventures into privacy and competition law”). Matthew Heiman thinks I’m on the wrong page when I suggest that Silicon Valley’s suppression of conservative speech is the kind of detriment to consumer welfare that the antitrust laws should take into account, even in a Borkian world.

I mock Austrian Greens for suing to censor those who called it a “fascist party” – stopping their mouths not just in Austria but around the world. Yeah, guys, that’ll show ‘em who the fascists are. Less funny is the European Court of Justice’s advocate general, who more or less buys the Greens’ argument. And thereby reminds us why we miss Tom Wolfe, who famously said, “The dark night of fascism is always descending in the United States and yet lands only in Europe.”

Nate Jones answers the question, “Were the Russians much better at social media than we thought?” All the adjustments to that story, he notes, have increased our assessment of the sophistication in Russia’s social media attacks. And in This Week in Host Self-Promotion, I take advantage of Nate's remarks to urge my own solution to the utterly unsolved problem of hack-and-dox attacks by foreign governments on US candidates they don’t like: Ban the distribution of data troves stolen from candidates and officials. Nate agrees that First Amendment doctrine here is a lot friendlier to my proposal than most people think, but he cautions that the details get messy fast.

Matthew comments on Baltimore’s tragedy of errors in handling its ransomware attack. The New York Times’ effort to pin the blame on NSA's EternalBlue, which always looked tendentious and agenda-driven, now has another problem: It’s almost certainly dead wrong. EternalBlue doesn’t seem to have been used in the ransomware attack. Baltimore’s best case now is that its cybersecurity sucked so bad that other, completely unrelated hackers were using EternalBlue to wander through the city’s system at the same time as the ransom bandits.

Speaking of cybersecurity, Matthew reminds us of two increasingly common and dangerous hacker tactics: (1) putting the “P” in APT by hanging around the system so long that you’ve downloaded all the manuals, taken all the online training, and know exactly when and how to scam the system; and (2) finding someone with lousy network security who’s connected to a harder target and breaking in through the third party.

Finally, Gary Goldsholle helps us make sense of the litigation between the SEC and Kik, which first launched a cryptotoken that it insisted wasn’t a security offering and then crowdfunded a lawsuit to that effect against the SEC. So, finally: good news for lawyers if nothing else, and perhaps for future Initial Popcorn Offerings.

Download the 267th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

A modest proposal for countering Russian election interference

What can we do to counter Russian "hack and dox" interference with US election campaigns and candidates?  A lot more than we think, as long as we're willing to open the first amendment Overton window.  I posted my modest proposal on the topic over at Lawfare.  Here's the gist:

Of course, stopping the dissemination of such information raises real First Amendment questions, but the Supreme Court's pronouncements on this topic have been surprisingly qualified and leave plenty of room for legislation that would drain much of the fun out of Russian cyber-kompromat. In the leading case, Bartnicki v. Vopper, the court refused to enforce a statutory prohibition on disseminating the contents of illegally wiretapped conversations. The conversation in question was a cell phone call in which a member of a teachers' union said to the union's negotiator that if the school district didn't improve its offer to end a strike, "we're gonna have to go to their, their homes … to blow off their front porches, we'll have to do some work on some of those guys." The Supreme Court's opinion considered two principal justifications for a ban on dissemination of tapped conversations—deterring wiretapping and preserving privacy. The court dismissed the first because it thought deterrence could be achieved by prosecuting those who conducted the illegal tap. It was troubled by the second, recognizing that failing to punish the disclosure of private conversations was itself likely to restrain private speech. Nonetheless, in an expressly narrow decision, the court concluded that the conversation being disclosed was a matter of public concern, so that prohibiting dissemination would trench too far on freedom of speech. Two justices who were necessary to the majority wrote separately, narrowing the decision further by declaring that only a communication threatening physical harm or the like was of sufficient public concern to justify overriding the dissemination ban.

To my mind, this decision leaves plenty of room for imposing restraints on the distribution of private emails stolen by a foreign government. The government's interest in protecting private speech remains strong in the case of foreign government hacking, and it is bolstered by a deep national security concern that was quite lacking in Bartnicki. What's more, the Bartnicki court's notion that such thefts can be deterred by criminal prosecution is demonstrably wrong where government hackers are concerned. We've indicted Russian, Chinese and Iranian government hackers; it hasn't deterred any of them for long. Even taken at face value, the decision protects only dissemination that addresses a matter of public concern. That by itself would seem to allow Congress to restrict massive dumps of private communications that do not touch on significant public issues, let alone make threats of violence.

266. Will an end to social media trust mean an end to end-to-end encryption?

If you’ve lost the Germans on privacy, you’ve lost Europe, and maybe the world. That’s the lesson that emerges from my conversation with David Kris and Paul Rosenzweig about the latest declaration that the German interior minister wants to force messaging apps to decrypt chats. This comes at the same time that industry and civil society groups are claiming that GCHQ’s “ghost proposal” for breaking end-to-end encryption should be rejected. The paper, signed by all the social media giants, says that GCHQ’s proposal will erode the trust that users place in Silicon Valley. I suggest that maybe that particular argument is well past its sell-by date.

Speaking of trust, Paul outlines the latest tit-for-tat in the Silicon Curtain coming down between the US and China, as that country announces plans to publish an “unreliable entities” list of US companies. I note that the same spirit seems to be animating the announcement that China and Russia are transitioning their militaries from Microsoft Windows to other operating systems. Talk about a bonanza for the NSA: Just the coding errors alone will sustain its hackers for a generation – even in the unlikely event that the Chinese and Russians resist the temptation to seed the system with backdoors aimed at their erstwhile partners.

