Skating on Stilts

489. Going deep on deep fakes – plus a bonus interview with Rob Silvers on the Cyber Safety Review Board.

This was a big week for AI-generated deep fakes. Sultan Meghji, who's got a new AI startup of his own, walked us through four stories that illustrate how AI will lead to more confusion about what's real and what's not. First, a fake Biden robocall urged people not to vote in the New Hampshire primary. Second, a bot purporting to offer Dean Phillips's views on the issues was penalized by OpenAI because it didn't have Phillips's consent. Third, fake nudes of Taylor Swift led to a ban on Twitter searches for her image. And, finally, podcasters used AI to resurrect George Carlin and got sued by his family for violating copyrightish law. The moral panic over AI fakery meant that all of these stories were too long on "end of the world" and too short on "we'll live through this."

Regulators of AI are not doing a much better job of maintaining perspective. Mark MacCarthy reports that New York City's AI hiring law, which has punitive disparate-impact disclosure requirements for automated hiring decision engines, seems to have persuaded NYC employers, conveniently, that none of them are using automated hiring decision enginess, so they don't have to do any disclosures. Not to be outdone, the European Court of Justice has decided that pretty much any tool to aid in decisions is an automated decision making technology subject to special (and mostly nonsensical) data protection rules.

Is AI regulation beginning to suffer from backlash? Could be. Sultan and I report on a very plausible Republican plan to attack the Biden AI executive order on the ground that its main enforcement mechanism, the Defense Production Act, simply doesn't authorize the measures the order calls for.

In other Big Tech regulation, Maury Shenk explains the EU's application of the Digital Markets Act to tech companies like Apple and Google. Apple isn't used to being treated like just another tech company, and its contemptuous response to the EU's rules for its app market could easily spur regulatory sanctions. Looking at Apple's proposed compliance with the California court ruling in the Epic case and the European Digital Market Act, Mark says it's time to think about price regulating mobile app stores.

Even handing out big checks to technology companies turns out to be harder than it first sounds. Sultan and I talk about the slow pace of payments to chip makers, and the political imperative to get the deals done before November (and probably before March).

Senator Ron Wyden, D-Ore. is still flogging NSA and the danger of government access to personal data. This time, he's on about NSA's purchases of commercial data. So far, so predictable. But he's also misrepresenting the facts by claiming flatly that NSA buys domestic metadata, ignoring NSA's clear statement that the metadata it buys is "domestic" only in the sense that it covers communications with one end inside the country. Communications with foreign countries that flow into and out of the U.S. have long been considered appropriate foreign intelligence targets, as witness the current debate over FISA section 702.

Maury and I review a Jim Dempsey's effort to construct a liability regime for insecure software. His proposal looks reasonable, but Maury reminds me that he and I produced something similar twenty years ago, that is still not even close to adoption anywhere in the U.S.

I can't help but rant about Amazon's arrogant, virtue-signaling, and customer-hating decision to drop a feature that makes it easy for Ring doorbell users to share their videos with the police. Whose data is it, anyway, Amazon? Sadly, I'm afraid we know the answer.

It looks as though there's only one place where hasty, ill-conceived tech regulation is being rolled back. China. Maury reports on China's decision to  roll back video game regulations, to fire its video game regulator, and to start approving new games at a rapid clip -- though only after a regulatory crackdown had knocked more than $60 billion off the value of its industry.

We close the news roundup with a few quick hits:

• Outside of AI, VCs are closing their wallets and letting startups run out of money
• Apple launched what looks like an expensive dud – the Vision Pro
• Quantum winter may be back as quantum computing turns out to be harder than hoped
• And, speaking of winter, consumers and regulators seem to be cooling fast on self-driving cars in the wake of serious missteps by Cruise

Finally, as a listener bonus, we hear from Rob Silvers, Under Secretary for Policy at the Department of Homeland Security and Chair of the Cyber Safety Review Board (CSRB). Under Rob's leadership, DHS has proposed legislation to give the CSRB a legislative foundation. The Senate homeland security committee recently held a hearing about that idea. Rob wasn't invited, so we asked him to come on the podcast to respond to issues that the hearing raised – conflicts of interest, subpoena power, choosing the incidents to investigate, and more.

