Skating on Stilts

Skating on Stilts -- the award-winning book

Now available in traditional form factor from Amazon and other booksellers.

It's also available in a Kindle edition.

And for you cheapskates, the free Creative Commons download is here.

345. How COVID-Tracking Phone Apps Failed

In this episode, I interview Jane Bambauer on the failure of COVID-tracking phone apps. She and Brian Ray are the authors of "COVID-19 Apps Are Terrible—They Didn't Have to Be," a paper for Lawfare's Digital Social Contract project. It turns out that, despite high hopes, the failure of these apps was overdetermined, mainly by twenty years of privacy scandalmongering and regulation. In essence, Google and Apple set far too strict rules for the apps in an effort to avoid privacy-based political attacks, and the governments that could have reined them in surrendered instead, also in order to avoid privacy-based political attacks. So, we have no one to blame but ourselves, and our delusional valuation of privacy over life itself. Sometimes, privacy really does kill.

In the news roundup, we discover that face recognition suddenly isn't toxic at all, since it can be used to identify pro-Trump protestors.  Dave Aitel explains why face recognition might work even with a mask but still not be very good.  And Jane Bambauer reprises her recent amicus argument that Illinois's biometric privacy law is a violation of the first amendment.

If you heard the part of episode 344 last week about Silicon Valley speech suppression, you might be interested in seeing a further elaboration of proposal I came up with then, now  a Washington Post Op-Ed. Meanwhile, Dave reports that Parler may be back from the dead but dependent on Russian infrastructure. Dave wants to know if that means Parler can be treated by the Biden team like TikTok was treated by the Trump administration.

Dave also brings us up to speed on the latest SolarWinds news. He also casts a skeptical eye on a recent New York Times article pointing fingers at JetBrains as a possible avenue of attack. The story was anonymously sourced and remains conspicuously unconfirmed by other reporting.

Not dead yet, the Trump administration has delivered regulations for the exclusion of risky components from the national IT and communications infrastructure. Maury Shenk explains the basics.

Speaking of which, China is getting ready to strike back at such measures, borrowing the basic blocking statute rubric invented  by the Europeans. Blocking statutes can be effective, but only by putting private companies in a vise between two inconsistent legal duties. Bad news for the companies, more work for lawyers.

I ride one more hobbyhorse, critiquing Mozilla's decision to protect "user privacy" while imposing new burdens and risks on enterprise security. The object of my ire is Firefox's Encrypted Client Hello. Dave corrects my tech but more or less confirms that this is one more nail in the coffin for CISO control of corporate networks.

Matthew Heiman and I dig into the latest ransomware gang tactics -- going after top executive emails to raise the pressure to pay. The answer? I argue for more fake emails

In our concluding quick hits, Maury tells us about the CNIL's decision that privacy law prevents France from using drones to enforce its coronavirus rules. I note a new FDIC cybersecurity rule that isn't (yay!) grounded in personal data protection. Maury explains the recently EU advocate general's opinion, which would probably make Schrems II even less negotiable than it is now.  If it's adopted by the European Court of Justice, which I argue it will be unless the Court can find some resolution that is even more anti-American than the advocate general's proposal. And, finally, Matthew tells us that the State Department has reorganized to deal with cyber issues – a reorganization that may not last longer than a few months.

Download the 345th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

What to do about Silicon Valley speech suppression

The Washington Post has published my op-ed on social media speech suppression and what to do about it.  I consider and deprecate the use of section 230 and the antitrust laws, which leads me to using the tax code to induce gatekeeper platforms to break themselves up:

What if the federal government imposed a 40 percent tax on the gross revenue of gatekeeper social media companies that have more than, say, 30 million active users in the United States? Instead of fighting antitrust authorities in the trenches for years, companies faced with such a harsh tax rate would rush to break themselves up. (And if they didn’t, well, the treasury could certainly use the revenue after the bailouts of 2008-09 and 2020-21.) Efforts to avoid the tax would surely spur a proliferation of mainstream social media companies, each serving a broad audience. Some might adopt an editorial stance that leans to the left and others to the right, just as broadcast and other news media already do. But their ability to enforce ideological conformity or pursue a unified business interest would be shattered.

https://www.washingtonpost.com/opinions/2021/01/19/rein-in-big-tech-taxes/ 

344. A Wilderness of Mirror Imaging: US v. Chinese Intelligence

In this episode, I interview Zach Dorfman about his excellent reports in Foreign Policy about US-China intelligence competition in the last decade. Zach is a well-regarded national security journalist, a Senior Staff Writer at the Aspen Institute's Cyber and Technology program, and a Senior Fellow at the Carnegie Council for Ethics in International Affairs. We dive deep into his tale of how the CIA achieved remarkable penetration of the Chinese government and then lost it, inspiring China to mirror-image the Agency's techniques and build a far more professional and formidable global intelligence network.

In the news roundup, we touch on the disgraceful demonstration-cum-riot at the Capitol this week and the equally disgraceful Silicon Valley rush to score points on the right in a way they never did with the BLM demonstrations-cum-riots last summer. Nate Jones has a different take, but we manage to successfully predict Parler's shift from platform to (antitrust) plaintiff and to bond over my proposal to impose heavy taxes on social media platforms with more than ten million users. Really, why spend three years in court trying to break 'em up when you can get them to do it themselves and raise money to boot?

SolarWinds keep blowing. Sultan Meghji and Zach Dorfman give us the latest on the attribution to Russia, the fine difference between attack and espionage, and the likelihood of new direct or indirect cybersecurity regulation.

Pete Jeydel and Sultan cover the latest round of penalties imposed by the rapidly dwindling Trump administration on Chinese companies.

Nate dehypes the UK High Court decision supposedly ruling mass hacking illegal. He previews some Biden appointments, and we talk about the surprising rise of career talent in the new administration and why that might be happening. Nate also critiques DNI Grenell after accusations of politicization of intelligence. I'm kinder. But not when I condemn Distributed Denial of Services for joining forces with ransomware gangs to punish victims;  it's hard to believe that anyone could make Julian Assange and Wikileaks look responsible, but DDOS does. Speaking of Julian, he's won another Pyrrhic victory in court – likely extending his imprisonment with another temporizing win.

Download the 344th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

343: The Grim Lessons of the SolarWinds Breach

Episode 343 of the Cyberlaw Podcast is a long meditation on the ways in which technology is encouraging other nations to exercise soft power inside the United States. I interview Nina Jankowicz,, author of How to Lose the Information War on how Russian disinformation has affected Poland, Ukraine, and the rest of Eastern Europe – and the lessons, if any, those countries can offer a divided United States.

In the news, Bruce Schneier and I dig for more lessons in the rubble left behind by the SolarWinds hack. Nobody comes out looking good. Persistent engagement and defending forward only work if you’re actually, you know, engaged and defending, and Russia’s cyberspies managed (not surprisingly) to hide their campaign from NSA and Cyber Command. More and better defense is another answer (not that it worked during the last 40 years it’s been tried). But whatever solution we pursue, Bruce makes clear, it’s going to be expensive.

Taking a quick break from geopolitics, Michael Weiner gives us a rundown on the new charges and details (mostly redacted) in the Texas case against Google for monopolization and conspiring with competitor Facebook. The scariest thing about the case from Google’s point of view, though, may be where it’s been filed. Not Washington but the Eastern District of Texas, the most notoriously pro-plaintiff, anti-corporate jurisdiction in the country.

Returning to ways in which foreign governments are using our technology against us, David Kris tells the story of the Zoom executive who used pretextual violations of terms of service to take down speech the Chinese government didn’t like, censoring American efforts to hold a Tiananmen memorial. The good news: he was charged criminally by the Justice Department. The bad news: I can’t help suspecting that China learned this trick from the ideologues of Silicon Valley.

Aaand, right on cue, it turns out that China’s been accused of using its 50-cent army to file complaints of racism and video game violence against Americans using the platform to criticize China’s government, a tactic the target claims is getting YouTube to demonetize his videos.

Next, Bruce points us toward a deep and troubling series of Zach Dorfman articles about how effectively China is using technology to vault over US intelligence agencies in the global spying competition.

Finally, in quick succession:

• David Kris explains what’s new and what’s not in Israel’s view of international law and cyberconflict.
• I note that President Trump’s NDAA veto has been overridden, making the cyberczar and DHS’s CISA the biggest winners in the cyber policy arena.
• Bruce and I give a lick and a promise to the FinCen proposed rule regulating cryptocurrency. We’re both inclined to think more reregulation is worth pursuing, but we agree it’s too late for this administration to get anything on the books.
• David Kris notes that Twitter has been fined around $550 thousand over a data breach filing that was a few days late – a fine imposed by the Irish data protection office in a GDPR ruling that is a few years late.
• Apple has lost its bullying copyright battle against security start-up Corellium but the real risk to Corellium may be in the as-yet unresolved claim for violation of the DMCA.
• And the outgoing leadership of DHS is issuing new warnings about the cyber risks of using Chinese technology, this time touching on backdoors in TCL smart TVs and the risk of compromise from Chinese data services

Download the latest episode here.

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

 

342. Will European Privacy Law Protect American Child Molesters?

Our interview is with Alex Stamos, who lays out a complex debate over child sexual abuse that's now roiling Brussels. The application of European privacy standards (and European AI hostility) to internet communications providers has called into question the one tool that has reduced online child sex predation. Scanning for sex abuse images works well, and even scanning for signs of "grooming" is surprisingly effective.  But both depend on automated monitoring of communications content, something that has apparently come as a surprise to European lawmakers hoping to impose more regulation on American tech platforms.  Left unchanged, the new European rules could make it easier to abuse kids all around the world.  Alex explains the rushed effort to head off that disaster – and tells us what Ashton Kutcher has to do with it (a lot, it turns out).

Meanwhile, in the news roundup, Michael Weiner breaks down the FTC's (and 46 states') long-awaited antitrust lawsuit against Facebook. Maybe the government will come up with something as the case moves forward, but its monopolization claims don't strike me as overwhelming.  And, as Mark MacCarthy points out, the likelihood that the lawsuit will do something good on the privacy front is vanishingly small.

