Skating on Stilts

493. Google’s Gemini tells us exactly what’s wrong with Silicon Valley

This episode of the Cyberlaw Podcast kicks off with the Babylon Bee’s take on Google Gemini’s woke determination to inject a phony diversity into images of historical characters: "After decades of nothing but white Nazis, I can finally see a strong, confident black female wearing a swastika. Thanks, Google!" Jim Dempsey and Mark MacCarthy join the discussion because Gemini’s preposterous image diversity quotas deserve more than snark. In fact, I argue, they were not errors; they were entirely deliberate efforts by Google to give its users not what they want but what Google in its wisdom thinks they should want. That such bizarre results were achieved by Google’s sneakily editing user prompts to ask for, say, “indigenous” founding fathers simply shows that Google has found a unique combination of hubris and incompetence. More broadly, Mark and Jim suggest, the collapse of Google’s effort to control its users raises this question: Can we trust AI developers when they say they have installed guardrails to make their systems safe?

The same might be asked of the latest in what seems an endless stream of experts demanding that AI models defeat users by preventing them from creating “harmful” deepfake images. Later, Mark points out that most of Silicon Valley recently signed on to promises to combat election-related deepfakes.  In the 2010s, we all learned to hate the tech companies; in the 2020s, it seems, they've learned to hate us.

Speaking of hubris, Michael Ellis covers the State Department’s stonewalling of a House committee trying to find out how generously the Department funded a group of ideologues trying to cut off advertising revenues for right-of-center news and comment sites. We take this story a little personally, having contributed op-eds to several of the blacklisted sites.  

Michael explains just how much fun Western governments had taking down the infamous Lockbit ransomware service. I credit the Brits for the humor displayed as governments imitated Lockbit’s graphics, gimmicks, and attitude. There were arrests, cryptocurrency seizures, indictments, and more. It was fun while it lasted. But a week later, Lockbit was claiming that its infrastructure was slowly coming back on line.

Jim unpacks the FTC’s case against Avast for collecting the browsing habits of its antivirus customers. He sees this as another battle in the FTC’s war against corporate claims that privacy can be preserved by “de-identifying” personal data.

Mark notes the EU’s latest investigation into TikTok. And Michael explains how the Computer Fraud and Abuse Act relates to Tucker Carlson’s ouster from the Fox network.

Mark and I take a moment to promote next week’s review of the Supreme Court oral argument over Texas and Florida social media laws. The argument was happening while we were recording, but it was already clear that the outcome will be a mixed bag. Tune in next week for more.

Jim explains why the administration has produced an executive order about cybersecurity in America’s ports, and the legal steps needed to bolster port security.

Finally, in quick hits:

• We dip into the trove of leaked files exposing how China’s cyberespionage contractors do business
• I wish Rob Joyce well as he departs NSA and prepares for a career in cyberlaw podcasting
• I recommend the most cringe-inducing and irresistible long read of the week: How I Fell for an Amazon Scam Call and Handed Over $50,000
• And in a scary taste of the near future, a new research paper discloses that advanced LLMs make pretty good autonomous hacking agents.

 Download 493rd Episode (mp3)

 You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets

492. Are AI models learning to generalize?

We begin this episode with Paul Rosenzweig describing major progress in teaching AI models to do text-to-speech conversions. Amazon flagged its new model as having "emergent" capabilities in handling what had been serious problems – things like speaking with emotion, or conveying foreign phrases. The key is the size of the training set, but Amazon was able to spot the point at which more data led to unexpected skills. This leads Paul and me to speculate that training AI models to perform certain tasks eventually leads the model to learn "generalization" of its skills. If so, the more we train AI on a variety of tasks – chat, text to speech, text to video, and the like – the better AI will get at learning new tasks, as generalization becomes part of its core skill set. We're lawyers holding forth on the frontiers of technology, so take it with a grain of salt.