Download 489th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets

 

Cybertoonz on the FTC and National Security

Okay, maybe past Cybertoonz have been a little hard on the FTC, hinting that it has paid no attention to national security concerns around personal data. In light of the Commission's recent ruling in the X-Mode case, it's become clear that the FTC is focusing on how personal data is used to protect national security. So to give the Commission equal time on the issue, we've turned Cybertoonz over to Chair Lina Khan to express its views.

488. High Court, High Stakes for Cybersecurity

The Supreme Court heard argument last week in two cases seeking to overturn the Chevron doctrine, which requires courts to defer to administrative agencies in interpreting the statutes that the agencies administer. The cases have nothing to do with cybersecurity, but Adam Hickey thinks they're almost certain to have a big impact on cybersecurity policy.  That's because, based on the argument, Chevron is going to take a beating from the Court, if it survives at all. With Chevron weakened, it will be much tougher to repurpose existing law to deal with new regulatory problems. Given how little serious cybersecurity legislation has been passed in recent years, any new regulation is bound to require some stretching of existing law – and thus to be easier to challenge.

Case in point: Even without a new look at Chevron, the EPA was balked in court when it tried to stretch its authorities to justify cybersecurity rules for water companies. Now, Kurt Sanger tells us, EPA, FBI, and CISA have combined to release cybersecurity guidance for the water sector.  The guidance may be all that can be done under current law, but it's pretty generic; and there's no reason to think that underfunded water companies will actually take it to heart. Given Iran's demonstrated interest in causing aggravation and maybe worse in that sector, Congress is almost certainly going to feel pressure to act on the problem.

CISA's emergency cybersecurity directives to federal agencies are coming fast and furious. That's a bad sign, since they are a library of flaws that are already being exploited. As Adam points out, they also reveal just how quickly patches are being turned into attacks and deployed. I wonder how sustainable the current patch system will prove to be. (In fact, it's already unsustainable; we just don't have anything to replace it.)

Here's some good news. The Russians have been surprisingly bad at turning cybersecurity flaws into serious infrastructure problems even for a wartime enemy like Ukraine. Additional information about Russia's attack on Ukraine's largest telecom provider suggests that the cost to get infrastructure back was lower than expected and mostly consisted of spending to win the victim telco's customers back.

Companies are starting to report breaches under the new, tougher SEC rule, Adam tells us, and Microsoft is out of the gate early.  Russian hackers stole the company's corporate emails, Microsoft says, but it insists the breach wasn't material. I predict we'll see a lot of such hair splitting as companies adjust to the rule. If so, Adam predicts, we're going to be drowning in 8ks.

Kurt notes recent FBI and CISA warnings about the national security threat posed by Chinese drones. The hard question is what's new in those warnings. A question about whether antitrust authorities might want to investigate DJI's enormous market share leads to another about the FTC's utter lack of interest in getting guidance from the executive branch when its jurisdiction overlaps with a national security concern. Case in point:  After listing a boatload of "sensitive location data" that should not be sold, the FTC had nothing to say about the personal data of people serving on US military bases.  Nothing "sensitive" there, the FTC seems to think, at least not compared to homeless shelters and migrant camps. I'm gobsmacked, which naturally leads to a new Cybertoon.

Michael Ellis takes us through Apple's embarrassing failure to protect users of its Airdrop feature. It comes on top of Apple's decision to live down to the worst Big Tech caricature in handling the complaints of app developers about its app store. Michael explains how Apple managed to beat 9 out of 10 claims in Epic's lawsuit and still end up looking like the sorest of losers.

Adam is encouraged by a sign of maturity on the part of OpenAI, which has trimmed its overbroad rules on not assisting military projects.

Michael takes us inside a new US surveillance court just for Europeans, and we end up worrying about the risk that the Obama administration will come back to impose new law on the Biden team.