Russia's SVR, heir to the KGB, is making headlines with a remarkably sophisticated and well-hidden cyberespionage attack on a lot of institutions that we hoped were better at defense than they turned out to be. Nick Weaver lays out the depressing story, and Alex offers a former CISO's perspective, arguing for a federal breach notification law that goes well beyond personal data and includes after-action reports that aren't locked up in post-litigation gag orders. Jamil Jaffer tells us that won't happen in Congress any time soon.

Jamil also comments on the prospects for the National Defense Authorization Act, which is chock full of cyber provisions but struggling forward under a veto threat. If you're not watching the European Parliament tie itself in knots trying to avoid helping child predators, tune in to watch American legislators tie themselves into knots trying to pass an important defense bill without drawing the ire of the President.

The FCC, in an Ajit Pai farewell, has been hammering Chinese telecom infrastructure companies. In one week, Jamil reports, the FCC launched proceedings to kick China Telecom out of the US phone network, reaffirmed its exclusion of Huawei from the same infrastructure, and adopted a "rip and replace" mandate for US providers who still have Chinese gear  in their networks.

Nick and I clash over the latest move by Apple and Google to show their contempt for US counterterrorism efforts – the banning of a location data company whose real crime was selling the data to (gasp!) the Pentagon.

Mark explains proposals for elaborate new regulation elaborate new regulation of digital intermediaries now working their way through -- where else? – Brussels. I express some cautious interest in regulation of "gatekeeper" platforms, if only to prevent Brussels and the gatekeepers from combining to slam the Overton window on conservatives' fingers.

Mark also reports on the Trump administration's principles for U.S. government use of artificial intelligence, squelching as premature my celebration at the absence of "fairness" and "bias" cant.

Those who listen to the roundup for the porn news won't be disappointed, as Mark and I dig into the details of Pornhub's brush with cancellation at the hands of Visa and Mastercard – and how the site might overcome the attack.

In short hits, Nick and I disagree about Timnit Gebru, the "ethicist" who was let go at Google after threatening to quit and who now is crying racism. I report on the enactment of a modest but useful IoT Cybersecurity law and on the doxxing of the Chinese Communist Party membership rolls as well as the adoption of the most law-enforcement-hostile technology  yet to come out of Big Tech – Amazon's Sidewalk.       

Download the 342nd Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

341. It’s time to pay attention when attention stops paying

Did you ever wonder where all those trillion dollar tech valuations come from?  Turns out, a lot of the money comes from online programmatic advertising, an industry that gets little attention even from the companies it's making wealthy, such as Google. That lack of attention is pretty ironic, because lack of attention is what’s going to kill the industry, according to Tim Hwang, former Google policy maven and current research fellow at the Center for Security and Emerging Technology (CSET).  In our interview, Tim Hwang explains the remarkably complex industry and the dynamics that are leaching the value out of its value proposition. Tim thinks we’re in an attention bubble, and the pop will be messy.  I’m persuaded the bubble is real but not that its end will be disastrous outside of Silicon Valley.

But first, in the news roundup Sultan Meghji and I celebrate was seems like excellent news about a practical AI achievement in predicting protein folding. It’s a big deal, and an ideal problem for AI, with one exception.  The parts of the problem that AI hasn’t solved would be a lot easier for humans to work on if AI could tell us how it solved the parts it did figure out.  Explainability, it turns out, is the key to collaborative AI-human work. 

Opening the 'Black Box' of Artificial Intelligence | RealClearScience 

We welcome first time participant and long-time listener Jordan Schneider to the panel. Jordan is the host of the unmissable ChinaTalk podcast. Given his expertise, we naturally ask him about … Australia. 

Actually, it’s a natural, because Australia is now the testing ground for many of China’s efforts to bend independent countries to its will using cyber power along with trade leverage. Among the highlights: Chinese tweets about Australian war crimes, boosted by a hamhanded bot campaign. And in a move that ought to be front an center in future justifications of the Trump administration’s ban on WeChat, the platform refused to carry the Australian prime minister’s criticism of the war-crimes tweet. Tom Cotton and Marco Rubio, call your office!

And this will have to be the Senators' fight, because it looks more and more as though the Trump administration has thrown in the towel. Its claim to be negotiating a TikTok sale after ordering divestment is getting thinner; now the divestment deadline has completely disappeared, as the government simply says that negotiations will continue.   Nick Weaver is on track to win his bet with me that CFIUS won’t make good on its Tiktok order before the mess is shoveled onto Joe Biden’s plate.

Whoever was in charge of beating up WeChat and TikTok may have checked out of the Trump administration early, but the team that’s sticking pins in other Chinese companies is still hard at work. Jordan and Brian talk about the addition of SMIC to the amorphous Defense blacklist. And Congress has passed a law (awaiting Presidential signature) that will make life hard for Chinese firms listed on U.S. exchanges.

China, meanwhile, isn’t taking this lying down, Jordan reports. It is mirror-imaging all the Western laws that it sees as targeting China, including bans on exports of Chinese products and technology. It is racing (on what Jordan thinks is a twenty-year pace) to create its own chip design capabilities.

And with some success. Sultan, the podcast’s resident DeHyper, takes some of the hype out of China’s claims to quantum supremacy.  But even dehyped, China’s achievement should be making those who rely on RSA-style crypto just a bit nervous (and that’s all of us, of course).

Michael Weiner previews the still veiled state antitrust lawsuit against Facebook and promises to come back with details as soon as it’s filed. In quick hits, I explain why we haven’t covered the Iranian claim that their scientist was rubbed out by an Israeli killer robot machine gun: I don’t actually believe them.

Brian explains that another law aimed at China and its use of Xinjian forced labor is attracting lobbyists but likely to pass. Apple, Nike, and Coca-Cola have all taken hits for lobbying on the bill; none of them say they oppose the bill, but it turns out there’s a reason for that. Lobbyists have largely picked the bones clean.

President Trump is leaving office in typical fashion – gesturing in the right direction but uninteresting in actually getting there. In a “Too Much Too Late” negotiating move, the President has threatened to veto the defense authorization act if it doesn’t include a repeal of section 230 of the Communications Decency Act. If he’s yearning to wield the veto, Dems and GOP alike seem willing to give him the chance.  They may even override, or wait until January 20 to pass it again.

Finally I commend to interested listeners the oral argument in the Supreme Court’s Van Buren case, about the Computer Fraud and Abuse Act. The Solicitor General’s footwork in making up quasitextual limitations on the more sweeping readings of the Act is admirable, and it may well be enough to keep van Buren in jail, where he probably belongs for some crime, if not this one. 

Download the 341st Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

340: Henry Kissinger and Michael Daniel on How to be a Cyber Czar

Our interview in this episode is with Michael Daniel, formerly the top cybersecurity adviser in the Obama NSC and currently the CEO of the Cyber Threat Alliance.  Michael lays out CTA’s mission. Along the way he also offers advice to the Biden cyber team – drawing in part on the wisdom of Henry Kissinger.

In the news roundup, Michael joins Jamil Jaffer and Nate Jones to mull the significance of Bruce Reed’s appointment to coordinate technology issues in the Biden White House.  Reed’s tough take on Silicon Valley companies and section 230 may form the basis of a small-ball deal with Republicans on things like child sex abuse material, but none of us thinks a broader reconciliation on content moderating obligations is in the offing.

When it comes to regulating the tech sector, Brussels is a fount of proposals. The latest, unpacked by Jamil and Maury Shenk, is intended to build on the dubious success of GDPR in jumpstarting the EU’s technology industry. If it reminds you of the brilliant success of European regulation in creating a large certification authority industry, you won't be far wrong.

Maury and I puzzle over exactly how a Russian divorcee won a court order allowing access to her estranged son’s Gmail account. Our guess: the court stretched a point to conclude that the son had consented.

Another day, another China-punishing measure from the Trump administration: Jamil explains the administration’s vision of a bloc of countries that will unite in resistance to China’s punitive trade retaliation against inconvenient Western countries, most notably Australia, now getting hit hard by China.

Meanwhile, Maury reports that the administration has identified nearly 90 Chinese companies that are closely tied to the Chinese military for purposes of export control licenses. The only good news for US exporters is that the list eliminates some ambiguity about the status of some companies.

Maury also gives an overview of what most of us think is an oxymoron: Privacy in China. In fact, there is growing attention to protecting privacy at least from commercial companies. But harsh penalties, as always, are going to make observers wonder “who did that company piss off?” before they wonder “what did that company do wrong?”

Maury also reports on the effort to revive Privacy Shield – and on just how little the negotiators have to work with.

Jamil comments on the ever-rising cost of cybersecurity, and the possible implications for bank consolidation.

Nate reviews privacy and security doubts about Amazon’s Sidewalk feature, which turns Alexa devices into neighborhood WiFi networks.

Maury and I note that the deadline for a TikTok sale is a week away and maybe always will be.

Jamil wonders why ZTE asked the FCC to reconsider its exclusion of the company from the US telecoms infrastructure. The FCC order denying the request was not exactly a marketing triumph.

Jamil and I have fun asking how much snooping will go on in a proposed new fiber-optic network linking Saudi Arabia and Israel. Biggest loser? Egypt.

Nate is not surprised that France is pushing its tax for the (US) tech sector, but we debate whether the timing will turn out to be good for France or bad. I claim that White House ADHD will be France’s best friend.

Maury and I try to figure out whether there’s a public policy case in favor of the Rivada plan to take over a bunch of DoD spectrum and rent out whatever is excess to DoD needs. Maybe there is, but we can’t find it.

Download the 340^th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

339: The Privacy and Europocrisy Oversight Board

Here's my favorite story from this episode: David Kris told us about a report from the Privacy and Civil Liberties Oversight Board that spelled out the enormous value that European governments have gotten in their fight against terrorism from the same American surveillance programs that European institutions have been trying for twenty years to shut down.  The PCLOB report is a delightful takedown of European virtue-signaling, and I hope the Biden Administration gives the PCLOB a new name and mission in honor of the report.

The news roundup actually begins with a review of the US-China tech relationship and how it might change under a Biden administration. The Justice Department has given itself a glowing report card for its contribution to decoupling – by opening a new China-related counterintelligence case every 10 hours. I ask how long this can go on before China starts arresting American businessmen – something that will surely kick off another round of decoupling.