Maury Shenk highlights the latest German effort to regulate “broadcasting” of content on the Internet, which the German authority says will mandate transparency and diversity. I think it’s transparently about shoring up the German establishment, a view hardly contradicted by the ham-handed way CDU leader Annegret Kramp-Karrenbauer responded to the CDU’s drubbing in the EU elections. The losses were widely attributed to YouTube influencers who urged young voters to reject the main parties. The solution, AKK suggested, was more regulation of YouTube influencers. Ja, natürlich.

David brings us up to date on Iran’s latest effort to engage in social media manipulation and Facebook’s response.

Alicia Loh parses a DC Circuit ruling that all the White House has to do to comply with laws on keeping records of official communications is send out a memo. That obligation was satisfied, the court ruled, by a memo telling White House staff who use “vanishing” messaging apps to take screenshots of any official communications and preserve the messages. Alicia is practically the only member of our panel who even knows how to take a screenshot on a phone, which suggests that White House staff compliance might be, well, underwhelming.

Maury gives us a quick update on US states imitating GDPR. Short version: Watch California and then New York.

And in a lightning round, I am struck by the sight of an FTC commissioner begging the Ninth Circuit not to uphold the FTC’s position in the Qualcomm case on appeal. Maury and I note the growing demand in Silicon Valley companies for mass contract labor spurred by the need to train AI. And Paul and I speculate on the probability of antitrust cases against Google and Amazon. It’s been a long cold Chicago winter for antitrust plaintiffs, but a change in the climate may be coming.

Download the 266th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

265. Cheapfakes and the end of blackmail

Paul Rosenzweig leads off with This Week in China Tech Fear – an enduring and fecund feature in Washington these days. We cover the Trump Administration's plan to blacklist up to five Chinese surveillance companies, including Hikvision, for contributing to Uighur human rights violations in the West of China, DHS's rather bland warning that commercial Chinese drones pose a data risk for US users, and the difficulty US chipmakers are facing in getting "deemed export" licenses for Chinese nationals.

We delve deeper into a remarkably shallow and agenda-driven New York Times article by Nicole Perlroth and Scott Shane that blames NSA for Baltimore's ransomware problem without ever asking why the city failed for two years to patch its systems. David Kris uses the story to take us into the Vulnerabilities Equities Process – and its flaws.

There may be a lot – or nothing – to the Navy email "spyware" story, but David points out just how many of today's cyber issues it touches. With the added fillip of a "Go Air Force, Beat Navy" theme not usually sounded in cybersecurity stories.

Paul expands on what I have called Cheapfakes (as opposed to Deep Fakes) – the Pelosi video manipulated to make her sound impaired. And he manages to find something approaching good news in the advance of faked video – it may mean the end of (video) blackmail.

But not the end of "revenge porn" and revenge porn laws. I ask Gus Hurwitz whether those laws are actually protected by the Constitution, and the answer turns out to be highly qualified. But, surprisingly, media lawyers aren't objecting that revenge porn laws criminalizing the dissemination of true facts are on a slippery slope to criminalizing news media. Only a bit more persuasively, though, that is the argument they're making about the expanded charges of espionage against Wikileaks founder Julian Assange. David offers his view of the pros and cons of the indictment.

And Gus closes us out with some almost unalloyed good news. Despite my suspicion of any bipartisan bill in the current climate, he insists that the Senate-passed anti-robocalling bill is a straight victory for the Forces of Good. But, he warns, the House could still screw things up by adding a private right of action along the lines of the Telephone Consumer Protection Act, which has provided the plaintiffs bar with an endless supply of class actions without actually benefiting consumers.

Download the 265th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

264. Unpacking the Supreme Court’s decision in Pepper v. Apple

We begin this episode with a quick tour of the 5-4 Apple antitrust decision that pitted two Trump appointees against each other. Matthew Heiman and I consider the differences in judging styles that produced the split -- and the role that 25 years of living with Silicon Valley “platform billionaires” may have played in the decision.

Eric Emerson joins us for the first time to talk about the legal fallout from the latest tariff increases on Chinese products. Short version: companies have some short-term tactics to explore (country of origin, drawback, valuation), but large importers/resellers will have to grapple with larger and costlier strategies of supply chain diversification and localization.

Meanwhile, China has not been taking the trade war lying down. In addition to its own tariff increases, it now seems to be enforcing its demanding cybersecurity law more aggressively against foreign firms. I suggest that we may also be seeing retaliation in Chinese courts as well.

In related news, Nick Weaver and I debate the potentially sweeping new Executive Order on Securing the Information and Communications Technology and Services Supply Chain.

Maury Shenk explains the UK Supreme Court ruling that expands the court’s authority over the UK’s intelligence agencies -- despite clear Parliamentary language to the contrary. Bottom line: Bad news for UK intelligence. Hidden good news for the US: Turns out that there is something worse than activist judges interpreting a written constitution – activist judges who can more or less make up the constitution they interpret.

It was a cybersecurity disaster week for some of the biggest names in tech. Nick helps me understand which bugs were worst, Cisco’s, Intel’s, or Microsoft’s. Then we review the equally bad week that the NSO Group and its WhatsApp exploit had.

Cleaning up in a lightning round:  We cover the order requiring the Chinese owner of Grindr to sell by mid-2020. We also cover Canada’s approach to social media, which spurs me to offer unwonted praise for France’s Macron and his moderation. The EU has a plan for sanctions on cyberattackers; Matthew and I doubt it will get much use. Is too much fuss being made over leak investigators using Web bugs to see if defense counsel at Guantanamo have been leaking; Nick and I disagree, at least a bit.

And the podcast closes with yet another installment in our long-running feature, “This Week in Internet Sex Toy Law.” Suffice it to say that the latest case can’t be understood without consulting both Orin Kerr and Jerry Seinfeld.

Download the 264th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to

CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect their firms, clients, spouses, or families.

263. The Intercept -- a close second to the FBI in sending leakers to jail!

With apologies for the lateness of this post, Episode 263 of The Cyberlaw Podcast tells the sad tale of yet another US government leaker who unwisely trusted The Intercept not to compromise its source. As Nick Weaver points out, The Intercept also took forever to actually report on some of the material it received.

In other news, Brian Egan and Nate Jones agree that Israel broke no new ground in bombing the headquarters of Hamas’s rudimentary hacking operation during active hostilities.

Nick and I dig into the significance of China’s use of intrusion tools pioneered by NSA. We also question the New York Times’s grasp of the issue.

The first overt cyberattack on the US electric grid was a bust, I note, but that’s not much comfort.

How many years of being told “I’m washing my hair that night” does it take before you realize you’re not getting anywhere? The FCC probably thought China Mobile should have gotten the hint after eight years of no action on the company's application to provide US phone  service, but just in case the message didn’t get through, the Commission finally pulled the plug last week.

Delegating to Big Social the policing of terrorist content has a surprising downside, as Nate points out. Sometimes the government or civil society need that data to make a court case.

We touch briefly on Facebook’s FTC woes and whether Sen. Hawley (R-MO) should be using the privacy stick to beat a company he’s mad at for other reasons. I reprise my longstanding view that privacy law is almost entirely about beating companies that you’re mad at for other reasons.

Download the 263rd Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

262. Udderly indefensible facial recognition scandal may drive new privacy mooovement

Have the Chinese hired American lawyers to vet their cyberespionage tactics – or just someone who cares about opsec? Probably the latter, and if you’re wondering why China would suddenly care about opsec, look no further than Supermicro’s announcement that it will be leaving China after a Bloomberg story claiming that the company’s supply chain was compromised by Chinese actors. Nick Weaver, Joel Brenner, and I doubt the Bloomberg story, but it has cost Supermicro a lot of sales – and even if it isn’t true this time, the scale and insouciance of past Chinese cyberespionage make it inherently believable. Hence the company’s shift to other sources (and, maybe, a new caution on the part of Chinese government hackers).

GDPR and the California Consumer Privacy Act (CCPA) may be the Dumb and Dumber of privacy law, but neither is going away. And for the next six months, California’s legislature will be struggling against a deadline to make sense of the CCPA. Meegan Brooks gives us an overview.

But we in Washington can’t get too smug about California’s deadline-driven dysfunction. Congress also faces a year-end deadline to renew the Section 215 program, and even the executive branch hasn’t decided what it wants. Joel takes us through the program’s history, its snake-bitten implementation, and the possible outcomes in Congress.

This week in Silicon Valley content control: Facebook dropped the link-ban hammer on Louis Farrakhan, Alex Jones, and Milo Yiannopoulos for being “dangerous.” But did it really? Once again, I volunteer to put my Facebook access at risk by testing Facebook’s censorship engine – posting a different Infowars story there every day. Not because I love the conspiracy-mongering Alex Jones but because banning links is a bad idea. (Among other things, you can’t really pile links up and burn them in cinematic pyres at rallies.) But both Facebook and Jones may have a codependent interest in overstating the ban, because as of Day 4 of my experiment, my Facebook account is still alive and well, as are the Infowars links.

The FBI has accused US scientists of sending intellectual property to China, running shadow labs, and (this part really appalls Nick) corrupting the peer review process at NIH. Sadly, Science magazine buys into easy claims that the flap is born of racial bias.

We close the episode with the latest and most shocking facial recognition scandal. It turns out face recognition researchers are chasing down unwilling subjects and restraining them to get the subjects’ pictures – all in service to untried and udderly unreliable technology. All we need to turn this into a major scandal is a public policy entrepreneur willing to work the intersection between the EFF and PETA.

Download the 262nd Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

The most interesting thing about Facebook's censorship engine

I don't want to bury the lede here.

Probably the most interesting thing about this test is what hasn't happened. I haven't been suspended or warned by Facebook about linking to Infowars, and while Facebook has broken some of the links to Infowars, it has done so in a fashion so haphazard and incompetent that I doubt the breakage was intentional.

Does this mean that Alex Jones is overhyping the Facebook "link ban"? Nah, that would make him a conspiracy-mongering paranoid ... oh. Never mind.

Day 3 of testing Facebook's censorship engine

Has the Facebook censorship engine finally caught up with Facebook's censorship ambitions? My day 2 post, when it first went up, resolved to a deep link on Infowars about US unemployment reaching a 50-year low. When I reposted it with public access, though, the link resolved to a "Page Not Found" message -- on Infowars.com.

I thought maybe Facebook engineers had finally got their censorship engine up and running, but first I checked to see if Infowars had dropped the story. Nope, it still seems to be on the Infowars site, here: https://www.infowars.com/jobs-surge-unemployment-falls-to-…/

But if this is the result of the censorship engine, it's still coughing and backfiring. More likely, the answer to this mystery lies in the details of ad tracking URLs. When the link went up, Facebook rewrote it to include a prefix: "fbclid=IwAR1P6by_S5-lBYmb6vbkhnLVohyIFZfgLqvFegLwIYfUApVNzI5CxogVp-s". I assume that the purpose of the prefix was to make sure Facebook could identify everyone who clicked on the link as they left Facebook's site. But for whatever reason, the prefix stopped working and stopped delivering people to the deeplinked story. The link still went to Infowars, but that site didn't recognize the prefix and therefore said that it couldn't find the page, once again dropping Facebook readers on the Infowars landing page, where they are exposed to the Full Alex Jones Paranoia Package -- probably not what Facebook engineers intended.

I'm thinking maybe there's a new IT law in all this mess, something like: "Censorship is hard. Leave it to the Chinese."

UPDATE:

It definitely looks as though the "fbclid" prefix added by Facebook to my Infowars URL was an ad tracking tool known as Facebook Click ID. If I remember my internet architecture, Infowars can tell when someone comes to the Infowars site after clicking on a Facebook link, but it can't tell *which* Facebook link was clicked on. The Click ID provides much more granular information about which link generated the Infowars traffic. This is presumably really valuable to advertisers and influencers who want to get credit (and get paid!) for the post or ad that actually sent traffic to Infowars.