Cristin Flynn Goodwin and Paul Stephan join Paul Rosenzweig to provide an update on Volt Typhoon, the Chinese APT that is littering Western networks with the equivalent of logical land mines. Actually, it's not so much an update on Volt Typhoon, which seems to be aggressively pursuing its strategy, as on the hyperventilating Western reaction to Volt Typhoon. There's no doubt that China is playing with fire, and that the United States and other cyber powers should be liberally sowing similar weapons in Chinese networks. Unfortunately, for all the heavy breathing, the public measures adopted by the West do not seem likely to defeat or deter China's strategy.

The group is not impressed by the New York Times' claim that China is pursuing a dangerous electoral influence campaign on U.S. social media platforms. The Russians do it better, Paul Stephan says, and even they don't do it well, I argue.

Paul Rosenzweig reviews the House China Committee report alleging a link between U.S. venture capital firms and Chinese human rights abuses. We agree that Silicon Valley VCs have paid too little attention to how their investments could undermine the system on which their billions rest, a state of affairs not likely to last much longer. Meanwhile, Paul Stephan and Cristin bring us up to date on U.S. efforts to disrupt Chinese and Russian hacking operations.

We will be eagerly waiting for resolution of the European fight over Facebook's subscription fee and the implementation by websites of "Pay or Consent" privacy terms. I predict that Eurocrats' hypocrisy will be tested by the effort to reconcile rulings for elite European media sites, which have already embraced "Pay or Consent," with a nearly foregone ruling against Facebook. Paul Rosenzweig is confident that European hypocrisy is up to the task.

Cristin and I explore the latest White House enthusiasm for software security liability. Paul Stephan explains the flap over a UN cybercrime treaty, which is and should be stalled in Turtle Bay for the next decade or more.

Cristin also covers a detailed new Google TAG report on commercial spyware.

And in quick hits,

• House Republicans tried and failed to find common ground on renewal of FISA Section 702
• I recommend Goody-2, the 'World's 'Most Responsible' AI Chatbot
• Dechert has settled a wealthy businessman's lawsuit claiming that the law firm hacked his computer network
• Imran Khan is using AI to make impressively realistic speeches about his performance in Pakistani elections
• The Kids Online Safety Act secured sixty votes in the U.S. Senate, but whether the House will act on the bill remains to be seen

Download 492nd Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets

 

491. Death, Taxes, and Data Regulation

The latest episode of The Cyberlaw Podcast features guest host Brian Fleming, while Stewart Baker is participating in the Canadian Ski Marathon. Brian is joined for the news roundup by Jane Bambauer, Gus Hurwitz, and Nate Jones.

They begin by discussing the latest U.S. government efforts to protect sensitive personal data, including the FTC's lawsuit against data broker Kochava and the forthcoming executive order restricting certain bulk sensitive data flows to China and other countries of concern.

Nate and Brian then discuss whether Congress has a realistic path to end the Section 702 reauthorization standoff before the April expiration and debate what to make of a recent multilateral meeting in London to discuss curbing spyware abuses.

Gus and Jane then talk about the big news for cord-cutting sports fans, as well as Amazon's ad data deal with Reach, in an effort to understand some broader difficulties facing internet-based ad and subscription revenue models.

Nate considers the implications of Ukraine's "defend forward" cyber strategy in its war against Russia. Jane next tackles a trio of stories detailing challenges, of the policy and economic varieties, facing Meta on the content moderation front, as well as an emerging problem policing sexual assaults in the Metaverse.

Bringing it back to data, Gus wraps the news roundup by highlighting a novel FTC case brought against Blackbaud stemming from its data retention practices.

In this week's quick hits, Gus and Jane reflect on the FCC's ban on AI-generated voice cloning in robocalls, Nate touches on an alert from CISA and FBI on the threat presented by Chinese hackers to critical infrastructure, Gus comments on South Korea's pause on implementation of its anti-monopoly platform act and the apparent futility of nudges (with respect to climate change attitudes or otherwise), and finally Brian closes with a few words on possible broad U.S. import restrictions on Chinese EVs and how even the abundance of mediocre AI-related ads couldn't ruin Taylor Swift's Super Bowl.