Speaking of decoupling, the latest legislation aimed at prison labor in China may be getting uncomfortably close to Apple, which is quietly lobbying to water down a bill that is expected to pass soon by overwhelming majorities. Megan Stifel and I conclude that the provision that probably scares Apple most is an obligation to make representations about whether the company’s products include parts made with prison labor. That is increasingly difficult to figure out as China has limited audits for such purposes, putting Apple in a tight spot. Sympathy for Tim Cook, however, is in short supply from our panel.

Speaking of legacy burnishing, the Trump White House has issued its own set of guidelines for federal agencies using artificial intelligence. Nick Weaver thinks they're actually not bad – light touch on most topics – which may be the nicest thing he’s said about a product of this White House in four years. Sticking with AI, Nick comments on the prospect for putting humans in the loop of AI decision making.  He thinks that’s a recipe for lousy AI, and that campaigns to get a “Human in the Loop” for lethal systems have already lost the technology fight. At best, he suggests, we can hope to have our poky old brains “on the loop” in future AI conflicts.

Some good news:  An IOT security bill that Megan and I both like (Megan more than I) has passed both houses of Congress and been sent to the President for signature. It only sets standards for the IOT that the federal government buys, but that’s a good first step.

As a former NSAer, I explain “GCHQ envy” to David, and he provides the latest reason why it should be rampant at the Fort this year, as the agency introduces a new offensive cyber unit to take on organized crime and hostile states.

David also takes on the question whether there’s a legal problem with the U.S. military buying location data from apps companies.  Short answer: Nope.

Megan explains a now-patched Facebook Messenger bug that would have allowed hackers to listen in on users. Nick tells us why the FBI needed to hire robots to retrieve sensitive files. Megan gives us some staggering statistics about the prevalence of ransomware. Hint: if you thought COVID-19 was a pandemic, you ain’t seen nothin’ yet. And I give a quick summary of the TikTok and WeChat ban litigation, where the government is unlimbering a host of new technical arguments.

I take a moment to give a shoutout to Sean Joyce, whose principles led him to walk away from what is probably going to be serious money when Airbnb goes public. The company’s leadership hired him as chief trust officer. Taking trust seriously, he argued for limits on when and how much data about individual users the company gave to the Chinese government.  But the debate reportedly ended when one of the founders declared, “We’re not here to promote American values.” That's not a good look for Airbnb, but the incident says a lot about Joyce, who left the company within weeks because he didn't share its principles.

And, finally, it turns out that the FCC is in its last weeks of Trump legacy burnishing; facing a deadline in January 2020, it had to choose between starting to write regulations about the scope of section 230 and dealing with foreign products in the 5G infrastructure.  It chose 5G.

And more.

Download the 339^th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

338. Another week, another warhead

This week sees yet another Trump administration initiative to hasten America's decoupling from China. As with MIRV warheads, the theory seems to be that if you launch enough of them, the next administration can't shoot them all down.  Brian Egan lays out this week's initiative, which lifts from obscurity a DoD list of Chinese military companies and excludes the companies from U.S. capital markets. 

Our interview is with Frank Cilluffo and Mark Montgomery. Mark is Senior Fellow at the Foundation for Defense of Democracies and Senior Advisor to the congressionally mandated Cyberspace Solarium Commission. Previously, he served as Policy Director for the Senate Armed Services Committee under Senator John S. McCain—and before that served for 32 years in the U.S. Navy as a nuclear trained surface warfare officer, retiring as a Rear Admiral in 2017. Frank is director of Auburn University's Director of Auburn University's McCrary Institute for Cyber and Critical Infrastructure Security. He served on the Cyberspace Solarium Commission and chaired the Homeland Security Advisory Council's subcommittee on economic security.

We talk about the unexpected rise of the industrial supply chain as a national security issue. Both Frank and Mark were moving forces in two separate reports highlighting the issue, as was I. (See also my op-ed on the same topic.) So, if we seem suspiciously in agreement on supply chain issues, it's because we are suspiciously in agreement on supply chain issues. Still, as an introduction to one of the surprise hot issues of the year, it's not to be missed.

After our interview in episode 336 of a Justice Department official on how to read Schrems II narrowly, you knew it was only a matter of time before we heard from Europe. Charles Helleputte reviews the European Data Protection Board's effort to give more authoritative and less comfortable advice to U.S. companies that want to keep relying on the standard contractual clauses. The Justice Department take on the topic manages to squeak through without a direct hit from the privacy bureaucrats.  Still, the EDPB (and the EDPS even more so) makes clear that anyone following the DOJ's lead is in for an uphill fight. (For those who want more of Charles's thinking on the topic, see this short piece.)

Zoom has been allowed to settle an FTC proceeding for deceptive conduct (claiming that its crypto was end to end when it wasn't, and more). Mark MacCarthy gives us details.  I throw shade on the FTC's failure to ask any serious national security questions about a company that deserves some. 

Brian brings us up to speed on TikTok.  Only one of the Trump administration penalties remains unenjoined. My $50 bet with Nick Weaver -- that CFIUS will overcome the judicial skepticism that IEEPA could not -- is hanging by a thread. Casey Stengel makes a brief appearance to explain why TikTok might win. 

Brian also reminds us that export control policymaking is even slower and less functional on the other side of the Atlantic, as Europe tries, mostly ineffectively, to adopt stricter limits on exports of surveillance tech. 

Mark and I admire the new Aussie critical-infrastructure cybersecurity initiative, for its clarity if not for its likely political appeal. 

Charles explains and I decry the enthusiasm of European courts for telling Americans what they can say and read on line, as an Austrian court tells Facebook to take down worldwide the description of an Austrian politician as belonging to a "fascist party." Apparently, we aren't allowed to say that political censorship is what members of a fascist party tend to advocate; but don't worry about our liability; we can't pronounce the plaintiff's name.  

So, in retrospect, how did the United States do in policing all the new cyberish threats to the 2020 election? 

• Brian gives the government credit for preventing foreign interference. I question the whole narrative of foreign interference, which didn't have much effect in 2016 or 2020 (other than the hack and dump operation against the DNC) but did align conveniently with Democratic messaging in both years (Hillary only lost because of the Russians! Ignore Trump's corruption allegations because they're just more Russian interference!).
• Mark and I wonder what Silicon Valley thinks it's accomplishing with its extended bans on political advertising after the election.  After all, it's almost always election season somewhere (see, e.g., Georgia).
• DHS's CISA did produce a detailed rumor control site that helped correct misunderstandings -- but may have corrected one too many of the President's tweets.  In consequence, Under Secretary Chris Krebs, familiar to Cyberlaw Podcast listeners, may be on the chopping block. That would be a shame for DHS and CISA; for Chris it's probably a badge of honor. Frank Cilluffo and Mark Montgomery weigh in with praise for Chris as well.

And more.

Download the 338th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The Chinese supply chain problem

An excerpt from my latest Washington Post article:

How to deal with the risks to homeland and national security posed by trade with China (and Russia) is the focus of a report by the Department of Homeland Security Advisory Council that is scheduled to be released Thursday. I took part in the study, which reinforces and adds to recent bipartisan supply-chain recommendations of the Cyberspace Solarium Commission.

The danger from U.S. dependence on trade with China has been growing across more than three decades. Administrations before Trump's clung to an increasingly forlorn hope that opening U.S. markets to Chinese goods would mean cheaper materials for U.S. industries and a growing Chinese commitment to democracy and open markets.

By 2016, though, China's aims were clear: Create a domestic alternative to practically every technology it bought from the United States, then allow these Chinese tech companies to squeeze out their Western competitors. Safe from competition at home, the flourishing Chinese companies could target foreign markets, too. Meanwhile, the doctrine of "civil-military fusion" would ensure that the People's Liberation Army benefited from its domestic commercial technology development.

The report of the Homeland Security Advisory Council will be posted here under Recommendations. The Cyberspace Solarium paper is here.

336. Could Kim Jong Un kill 300 million Americans today?

This episode's interview with Dr. Peter Pry of the EMP Commission raises an awkward question: Is it possible that North Korea already has enough nuclear weapons to cause the deaths of hundreds of millions of Americans -- by permanently frying our electrical infrastructure with a single high-altitude blast?  And if he doesn't, could the sun accomplish pretty much the same thing?  The common factor in both scenarios is EMP – electro-magnetic pulse. We explore the problem in detail, from the capabilities of adversaries to the controversy that has pitted Dr. Pry and the EMP Commission against the power industry and the Energy Department, which are decidedly more confident that the US would withstand a major EMP event. And, for those disinclined to trust those sources, Dr. Pry offers a few tips on how to make it more likely that your systems will survive an EMP.

In the news, the election turned out not to be hacked, not to be violence-plagued, and not to be the subject of serious disinformation. That didn't stop Twitter and YouTube from overreacting when a leftie hate-object, Steve Bannon, used hyperbole ("heads on pikes") to express his unhappiness with Dr. Fauci. Really, Twitter's Trust and Safety operation is so blinkered it can't be fixed and should be nuked from orbit.  Oh, wait, there goes my Twitter account and my YouTube career!

In legal tech news, Michael Weiner explains what's at stake in the Justice Department's antitrust lawsuit challenging Visa's $5.3 billion acquisition of Plaid. I wonder if that means the Department is out of antitrust-litigating ammo.  And it might be, except that you can buy a lot of ammo with $1 billion worth of Silk Road bitcoins, now being claimed by the US. Sultan Meghji says the real question is why it took the U.S. so long to lay claim to the coins.

 Just when private companies have come up with plans to comply with California's privacy law, the voters there change everything.  Well, maybe not everything.  It looks, Dan Podair suggests, as though compliance with the new CPRA will mostly involve complying with the old CCPA plus a whole bunch more. Meanwhile, I'm fascinated by the idea that California initiatives can say, "Oh, and by the way, this law can only be amended to make it more demanding." 

 We bring Michael back to the conversation to brief us on the FTC's plan to launch an antitrust case against Facebook using its own administrative law judges to hear the evidence. Michael admits that some might call that a kangaroo court; I suggest that LabMD's Mike Dougherty be called as an expert witness.

 Sultan and I note the ongoing failure of media and rights groups to successfully toxify facial recognition technology; now it's been used to identify a "mostly peaceful" protestor who allegedly took a break from peacefulness to punch a cop.  And it's hard to argue with using face recognition when it confirms a picture ID the suspect left behind in Lafayette Square. 