Adam explains yet another European Court of Justice decision on GDPR.  This time it's a European government in the dock.  The result is the same, though: national security is pushed into a corner, and the data protection bureaucracy takes center stage.

Finally, we end with a sad disclosure. While bad cyber news will continue, cyber-enabled day drinking will not. Uber has announced the end of Drizly, its liquor delivery app.

Download 488th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets

The FTC defines sensitive locations for data brokers -- and Cybertoonz is not impressed.

The FTC has begun a new campaign against data brokers who are collecting and selling "sensitive" location information. Cybertoonz asks the obvious question.

487. Cyberwar continues to underperform

Matthew Heiman kicks off this episode of the podcast with a breakdown of Russia's attack on Ukraine's largest mobile operator. The attack was strikingly effective in destroying much of Kyivstar's infrastructure, and strikingly ineffective in achieving any meaningful Russian objectives, since service was quickly restored. Perhaps to even up the score, Ukraine supporters launched an even less effective cyberattack on an Iranian medical software company, presumably as retribution for Iran's supplying drones to Russia.

Hacking as an act of war may turn out to be more important in court than on the battlefield, at least when the victims file insurance claims, Jim Dempsey tells us. Merck's effort to get insurance coverage for its NotPetya losses despite an act of war exclusion has been settled. Which means that, if you want to know what cyberwar means for your insurance coverage, you need to review your current policy, which has almost certainly changed since the Merck case began.

Moving to the world of cybersecurity regulation, Cristin Flynn Goodwin recommends digging into the output of the reigning American champion for prescriptive cybersecurity rules, New York's Department of Financial Services, which recently sanctioned a cryptocurrency firm for a host of violations, including insufficient cybersecurity.

In Washington, meanwhile, the administration is promising to impose new cybersecurity requirements on hospitals, many of whom have been crippled by ransomware attacks. The hospitals aren't taking it well, but Jim thinks the legal basis for regulation can be found in the Golden Rule: The feds are supplying the gold, so they will make the rules.

It's "dogpile on the SEC" week, and no one is feeling sorry for the agency. Cristin reminds us that the SEC's X/ Twitter account was hacked and a market-moving tweet released last week, apparently because the SEC failed to abide by its own regulatory guidance about securing accounts with multi-factor authentication. That's also the subject of a recent Cybertoon, which asks whether the SEC should pay Elon Musk a whistleblower award for outing the agency's security failings.

The FTC's war on location data brokers continues to heat up. Jim reports on the FTC's settlement with one geolocation broker and its sweeping complaint against another. We also return to the FTC's settlement with Rite Aid over use of facial recognition, and its transformation of the settlement into a caution for users and makers of artificial intelligence products.

Speaking of AI, Cristin and I debate what should be done about the use of AI to create fake nudes of real people and other harassing tactics.

I argue that AI has bigger problems to deal with, citing Anthropic's recent report on just how hard it is to counteract malicious AI training.

Matthew and I marvel over the way that a longstanding insurgency in northern Myanmar has turned into a cybersecurity problem.

Finally, I pass on some listener feedback about an earlier episode that asked whether Apple knew about the highly sophisticated Triangulation exploit used against Kaspersky and the Russian government. It turns out that plenty of security pros find it plausible that Apple would not have been aware of the attack. 

Download 487th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets

Cybertoonz -- Hacking the SEC

486. Triangulating Apple

Returning from winter break, this episode of the Cyberlaw Podcast covers a lot of ground. The story I think we’ll hear the most about in 2024 is the remarkable exploit used to compromise several generations of Apple iPhone. The question we’ll be asking is simple: How could an attack like this be introduced without Apple’s knowledge and support? We don’t get to this question until near the end of the episode, and I don’t claim great expertise in exploit design, but it’s very hard to see how such an elaborate compromise could be slipped past Apple’s security team. The second question is which government created the exploit. It might be a scandal if it were done by the U.S. But it would be far more of a scandal if done by any other nation.

