Skating on Stilts

284. As Ben Franklin almost said, a throuple can keep a secret – if a couple of them are dead

You knew we’d go there. In this episode I talk about Congresswoman Katie Hill’s “throuple” pics and whether the rush to portray her as a victim of revenge porn raises questions about revenge porn laws themselves. Paul Rosenzweig, emboldened by twin tweets – from President Trump calling Never-Trumpers like him “human scum” and from Mark Hamill welcoming him to the Rebel Scum Alliance – takes issue with me.

In a more serious vein, Brian Egan, Paul, and I dig deep into the roots of the battle over how to keep “emerging technology” out of Chinese hands.

Paul explains a Georgia Supreme Court ruling that cops need a warrant to access automobile data after an accident.

Brian and I talk about why DHS might issue a binding operational directive requiring federal agencies to adopt vulnerability disclosure programs.

Maury Shenk tells us to look for tougher cybersecurity rules in China starting December 1.

Paul unpacks the thinking behind a finding of bias in a widely used health care algorithm.

Maury reminds us that “going dark is not going dark,” at least not in India, where the Supreme Court is consolidating several legal fights over WhatsApp’s end-to-end encryption. In Afghanistan, meanwhile, the New York Times says that WhatsApp has become a key tool for communication by the government.

I note a well-written study contradicting the widespread media narrative that YouTube’s recommendation engine is what’s radicalizing Americans. According to the authors, the problem isn’t YouTube’s recommendations but an audience that is looking for the kinds of alternative content that conservatives (not to mention the Alt-Right and the Alt-Lite) are offering.

In shorter takes, Paul and I cover Microsoft beating AWS to win an enormous Pentagon cloud contract, and Brian takes on the problem of lies in political ads on Facebook. And I ask whether we would be wise to follow Russia’s example and disconnect from the Internet from time to time.

Finally, Maury and I explore the challenge that TikTok poses not just to the US but also to the Chinese government. Short take: TikTok users can get away with a lot more pro-Hong-Kong-protest speech than the NBA can, at least in the US.

Download the 284th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

283. Is intelligence “reform” a self-licking ice cream cone and compliance trap?

Our interview is with Alex Joel, former Chief of the Office of Civil Liberties, Privacy, and Transparency at the Office of the Director of National Intelligence. Alex is now at the American University law school’s Tech, Law, and Security Program. We share stories about the difficulties of government startups and how the ODNI carved out a role for itself in the Intelligence Community (hint: It involved good lawyering). We dive pretty deep on recent FISA court opinions and the changes they have forced in FBI procedures. In the course of that discussion, I posit that every “reform” of intelligence dreamed up by Congress in the last decade has turned out to be a self-licking compliance trap, and I take back some of my praise for the DNI’s lawyering.

In the News Roundup, we’re inundated by serious new reports of cyberattacks. Dave Aitel admits that the hacking group he envies most is Turla, which was recently discovered to have totally pwned the entire attack infrastructure of an Iranian government team. Dave notes that Avast has succumbed to a second far-reaching intrusion into its network, reminiscent of the last attack, which led to the company sending out a compromised CCleaner application. We may never know whether Avast got the intruder out, Dave suggests, but his hat is off to the company’s PR team. In still more pwnage news, Dave praises two new detailed reports from security companies: FireEye’s report on APT41’s combination of espionage and cybercrime and Crowdstrike’s report on amazingly successful Chinese efforts to steal aircraft intellectual property. And one more: Cyber Command has leaked the bare minimum of information to show that Iran’s strike against Saudi oil facilities did not go unpunished. Dave and I both take our hats off to Iran’s PR team, which responded to the vague leak by claiming that Cyber Command “must have dreamt it.”

In other news, Gus Hurwitz breaks down a recent Ninth Circuit decision construing the Section 230 immunity that Congress has given to companies that filter content on the Internet. Remarkably, two judges thought that the immunity for preventing access to “objectionable” content would allow a company to filter out its competitor’s products. It's easy to see how competition might be objectionable to the company, but harder to see why Congress would have shared that view. Luckily, the two judges who got it wrong were a district court judge and the Ninth Circuit dissenter. But the close call shows how broadly the “objectionable” immunity sweeps. Which raises the question why US trade agreements should broaden the immunity and turn it into international law that can’t be amended easily, or at all. That was a point of rare bipartisan agreement at a recent House hearing. But there’s no sign yet that Congress is going to reject the trade deals that do this. Gus and I also touch on the latest flaps over social media content monitoring.