 Next, Sultan and I take on Toxification II, the campaign to make people believe that racist artificial Intelligence is a thing. Poorly trained AI is definitely a thing, Sultan argues, but that doesn't make for the same kind of story.

 Charles Helleputte analyzes the latest rumor that the EU is planning to prohibit end-to-end crypto. He notes that the EU is also pursuing more infrastructure security and wonders whether the two initiatives can be sustained together.

It turns out that other people on Zoom can, in theory and under the right conditions, guess what you're typing.  It's one more reason to be careful about webcams and security. I make the sort of cheap Jeffrey Toobin joke you've come to expect from me.

 And more.

Download the 337th Episode (mp3)

Music by Weissman Sound Design. You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

336, Trumping Schrems II

Our interview this week is a deep dive into the mess created by the EU Court of Justice in Schrems II – and some pretty good ideas for how companies might avoid the mess, courtesy of a U.S. Government white paper. I interview Brad Wiegmann, Senior Counselor for the National Security Division at the US Department of Justice about the white paper. We cover a host of arguments and new facts that may help companies navigate the wreckage of Privacy Shield and preserve the standard corporate clauses they’ve relied on for transAtlantic data transfers. And, yes, the phrase “hypocritical European imperialism” does cross my lips.

In the news, we can’t let election eve pass without a look at all the election security threats and countermeasures now being deployed.  I argue that the election security threat is the second coming of Y2K – a threat that is almost certainly an overhyped bogeyman, but one we can’t afford to ignore.  Jamil Jaffer and Pete Jeydel push back. Silicon Valley’s effort to ensure that no one questions the legitimacy of a Biden victory also comes in for some criticism on my end – and is defended by Nate Jones. My nomination for Flakiest Silicon Valley Election Security Techno-nostrum is the banning of post-election political ads. That just guarantees that speech about the election will default to the biggest “organic” voices on the internet and to the speech police at each platform. Or was that the intent?

Confused about all the TikTok and WeChat litigation? It's pretty simple, really: the US hasn’t won a single case, and it’s gone down hard in three separate opinions, the latest by US District Judge Beetlestone of Philadelphia. This could be Trump Derangement at work, but the fact is that the Chinese platforms have a plausible argument that Congress prohibited the use of IEEPA to "indirectly regulate" distribution of speech. Banning a social platform might seem to fit within that prohibition, but the result is crazy: it implies that TikTok could replay all the Russian election interference memes from 2016, and the government would be helpless to stop it. On appeal, we may see the courts taking a broader view of the equities. Or they may be tempted to say, “Well, Congress screwed this up, let Congress unscrew it.” 

Nate and I try to sum up what we learned from the social media speech suppression hearing on the Hill. Nate sees no common ground emerging despite wide unhappiness with Silicon Valley’s role in regulating speech. I am more optimistic that a Congress looking to make progress could agree on first steps toward transparency practices on the platforms. The companies themselves seem to have decided that this is table stakes as they strive to avoid worse. 

Nate gives us a quick view of the platform speech debate in Europe.  My summary: Silicon Valley is already incentivized by EU law to oversuppress; now they’re asking for immunity when they oversuppress, which means, of course, even more suppression. 

In quick hits, Pete talks about the ransomware threat to US health care. Nate explains the tensions between law enforcement and intelligence in Canada. And Pete tells us why fertility clinics are the latest national security concern for CFIUS. 

And more!

Download the 336th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

335. Digital Dunkirk

In this episode, I interview Rob Knake, Senior Fellow at the Council on Foreign Relations, about his recent report, "Weaponizing Digital Trade -- Creating a Digital Trade Zone to Promote Online Freedom and Cybersecurity." The theme of the report is what the US can salvage from the wreckage of the 1990s Magaziner Consensus about the democratizing and beneficent influence of an unregulated Silicon Valley. I suggest that, when you're retreating from global ambition to a battered band of democratic nations, talking about "weaponization"  is delusional; what the paper really proposes is a kind of "Digital Dunkirk." Rob and I proceed to disagree about the details but not the broad outlines of his proposal.

In the news roundup, we finally have a Google antitrust complaint to pore over, and I bring Steptoe's Michael Weiner on to explain what the complaint means. Bottom line: it's a minimalist stub of a case, unlikely to frighten Google or produce structural changes in the market -- unless a new administration (or a newly incentivized Trump Justice Department) keeps adding to the charges as the investigation wears on.

Speaking of Justice Department filings that serve up less than meets the eye, DOJ has indicted GRU hackers for practically every bad thing that has happened on the internet in the last five years, other than the DNC hack. (In fact, I lost an unsaved Word document in 2017 that I'm hoping will be added to the charges soon.) The problem, of course, is that filing the charges is the easy part; bringing these state hackers to justice is so hard as to be more or less inconceivable.  So one wonders (along with Jack Goldsmith) whether a policy that requires a stream of indictments for all the cyberattacks on the US and its allies is a wise use of resources. Maury Shenk thinks it might be, at least as a way of demonstrating US attribution capabilities, which are indeed impressively showcased in the indictment.

While we're on the subject of questionably effective US retaliation for cyberattacks, Maury notes that the Treasury Department has imposed sanctions on the unpronounceable Russian institute, TsNIIKhM, that seems to have developed the industrial control malware that caused massive outages in Saudi Arabia and that may still be planted in US energy systems as well. Again, no one doubts that heavy penalties should be imposed; the question is whether these penalties will actually ever reach TsNIIKhM.

In another law enforcement action against cyberattacks, Nick Weaver celebrates the German government's dawn raid on spyware exporter, FinFisher. And Maury expresses modest hope for Facebook's Oversight Board now that it has started reviewing content moderation cases. Color me skeptical.

Now that we've seen the actual complaint, Nick has his doubts about Microsoft's legal attack on Trickbot. It may be working, he says, but why is Microsoft doing something that the FBI could have done? I pile on, raising questions about the most recent legal theory Microsoft has rolled out in support of its proposed remedies.

Finally, in quick hits:  I hum a few bars from "John Henry" in response to a Bloomberg story suggesting that CEOs are successfully beating the AI engines parsing their analyst calls and trading on the results. Maury then debunks the parts of the story that made it fun, but not before I've asked whether Spinal Tap was decades ahead of its time in repackaging failure for AI consumption. Maury notes what I predict will be ho-hum Judiciary Committee testimony of Twitter and Facebook CEOs about their suppression of the New York Post "laptop from hell" Hunter Biden story.  I'm much more interested in the Commerce Committee's subpoenaing of contacts between the campaigns and those companies.  Because you just know the campaigns have a whole strategy for working the speech referees of Silicon Valley, and it would be an education to see how they do it.  Nick and I congratulate Edward Snowden on the confirmation that he'll be in Russia forever. And I mock the Portland City Council as well as all the journalists who tried to make face recognition toxic – until it turned out that face recognition might help antifa dox the police.  Suddenly we can't expect to stop the march of technology.

Download the 335th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

334: Fight Like a Canadian

This episode features an interview with Ronald Deibert, Professor of Political Science, and Director of the Citizen Lab at the Munk School of Global Affairs & Public Policy, University of Toronto. We talk about his new book, Reset: Reclaiming the Internet for Civil Society. We also talk about the unique Canadian talent for debating with bare-fisted politesse. Ron gets to use that talent often in our discussion of what’s wrong with the technology ecosystem and whether it can be improved by imposing “restraint” on government and the private sector.

In the news roundup, I urge Twitter to bring back the Fail Whale to commemorate its whale of a fail in trying to suppress a New York Post story that is bad news for Joe Biden. It’s a disaster on all fronts, with Twitter unable to offer a satisfactory explanation for its suppression of the news report, or to hold to any particular enforcement policy for more than a day, and it ended with an embarrassing insistence that the Post can’t have its account back until it deletes tweets that Twitter would probably allow the Post to post today.  

And not surprisingly, the episode is encouraging everyone to think that they can do this better than Twitter.  The FCC is going to start work on an effort to add an administrative gloss to section 230. Mark MacCarthy thinks the Commission lacks authority to interpret the provision; I disagree. We do agree that Justice Thomas’s thoughts on section 230 are surprisingly detailed – and make Supreme Court review of the provision a lot more likely. 

Megan Stifel tells us that the ransomware business is getting even more specialized.  Together we wonder if that specialization opens the door to new, even more creative, ways to take down organized cybercrime. 

David Kris notes the pearl-clutching over search warrants that identify a pattern of conduct rather than an individual.  He almost agrees with me that this is just what probable cause looks like in the twenty-first century. 

This week puts on display Europe’s trademarked "Tough Privacy Talk and Slow Privacy Walk" policy approach: David teams with Charles Helleputte to make sense of two data protection rulings in Europe that bring a lot more thunder than lightning to the debate: First, an attack on the privacy standards, such as they are, for online advertiser  real time bidding. Second, the proclamations of France’s top court and its DPA about sending health data to US cloud providers. 

Megan notes two stories that deepen trends we knew were coming: hackers chaining VPN and ZeroLogon bugs to attack US government networks, maybe including election agencies,   and Iranian state hacker group resorting  to ransomware attacks. 

We cover a few updates of past weeks’ stories: The fallout continues from OFAC’s ransomware advisory. (Rumors that the agency will be renamed WTF OFAC are unconfirmed.) And Tik/Chat seems to be settling in for a longer court battle before the government’s arguments start to take hold. (As a bonus, our Cyberlaw grammarian makes a surprise appearance to announce the rule of English usage that prevents TikTok from ever being TokTik). 

In quick hits, we boldly predict that the government will launch an antitrust suit against Google, some day. We speculate on why Tesla’s autopilot AI might be fooled by projected images. And we note New York’s claim that Twitter is systemically important to the nation’s financial system -- which is just about the most 2020 thing I’ve heard in a while.

And more! 

 Download the 334th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! And thanks for our new theme music to Ken Weissman of Weissman Sound Design.

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

 

333. Interview with David Ignatius

In our latest episode I interview David Ignatius about the technology in his latest spy novel, The Paladin. Actually, while we do cover such tech issues as deepfakes, hacking back, Wikileaks, and internet journalism, the interview ranges more widely, from the steel industry of the 1970s, the roots of Donald Trump’s political worldview, and the surprisingly important role played in the Trump-Obama-Russia investigation by one of David Ignatius’s own opinion pieces.

