Skating on Stilts

Episode 68: Julian Sanchez and ISSA-NOVA

Our guests for Episode 68 include Julian Sanchez, senior fellow at the CATO Institute where he studies issues at the busy intersection of technology, privacy, and civil liberties, with a particular focus on national security and intelligence surveillance. They also include the entire May meeting of ISSA- NOVA, which kindly invited the Cyberlaw Podcast to go walkabout once again. The audience provides useful feedback on several of the topics covered in this episode.

We begin with This Week in NSA.  And even though we had no idea how the Senate process would end up,neither it turns out did Majority Leader McConnell or anyone else.  Our remarks on the Congressional dynamic remain as relevant now as when we made them, despite our intimations of obsolescence.   We also cover an early judicial decision on insurance coverage for data breaches (subscription required), the US indictment of (another!) six Chinese economic espionage agents, and the personal data orphaned by Radio Shack’s bankruptcy.

More importantly, we seize on a flimsy pretext to revisit Max Mosley’s five-hour, five hooker sadomasochistic orgy (subscription required) and his self-defeating efforts to wipe it from the internet by threats of lawsuit.  It turns out he’s now reached a settlement with Google.  I speculate that perhaps we’ve misread Mosley all this time.  Maybe he’s doing this because of the Streisand effect, not in spite of it.  It’s like he wants the internet to punish him, or something …

Returning to serious coverage, we note that CCIPS and the Justice Department may be suffering from Baker Derangement Syndrome in the face of my defense of private cyber-investigation that goes beyond network boundaries.  The Department’s latest effort involves persuading CSIS and a group of CISOs to join a draft paper that looks suspiciously like a DOJ brief in opposition to the Cyberlaw Podcast.   And the supposed consensus among CISOs that’s identified in the paper breaks down quickly, rejected ten to one in an informal poll of the ISSA-NOVA audience.

 Julian and I mix it up over the new, revived Crypto Wars, as I challenge the claim that building access to encryption systems is always a bad idea.  That, I say, will come as news to all the network security administrators who access end-to-end TLS sessions on a routine basis because the security consequences of not “breaking” that crypto are worse than the corporate front door.  He recommends that I ask Dan Kaminskyto comment on that statement, and since Dan will be a guest on the podcast soon, we’ll all get to hear his answer.

 The Cyberlaw Podcast is now open to feedback.  Send your questions, suggestions for interview candidates, or topics to [email protected].  If you’d like to leave a message by phone, contact us at +1 202 862 5785.

 Download the sixty-eighth episode (mp3).

 Subscribe to the Cyberlaw Podcast here. We are also now on iTunes and Pocket Casts!

Episode 67: Geerheads Rejoice!

Our guest for Episode 67 is Dan Geer, a legendary computer security commentator and current CISO for In-Q-Tel.  We review Dan’s recommendations for improving computer security, including mandatory reporting of intrusions, liability for proprietary software, striking back at hackers, at least in some ways, and getting the government to purchase and fix vulnerabilities.  We agree on the inherent foolishness of the Internet voting movement, but I disagree with Dan on the right to be forgotten, and I predict that net neutrality will lead to the opposite of what he wants – both more regulation of operators and more limits on what the operators are allowed to carry.

As with Bruce Schneier, I accuse Dan of a kind of digital Romanticism for advocating improbable personal defenses like using Tor for no reason, having multiple online identities, swapping affinity cards, and paying your therapist under an assumed name.  But Dan makes me eat my words.

More from Dan can be found here, here, and here.

In the news roundup, we introduce Alan Cohn, yet another recent alumnus of the DHS Policy office now at Steptoe.  We also revive This Week in NSA , pooling our collective inability to predict what the week will hold for the 215 metadata program.  We muse about border laptop searches, questioning both DOJ’s choice of battleground and the ability of judges to withstand a PR campaign by the privacy lobby.  We cover a FOIA case to find out if the FTC actually has security standards – a case filed by Phil Reitinger and Steptoe.  The roundup ends with the plane-hacking case, the FBI’s Stingray guidance, and the first anniversary of the EU’s misbegotten Right to Be Forgotten.

The Cyberlaw Podcast is now open to feedback.  Send your questions, suggestions for interview candidates, or topics to [email protected].  If you’d like to leave a message by phone, contact us at +1 202 862 5785.

Download the sixty-seventh episode (mp3).

Subscribe to the Cyberlaw Podcast here. We are also now on iTunes and Pocket Casts!

 

 

Schneier v. Baker Puts Mayweather v. Pacquiao in the Shade

Episode 65 would be ugly if it weren’t so much fun.  Our guest is Bruce Schneier, cryptographer, computer science and privacy guru, and author of the best-selling Data and Goliath – a book I annotated every few pages of with the words, “Bruce, you can’t possibly really believe this.”  And that’s pretty much how the interview goes, as Bruce and I mix it up over hackbacks, whether everyone but government should be allowed to use Big Data tools, Edward Snowden, whether “mass surveillance” has value in fighting terrorism, and whether damaging cyberattacks are really infrequent and hard to attribute.  We disagree mightily – and with civility.

The news roundup covers Congress’s debate over NSA and section 215.  The House is showing a dismaying efficiency in moving bad bills while the Senate is mired in what may turn out to be more productive confusion (see, e.g., S. 1035 and S. 1123).  

We unpack the Supreme Court’s grant of certiorari in Spokeo, which looks like a no-lose opportunity for privacy class action defendants.

A new and troubling development in cyber insecurity in the form of the malware Cryptowall, which infected readers of the Huffington Post via ads for Hugo Boss, then encrypted the readers’ hard drives and held their data for ransom.  We ask whether the ad networks or even the web publishers will eventually be held liable for transmitting the infected ads.  The Senate Homeland Security Committee's report on malvertising risks and liabilities last year concluded that liability couldn’t be established because none of the participants in the online advertising industry is directly responsible for the harm.  I think the Senate Homeland Security committee has never litigated in the Eastern District of Texas.

In quick news,  Goldman’s “Flash Boy” has been convicted again.  The FCC says it doesn’t regulate Stingrays, except to require FBI approval for purchasers. The US and Japan deepen their cyber defense relationship, and Prime Minister Abe gets standing O for calling out (shh! Chinese) cybertheft of IP.  And DOJ releases cybersecurity guidance that is surprisingly good – but for what I call its fatally flawed view of hacking back (actually I called the authors “jackasses” but who's keeping track?).

As always, send your questions and suggestions for interview candidates to [email protected] or leave a message at +1 202 862 5785.

Download the sixty-fifth episode (mp3).

Subscribe to the Cyberlaw Podcast here. We are also now on iTunes and Pocket Casts!