It seems unlikely that Facebook and its advertisers are still collecting money from Infowars for the scarps of traffic they still send to that site, but it's hard to see what other purpose the click ID system serves. Presumably this is just the result of some default URL translator that Facebook applies to all URLs on its system.

 

Beta testing Facebook's censorship engine

My latest Facebook post:

Day 2. I'm posting a link to an Infowars story taken from CNBC and headlined "JOBS SURGE, UNEMPLOYMENT FALLS TO LOWEST SINCE 1969." https://www.infowars.com/jobs-surge-unemployment-falls-to-…/ Unlike last time, though, the link does not end at Infowars's landing page. Could it be that I'm inadvertently helping to beta test Facebook's censorship engine?

https://www.facebook.com/stewart.a.baker

Is Facebook really banning links to Infowars? I put my Facebook account at risk to find out

I'm conducting an experiment to see whether Facebook is really banning links to Alex Jones's nasty but not illegal site.  Unfortunately, it means putting my Facebook account at risk of suspension or disappearance.  Here's what I posted earlier today:

According to the Atlantic, Facebook has decided that no one can link to Alex Jones's Infowars -- with the possible exception of posts that say mean things about the site:

"Facebook and Instagram will remove any content containing Infowars videos, radio segments, or articles (unless the post is explicitly condemning the content), and Facebook will also remove any groups set up to share Infowars content and events promoting any of the banned extremist figures, according to a company spokesperson." 

https://www.theatlantic.com/…/instagram-and-faceboo…/588607/

I'm not a fan of Jones and his nasty conspiracy-mongering. But I'm also not a fan of Facebook telling me what I can and cannot say. So, as an experiment to see whether and how Facebook actually administers its censorship regime, I'm posting links to apparently accurate news stories on the Infowars site to see what Facebook does.

If you never hear from me again, you'll know what happened!

And here we go. A link to an Infowars story taken from Reuters about drug company convictions related to opioids and bribery: 

https://www.infowars.com/drug-company-founder-execs-found-…/

If you're reading this on the blog, you'll see a link to a story about drug company execs being convicted of bribery in an opioids scandal.  But if you read it on Facebook, you get a link to the Infowars landing page, which features much more opinionated content.  At first I thought perhaps Infowars was blocking deep links into its site, but now it looks as though Facebook is redirecting any deep links to the Infowars landing page.  Which seems a little self-defeating given the nature of what's on that page.  Which just goes to show:  censorship is hard work. But not to worry; I'm sure China is developing new tools every month!

261. Blockchain Takes Over the Podcast

In Episode 261, blockchain takes over the podcast again. We dive right into the recent activity from the SEC, namely, the Framework for “Investment Contract” Analysis of Digital Assets and the No-Action Letter issued to TurnKey Jet, Inc. (TurnKey) for a digital token. Gary Goldsholle noted this guidance has been eagerly anticipated since July 2017 when the SEC first applied the Howey Test to a digital token with the DAO report. The current framework focuses primarily on the reasonable expectation of profits and efforts of others prongs of the Howey Test. While the framework lays out a number of factors to consider when determining whether a token is a security, the practicality of those factors is still up for debate.

Will Turner explained that the TurnKey No-Action Letter was most useful for parties interested in structuring a private, permissioned, centralized blockchain, but believes the guidance in the Framework would allow for alternative structures. The key from the SEC’s perspective is that there is no expectation of profits for token holders, since the token is a stablecoin pegged to the value of USD and there is no use of the token outside of TurnKey’s network. Jeff Bandman noted the irony that the first No-Action Letter related to blockchain and cryptocurrency involves private jets, particularly since “Mr. and Ms. 401(k)”—the retail investors SEC Chairman Jay Clayton is focused on protecting—are not likely to become private jet users anytime soon.

Jeff emphasized the importance of network functionality and observed that the network for private jet use was already established. Alan Cohn highlighted this tension between the need for centralization to achieve functionality, and need for decentralization as a means to avoid meeting the “derived from the efforts of others” prong of the Howey Test.

Gary then turned to Blockstack’s Regulation A filing, the most comprehensive effort to register a token under Reg. A that we have seen to date. Blockstack is seeking to be a Tier 2 issuer, meaning they can raise up to $50 million in 12 months, which comes with heightened disclosure obligations and requires audited financials. While they seek to raise capital as a security today, their ultimate goal – and a central risk factor in their offering circular – is to achieve the requisite level of decentralization such that they no longer would meet the definition of a security.

Meanwhile, in Congress, the recently reintroduced Token Taxonomy Act of 2019 would exempt a newly defined category of digital tokens from the definition of a security, as well as provide some clarity on tax issues for cryptocurrency users and exchanges. Jeff observed that these amendments might contribute further to a gap in federal regulation over spot trading markets. While the CFTC has enforcement authority, they do not have the authority to directly supervise the bitcoin trading market.

Turning to the interview, Jeff describes how he co-founded Global Digital Finance (GDF), along with other co-founders in Europe, Asia, and the United States, in order to address the lack of international standards surrounding the blockchain industry – or even a general consensus of terminology. Jeff describes how GDF has a number of working groups focused on developing high-level principles and standards on a range of topics, including stablecoins, custody, tax, and security tokens. GDF is trying to fill in some of the gaps that appear when jurisdictions regulate cryptocurrencies and crypto-assets differently.  As an example of its work, GDF’s KYC/AML/CTF group recently commented on FATF’s standards, issuing two comments in October 2018 and April 2019.

Jeff is also in the process of launching a new transfer agent service, Block Agent, focused on enabling and supporting SEC-regulated issuances. As markets mature, it is increasingly important to have the necessary post-trade infrastructure, and he is committed to offering services that recognize the novel features and efficiencies around these new technologies.