Download 491st Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets

490. Episode 490 of the Cyberlaw Podcast

It was a week of serious cybersecurity incidents and unimpressive responses. As Melanie Teplinsky reminds us, the U.S. government has been agitated for months about China's apparent strategic decision to hold U.S. infrastructure hostage to cyberattack in a crisis. Now the government has struck back at Volt Typhoon, the Chinese threat actor pursuing that strategy. It claimed recently to have disrupted a Volt Typhoon botnet by taking over a batch of compromised routers. Andrew Adams explains how the court-ordered takeover was managed. It was a lot of work, and there is reason to doubt the effectiveness of the effort. The compromised routers can be re-compromised if they are turned off and on again. And the only ones that were uncompromised by the U.S. seizure are those inside the U.S., leaving open the possibility of DDOS attacks from abroad. Finally, DDOS attacks on our critical infrastructure shouldn't exactly be an existential threat. All things considered, I argue that there's a serious disconnect between the government's hair-on-fire talk about Volt Typhoon and its business-as-usual response.

Speaking of cyberattacks we could be overestimating, Taiwan just had an election that China cared a lot about. According to one detailed report, the Chinese threw a lot of cyber at Taiwanese voters -- and failed to make much of an impression. Richard Stiennon and I mix it up over whether the Chinese will do better trying to influence the 2024 outcome here.

While we're covering humdrum responses to cyberattacks, Melanie explains U.S. sanctions on Iranian military hackers for their hack of U.S. water systems that were more or less fish in a barrel.

For comic relief, Richard lays out the latest drama around the EU AI Act, now being amended in a series of backroom deals and off-the-books promises. I predict that the effort to pile pet-rock provisions on top of anti-American protectionism will end, not in a GDPR-style triumph for Europe but in a continent-wide AI desert. The EU market is now small enough for AI companies to bypass Europe entirely at the first sign of toxic regulation.

The U.S. is not the only player whose response to cyberintrusions is looking inadequate this week. Richard explains Microsoft's recent disclosure of a Midnight Blizzard attack on the company and a number of its customers. The company's obscure explanation of how its technology contributed to the attack and, worse, its effort to turn the disaster into an upsell opportunity earned Microsoft a patented Alex Stamos spanking.

Andrew explains the recent Justice Department charges against three people who facilitated the big $400m FTX hack that coincided with the exchange's collapse. Does that mean the hack wasn't an inside job? Not so fast, Andrew cautions. The government hasn't recovered the $400m, and it isn't claiming the three SIM-swappers it has charged are the only conspirators.

Melanie explains why we've seen a sudden surge in state privacy legislation. It turns out that industry has stopped fighting the idea of state privacy laws and is now selling a light-touch model law that omits things like a private right of action.

I give a lick and a promise to a "privacy" regulation now being pursued by CFPB for consumer financial information. I put privacy in quotes, because it's really an effort to create a whole new market for personal data, one that will assure better data management while undermining the competitive advantage of big data holdings. Bruce Schneier likes the idea. So do I, in principle, but it means a massive re-engineering of a big industry by technocrats who may not be quite as smart as they think they are. Bruce, if you want to come on the podcast to explain and debate  the whole thing, send me email!

Spies are notoriously nasty, and often petty, but one of the nastiest and pettiest, Joshua Schulte, was sentenced to 40 years in prison last week. Andrew has the details.

There may be some good news on the ransomware front. More victims are refusing to pay. Melanie, Richard, and I explore ways to keep that trend going. I urge consideration of a tax on ransom payments.

I also flag a few new tech regulatory measures likely to come down the pike in the next few months. The FCC will likely use the TCPA to declare the use of AI-generated voices in robocalls illegal. And Amazon is likely to find itself held liable for the safety of products sold by third parties on the Amazon platform.

Finally, a few quick hits:

• Amazon has abandoned its iRobot acquisition, thanks to EU "competition" regulators, with the likely result that iRobot will be out of the competition for good
• David Kahn, who taught us all the romance of cryptology, has died at 93
• Air Force Lt. Gen. Timothy Haugh is taking over Cyber Command and NSA from Gen. Nakasone
• And for anyone suffering from Silicon Valley Envy, 23andMe offers a small corrective. The company is now a rare "reverse unicorn" – having fallen in value from $6 Billion to practically nothing

Download 490th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets