Skating on Stilts

122: UK meets Pottery Barn -- "You Brexit, you owns it"

Was Iran’s cyberattack bricking vast numbers of Saudi Aramco computers justified by a similar attack on the National Iranian Oil Company a few months’ earlier?  Does NSA have the ability to “replay” and attribute North Korean attacks on companies like Sony? And how do the last six NSA directors stack up against each other?  Those and other questions are answered by our guest for episode 122, Fred Kaplan, author of Dark Territory: The Secret History of Cyber War.

In the news roundup, we explore British corollary of the Pottery Barn Rule:  “You Brexit, you owns it.”  As the UK and the EU struggle to deal with fallout from the historic UK vote, all the incentives seem to be in place for the EU to do what it does best:  vindicate the worst instincts of the European elite.  In the name of deterring other departures, the EU is unlikely to offer the UK much in the way of concessions.  On data protection, for example, Maury Shenk points out that the UK will likely have to keep its current law -- and adapt to the new regulation -- just to avoid a claim that British privacy law is inadequate. 

In other news, DHS has released final guidelines for protecting privacy while sharing cyber threat information;  I think they’re pretty good.

Michael Vatis and I also puzzle over the dicta adopted in a recent EDVA opinion that the utter insecurity of personal computers leaves users without a reasonable expectation of privacy and allows the FBI to use hackers’ tools without a warrant.  I love it when a district court stakes out territory that makes even me feel like a civil libertarian.

The FTC drops a heavy fine on inMobi.  Michael points out the much heavier weaponry that COPPA allows the Commission to deploy in privacy cases that involve children.  But we have trouble mustering much sympathy for inMobi.

Finally, we’re still trolling for listener feedback on whether we should go to the trouble of trying to arrange CLE credit for listening to the podcast.  Based on reaction so far, we won’t.  So if you’d like to get CLE credit for the podcast, it’s time to send your vote to [email protected].

As always, the Cyberlaw Podcast welcomes feedback. Send e-mail to [email protected]  or leave a message at +1 202 862 5785.

Download the 122^nd episode (mp3).

Subscribe to the Cyberlaw Podcast here. We are also now on iTunes, Pocket Casts, and Google Play!

120: Europocrisy Prize

European hypocrisy on data protection is a lot like the weather.  Everyone complains about it but no one does anything about it.  Until today.  

 In episode 120, we announce the launch of the Europocrisy Prize.  With the support of TechFreedom, we’re seeking tax deductible donations for a prize designed encourage the proliferation of Schrems-style litigation, but with a twist.  We’ll award the prize to anyone who brings complaints that force Europe to apply the same human rights and data export standards to Russia, China, and Saudia Arabia as it applies to the US.  More on the prize here.  

 We’re inspired to this announcement because, as Katie Cassel tells us in the news roundup, the data protection commissioner in Hamburg is hot-dogging on the privacy issue, and with relish. He has imposed fines on US companies for the offense of being caught by surprise when the Safe Harbor went down.  Naturally, as far as we can tell, no similar cases have been launched against Russia, China, or any of the other countries that never even bothered to negotiate over privacy with the EU.  The Europocrisy Prize, though, should go a long way to even the score.

 We’re joined for the news roundup by Paul Rosenzweig of Red Branch Consulting, and he clues us in on the fight over ICANN’s future now being waged in Congress.  Meanwhile, Alan Cohn explains why standing is such a high threshold for data breach plaintiffs, leading us to muse on exactly how much harm we can show from the disclosure of our naked pictures on the internet (in contrast to viewers, for whom injury may be presumed).  

I highlight a workmanlike opinion from Judge Doumar on the FBI’s remote hacking of child porn aficionados.  I also thank Sen. Cornyn and others on the Judiciary Committee for exposing just how little privacy groups care about ECPA reform.  Sen. Cornyn has offered an amendment that would give back to the FBI the NSL access they had in 2008 to electronic communications transactions records.  In order to keep Sen. Cornyn’s amendment off their reform bill, they’ve apparently ditched the whole bill.  

 In other privacy misrepresentation news, the UK press is full of headlines claiming that the “controversial” Investigatory Powers Act is moving forward “despite hacking and snooping fears.”  Clue for the press:  When the House of Commons vote to send a bill to the House of Lords is 444 to 69, calling it “controversial” just makes you look stupid and ideological.   Most significantly, the bill goes out of its way to make clear that, if Apple makes the same arguments in the UK that it made against the FBI, it will lose.  Tim Cook’s publicity campaign is really paying dividends, eh?

 Katie explains the US Justice Department’s proposal to modify US law and streamline the production of electronic evidence to foreign governments.  If they do that without extracting an end to EU data export restraints, the DOJ’s license to practice diplomacy should be revoked.

In other news, the French government has convicted Uber and two of its executives of failing to show sufficient respect to French officialdom.  And the right to be forgotten turns out to be unworkable (who could have foreseen that!?).

 Finally, we poll DHS alumni on whether the department’s cybersecurity organization, NPPD, should be raised to the status of a full-blown DHS component.  Suzanne Spaulding will be pleased with the answer.

Note:  Our interview with Rep. Will Hurd was delayed at the last moment, so we’re releasing it separately from the episode 120 news roundup.

And a question for our listeners:  Should we take the steps necessary to get CLE credit for listening to the podcast?  If so, for which states?  This is a hassle, and it may not be practical for many states, but we'd like to know how much interest there is in CLE.  So please let us know by sending a message to [email protected].