Dan Podair explains what’s good and what’s missing from the California AG’s rules implementing California’s new, sweeping privacy act.

Poor Equifax: Just when they were hoping the worst had passed, the plaintiff’s bar doxxed even more embarrassing security failings. Dave offers this cold comfort: All the mistakes that embarrased Equifax could be found in pretty much any network in the country. More cold than comfort, Dave!

And, finally, we close with This Week in Puerile Jokes: All inspired, of course, by the UK Government’s decision to drop its plan to require ID to watch sex videos online.

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

282. Has China opened a quantum hype lead over the US?

 Our interview is with Sultan Meghji, CEO of Neocova. We cover the large Chinese investment in quantum technology and what it means for the United States. It’s possible that Chinese physicists are just better than American physicists at extracting funding from their government by hyping their science. Indeed, it looks as though some quantum tech, such as the use of entangled particles to identify eavesdropping, may turn out to have dubious military value. But not all. Sultan thinks the threat of special purpose quantum computing to break encryption poses a real, near-term threat to US financial institutions’ security.

In the News Roundup, we cover the new California Consumer Privacy Act regulations, which devote a surprising amount of their 24 pages to fixing problems caused by the Act’s feel-good promise that consumers can access and delete the information companies have on them.

Speaking of feel-good laws that are full of liability land mines, the Supreme Court has let stand a Ninth Circuit ruling that allows blind people to sue under the Americans with Disabilities Act if websites don’t accommodate their needs. Nick Weaver and I explore a few of the harder questions raised by this seemingly simple mandate (you can accommodate the blind by providing a "read aloud" option, but what about people who are blind and deaf?) and the risks of making law by retroactively imposing liability.

Weirdly for a populist administration that says it mistrusts the big social platforms for their restricting of conservative speech, the Trump trade negotiators are actually expanding Section 230 immunities for Silicon Valley that both left and right have begun to question. The expansion is buried in hard-to-amend and even-harder-to-repeal trade agreements. By way of explanation, I lay out the Realpolitik of trade deals. As if to prove my point, the US and Japan have signed a Digital Trade Agreement that has much the same provision.

Nick and I muse on the rise of Commerce Department sanctions on individual companies. In a way, such sanctions are a less harsh alternative to OFAC sanctions, which include property seizures, but they are also like antibiotics -- they either destroy the target or help it develop better resistance for the future.

Does TLS stand for “Tough Luck, Sucker?” That’s the message of a new and clever form of malware that has been, softly attributed to the Russian FSB.

Apple, having banned, and then unbanned, an app that locates police activity in Hong Kong, has now re-banned it. Tim Cook offers an explanation for the latest move that triggers Nick’s bovine excrement detection system. In a Final Four of Hypocritical Surrender to the PRC, LeBron James and the NBA give ESPN a run for its money. South Park fails to qualify.

Matthew Heiman and I discuss India’s effort to create a national facial recognition system. Naturally BuzzFeed thinks it’s Evil. Not enough people of color in the training set, apparently, or perhaps it’s too many. Or Modi is too much like Trump. Or some damn thing. Look, it’s Evil, okay? So shut up and leave BuzzFeed alone.

Nick and I consider DHS’s request for the power to subpoena ISPs to identify owners of compromised systems. I critique Herb Lin’s suggestion that the ISPs can solve the problem without giving data to DHS.

As Matthew notes, it was just last month that the French government gave the world a stiff-necked little lecture on respecting sovereignty in cyberspace. So why are French police helping reprogram computers in Latin America? Because it’s different when the French are doing it than when it’s done to them, I surmise.

A recent “good guy with a keyboard” story offers me one more chance to tout my views on hacking back.  I ask why someone who’s rescued hundreds of victims from ransomware should have to worry for one minute about being prosecuted for compromising (again) the already compromised C2 machines that apparently held the keys.

Matthew and I try to simplify a complex ruling from two FISA courts. Among the takeaways: The FBI has been running a lot of searches against 702 databases (3.1 million a year!), which greatly complicates its compliance program, and the FISA courts are overusing the 4th amendment, which in FISA minimization cases is like trying to do brain surgery with a chainsaw.

Argh! That embarrassing Bloomberg Supermicro story is back. Sort of. Wired has shown that something like it could really be done. Which, Nick points out, we already knew.

I give a shoutout to Jennifer Daskal and Peter Swire for their useful overview of the UK-US CLOUD Act, but I wonder if the agreement's mutual “no targeting of the other country’s nationals” assurances are a scalable solution.

Finally, Matthew reviews the second volume of the SSCI report on its investigation into Russian election interference. The TL;DR? The Russians did what you think they did. The closest thing to a surprise? After starting out just trying to hurt Hillary, by the end the Russians seem to have been trying to help Trump too.

Download the 282nd Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

281. When will the European Union order Twitter to silence President Trump?

Today’s episode opens with coverage of a truly disturbing bit of neocolonialist lawmaking from the Court of Justice of the European Union. The CJEU ruled that an Austrian court correctly ordered Facebook to take down statements about an Austrian politician, not just in Austria, not just in Europe, but everywhere in the world. Called an “oaf” and a “fascist,” the politician more or less proved the truth of the accusations by suing to keep that and similar statements off Facebook worldwide. I suggest that the US adopt blocking legislation to protect the First Amendment from foreign government interference and argue that President Trump should support such a law. After all, if he were ever to insult a European politician on Twitter, this ruling could lead to litigation that takes his Twitter account off the air. Heading off that threat is truly a legislative and international agenda for the Age of Trump! 

Nick Weaver returns to the podcast and gives the FDA a better report card than I expected on its approach to cybersecurity. But we agree that the state of medical device and implant security remains parlous. 

I try my hand at explaining the DC Circuit’s Net Neutrality ruling in Mozilla v. FCC. There are still some rounds to be played, but Net Neutrality, if not dead, may at least be pining for the fjords (or a Democratic administration).

We introduce a new feature: This Week in Elizabeth Warren. She has a plan to revive the Congressional Office of Technology Assessment. Nick likes the idea. I’m less enthusiastic, perhaps because I actually did some work for OTA before it disappeared.

Nick also helps unpack the flap over Google’s proposal to do DNS-over-HTTPS, and why ISPs aren’t happy about it. Bottom line: If you haven’t been paying much attention to the issue, you made the right choice. Nick explains why. Just think of how much time you saved by listening to the podcast!

Nick also explains how Uzbekistan managed to give state cyberattacks an aura, not of menace or invincibility, but of clownish incompetence.

David Kris tells us why privacy advocates and NGOs object to the French government’s use of nationwide facial recognition for its ID program. If that's the best they can do, I suggest, this may be the dumbest face recognition privacy “scandal” in history.

The cops have shut down a Dark Web data center operating from… a NATO bunker? Nick reveals that the main reason to operate from a NATO bunker is, well, marketing. 

Apparently channeling Stewart Baker, Attorney General Bill Barr is all-in on discouraging mass-market warrant-proof encryption. Nick thinks he’s picked the wrong fight and should go after phone storage encryption instead. And maybe Nick’s right, since the civil-liberties shine on Apple is looking a little scuffed these days. 

David tells us that NSA has launched a new defense directorate with Anne Neuberger at its helm. I promise to interview her on the podcast early next year.

David talks about the California man charged with delivering classified information to China’s Ministry of State Security. I want to know how many spies China has in the US if they can create what amounts to Uber for dead drops.

Dog bites man: Pervy Yahoo engineer pleads guilty to hacking emails for pornographic images. I’m surprised this doesn’t happen every month. 

And in a sign that Congress can still reach bipartisan agreement on bills that do more or less nothing, both the House and the Senate have adopted bills authorizing (but not funding) DHS “cyber hunt” teams to help local governments suffering from cyber ransom and other attacks.

Bringing back an old favorite theme, I cover the hacking of an electronic billboard to play porn – and celebrate the crowdsourcing of the facial recognition needed to identify the actresses. (At least I think it was face recognition.) Tracked down and asked for comment, one actress urged her involuntary viewers to “keep both hands on the wheel.”

Download the 281st Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed!

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.