Jeffery Atik and I lead off the episode by covering recent AI legal developments that simply underscore the obvious: AI engines can’t get patents as “inventors.” What's more interesting is the possibility that they’ll make a whole lot of technology “obvious” and thus unpatentable. Speaking of obvious, claiming that companies violate copyright when they train AI models on New York Times content requires a combination of arrogance and cluelessness that can only be found at, well, the New York Times.

Paul Stephan joins us to note that the National Institute of Standards and Technology (NIST) has come up with some good questions about standards for AI safety. 

Jeffery notes that U.S. lawmakers have finally woken up to the EU’s misuse of tech regulation to protect the continent’s failing tech sector. Even the continent’s tech sector seems unhappy with the EU’s AI Act, which was rushed to market in order to beat the competition and is therefore flawed and likely to yield unintended and disastrous consequences, a  problem that inspires this week’s Cybertoon.

Paul covers a lawsuit blaming AI for the wrongful denial of medical insurance claims. As he points out, insurers have been able to wrongfully deny claims for decades without needing AI. Justin Sherman and I dig deep into a New York Times article claiming to have found a privacy problem in AI. We conclude that AI may have a privacy problem, but extracting a few email addresses from ChatGPT doesn’t prove the case.

Finally, Jeffery notes an SEC “sweep” examining the industry’s AI use.

Paul explains the competition law issues raised by app stores – and the inconsistent outcome of app store litigation against Apple and Google. Apple's app store skated free in a case tried before a judge, but Google lost before a jury and has now entered into an expensive settlement with other app makers. Yet it’s hard to say that Google’s handling of its app store monopoly is more egregiously anticompetitive than Apple’s.

We do our own research in real time to address an FTC complaint against Rite Aid for using facial recognition to identify repeat shoplifters.  The FTC has clearly adopted Paul’s dictum, “The best time to kick someone is when they’re down.” And its complaint shows a lack of care consistent with that posture.  I criticize the FTC for claiming without citation that Rite Aid ignored racial bias in its facial recognition software.  Justin and I dig into the bias data; in my view, if FTC documents could be reviewed for unfair and deceptive marketing, this filing would lead to sanctions.

The FTC fares a little better in our review of its effort to toughen the internet rules on child privacy, though Paul isn’t on board with the whole package.

We move from government regulation of Silicon Valley to Silicon Valley regulation of government. Apple has decided that it will now require a judicial order to give government’s access to customers’ “push notifications.” And, giving the back of its hand to crime victims, Google decides to make geofence warrants impossible by blinding itself to the necessary location data. Finally, Apple decides to regulate India’s hacking of opposition politicians and runs into a Bharatiya Janata Party (BJP) buzzsaw.

Paul and Jeffery decode the EU’s decision to open a DSA content moderation investigation into X.  We also dig into the welcome failure of X's lawsuit to block California’s content moderation law.

Justin takes us through the latest developments in Cold War 2.0. China is hacking our ports and utilities with intent to disrupt (as opposed to spy on) them. And the U.S. is discovering that derisking our semiconductor supply chain is going to take hard, grinding work. Justin looks at a recent report presenting actual evidence on the question of TikTok’s standards for boosting content of interest to the Chinese government.

And in quick takes,

• I celebrate the end of the Reign of Mickey Mouse in copyright law
• Paul explains why Madison Square Garden is still able to ban lawyers who have sued the Garden
• I note the new short-term FISA 702 extension
• Paul predicts that the Supreme Court will soon decide whether police can require suspects to provide police with phone passcodes
• And Paul and I quickly debate Daphne Keller’s amicus brief for Frances Fukuyama in the Supreme Court’s content moderation cases

Download 486th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets

Cybertoonz explains the EU AI Act in four panels

 

As covered in this week's Cyberlaw Podcast, the AI Act is getting some poor reviews -- from the US Congress as well as Europe's tech sector. How could something like this happen in the home of the vaunted "Brussels Effect?" Fear not.  Cybertoonz has the explanation.