Download the 333^rd Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! Our thanks to Ken Weissman of Weissman Sound Design for the new theme music.  

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

332.Internet of Junk

It’s a law-heavy tech news week, so this episode is all news. If you come for the interviews, though, do not fear.  We’ll be releasing episode 333 tomorrow, and it’s all interview, as I talk with David Ignatius about the tech issues in his latest spy novel, The Paladin.

To kick things off in episode 332, Matthew Heiman returns to the podcast; he analyzes a new decision of the Court of Justice of the EU. The CJEU claims in its headline holding to put limits on governments' mass collection of mobile and internet data, but both Matthew and I think the court's footnotes take away much of the doctrine the headlines proclaims – and maybe in a way that will help the US as it tries to work around the CJEU’s foolhardy decision in Schrems II.

Sultan Meghji tells us that Trickbot has attracted the attention of both Cyber Command and Microsoft’s lawyers.  Unfortunately, even that combination isn’t proving fatal, and I wonder whether Microsoft’s creative lawyering has gone a step too far.

The Democrat-controlled House Judiciary Committee has released a blockbuster tech antitrust report. It’s hardly news that Democrats and Republicans on this most partisan of committees disagree about the issue, but Matthew and I are struck by how modest the disagreements are.  In contrast, despite our conservative leanings, Matthew and I manage to disagree pretty profoundly on how antitrust principles should apply to Big Tech.

Sultan, meanwhile, draws the short straw and has to explain the mother of all metaphor bombs that exploded in the Supreme Court during oral argument in Google v. Oracle. It was a discouraging argument for those of us who admire the Justices, whose skills at finding apt metaphors completely failed them. I offer my past experience as a Supreme Court advocate to critique the argument and lay odds on the outcome. (Short version: Google has a nearly 50-50 chance of winning, and the Court has about the same chance of producing a respectable opinion.

Brian Egan joins us to talk about the Justice Department’s sober report on how law enforcement can combat terrorist and criminal use of cryptocurrency.

I claim to have caught Twitter and Facebook in a clear example of improper suppression of conservative (or at least Trumpist) speech, as they suppress as misleading a Trump tweet that turns out to be, well, true.

Brian and I dig into the latest litigation over banning TikChat from US markets. Short version: the Justice Department has filed a strong brief seeking to overturn WeChat’s first amendment protection from the ban. If you’re looking for raw disagreement, listen for Brian coming out of his chair when I start comparing Silicon Valley and Chinese Communist Party net censorship regimes.

Matthew explains why Sweden and Switzerland are fighting over a crypto company widely reported to have been compromised by US and German intelligence fifty years ago.

And for our sensitive male listeners, this may be the point where you turn the podcast off, as I explain the dire consequences of combining bad IOT security and male chastity devices.  Though, come to think of it, an angle grinder would make a pretty effective chastity device by itself.

And more!

Download the 332^nd Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug. Thanks to Ken Weissman of Weissman Sound Design for our theme music.

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

331. Damned if You Do, and Damned if You Don’t (Pay the Ransom)

In this episode, Jamil Jaffer, Bruce Schneier, and I mull over the Treasury announcement that really raises the stakes even higher for ransomware victim.  The message from Treasury seems to be that if the ransomware gang is the subject of OFAC sanctions, as many are, the victim needs to call Treasury and ask for a license to pay – a request that starts with a “presumption of denial.”  

Someone has been launching a series of coordinated attacks designed to disrupt Trickbot. Bruce explains.

CFIUS is baring its teeth on more than one front. First comes news that a newly resourced CFIUS staff has begun retroactively scrutinizing past Chinese tech investments. This is the first widespread reconsideration of investments that escaped notice when they were first made, and it could turn ugly. Next comes evidence that the TikTok talks with CFIUS could be getting ugly themselves, as Nate Jones tells us that Treasury Secretary Mnuchin has laid down the elements the US must have if TikTok is to escape a shutdown. None of us think this ends well for TikTok, as China and the US try to prove how tough they are by asking for mutually exclusive structures.

The US government is giving US companies some free advice about how to keep sending their data to the US despite the European Court of Justice decision in Schrems II: First-time participant Charles Helleputte offers a European counterpoint to my perspective, but we both agree that there’s a lot of value in the US white paper. If nothing else, it offers a defensible basis for most companies to conclude that they can use the standard contractual clauses to send data to the US notwithstanding the court’s egregiously anti-American opinion. The court may not agree with the white paper, but the reasoning could buy everyone another three years and might be the basis of yet another US-EU agreement.

The UK seems to be preparing to take Bruce’s advice on regulating IOT security, but he thinks that banning easy default passwords is just table stakes.

Bruce and I once again review the bidding on voting by phone, and once again we agree: No. Just No.

Nate questions the press stories (and FBI director testimony) claiming that the FBI is pivoting to a new strategy for punishing hackers by sending Cyber Command after them. He thinks it’s less a pivot and more good interagency citizenship, which I suspect is still a change of pace for the Bureau.

Bruce and I explore the possibility of attributing exploits to individuals based on their coding style. You might say that their quirks leave fingerprints for the authorities, except that at least one hapless hacker has one-upped them by leaving his actual fingerprints behind in an effort to get himself approved in a biometric authentication system.

And in updates, we note that Microsoft has a new and unsurprising annual report on cyberattacks it has seen; the Senate will be subpoenaing the CEOs of Big Social to talk section 230 in an upcoming  hearing; and the House intel committee has a bunch of suggestions for improving the performance of the intelligence community against evolving Chinese threats.

And more!

Oh, and we have new theme music, courtesy of Ken Weissman of Weissman Sound Design.  Hope you like it!

Download the 331^st Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

330: US-China Tech Divide – Where Will it End?

Our news roundup is dominated by the seemingly endless ways that the US and China can find to quarrel over tech policy.  The Commerce Department’s plan to use an executive order to cut TikTok and WeChat out of the US market has now been enjoined. But the $50 Nick Weaver bet me that TikTok could tie its forced sale up until January is still at risk, because the administration has a double-barreled threat to use against that company – not just the executive order but also CFIUS – and the injunction so far only applies to the first. 

I predict that President Xi is likely to veto any deal that appeals to President Trump, just to show the power of his regime to interfere with US plans. That could spell the end of TikTok, at least in the US. Meanwhile, Dave Aitel points out, a similar but even more costly fate could await much of the electronic gaming industry, where WeChat parent TenCent is a dominant player. 

And just to show that the US is willing to do to US tech companies what it’s doing to Chinese tech companies, leaks point to the imminent filing of at least one and perhaps two antitrust lawsuits against Google. Maury Shenk leads us through the law and policy options.

The panelists dismiss as PR hype the claim that it was the threat of “material support” liability that caused Zoom to drop support for a PFLP hijacker’s speech to American university students. Instead, it looks like garden variety content moderation aimed this time at a favorite of the far left.

Dave explains the good and the bad of the CISA order requiring agencies to quickly patch the critical Netlogon bug. 

Maury and I debate whether Vladimir Putin is being serious or mocking when he proposes an election hacking ceasefire and a “reset” in the cyber relationship. We conclude that there’s some serious mocking in the proposal.

Dave and I also marvel at how Elon Musk, for all his iconoclasm, sure has managed to cozy up to both President Xi and President Trump, make a lot of money in both countries, and take surprisingly little flak for doing so.  The story that spurs this meditation is the news that Tesla is so dependent on Chinese chips for its autonomous driving engine that it’s suing the US to end the tariffs on its supply chain. 

 In quick hits and updates, we note a potentially big story: The Trump administration has slapped new restrictions on exports to Semiconductor Manufacturing International Corporation, China’s most advanced maker of computer chips. 

The press that lovingly detailed the allegations in the Steele dossier about President Trump’s ties to Moscow hasn’t been quite so enthusiastic about covering the dossier’s astounding fall from grace. The coup de grace came last week when it was revealed that the main source for the juiciest bits was flagged by the FBI ten years ago as a likely Russian foreign agent; he escaped a FISA order only because he left the country for a while in 2010. 

 The FISA court has issued an opinion on what constitutes a “facility” that can be tapped with a FISA order. It rejected the advice of Cyberlaw Podcast regular David Kris in an opinion that includes all the court’s legal reasoning but remains impenetrable because the facts are all classified. Maury and I come up with a plausible explanation of what was at stake.

The Trump administration has proposed section 230 reform legislation similar to the white paper we covered a couple of months ago. The proposal so completely occupies the reasonable middle of the content moderation debate that a Biden administration may not be able to come up with its own reforms without sounding fatally similar to President Trump. 

And in yet more China news, Maury and Dave explore the meaning of Nvidia’s bid for ARM, and Maury expresses no surprise at all that WeWork is selling off a big chunk of its Chinese operations 

Oh, and we have new theme music, courtesy of Ken Weissman of Weissman Sound Design.  Hope you like it!

Download the 330th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

 

329. The TikTok Dumpster Fire

John Yoo, Mark MacCarthy, and I kick off episode 329 by jumping with both feet into the cyberspace equivalent of a dumpster fire. There is probably a pretty good national security case for banning TikTok. In fact, China made the case a lot better than the Trump administration when it declared, "You know that algorithm that tells all your kids what to watch all day? That's actually a secret national security asset of the People's Republic of China." But the administration's process for addressing the national security issue was unable to keep up with President Trump's eagerness to announce some kind of deal. The haphazard and easily stereotyped process probably also contributed to the casual decision of a magistrate in San Francisco to brush aside US national security interests in the WeChat case, postponing the order on dubious first amendment grounds that John Yoo rightly takes to task.

Megan Stifel tells us that the bill for decoupling from China is going to be high – up to $50 billion just for chips if you listen to the Semiconductor Industry Association.

Speaking of big industry embracing big government, Pete Jeydel explains IBM's slightly jarring suggestion that the government should slap export controls on a kind of face recognition technology that Big Blue doesn't sell any more. Actually, when you put it like that, it kind of explains itself.

Megan tells us that the House has passed a bill on the security of IOT devices. The bill, which has also moved pretty far in the Senate, is modest, setting standards only for what the federal government will buy, but Megan has hopes that it will prove to be the start of a broader movement to address IOT security.

