We begin the episode with Michael Ellis taking a close look at the takedown of the ransomware gang. It’s a good story for the good guys, as REvil seems to have been brought down by the same tactic it used against so many of its victims—malware that lingered in the backups it used to restore its network. I note that this seems to be a continuation of efforts that were interrupted in the early summer—and led to a lot of criticism that the FBI had prioritized its intrusion and takedown over giving victims the decryption key. Looks like the FBI is getting the last laugh.

The U.S. is trying to hold Putin responsible for stopping Russian ransomware gangs. Michael thinks that effort is not advanced by recent statements from the Pentagon raising doubts about whether Putin actually has the ability to stop the attacks.

One technology where Russia’s capabilities have grown stronger is, naturally, the ability to censor and suppress criticism both on domestic and Western platforms. David Kris discusses the kinds of hostages Russia has learned to take, and their success in bringing Western social media to heel.

The U.S. Commerce Department has released a complex new rule for the export of network intrusion tools. Meredith Rathbone, from Steptoe’s trade regulation practice, boils the rule down to a few soundbites. The short version? Commerce has done a pretty good job of protecting legitimate distributors of intrusion software, but even the good guys are going to have to save a lot more receipts.

Michael and Paul Rosenzweig reprise the latest news about content moderation, particularly Twitter’s own study showing that its algorithms offer up a bit more conservative than left-wing content. That raises the question whether right-leaning commentary and news is more popular because more people want it. If so, the employees at Facebook are determined to keep it from them, as recent leaks show aggressive internal efforts to squash Breitbart’s reach on the platform.

David and I unpack Ian Bremmer’s Foreign Affairs article on “How Big Tech Will Reshape the Global Order.” David sees more in the piece than I do.

Paul and Michael kick off a discussion of our negotiations with the EU over transatlantic data flows. But in no time, all four of us are sounding off. We offer some solutions, and plenty of criticism for the EU (“The continent that invented hypocrisy”). 

David notes that NSA is pursuing more collaboration with the private sector. How well that will work out is TBD, we agree.

In quick hits and updates:

• I note with irony that Frances Haugen has discovered the limits of criticizing Facebook. Whatever you do, you can’t criticize WhatsApp’s growing use of end2end encryption, even if it does allow the service to ignore foreign cyberespionage.
• Trump and TRUTH are together at last, and Paul has the details. Bottom line: it feels like a typical Donald Trump production: great hype, plenty of controversy, and weak execution. 
• Hackback, isn’t dead, it turns out, yet. I discuss the political and business advocates for a kinder, gentler version of private hackback, modeled on private investigators.

Download the 380th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Fresh from his launch of the Alperovitch Institute for Cybersecurity Studies, Dmitri Alperovitch kicks off this episode with a hopeful take on the 31-nation videoconference devoted to combatting ransomware. He and Nate Jones both think a coordinated international effort could pay off. I challenge Dmitri to identify one new initiative that this group could enforce, and he rises to the occasion.

Dmitri also previews one of the proposals for regulating Silicon Valley that might yet make it through Congress—a ban on “self-preferencing” by platforms that sell both their own and other people’s products. No, we don’t get out of this discussion without a “Master of our domain” Seinfeld reference. Or a nod in the direction of China’s even more aggressive use of antitrust remedies against companies like meal delivery giant Meituan.

Tatyana Bolton, meanwhile, identifies a second front in the attack on Big Tech – regulation of algorithms. This leads us into a discussion of freedom of speech versus “freedom of reach” and a WSJ story on the weaknesses of Facebook’s AI system for downrating but only occasionally nuking “hate speech.” I argue that social media will embrace AI reach restrictions, if only as a way to make sure the victims of Silicon Valley censorship never realize how much their voices are being squelched.

Microsoft has given up its ambitions for LinkedIn’s China operations, Dmitri notes, dropping the social media elements and moving to straight job listings. I think the retreat was overdetermined by the Chinese government’s effort to extract both financial and political concessions from Microsoft. In more news about Chinese regulation, it turns out that the Chinese ban on crypto-mining didn’t quite reach the crypto miners using state resources.

But if China is slowly poisoning its high-tech sector, why does a former Pentagon official think the U.S. has lost the AI race to China? Nate and I are cautiously skeptical of that view, not least because of the official’s, uh, provenance.

Tatyana and I dig into WhatsApp’s somewhat limited adoption of encrypted backups, and the policy’s likely impact on law enforcement and different categories of criminal. In quick hits, I also nod to the critique of “client-side scanning” of phone content for law enforcement offered by All the Usual Cryptographers.

In more comic relief, the governor of Missouri embarrasses himself by threatening criminal prosecution after a state website’s security flaws are exposed by a reporter who seems to have done all the right things from a responsible disclosure point of view.

In other quick hits, 

• I report on Facebook’s appeal of the magistrate opinion unexpectedly gutting the Stored Communications Act for everyone who’s ever been deplatformed by social media. It’s a workmanlike effort, but only mildly persuasive. This could turn out to be a big hole in the SCA, I offer.
• Dmitri breaks down the federal government’s plan to issue SD cards to all its employees for network access. It’s a good idea, he thinks, but saying it will end phishing of employees is more fond hope than reasonable expectation.

