Skating on Stilts

269. A McLaughlin Group for cybersecurity

Our interview guests this week are Dick Clarke and Rob Knake, who have just finished their second joint book on cybersecurity, The Fifth Domain. We talk about what has changed and what they got right and wrong in their original book. Clarke and Knake offer surprising flashes of optimism from about the state of cybersecurity today, and the book itself is an up-to-date survey of the policy environment. Best of all, they have the courage to propose actual policy solutions to problems that others just admire. I disagree with about half of their proposals, so much light and some heat are shed in the interview, which I end by bringing back the McLaughlin Group tradition of rapid-fire questions and an opinionated "You're wrong" whenever the moderator disagrees. C'mon, you know the arguments are really why you listen, so enjoy this one!

In the News Roundup, Gus Hurwitz covers the Supreme Court's ruling on when a forum is subject to First Amendment limits. Short takeaway: There is not a single Justice who thinks Silicon Valley's platforms are public fora subject to the First Amendment. Sen. Hawley (R-MO) comes in for some mockery as a result, which prompts me to invite him to defend himself on a future episode (not so much because the First Amendment applies to this podcast but because it would be fun).

Matthew Heiman spells out the strategy behind Facebook's proposed cryptocurrency. He thinks it's all about the data; I think it's all about WeChat. Whatever the motive, every regulatory body in Europe and the US has descended on the company to extract concessions – or perhaps to kill the currency outright, as our own Nick Weaver has proposed.

Maury Shenk reports on the US government's threat to limit Indian H-1B visas if India persists in its extreme data localization policies. I suggest that the fight may be as much about terrorism finance as protectionism.

This Week behind the Silicon Curtain: Apple is considering moving 15-30% of its production capacity out of China. Matthew and I agree that that's easier said than done, but the move is inevitable.

Gus lays out the difficulties that YouTube has had meeting the child protection requirements of COPPA and the FTC's growing interest in changing YouTube's approach to videos aimed at kids.

Is China's social credit rating system a Potemkin village? Bloomberg seems to think so, but Maury has his doubts. So, if you thought you could stop fearing the system and start laughing at it, better think again.

Finally, This Week in Karma: The medical billing firm whose cybersecurity failings resulted in multiple medical data breaches has filed for bankruptcy, evidently the result of liabilities arising from the breach.

Download the 269th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

268: “Treason” at the New York Times

We interview David Sanger, whose recent New York Times article on US intrusions into the Russian grid was condemned as “a virtual act of treason” in a presidential tweet. Turns out that national security officials, contacted before the story ran, didn’t ask the Times to hold the story. Understandably. If you’re signaling to Putin that his grid will be at risk as long as he puts ours at risk, a front-page story in the New York Times is a pretty good way to get the word out.

We’re starting to see a lot more casualties in the New Code War between the US and China. Broadcom has issued a $2 billion warning that has shaken the global chip sector. And Hollywood is whistling past the graveyard if it thinks that China is going to stop squeezing US film profits in China. And the adjustment to a divided global tech market keeps finding new pain points. Turns out that even the F-35 depends on a Chinese supply chain.

Speaking of security holes, Nick Weaver breaks down the cause and significance of the Rowhammer exploit and its latest sibling, RAMBleed. And to complete the paranoia segment of the show, Nick explains just how easy it is to use LinkedIn to build a network of people with clearances who can be compromised by a nonexistent woman.

Should Silicon Valley face an antitrust breakup that might produce more viewpoint competition? Mark MacCarthy breaks down a speech given by the Justice Department’s antitrust chief, pointing out that conservatives crusading to make viewpoint competition part of antitrust analysis got a little more comfort than usual from the speech.

Or should Silicon Valley lose its immunity under Section 230 of the Communications Decency Act because of its high-handed treatment of conservatives? David Benger tells us that the DC Circuit does see a limit to the Section 230 immunity – but a pretty distant one. Mark points out that Congress might itself cut back on the doctrine – but only, I note, if it’s willing to violate the US-Canada-Mexico trade deal.

Finally, Nick and I have different takes on what I call the overhyped breach of the week, in which a Customs and Border Protection subcontractor lost photos of thousands of travelers. Turns out it wasn’t much of a breach for the agency, but it was a potentially devastating breach for its subcontractor.

Download the 268th Episode (mp3).

 

267. “Call me a fascist again and I’ll have you censored all over the world.”

We kick off Episode 267 with Gus Hurwitz reading the runes to see whether the 50-year Chicago winter for antitrust plaintiffs is finally thawing in Silicon Valley. Gus thinks the predictions of global antitrust warming are overhyped. But he recognizes we’re seeing an awful lot of robins on the lawn: The rise of Margrethe Vestager in the EU, the enthusiasm of state AGs for suing Big Tech, and the piling on of Dem presidential candidates and the House of Representatives. Judge Koh’s Qualcomm decision is another straw in the wind, triggering criticism from Gus (“an undue extension of Aspen Skiing”) and me (“the FTC needs a national security minder when it ventures into privacy and competition law”). Matthew Heiman thinks I’m on the wrong page when I suggest that Silicon Valley’s suppression of conservative speech is the kind of detriment to consumer welfare that the antitrust laws should take into account, even in a Borkian world.

I mock Austrian Greens for suing to censor those who called it a “fascist party” – stopping their mouths not just in Austria but around the world. Yeah, guys, that’ll show ‘em who the fascists are. Less funny is the European Court of Justice’s advocate general, who more or less buys the Greens’ argument. And thereby reminds us why we miss Tom Wolfe, who famously said, “The dark night of fascism is always descending in the United States and yet lands only in Europe.”

Nate Jones answers the question, “Were the Russians much better at social media than we thought?” All the adjustments to that story, he notes, have increased our assessment of the sophistication in Russia’s social media attacks. And in This Week in Host Self-Promotion, I take advantage of Nate's remarks to urge my own solution to the utterly unsolved problem of hack-and-dox attacks by foreign governments on US candidates they don’t like: Ban the distribution of data troves stolen from candidates and officials. Nate agrees that First Amendment doctrine here is a lot friendlier to my proposal than most people think, but he cautions that the details get messy fast.

Matthew comments on Baltimore’s tragedy of errors in handling its ransomware attack. The New York Times’ effort to pin the blame on NSA's EternalBlue, which always looked tendentious and agenda-driven, now has another problem: It’s almost certainly dead wrong. EternalBlue doesn’t seem to have been used in the ransomware attack. Baltimore’s best case now is that its cybersecurity sucked so bad that other, completely unrelated hackers were using EternalBlue to wander through the city’s system at the same time as the ransom bandits.

Speaking of cybersecurity, Matthew reminds us of two increasingly common and dangerous hacker tactics: (1) putting the “P” in APT by hanging around the system so long that you’ve downloaded all the manuals, taken all the online training, and know exactly when and how to scam the system; and (2) finding someone with lousy network security who’s connected to a harder target and breaking in through the third party.

Finally, Gary Goldsholle helps us make sense of the litigation between the SEC and Kik, which first launched a cryptotoken that it insisted wasn’t a security offering and then crowdfunded a lawsuit to that effect against the SEC. So, finally: good news for lawyers if nothing else, and perhaps for future Initial Popcorn Offerings.

Download the 267th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

A modest proposal for countering Russian election interference

What can we do to counter Russian "hack and dox" interference with US election campaigns and candidates?  A lot more than we think, as long as we're willing to open the first amendment Overton window.  I posted my modest proposal on the topic over at Lawfare.  Here's the gist:

Of course, stopping the dissemination of such information raises real First Amendment questions, but the Supreme Court's pronouncements on this topic have been surprisingly qualified and leave plenty of room for legislation that would drain much of the fun out of Russian cyber-kompromat. In the leading case, Bartnicki v. Vopper, the court refused to enforce a statutory prohibition on disseminating the contents of illegally wiretapped conversations. The conversation in question was a cell phone call in which a member of a teachers' union said to the union's negotiator that if the school district didn't improve its offer to end a strike, "we're gonna have to go to their, their homes … to blow off their front porches, we'll have to do some work on some of those guys." The Supreme Court's opinion considered two principal justifications for a ban on dissemination of tapped conversations—deterring wiretapping and preserving privacy. The court dismissed the first because it thought deterrence could be achieved by prosecuting those who conducted the illegal tap. It was troubled by the second, recognizing that failing to punish the disclosure of private conversations was itself likely to restrain private speech. Nonetheless, in an expressly narrow decision, the court concluded that the conversation being disclosed was a matter of public concern, so that prohibiting dissemination would trench too far on freedom of speech. Two justices who were necessary to the majority wrote separately, narrowing the decision further by declaring that only a communication threatening physical harm or the like was of sufficient public concern to justify overriding the dissemination ban.

To my mind, this decision leaves plenty of room for imposing restraints on the distribution of private emails stolen by a foreign government. The government's interest in protecting private speech remains strong in the case of foreign government hacking, and it is bolstered by a deep national security concern that was quite lacking in Bartnicki. What's more, the Bartnicki court's notion that such thefts can be deterred by criminal prosecution is demonstrably wrong where government hackers are concerned. We've indicted Russian, Chinese and Iranian government hackers; it hasn't deterred any of them for long. Even taken at face value, the decision protects only dissemination that addresses a matter of public concern. That by itself would seem to allow Congress to restrict massive dumps of private communications that do not touch on significant public issues, let alone make threats of violence.

266. Will an end to social media trust mean an end to end-to-end encryption?

If you’ve lost the Germans on privacy, you’ve lost Europe, and maybe the world. That’s the lesson that emerges from my conversation with David Kris and Paul Rosenzweig about the latest declaration that the German interior minister wants to force messaging apps to decrypt chats. This comes at the same time that industry and civil society groups are claiming that GCHQ’s “ghost proposal” for breaking end-to-end encryption should be rejected. The paper, signed by all the social media giants, says that GCHQ’s proposal will erode the trust that users place in Silicon Valley. I suggest that maybe that particular argument is well past its sell-by date.

Speaking of trust, Paul outlines the latest tit-for-tat in the Silicon Curtain coming down between the US and China, as that country announces plans to publish an “unreliable entities” list of US companies. I note that the same spirit seems to be animating the announcement that China and Russia are transitioning their militaries from Microsoft Windows to other operating systems. Talk about a bonanza for the NSA: Just the coding errors alone will sustain its hackers for a generation – even in the unlikely event that the Chinese and Russians resist the temptation to seed the system with backdoors aimed at their erstwhile partners.

Maury Shenk highlights the latest German effort to regulate “broadcasting” of content on the Internet, which the German authority says will mandate transparency and diversity. I think it’s transparently about shoring up the German establishment, a view hardly contradicted by the ham-handed way CDU leader Annegret Kramp-Karrenbauer responded to the CDU’s drubbing in the EU elections. The losses were widely attributed to YouTube influencers who urged young voters to reject the main parties. The solution, AKK suggested, was more regulation of YouTube influencers. Ja, natürlich.

David brings us up to date on Iran’s latest effort to engage in social media manipulation and Facebook’s response.

Alicia Loh parses a DC Circuit ruling that all the White House has to do to comply with laws on keeping records of official communications is send out a memo. That obligation was satisfied, the court ruled, by a memo telling White House staff who use “vanishing” messaging apps to take screenshots of any official communications and preserve the messages. Alicia is practically the only member of our panel who even knows how to take a screenshot on a phone, which suggests that White House staff compliance might be, well, underwhelming.

Maury gives us a quick update on US states imitating GDPR. Short version: Watch California and then New York.

And in a lightning round, I am struck by the sight of an FTC commissioner begging the Ninth Circuit not to uphold the FTC’s position in the Qualcomm case on appeal. Maury and I note the growing demand in Silicon Valley companies for mass contract labor spurred by the need to train AI. And Paul and I speculate on the probability of antitrust cases against Google and Amazon. It’s been a long cold Chicago winter for antitrust plaintiffs, but a change in the climate may be coming.

Download the 266th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.