I reprise the latest demonstrations that Silicon Valley hates conservatives, and how far it will go to suppress their speech.  My favorite is Facebook deciding that a political ad that criticizes transwomen competing in women's sports must be taken down because it "lacks context". Unlike every other political ad since the beginning of time, apparently. Although Twitter's double standard for a "manipulated media" label is pretty rich too: Turns out that in the Twitterverse, splicing Trump's remarks to make him say what the Biden camp is sure he meant is perfectly fair , but splicing a Biden interview so he says what the Trump camp is sure he meant is Evil Incarnate.

Finally, Megan rounds out the week with a host of hacker news. The North Koreans are in bed with Russian cybercrime gangs.  (I can't help wondering which one wakes up with fleas.) The Iranians are stealing 2FA codes and some of them have now been indicted by the US Justice Department, though not apparently for the 2FA exploit.  A long-running Chinese cybergang has also been indicted.  That won't actually stop them, but it will be hard on their Malaysian accomplices, who are already in jail.

Our interview this week is with Michael Brown, a remarkably influential defense technologist. He's been CEO of Symantec, co-wrote the report that led to the passage of FIRRMA and the transformation of CFIUS, and he now runs the Defense Innovation Unit in Silicon Valley. He explains what DIU does and some of the technological successes it has already made possible.

Oh, and we have new theme music, courtesy of Ken Weissman of Weissman Sound Design.  Hope you like it!

Download the 329^th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

328. Jane's Fighting Nerds

The Belfer Center has produced a distinctly idiosyncratic report ranking the world's cyber powers – though they should have called it Jane's Fighting Nerds. Bruce Schneier (@schneierblog) and I puzzle over its rankings, but at least the authors provided the underlying assessments that led them, among other oddities, to rank the Netherlands No. 5, and Israel nowhere in the top ten. The US is number one, but that's partly due to the Center's insistence that the US ranking should be boosted because we're a norms superpower. In my book, that should have cost us a 20% discount off our offensive capabilities ranking.  Don't agree? Download the report and pick your own fight!

Our interview today is with Cory Doctorow, diving deep on his pamphlet/book, "How to Destroy Surveillance Capitalism." It's a robust and entertaining three-cornered fight – me, Cory, and the absent Shoshana Zuboff, whose 700-page tome launched the surveillance capitalism meme. You'll enjoy hearing me ask Cory, a Red Diaper Baby born to Trotskyists, to explain why his solution to tech's overreach is so similar to Attorney General Bill Barr's.

Elsewhere in the news roundup, Nate Jones (@n8jones81) and I unpack the Pandora's Box of pain loosed by the European Court of Justice in Schrems II. Facebook is fighting a multilevel rearguard action – in the courts, in two capitals, and in its terms of service -- to try to salvage its current business model.

I cover the latest Tok in the TikTok saga.  Oracle has won … something or other. Sultan Meghji (@sultanmeghji) and I puzzle over how the TikTok algorithm can stay in China while the dataset it's training on remains in the United States. 

The Justice Department's antitrust lawsuit against Google is getting nearer and nearer, judging from the thrashing in the underbrush. But we still don't have a good idea what part of Google's business will be targeted. Sultan explains the state of play. 

In a news flash as surprising as a report that the weather in San Diego will be sunny and fair, Microsoft has confirmed that the Chinese, Iranians, and Russians have launched cyber-attacks on Biden and Trump campaigns. For reasons unknown, the press can't get enough of this thin gruel.

Bruce and Sultan chart the reasons and tactics behind the rise of ransomware and the importance of being a reliable criminal if you want to make money in extortion. 

Nate unpacks China's global data security initiative so you don't have to waste your time. The tl;dr is that other countries shouldn't do any of the things China is doing or aspiring to do. 

Speaking of things you don't have to read because we took the hit, Bruce tells us what's in the new White House cyber-security policy for space systems. Really, it's all "shoulds" and puts nobody in charge of enforcement. It would be kind to call it the beta version of a space cybersecurity policy.

Sultan argues that there may after all be a limit to the EU's ability to get every part of the internet economy to enforce EU speech codes, and the domain name registries hope they're on the other side of that line. 

You probably saw the "op-ed" that an AI "wrote," explaining why humans need not fear it.   Bruce, Sultan, and I have plenty of fun mocking Open AI's penchant for Open Hype.  But Bruce reminds us that sooner or later the hype will be real, and more than half of Twitter will be machines talking to other machines.  Judging from my Twitter feed, that will be an improvement. 

Finally,  This Week in Sore Losing: In honor of AWS's brief complaining that it should have beat Microsoft to the lucrative JEDI contract, I update an old lawyer's motto: If you've got the law on your side, pound the law. If you've got the facts, pound the facts. And if you've got neither, pound the Orange Man.

And more!

Download the 328th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

327. “I’ll Take Hacking Tesla for One Million Dollars, Alex”

327: “I’ll Take Hacking Tesla for One Million Dollars, Alex”

In the 327th episode of the Cyberlaw Podcast, Stewart is joined by Nick Weaver (@ncweaver), David Kris (@DavidKris), and Dave Aitel (@daveaitel). We are back from hiatus, with a one-hour news roundup to cover the big stories of the last month. 

Pride of place goes to the WeChat/Tiktok mess, which just gets messier as the deadline fdraws near. TikTok is getting all the attention but WeChat is by far the thornier policy and technical problem. I predict delays as Commerce wrestles with them. Nick Weaver predicts that TikTok’s lawsuit will push resolution of its situation into January.  I’ve got fifty bucks that says it won’t. Lawfare wins either way.

Dave Aitel digs into the attempted Tesla hack. Second best question in the segment: Who’s the insider that enabled an attack on his employer and is still working there three years later?  Best question: How many CSO’s can say with confidence that none of their employees would take $1 million to plug a USB stick into the company network? 

This Month in Overhyped Judicial Decisions about FISA: David Kris lays out the seven-years-late Ninth Circuit decision that has been billed as striking at the FISA warrantless surveillance law. Talk about overtaken by events. The opinion grumbles about the fourth amendment but doesn’t actually rule on that ground (and its analysis is so partial that it isn’t even persuasive dicta). It boldly finds that the collection violated a statute that has been repealed anyway. And then it says that doesn’t matter because suppression of the evidence isn’t a remedy and the violation didn’t taint the trial.  The only really good news for the libertarian left is that Justice can’t appeal to the Supreme Court because, well, it won.

David also takes on the other overhyped FISA decision, a lengthy FISA court review of agencies’ minimization practices with respect to Americans’ data collected under section 702. The court approved practically everything but was predictably and not improperly upset at the FBI’s inability to design social and IT systems that prevent dumb violations of the rules. 

Speaking of FISA, important national security provisions remain unsettled, in large part because of Trump’s misguided opposition. Who, David asks, could possibly persuade GOP members that there’s a FISA reform that responds to their sense of grievance over the Russian collusion investigation?  I volunteer, with lengthy testimony to the PCLOB and a shorter piece in Lawfare.

Dave Aitel asks why we’re surprised that Iranian hackers are monetizing access to networks that don’t offer national security value to their government. Or that hackers are following their targets into specialized software markets. If you know your target is a law firm, he suggests, you’d be better off looking for flaws in Relativity than in Windows…. Uh, excuse me, but I just felt someone walk over my grave.

Nick and Dave are both critical of the Justice Department’s indictment of Joe Sullivan for obstruction of justice and misprision of felony. That is beginning to look like a case Sullivan can win, and one he just might take it to trial. 

Nick thinks the Justice Department is playing a long game in pretending it can seize 280 cryptocurrency accounts used by hackers. It can’t get the funds, but it sure can make it hard for the hackers to get them. 

U.S. Agencies Must Adopt Vulnerability-Disclosure Policies by March 2021. 

And more!

Download the 327th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Partisan Taint in the Trump-Russia Investigation

It's been four years since the FBI began its national security investigation of the Trump campaign, and Americans remain deeply divided over the probe. Democrats think the investigation was more than warranted by the number of suspicious contacts between Team Trump and the Russian government. Republicans think the investigation was a partisan hit job on an anti-establishment candidate.

They're both right.

It would have been national security malpractice not to investigate possible Russian influence over the Trump campaign. Hostile foreign governments will always be tempted to use the openness of American presidential contests to boost their favored candidates or sabotage others. More such investigations will be needed in the future. After spending four years advertising the success of Russia's interference campaign, the U.S. should not be surprised if other countries get the message and launch their own. Given the risks, national security agencies can't be gun-shy about probing foreign government efforts to infiltrate the U.S. political system.

At the same time, there is a lot more evidence than many people realize that the 2016 investigation was pervasively tainted by hostility to Donald Trump. In part, that comes with the territory. Any time government officials order national security surveillance of people who want to kick them out of office, they will be suspected of partisan motives. Put charitably, the Obama administration bungled this dimension; it failed to recognize just how partisan its investigation of a political rival would look, and it did far too little to avoid the appearance of partisanship. Less charitably, there is reason to believe that the Obama administration milked the investigation for partisan advantage.

That less charitable view deserves respect. First because it's backed by considerable evidence. And second because it's unpersuasive to tell half the country that their suspicions are mere conspiracy theories that they should just get over. The U.S. needs a national security system that the whole country has confidence in.

Especially now. The United States has spent nearly 50 years guarding against one kind of intelligence abuse—the government turning its intelligence machinery against individual rights and unpopular minorities. It hasn't had to worry much about a different kind of abuse—employing national security surveillance to achieve partisan political ends.

It's not that it can't happen here, as anyone would know who studied J. Edgar Hoover's collection of dirt on politicians—or his willingness to share that dirt with presidents when they felt the need. The United States has been lucky in recent decades. Divided government and a narrow range of political differences discouraged incumbents from using intelligence capabilities against the opposition.

Now, not so much. If it sees members of the other party not just as wrong but as borderline treasonous, why wouldn't the party in power use national security authorities against them? As that temptation grows, institutional reforms are needed to keep officials from yielding to it and, just as important, to show skeptics that the reforms actually worked.

The Obama administration clearly flunked the second requirement. They quite possibly flunked the first one too. Here are the most salient facts in support of that view—a much more detailed accounting of which is available, complete with footnotes, in my forthcoming testimony to the Privacy and Civil Liberties Oversight Board.