Download the 120th episode (mp3).

Subscribe to the Cyberlaw Podcast here. We are also now on iTunes, Pocket Casts, and Google Play!

119: The sex, politics, and futurism episode

Our guest for episode 119 is Kevin Kelly, founding executive editor of Wired Magazine and author of The Inevitable: Understanding the 12 Technological Forces that will Shape our Future.  Kevin and I share many views – from skepticism about the recording industry’s effort to control digital data to a similar skepticism about EFF’s effort to control personally identifiable data – but he is California sunny and I am East Coast dark about where emerging technology trends are taking us.  The conversation ranges from Orwell and the Wayback Machine to the disconcerting fluidity and eternal noobie-ness of today’s technological experience.  In closing Kevin sketches a quick but valuable glimpse of where technology could take us if it comes from Shenzhen rather than Mountain View, as it likely will.

 The news roundup leavens deep thoughts about the future with loose talk about sex and politics.  I ask whether the FOIA classification review of Hillary Clinton’s email is compounding the damage done by her use of a homebrew server.  I discover the weird connection between leak defenders like Julian Assange and Jacob Appelbaum and sexual extortion – and even offer a theory to explain it (caution:  involves threesomes).  We award the Dumbest Journalism of 2016 prize to Jason Leopold, Marcy Wheeler, and Ky Henderson for a VICE article that spends thousands of words trying in vain to justify its headline – and also manages to bury the only interesting news the reporters turned up.  (They have pole-dancing competitions in China?  And the organizer invited Edward Snowden’s girlfriend to compete, just as Snowden was getting ready to release NSA’s files?  Sounds like a great story, but the authors ignore it in favor of tendentious NSA bashing.)  And to cap off this week is cybersecurity karma, North Korea cloned Facebook for its nomenklatura, only to have a Scottish teen take it over because the logon credentials were left at “admin” and “password.”

 More seriously, I report that USTR will in the future try to negotiate limits on data localization even for financial institutions.  

 Maury Shenk reports on the successful EU jawboning of big American tech companies to crack down on “hate speech” on line.

 Organizations whose hate speech has mainly been aimed at Smith v. Maryland and the third party rule had a bad week, I note, as the only circuit to require warrants for cell-site location recedes in an en banc opinion that drastically cuts the Supreme Court’s incentive to grant cert on the issue.

 Maury reports on delays to the EU’s Paris-related changes in anti-money-laundering regulation.  And I puzzle over the newfound enthusiasm in Republican and cable industry circles for FTC-style privacy regulation.

 As always, the Cyberlaw Podcast welcomes feedback.  Send e-mail to [email protected] or leave a message at +1 202 862 5785.

Download the 119^th episode (mp3).

 Subscribe to the Cyberlaw Podcast here. We are also now on iTunes, Pocket Casts, and Google Play!

118: European Union jumps the tech shark

Episode 118 digs deep into DARPA’s cybersecurity research program with our guest, Angelos Keromytis, associate professor at Columbia and Program Manager for the Information Innovation Office at DARPA. Angelos paints a rich picture of a future in which we automate attribution across networks and international boundaries and then fuse bits of attribution data as though they were globules of the Terminator reassembling into human form. 

In the news roundup, a district court judge takes NIT-picking to an extreme, quietly deep-sixing child porn evidence because the FBI would not disclose its Network Investigative Technique.  Michael Vatis and I wonder why such an important call would not be dignified by a written opinion.  Michael and I also trade assessments of Twitter’s latest effort to revive its faltering lawsuit to reveal how many national security discovery orders it has received.  Michael is more bullish than I am on Twitter’s prospects.

The EU has officially given up on competing with the rest of the world on internet technology, and it has gone back to its roots – using regulation to at least force successful companies to pay a toll of hassle and forelock-tugging in Brussels.  Maury Shenk has the facts (if not quite the attitude):   In recent days, the EU has announced that it is trying halfheartedly to erase national boundaries in online sales,  imposing its egregious European content regulations on companies like Netflix, litigating over the lawfulness of US companies relying on standard data protection contract terms, moving forward with bitcoin and blockchain regulation, and fighting over which European institution can pretend the loudest that it could have won a better deal from the US in the Privacy Shield talks.   Whew!  That’s apparently what passes for A Job Well Done in Brussels.

The US Senate, in contrast, really is doing a good job, at least so far, I explain, by requiring that fans of ECPA reform agree to correct a drafting error that has kept the FBI from getting electronic communications transactional records with a national security letter.  The Silicon Valley U-turn ‒ from providing to refusing such data for an NSL ‒ has driven the FISA 215 workload through the roof as the FBI seeks an alternative mechanism.   Remarkably, the data is already available with an NSL in ordinary criminal investigations, but swamping the FBI’s resources in terrorism cases is apparently what passes for civil liberties campaigning these days. Luckily, both the intelligence committee and the judiciary committee think the time is now to fix the oversight; and if that means attaching it to ECPA reform, well, they’d only be using a legislative hostage-taking tactic that privacy campaigners honed to perfection in decades past.

Alan Cohn, finally, brings us up to date on SWIFT and its travails.  I channel Paul Rosenzweig, asking how serious an institution can be about cybersecurity if it’s just getting around to recommending two-factor authentication.