For our listeners in the DC area, Steptoe is hosting a half-day complimentary regulatory symposium this Thursday, May 2, in our DC office. Our plenary speakers include current and former commissioners and high-level officials with agencies such as the Federal Energy Regulatory Commission, the Surface Transportation Board, and the Environmental Protection Agency. We will also have breakout panels focused on four separate topics: Deference, Globalization, Regulatory/Legislative Approach, and Preemption. To register, click here.

Download the 261st Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

260: Sending our passports to Pornhub

In this episode, Nick Weaver and I discuss new Internet regulations proposed in the UK. He’s mostly okay with its anti-nudge code for kids, but not with requiring proof of age to access adult material. I don’t see the problem; after all, who wouldn’t want to store their passport information with Pornhub?

Sri Lanka’s government has suspended social media access in the wake of the Easter attack. As Matthew Heiman notes, the reaction in the West is more or less a shrug – far different from the universal contempt and rejection displayed toward governments who did much the same during the 2011 Arab Spring rebellions. What made the difference? I argue that it’s Putin’s remarkably successful 2016 social media counterattack on Hillary Clinton as payback for her social media campaign against him in 2011.

DNS hijacking is just getting more brazen, according to a new Cisco Talos report. Nick and I talk about why that is and what could be done about it.

Paul Rosenzweig, back from hiatus and feisty as ever, mocks the EU Commission for its on-again, off-again criticism of Kaspersky’s security. Short version: The Commission wants badly to play in cybersecurity because it’s the Hot New Thing, but it has no institutional competence there, in either sense of the word. Speaking of Kaspersky, someone is doing a bad job of trying to compromise its critics with ham-handed private investigator-imposters.

Naked Kitten? Nick and I have a good laugh at the doxxing of Iranian government hackers, including their tools (and, naturally, their girlfriends).

Man bites dog: The Trump Administration is taking interagency processes seriously, and doing a better job than Obama’s team – at least when it comes to use of Cyber Command. Matthew dives into the repeal of PPD-20.

Paul brings us up to date on the Mar-a-Lago Thumb Drive Affair. Maybe it wasn’t malware after all. My guess? Schizophrenia.

Remember that face recognition software that the NGOs said was so crappy it had to be banned? Now, the New York Times reports that it’s so good it has to be banned. Not so fast, says Microsoft: Our face recognition software is still so crappy that it can’t be sold to law enforcement, and it ought to be export controlled so that China can sell – and keep improving – its own face recognition tools.

Bet you thought we forgot the Mueller Report. Nope! In fact, I offer the one conclusion about the report that everyone across the political spectrum can agree on. Anti-climactically, Paul and I point out that the report throws sidelights on the "Going Dark" debate and Bitcoin anonymity. Nick points out that we already knew everything the Mueller Report tells us on those topics.

Finally, Nick and I wrangle over the lessons to be drawn from Facebook’s privacy travails.

Download the 260th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Episode 259: Why France understands the Chinese better than the rest of us

Our News Roundup is hip deep in China stories. The inconclusive EU - China summit gives Matthew Heiman and me a chance to explain why France understands – and hates – China’s geopolitical trade strategy more than most. Maury Shenk notes that the Pentagon’s reported plan to put a bunch of Chinese suppliers on a blacklist is a tribute to China’s own schedule of sectors where Western companies. are blacklisted. And Matthew discloses reason to believe that China has finally begun to use all the US personnel data it stole from OPM. I’m so worried it may yet turn my hair pink, at least for SF-86 purposes.

And in a sign that it really is better to be lucky than to good, Matthew and I muse on how the Trump Administration’s China policy is reinforcing broader economic trends to make US companies reconsider their reliance on Chinese manufacturing.

It’s not all China, though. To kick things off, Nick Weaver and I schadenfreude our way through an otherwise serious take on the Julian Assange story and its strikingly narrow Computer Fraud and Abuse Act charge – and why extradition is likely to be a pain.

We also delve into the Google Sensorvault story. Nick and I agree that law enforcement access to location data, especially under the conditions set by Google, isn’t much of a privacy scandal, at least compared to private access to the same data. But that doesn’t mean it won’t raise endless legal problems for all concerned, partly because asking for a warrant to start the process isn’t quite the right legal or privacy framework.

Pete Jeydel notes two examples of CFIUS’s new toughness: It’s forcing a Russia-linked firm to sell its stake in a cybersecurity company, and it has handed out a $1 million fine to a company that blew off obligations under a mitigation agreement.

Maury covers the German data protection commissioner’s refusal to let German cops store data in the Amazon cloud. The commissioner blames the CLOUD Act and the risk that US authorities may get cross-border access to the data. I flag the commissioner for hypocrisy and ignoring international law. Turns out that the Justice Department has a good new whitepaper out on the CLOUD Act, and it points out that remote access to offshore data has been an implicit part of the Budapest Convention since the ‘90s.

Returning once more to China, Maury and I touch on the Chinese government’s use of AI to find Uighurs in crowds of Han Chinese. In my view, the only thing surprising about this story is that the New York Times thinks we should be surprised by it.

Download the 259th Episode (mp3).

 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

 

Episode 258: The death of Section 230

Our News Roundup leads with the long, slow death of Section 230 immunity. Nick Weaver explains why he thinks social media’s pursuit of engagement has led to a poisonous online environment, and Matthew Heiman replays the astonishing international consensus that Silicon Valley deserves the blame – and the regulation – for all that ails the Internet. The UK is considering holding social media execs liable for “harmful” content on their platforms. Australia has already passed a law to punish social media companies for failure to remove “abhorrent violent material.” And Singapore is happily drafting behind the West, avoiding for once the criticism that its press controls are out of step with the international community. Even Mark Zuckerberg is reading the writing on the wall and asking for regulation. I note that lost in the one-minute hate directed at social media is any notion that other countries shouldn’t be able to tell Americans what they can and can’t read. I also wonder whether the consensus that platforms should be editors will add to conservative doubts about maintaining Section 230 at all – and in the process endanger the US-Mexico-Canada Agreement that would enshrines Section 230 in US treaty obligations.