The DNC and the Steele "Dossier"

A major part of the Crossfire Hurricane investigation and the public disclosures it produced was the "dossier" created by Christopher Steele. We all now know that it was a salacious and unverifiable hit job assembled not by a network of intelligence sources but by a mix of Steele's friends, their drinking buddies, and probably a few disinformation specialists from GRU (Russia's military intelligence agency). Worse, Steele assembled that hit piece as a subcontractor to the Democratic National Committee, and judging by his conduct, he thought his role was to lobby the FBI to use its formidable national security powers against the Republican campaign—and to leak both the investigation and the now "FBI-validated" dossier in hopes of ruining Trump's candidacy.

There are reasons to suspect that, despite its denials, the DNC intended that outcome: It hid its ties to Steele behind multiple cutouts and a dubious claim of attorney-client privilege, then falsely denied its connection to Steele for months after the story broke. In the end, Steele's work didn't pay off for Democrats until after the election. But during the transition it stoked the Russia collusion narrative that put a cloud of illegitimacy over the first two years of the Trump administration. That is a remarkable, if unseemly, achievement for a partisan hit job. Other political actors will learn the lesson and can be expected to use cutouts in the future to lobby the national security agencies against their domestic enemies.

Partisan Bias and the Carter Page FISA Application

The one really detailed examination of how the Crossfire Hurricane investigators treated the evidence against the Trump campaign is the inspector general's dissection of the Carter Page wiretap application. That story does not exactly rebut the suspicion that partisanship tainted the probe. The application was full of errors and omissions, and all of them cut against Page and the Trump administration. Almost no one in the Justice Department or FBI stopped to ask if it was wise to pursue a surveillance order against a prominent member of the opposing party without taking a hard look at the evidence. As a result, the investigators left out—or even lied about—a raft of information that would have raised doubts about whether Page was a legitimate surveillance target.

For a while, it was possible to put these errors down to a different cause—not partisanship but a complete collapse in the Foreign Intelligence Surveillance Act (FISA) fact-gathering process. That comforting line of thinking rested on two findings by Inspector General Michael Horowitz—first that he found no evidence of bias and second that he found pervasive errors in 29 unrelated FISA applications. On closer examination, neither of those findings offers much support to the "FISA is broken" hypothesis.

First, on partisan motivation in Crossfire Hurricane, what the inspector general actually found was that no one at the FBI was foolish enough to say in writing or in testimony that they or others at the FBI were operating with a partisan bias. As the inspector general acknowledged in his Senate testimony, the absence of bias evidence didn't prove an absence of bias. In fact, the inspector general did find written evidence of bias—in the texts of Peter Strzok, which are full of animus toward Trump. Strzok had great influence over the Crossfire Hurricane investigation, but the inspector general decided that Strzok's bias didn't count because Strzok never acted completely alone in the investigation. Really, that's it. If I'm ever accused of a crime, I want Michael Horowitz on my jury.

Second, the errors he found in 29 other FISA applications evaporated on a closer look. They were, it turns out, almost all failures to properly footnote the FBI's sources. When the FISA court ordered a review of all 29, the Justice Department found only two material errors, and neither of them cast doubt on the issuance of the wiretap order. That contrasts starkly with the Carter Page application, where the department has admitted that the errors were so serious that at least two and perhaps all four FISA orders should never have been issued.

In short, the only FISA application that targeted a partisan opponent of the administration was corrupted by numerous material omissions and errors and at least one false statement, one of the most influential investigators was a voluble Trump hater, and others may have harbored a bias against Trump that they were too prudent to articulate. Since the FISA process in general now seems to be careful and accurate, if not perfect, the deviation from norm in the case of Carter Page strongly supports the view that anti-Trump bias was at work.

A Conveyor Belt from Press Reports to Surveillance

Actually, there's more. The inspector general passed over in silence the remarkable reliance of the Page application on media reporting. Fully a third of the core FISA case against Page consists of summaries of news stories. By itself, relying on media reports was a likely source of bias against anyone associated with Trump. (If you want to argue about that, all I can say is that I want you on my jury too.) But we don't have to argue about media bias in the abstract. It can be found in the Page application itself, which relies on a Washington Post opinion piece, without disclosing to the court either the source or the fact that it isn't, strictly speaking, a news report at all. Almost as bad, the opinion piece claims that the Trump campaign diluted the GOP platform on Ukraine in ways that favored Russia. (In fact, the campaign accepted a mildly diluted version of an amendment offered by a Ted Cruz delegate, which is a lot more accommodation than delegates for defeated candidates usually get at conventions.) The claim has been investigated extensively, including by Robert Mueller and the Senate Intelligence Committee, without finding any wrongdoing. The nicest thing you can say about the article in retrospect is that it was slanted to take the worst view of the Trump operation. An equally fair summary would be that the story became part of an FBI conveyor belt for turning media bias into a wiretap order. If that doesn't worry you, imagine today's Justice Department obtaining a FISA order against Biden campaign advisers by relying on an article from Breitbart, and simply telling the court, as the Page application does, that the information comes from "an identified news source."

Targeting Michael Flynn

That's not the worst of it. Viewed from the standpoint of partisan abuse, the Michael Flynn story is especially troubling. He had been investigated and cleared by the FBI on Jan. 3, 2017. But two days later, on Jan. 5, the White House obtained a wiretap of Flynn talking to Russian Ambassador Sergey Kislyak about Russia's response to the Obama administration's recent sanctions. The wiretap of Flynn's remarks was legal, because the "target" of the tap was Kislyak not Flynn. But the legality of the collection does not fully resolve what you might call an analytical reverse-targeting after the fact. That's because the White House was only really interested in Flynn's side of the call.

After an Oval Office meeting about Flynn's remarks, Obama administration officials began a concerted campaign to use those remarks against him. Within three weeks, he'd face leaks accusing him of violating the criminal Logan Act, he'd be reinvestigated under an implausible counterintelligence theory, and he'd find himself ambushed by the FBI in a perjury-trap interview. He'd also become the first American to have a FISA-tapped conversation leaked to the press by political rivals. Within four weeks, he'd be gone from government, disgraced and facing criminal prosecution.

By any measure, this was a political use of a FISA wiretap that targeted an American. It may have been a lawful political use of a FISA tap, but that's not something people should be comfortable with. The Obama administration, however, had gotten comfortable with it a few years earlier. When Israel was fighting Obama's Iran nuclear deal in Washington, it worked closely with Hill Republicans. The U.S. apparently tapped the Israelis, again legally, since they were foreign government officials. And the taps may have offered some national security insights; any time a government, however friendly, lobbies Congress against the American president, we ought to know what it's up to. But the foreign intelligence value of understanding what the Israelis were saying paled next to the political value of getting real-time intelligence on the GOP's Hill strategy for stopping the Iran deal. The unfortunate lesson the Obama administration learned in that battle was that the president can use FISA taps against his political enemies as long as he checks the right legal boxes. If it worked against the congressional Republicans, why wouldn't it work against Team Trump?

But turning FISA into just another partisan weapon means it's going to be used like one. If it hurts the other side, it's going to be leaked. Which is what happened with Flynn's conversation. The leak was unprecedented in national security circles, but in Washington politics, it was just another Thursday. More than 40 years had elapsed before the first FISA tap of an American was leaked to the press. I doubt it'll be that long before the second.

The Need for Reform

To be clear, apart from the Flynn leak, none of this was plainly illegal, and no one should want the government to ignore indications that a prominent political figure is working with a hostile government. But the Republicans who were on the receiving end of these intelligence operations have every reason to doubt the good faith of the administration that carried them out. And that in itself will prove fatal to the bipartisan support the intelligence community needs as it responds to foreign influence operations. What's needed are reforms that will prevent future administrations from using the intelligence community against the opposition in this way.

Unfortunately, most of the reform proposals are warmed-up leftovers beloved of individual rights advocates—more paperwork and audits and amici curiae for all FISA applications, not just the ones that pose partisan risk. Others could make things worse, such as the measures to require that the attorney general be briefed on FISA taps with partisan risk. Is there anyone on the GOP side who would be relieved to hear that the Flynn matter was overseen by Sally Yates, who chose partisanship over Justice Department tradition in refusing to defend the new administration's immigration policy in court? Is there anyone on Team Biden who'll be comforted to hear that William Barr will decide whether to investigate the former vice president for ties to Ukraine or China? It's fine for the case to get high-level review; top officials often have better instincts than those in the ranks. But it's not enough. We need to create a career position for a nonpartisan FBI agent or lawyer to challenge the FISA application and every other stage of the investigation. (The attorney general's supplemental reforms memo of Aug. 31, 2020, takes a good step in this direction by requiring that politically sensitive surveillance and search applications be reviewed by a special agent from a field office not involved in the investigation.) The career official should also take the lead in reporting on the investigation to majority and minority congressional leadership, not after the fact but as it proceeds.

And when an operation has both political and national security value, the intelligence it produces needs special and far more limited handling, especially when it goes to political appointees. Every one of them should be required to sign a receipt explaining why he or she needs to read it, and the intelligence community should routinely include tags on some reports that will disclose which one was leaked.

Other measures are simple. The FBI should offer media reports to the FISA court only rarely, and it should disclose their source and any credible claims of bias that have been leveled against the news outlet. Anyone who pays a third party—directly or indirectly—to try to influence the FBI or other national security agency should disclose that fact, just as lobbyists trying to influence Congress or political appointees must.

There's plenty of room to argue about which safeguards will best limit the partisan misuse of the United States's security machinery. I hope that this piece—and my longer testimony to the Privacy and Civil Liberties Oversight Board—are at least sufficient to establish that, without new safeguards, the United States will slowly lose its ability to respond as it must to foreign influence operations.

 

FISA Reform and the Appearance of Partisanship in Intelligence Investigations

The Chairman of the U.S. Privacy and Civil Liberties Oversight Board has, perhaps unwisely, invited me to provide written input on ways to reform the country’s intelligence collection authorities. I have commented publicly on the topic many times since my tenure as general counsel of the National Security Agency in the early 1990s. Because recent commentators have failed to address the most pressing need for intelligence reform, I am grateful for the opportunity to do so again. I am posting my testimony here, in advance of the PCLOB's publication so that readers of my shorter piece on the same topic will have the benefit of the more detailed analysis and sourcing in the full testimony.