Nate Jones and I summarize the latest Reuters piece on American hackers working for the UAE. The short version? This is more a victory lap combined with journalists’ special pleading than a major new story.

Nate also briefs us on the latest tale of woe from Silicon Valley, where taking Chinese money and tech means you’re likely to get burned – in a government-ordered fire sale.

Nick and I disagree about how flawed facial recognition is, but not on the fact that NGOs are working overtime to turn the technology toxic.

Nate gives Kaspersky’s lawyers high grades for imagination and effort but not for credibility in their claim that we can trust the company’s software because Russian law doesn’t authorize Putin to intercept its data feeds.

And, with a hat tip to Gus Coldebella for the story, Matthew and I dig into the Washington attorney general’s $12 million settlement with Motel 6 for its cooperation with ICE. We think Motel 6 could have defended on federal preemption grounds and maybe gotten help from the Justice Department. But if the problem was bad publicity, that defense would have just made things worse.

Our interview is with Adam Segal, the Council on Foreign Relations’ expert on all things digital and China. Adam prognosticates on the likely fate of US-China trade talks, data localization in China, and on the future of China’s commercial cyberespionage plans.

Download the 258th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of our spouses (especially our spouses!), our clients, or our institutions.

Episode 257: How we know the North Korean Embassy break-in wasn’t the work of the CIA

In today’s News Roundup, Klon Kitchen adds to the sory of the North Korean Embassy invasion by an unknown group. Turns out some of the participants fled to the US and lawyered up, but the real tipoff about attribution is that they’ve given some of the data they stole to the FBI. That rules out CIA involvement right there.

Nick Weaver talks about Hal Martin pleading guilty to unlawfully retaining massive amounts of classified NSA hacking data. It’s looking more and more as though Martin was just a packrat, making his sentence of nine years in prison about right. But as Nick points out, that leaves unexplained how the Russians got hold of so much NSA data themselves.

Paul Hughes explains the seamy Europolitics behind the new foreign investment regulations that will take effect this month.

Nick explains the deeply troubling compromise of update certs at ASUS and the company’s equally troubling response. I ask why the only agency with clear authority over an incident with important national security implications is the FTC.

Nick and I comment on the FTC’s pending investigation of the privacy practices of seven Internet service providers.

Speaking of sensitive data practices, Klon talks about the Committee on Foreign Investment in the United States’ belated recognition that maybe the Chinese shouldn’t have access to the most intimate desires of the US LGBTQ community. I try to explain the difference between Tik Tok and Yik Yak and mostly fail.

Meanwhile, in splinternet news, the EU Parliament has approved the controversial Copyright Directive. A bunch of MEPs, soon to be running for reelection, claim they meant to vote against it, really, but somehow ended up voting for it.

The Department of Housing and Urban Development is suing Facebook for violating the Fair Housing Act. I ask listeners for help in finding guests who can talk about whether it’s a good idea to bar ad targeting that lets companies look for more customers like the ones they already have, even if their customers already skew toward particular genders and ethnicities.

Finally, Nick and I break down Gavin de Becker’s claim that the real killer in the Bezos sexting flap was Saudi Arabia. Plenty of smoke there, but the lack of a reference to any forensic evidence raises doubts about de Becker’s version of events.

Download the 257th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

256. The National Bloviation Strategy

I know. The title could be talking about pretty much any national strategy written in the last 15 years. And that’s the point. In the interview, Dr. Amy Zegart and I discuss the national cyber strategy and what’s wrong with it, besides all the bloviating. We also explore the culture clash between DOD and Silicon Valley (especially Google), and whether the right response to the Mueller report would be to conduct a thorough investigation into how the Intelligence Community and Justice handled the collusion allegations at the start of the Trump Administration. As a bonus, Amy answers this burning question: “If a banana republic is a country where losing an election means getting criminally investigated, what do you call a country where winning an election means getting criminally investigated?”

In the news roundup, we talk about the New Zealand massacre and whether six months from now it will feel as though we overreacted to distribution of the video of the attack. Along the way, we  are amazed to discover that New Zealand actually still has a “Chief Censor.”

If you thought the Boeing 737MAX approval cast the FAA in a bad light, there’s some good news for that embattled agency: The FDA is even worse at dealing with software risks. Matthew Heiman and I talk about the agency’s unimpressive handling of a flaw that would let hackers control defibrillators implanted in patients.

Conservatives v. Silicon Valley. Apparently looking for Odd Couple of the Month coverage, Sen. Josh Hawley is sounding all Sen. Elizabeth Warren-y about Facebook and Silicon Valley. And Devin Nunes is renewing claims of social media bias against conservatives. Indeed, he’s putting his lawyers where his mouth is, suing Twitter and his fake Twitter Mom for defamation. It’s an uphill battle, but I would really love to read the internal Twitter emails about Nunes if his case gets to discovery.  That's his best chance to show actual malice.

Matthew tells us that the latest European fine of $1.7 billion means that Google has been hit with $7.6 billion in EU fines since 2017 – mostly for “in the eye of the beholder” abuses of a dominant position.

Jennifer Quinn-Barabanov makes a guest appearance to read the tea leaves in the SCOTUS remand of a cy pres case without decision. Bottom line: The Court is likely to cut back on cy pres settlements, which may be good policy, but which also means trouble for defendants as well as the plaintiffs’ bar.

Matthew and I talk about the most fun caper involving North Korea in the last fifty years (since most of the other capers seemed to end in people dying). This time, the good guys got away after physically pwning the entire North Korean embassy in Spain. Spanish papers claim it was the CIA, but that’s what Spanish papers would say, isn't it? This time, though, I’d like to think it’s true.

Maury Shenk explains why US chip makers don’t actually want massive new guaranteed orders as part of a China trade deal.

And Matthew tells us how Egypt is taking advantage of the cover provided by Australia and New Zealand to tighten control of websites and social media accounts that pose a “threat to national security.”

Download the 256th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

255: Imitation is the sincerest form of flattery: Russia and China revamp their military technologies

In our interview, Elsa Kania and Sam Bendett explain what China and Russia have learned from the American way of warfighting – and from Russia’s success in Syria. The short answer: everything. But instead of leaving us smug, I argue it ought to leave us worried about complacency followed by unpleasant military surprises. Elsa and Sam both try to predict where the surprises might come from. Yogi Berra makes an appearance.

In the News Roundup, David Kris explains the Fourth Circuit’s decision to turn a hostile spouse-swap dispute into an invitation to screw up the law of stored electronic communications for a generation.

And in other litigation, a Trump-appointed judge dismisses a lawsuit charging Silicon Valley with unlawfully censoring the right. Nate Jones and I agree that, while the decision is broadly consistent with law, it may spell trouble for Silicon Valley in the long run. That’s because it depends on an idiosyncratic DC Court of Appeals interpretation of the District’s public accommodation law. I speculate that Alabama or Texas or Mississippi could easily draft a law prohibiting discrimination on the basis of viewpoint in public accommodations like,say,  Internet platforms.

Nick Weaver and I note the UN report that North Korea has stolen $571 million, much of it in cryptocurrency. I ask whether the US Treasury could seize those ill-gotten bits. Maybe, says Nick, but it would really bollix up the world of cryptocurrency (not that he minds).

I explain that DHS will be rolling out facial scanning technology to a boatload of US airports – and why there’s no hidden privacy scandal in the initiative.

And this story kind of makes you wonder about their banks and their chocolate: Nick gloats as Switzerland’s proposed Internet voting system follows his predicted path from questionable undertaking to deep, smoking crater.

Elsa Kania and I offer praise for the Navy Secretary’s willingness to accept scathing criticism of the Navy’s cybersecurity.

And Nick and I close with an effort to draw lessons from the disastrous software and human factor interactions at the heart of the Boeing 737 MAX crashes.

Download the 255th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

254. The Cyberlaw Podcast -- without Stewart Baker at last!

You've begged for it in the comments, so here it is.  With Stewart Baker off the grid at the bottom of the Grand Canyon, literally, David Kris, Maury Shenk, and Brian Egan take merciless advantage to extol the virtues of data privacy and the European Union.

Maury interviews James Griffiths, a journalist based in Hong Kong and the author of the new book, The Great Firewall of China: How to Build and Control an Alternative Version of the Internet.

In the news, David and Brian discuss last week’s revelation that the NSA is considering whether it will continue to seek renewal of the of the Section 215 “call detail record” program authority when it expires in December. We plug last week’s Lawfare podcast in which the national security advisor to House Minority Leader McCarthy made news when he reported that the NSA hasn’t been using this program for several months. David waxes poetic on the little-known and little-used “lone wolf” authority, which is also up for renewal this year.

We explore the long lineup of politicians and government officials who are coming up with new proposals to “get tough” on large technology companies. Leading the charge is Senator Warren, who promises to roll out a plan to break up “platform utilities” – basically, large Internet companies that run their own marketplaces – if she is elected president. Not to be outdone, the current chair of the Federal Trade Commission has urged that Congress provide new authorities for the FTC to impose civil enforcement penalties on tech (and presumably other) companies that violate their data privacy commitments. And last – but never least – the French finance minister announced that he will propose a 3% tax on the revenue of the 30 largest Internet businesses in France, most of which are US companies.

David discusses how one technology company is using a more familiar tool – litigation – to fight back against Chinese companies for creating and then selling fake Facebook and Instagram accounts.

In the “motherhood and apple pie” category, Maury explains French President Macron’s call for the creation of a “European Agency for the Protection of Democracies” to protect elections against cyberattacks. And Brian covers a recently re-introduced bill, the Cyber Deterrence and Response Act, which would impose sanctions on “all entities and persons responsible or complicit in malicious cyber activities aimed against the United States.”

If you are in London this week, you can see James Griffiths during his book tour. On March 13, he will be at the Frontline Club, and on March 14, he will be at Chatham House. You can also see him later this month at the Hong Kong Foreign Correspondents Club.

Download the 254th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Interview on cybersecurity, European privacy, Snowden, and more

The second half of my interview with Cyber Insecurity News has been posted, here.  It deals with a lot of stuff from my career, including DHS, European privacy negotiations, Snowden, and cybersecurity.  (The first half is here.)  Here's an excerpt that captures some of my thinking on cybersecurity:

CIN: Is the government providing enough intelligence information—threats they’re aware of—to companies? I know that’s sometimes a complaint that companies have.

SB: Yeah, I do hear that. And I take that with a grain of salt. One thing I’ve learned from watching the intelligence community for 25 years is that intelligence in the abstract is almost never useful. For the intelligence to get good, you have to have a customer who understands the intelligence and how it’s being collected, and can tell the intelligence officers exactly what he wants and what’s wrong with the intelligence that has been collected. You don’t get good intelligence if you just try to go out and steal the best secrets you can. Because you usually don’t know what secrets really matter. You need a very sophisticated consumer who can say, “OK, I see what you’ve brought me. There are some interesting things here. But it isn’t exactly what I need. Go look for X.” The spies on their own would never think to look for X. They’re just not as deep into the technology or the situation as the consumer. So for an exchange of intelligence to be really useful, you have to make the companies your customer. I don’t think that’s likely to happen. Part of the private sector’s unhappiness with what they’re being given is their assumption that since what they got wasn’t that useful, they must not have gotten the good stuff. That’s not how intelligence works, in my experience. There isn’t “good stuff” just hiding out there. The good stuff—you have to dig it out as a customer. That isn’t likely ever to be something that the intelligence community does for individual companies.

 

CIN: What can companies be doing better?

SB: I think companies need to ask themselves—and they’re starting to do this—not so much what’s on my checklist of technologies to deploy, but who wants my stuff? And what tactics and tools are they using this week to get it? Those are things that are knowable. Those are things that you can get from intelligence. You can get it from the private sector forensics people as well. So knowing that there’s a North Korean or Chinese campaign to get information on, let’s say, windpower means that, if you’re a windpower company, you suddenly have a whole new set of adversaries, and you’re going to have to spend a whole hell of a lot more money on cybersecurity or lose your technology.  You constantly have to do a cost-benefit analysis there. But the key is knowing who’s breaking into your system, and why: Are they motivated by money, are they motivated by the desire to steal your technology? Are they criminals or governments? All of those are things that should be part of your cybersecurity planning.

 

CIN: You just said the magic word: “money.” When I talk to CISOs at companies, if we talk long enough and they feel comfortable enough, they will almost always say something about budgets, and how the management of companies so often underestimates how much is needed. And they routinely underfund cybersecurity budgets. What do you think?

SB: I agree. But I would also like to speak up for management and the board. Their most common complaint is: “My CISO comes in and says, ‘Bogeyman, bogeyman, bogeyman! Give me more money!’ He tells me that the North Koreans could do these things to me. Should I be worried about that or not? I feel as though I’m chasing goal posts that will always recede.” So there is a culture clash there. That’s one of the reasons that I like a model that asks, “Who wants my stuff, and what are they doing to get it?” Once you have that answer, you can also ask the question, “What would it cost to make sure they don’t get it? What do I have to do to defeat every one of the tools and tactics they currently are using?” Then, when I know how much that will cost, I can compare the cost of letting them win to the cost of making sure they don’t.  So I think you can reduce this to a cost-benefit analysis, if you’re disciplined about identifying who’s likely to attack companies like yours, and if you have up-to-date intelligence on how they’re getting into the systems they attack.

 

CIN: If you were the country’s cybersecurity czar, what would be the first things you would do?

SB: I would say, “If you are in a business that the lives of a large number of Americans depend upon—pipelines, refineries, electrical power grids, water, sewage systems—you’re going to have to meet certain cybersecurity standards. We’re going to continue to use regulatory agencies that you are familiar with, if you are regulated already at the federal level, but we’re going to find a way to make you meet these standards. And when we’re done getting you to meet those standards, the people that you do business with are going to have to meet those standards. We can’t afford to have weak links in our security process.” I hate to say that, because I see all the downsides to regulation. It slows everything down. It raises the cost of everything. It locks in a lack of competition. But there’s no obvious alternative, other than saying, “If you’re hacked, we’re going to expropriate your company, because you don’t deserve to be in business.” That would motivate people—sort of like the death penalty for companies. I don’t think we really want to do that. So, better to come up with a constantly shifting set of best practices, and impose them on people who currently don’t care enough to adopt them. They’re not evil people; they just don’t have enough skin in the game to worry about security.

 

CIN: What advice would you like to dispense before we conclude this conversation? Anything special you have to say to general counsel?

SB: Yes. It’s from a theme that we’ve been talking about—the need to think about who your adversary is. And it’s one of the hidden advantages in having your general counsel involved in cybersecurity. Engineers are used to protecting against inanimate nature. They’re really comfortable asking whether gravity is going to bring a bridge down. They’re much less comfortable asking, “What if the Russians wanted to bring it down, and they had all the explosives they needed?” They don’t do adversarial thinking as a routine part of their job description. And neither do the risk managers, who are most comfortable asking questions like, “Is this a risk we can self-insure, or do we have to get insurance for it?” In contrast, if you’re a good general counsel, you wake up every day and you say, “I know there are people—maybe competitors, maybe the plaintiffs bar, maybe governments—people out there who want to do my company harm using legal tools. I need to know who they are. I need to know what tools they will use to attack, and I need an early warning as they develop new ones. When the plaintiffs bar develops new lawsuits, I want to watch that. I hope that they try them out on somebody else first. But if they don’t, my job is to figure out what we will do in response.” In other words, the way of thinking about cybersecurity that I’m advocating is a way of thinking about corporate interests that lawyers are already familiar with. It should give general counsel a little bit of confidence that they have a perspective to bring to cybersecurity that isn’t just, “What will the regulators think if we don’t do this?” They can insist on more deeply adversary-based cybersecurity planning.

 

CIN: Based on your experience as an outside lawyer who advises general counsel, do you think that many GCs have a sense that cybersecurity is a really important part of their jobs, and have a seat at the table at their companies to help tackle it?   

SB: Yes and yes. First, you’d be crazy as a CEO not to give your general counsel a seat at the table, because liability is a significant part of the calculation here. In practically every tabletop exercise we run, people start turning to the general counsel almost routinely. It’s odd how often questions that easily could be answered by somebody else—there’s no necessary connection to the law—end up getting lateraled to the general counsel for one reason or another. I’m a little less confident that general counsel always bring to the task a breadth of strategic thinking that maximizes their value to the company. They will always say, “I can tell you what our regulatory obligations are. I can tell you what our privacy statement says. I can tell you what the liability decisions of the court might be, or what the FTC would say about this.” Those are all things that general counsel should be doing. I feel a little bit like a proselytizer when I say, “No, that isn’t enough; what you need to bring to this, in addition to all that, is the sense that your company is engaged in an eternal battle with institutional opponents, and that your job is to make sure your company is as fully armed for that battle as possible.”