Download Stewart Baker PCLOB testimony

 

 

 

326. Poisoned Faces

Our interview this week focuses on section 230 of the Communications Decency Act and features Lauren Willard, counsel to the Attorney General and a moving force behind the well-received Justice Department report on section 230 reform. Among the surprises: Just how strong the case is for FCC rule-making jurisdiction over section 230.

In the news, David Kris and Paul Rosenzweig talk through the fallout from Schrems II, the Court of Justice decision that may yet cut off all data flows across the Atlantic.

Paul and I speculate on the new election interference threat being raised by House Democrats. We also pause to praise the Masterpiece Theatre of intelligence reports on Russian cyber-attacks.

Nick Weaver draws our attention to a remarkable lawsuit against Apple. Actually, it’s not the lawsuit, it’s the conduct by Apple that is remarkable, and not in a good way. Apple gift cards are being used to cash out scams that defraud consumers in the US, and Apple’s position is that, gee, it sucks to be a scam victim but that’s not Apple’s problem, even though Apple is in a position to stop these scams and actually keeps 30% of the proceeds. I point out that Western Union – on better facts than Apple's– ended up paying hundreds of millions of dollars in an FTC enforcement action - - and still facing harsh criminal sanctions.

Paul and David talk us through the 2021 National Defense Authorization Act, which is shaping up to make a lot of cyber-security law, particularly law recommended by the Cyber Solarium Commission. On one of its recommendations – legislatively creating a White House cyber coordinator – we all end up lukewarm at best.

David analyzes the latest criminal indictment of Chinese hackers, and I try to popularize the concept of crony cyberespionage.

Paul does a post-mortem on the Twitter hack. And speaking only for myself, I can’t wait for Twitter to start charging for subscriptions to the service, for reasons you can probably guess.

David digs into the story that gives this episode its title – an academic study claiming that face recognition systems can be subverted by poisoning the training data with undetectable bits of cloaking data that wreck the AI model behind the system. How long, I wonder, before Facebook and Instagram start a “poisoned for your protection” service on their platforms?

In quick takes, I ask Nick to comment on the claim that US researchers will soon be building an “unhackable” quantum Internet. Remarkably his response is both pithy and printable.

And more!                                                                                                                 

Download the 326th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

 The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

How should the U.S. respond to the Schrems II decision?

The decision of the European Court of Justice (CJEU) in Schrems II is gobsmacking in its mix of judicial imperialism and Eurocentric hypocrisy. The decision invalidates the Privacy Shield agreement between the U.S. and the EU on the ground that U.S. protections for individual rights are not "adequate," by which the court means not "essentially equivalent" to the rights provided to individuals under European law. It manages to do this while acknowledging that the court and the EU have no authority to elaborate or enforce these rights against any of the EU's member states. That, the court says, is "irrelevant." It is making the rules for benighted foreign lands like Canada and the United States, not for Europeans. Freed from the prospect that any of the governments that appoint them will have to live with these rules, the judges of the CJEU declare that large chunks of U.S. intelligence law—including some of America's most productive and essential authorities, such as Section 702 of the Foreign Intelligence Surveillance Act (FISA)—are beyond the pale.

In theory, this means that the United States is a privacy-inadequate nation, and any company sending personal data here may be fined under the General Data Protection Regulation (GDPR) up to four percent of gross global income. (Yes, the court left open the question whether a special set of corporate contract clauses remained a legal basis for transferring data to the U.S., but very few lawyers think those clauses will actually provide any protection when challenged, since no private contract can undo the obligations of Section 702.)

It is astonishing that a European court would assume it has authority to kill or cripple critical American intelligence programs by raising the threat of massive sanctions on American companies. In so doing, the court overrode a formal executive agreement reached by the EU with the U.S.; it also rejected the view of the European Commission that U.S. law was adequate to protect individual rights.

Still, the court clearly does think it can force its views on not just the United States but the rest of the world as well. It has already told the Canadians that they don't measure up. Australia and India have been kept in limbo for a decade due to doubts about whether their democracies dance sufficiently to the justices' tune.

Perhaps, had the court been less stiff-necked, it might have forced a change in the laws of these countries. But now the entire project is bound for disaster. China, which is already a great power when it comes to personal data, has signaled to Europe that it will not tolerate interference with its internal affairs. Yet rather than confront a country that clearly lacks protections for individual rights, European bureaucrats have spent 20 years chivvying the United States over data transfers, signing and breaking half a dozen agreements, always asking for more and usually getting additional concessions—including appointment of a special U.S. "ombudsperson" to hear European complaints; enforcement of European law by U.S. agencies like the Federal Trade Commission and Commerce Department; and a special Judicial Redress Act, passed for Europe in 2015, that grants Europeans the right to file FOIA petitions. None of that was good enough for the CJEU. This history shows that, even if the U.S. again tried to modify its law to meet the court's rigid demands in Schrems II, more litigation and more demands—not peace—would be the result.

The time for American concessions is over. Throughout the emergence of this issue, the U.S. has insisted—and the EU has agreed—that data flows across the Atlantic should not be interrupted. Indeed, the World Trade Organization (WTO) agreement signed by Europe makes clear that data flows may not be regulated in the name of privacy if the regulation is a means of "arbitrary or unjustifiable discrimination between countries where like conditions prevail." Nothing could be more discriminatory or arbitrary than 20 years of pursuing the United States for the privacy equivalent of parking tickets while ignoring similar infractions by the member states and an endless series of privacy felonies by the People's Republic of China. It's time for the U.S. to get serious about ending this campaign of harassment.

What can the United States do? Plenty. Here are a few options that belong on the table in the interagency process.

1. Rescind the concessions the U.S. made to get the now-broken deal. This is a no-brainer. Europe has broken the deal it made, and it cannot keep the parts of the deal it likes. The U.S. attorney general should withdraw the special status of European nationals under the Freedom of Information Act and the Judicial Redress Act. The Office of the Director of National Intelligence should abolish the office of the ombudsperson created to give Europeans comfort that their complaints about intelligence collection would be heard. President Trump should rescind PPD-28, the Obama-era set of politically correct limitations on intelligence community activities, which has been kept alive as part of the Privacy Shield negotiations.

2. Prepare to retaliate in a way that shows the U.S. is serious. Americans have never paid much attention to periodic eruptions of the data transfer issue. We are always a little inclined to think that maybe Europeans have something to teach us about privacy and human rights, so righteous American anger about intrusion on our sovereignty has been slow to ignite. But now is the time to show Europe that the U.S. is serious about keeping in place effective counterterrorism measures—and keeping the right to write U.S. laws without getting permission from European governments.

Because this decision violates U.S. rights under the WTO, the executive branch has authority under Section 301 of the Trade Act of 1974 to impose tariffs and other import restrictions on the countries of the European Union. And it should. If the U.S. wants to get Europe's attention, it needs to get Germany's attention, which probably means heavy tariffs on German cars and perhaps car parts. Airplanes and airplane parts are also a touchpoint. As usual, the list of retaliation candidates will need to include something of great value to each member state—Irish whiskey, say, or French wines.

The retaliation process will take a few months. The goal is not to impose the tariffs but to put an end to the crisis—and to Europe's peculiar arrogance about imposing its personal data law on the rest of the world.

3. Make common cause with the U.K., Canada, Australia and perhaps India. The U.S. doesn't have to stand alone. The EU has been threatening the U.K. with an "inadequacy" determination as punishment for Brexit. Its court has already struck at Canadian law. And Australia and India surely know they are next. The U.S. should include these nations in any negotiation, but only if they join America in preparing sanctions against Europe.

4. Find a stopgap solution in one of the member states. The CJEU's admission that it doesn't have anything to say about how member states protect personal data isn't just a confession of hypocrisy. It could be an opportunity to do an end run on the whole mess created by the court. If any one of the member states—Poland, say, or Ireland or Hungary—were willing to sign a national security agreement with the United States, it would be acting within the national security authority conferred on it by Article 4(2) of the Treaty of the European Union.

Suppose, in the pursuit of its national security interests, Poland agreed to allow personal data to flow to the United States without restriction, in exchange for which the United States agreed to share with Poland any counterterrorism data it was able to obtain by virtue of its worldwide intelligence collection. That would only apply to data transferred from Poland, of course, but companies could set up subsidiaries in Warsaw, transfer their data holdings there from elsewhere in Europe—after all, the EU is a single market—and then let them move to the United States.

Or suppose that Poland's government and data protection authority agreed that data exports to the United States could be challenged on the ground that protections for Europeans from U.S. intelligence were inadequate—but only by a plaintiff who could demonstrate concrete economic injury. Since the European objection to U.S. law has been almost entirely theoretical, this has the double advantage of providing redress for actual human rights violations while exposing the fact that, by and large, no one in Europe can point to any.

Whether these one-country solutions would withstand the inevitable legal wrangling, I don't know, but the court left no time for companies to adjust. Getting a Polish exit visa for data from that country would give them breathing room even if the shelter doesn't ultimately survive its journey through the courts.

5. Negotiate an agreement that ends the threat to American companies. If the U.S. can get European governments to take seriously American objections to the notion that Europe can write U.S. law, there is a simple solution to this problem. The CJEU's opinion, though written as though grounded in the rights of man, is in fact based on a European regulation and a European treaty. As a matter of international law, both of those can be overridden by a newer treaty. Indeed, the U.S. entered into a binding executive agreement—the international equivalent of a treaty—when it bargained for the adequacy determination that the court overturned.

How could the court overturn a binding agreement, then? The Americans who negotiated the deal under the Obama administration gave a lot of binding promises about how they would handle European data, but they didn't get a binding promise in return that U.S. law would be deemed adequate and that data flows of compliant companies would not be restricted. Maybe they got snookered. Maybe they couldn't muster the will to draw a line in the sand. Whatever the reason, the agreement is utterly one-sided—all American concessions, plus a little European mood music.

So the U.S. should ask for the concessions it should have gotten last time: a binding assurance that U.S. protections for individual rights are not in need of European editing and that data flows will never be threatened again over this issue.

As democracies with long histories of protecting civil liberties—histories that stand up well next to those of most EU members—the United Kingdom, Australia and Canada should get the same assurances. The CJEU's only source of power to undo the deal is the GDPR and the Treaty of the European Union (which is also the source of the Charter of Fundamental Rights of the European Union). All of those instruments must yield to a binding international agreement with the United States and other democratic nations.