Download the 379th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The theme of this episode is a surge of creativity in the Biden administration as it searches for ways to regulate cybersecurity and cryptocurrency without new legislative authority. Paul Rosenzweig lays out the Department of Homeland Security’s entries in the creativity sweepstakes: New (and frankly pretty modest) cybersecurity directives to the rail and air industry plus a much more detailed (and potentially problematic) set of requirements for pipeline companies. Matthew Heiman describes a Justice Department plan for enforcing cybersecurity rules for federal contractors that should chill the hearts of management: an initiative that raises the prospect of whistleblower suits under the False Claims Act for failure to disclose breaches to the government. I suggest that this means the notoriously short tenure of the Chief Information Security Officer (CISO) at large companies will now come with a built-in retirement compensation package.

Creativity in regulating cryptocurrency was signaled both by the White House, which is working on a broader and more coordinated regulatory approach and by the Justice Department, which is planning a major criminal investigative approach to the industry. Nick Weaver gives us the details.

Paul covers a remarkably creative assertion of The Committee on Foreign Investment in the United States (CFIUS) jurisdiction over a Chinese purchase of Magnachip, a company with virtually no ties to the United States. Despite having no obvious skin in the game, CFIUS insisted on a CFIUS filing under President Trump and then vetoed the deal under President Biden. I suggest that the claim of extraterritorial jurisdiction, which in other circumstances might have annoyed South Korea, is in this case a good way for South Korea to avoid taking heat from China. 

Paul explains why the Facebook outage was a much bigger deal than Americans realized. If you were living in Costa Rica, the loss of Facebook and WhatsApp, he says, could have greatly complicated every aspect of daily life, including calls for emergency services.

Paul digs into the return of “hactivism”—not to mention skepticism about hactivism. I marshal the evidence that the Pandora Papers were the result of hacks, not leaks—and roast the newspapers feasting on the hack for their utter hypocrisy. Hey, Marty Baron! We haven’t forgotten that after the Democratic National Committee (DNC) leaks of 2016, you said “Before reporting on the release of hacked or leaked information, there should be a conversation with senior editors about the newsworthiness of the information, its authenticity and whether we can determine its provenance... If a decision is made to publish a story about hacked or leaked information, our coverage should emphasize what we know—or don’t know—about the source of the information and how that may fit into a foreign or domestic influence operation. Our stories should prominently explain what we know about the full context of the information we are presenting, including its origins and the motivations of the source, including whether it appears to be an effort to distract from another development.” We’re still looking for that “full context” in the Pandora Papers or the Epik leaks.

Nick fills us in on Facebook’s extreme reaction to the creation of a tool that allows users to escape the News Feed. I discover that I’ve completely missed the central Facebook experience because I semi-inadvertently disabled the news feed.

Paul offers some surprising news about the limits of Artificial Intelligence (AI). Turns out, it’s not that good even at some of the things it should be superb at, like radiology reviews.

Nick and I explore Google’s acceptance of warrants based on search terms. He thinks that this has gone on under the radar for some time because both government and Google think the public reaction will be bad for business. 

Finally, in two quick hits:

I brag about the proof that I’m one of the 14,000 Gmail users that the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU) fears most: Google caught the Russian spy agency trying to phish me with a doctored Word document. 

And Matthew reveals what the Russian SolarWinds hackers were looking for. From all the SolarWinds bad news, we extract this bit of good news: U.S. sanctions are really getting under Putin’s skin. So much so that sanctions are among Russian spies’ top collection priorities.

And more!

Download the 378th Episode (mp3) 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This is the meatiest episode in a long time, as Dmitri Alperovitch, Dave Aitel, and Mark MacCarthy go deep on the substance of a dozen stories or more. 

First up, Dmitri and I speculate on possible outcomes from the newly announced administration plan to convene 30 countries to crack down on ransomware. We also report on what may be the first conformed death resulting from the equipment failures caused by ransomware—a newborn strangled by its umbilical cord without the usual electronic warnings. 

Dmitri also recaps and explains a new cryptocurrency regulatory topic that doesn’t concern its use in ransomware schemes—the move to ensure the financial stability of stablecoins. 

Dave weighs in on two surprising provisions of the House intel authorization bill. The first would respond to the Project Raven incident by imposing new controls on ex-spies working for foreign governments. No one is against the idea, but no one thinks that the problem is limited to alumni of a few intelligence agencies. And the bill’s sweep is far broader than cases like Project Raven. I make the argument that it may criminalize ex-spies giving security advice to Airbus, or perhaps even the Atlantic Council.

The second imposes reporting requirements on U.S. government purchases of vulnerabilities from foreign vendors. This leads to a discussion of which nation has the best offensive talent. Dave thinks the old champ has been decisively dethroned. 

In other legislative news, Dmitri covers the three committees producing bills to require cyber incident reporting, with special emphasis on the recently leaked bill from Senate Intel.

It’s a very aggressive bill, perhaps designed to stake out negotiating room with the Homeland committees. I ask, “What’s the difference between Europe’s staggering fines for General Data Protection Regulation (GDPR) violations and the fines for violating U.S. cyber reporting obligations?” The answer: about two weeks, at which point the maximum fine due to the U.S. will exceed the top European fine.

Mark gives an overview and some prognostication about Google’s effort to overturn the EU’s $5 billion antitrust fine for its handling of Android. 

Dmitri and I find ourselves forced to face up to the growing soft power of Russia and China, which are now increasingly forcing Silicon Valley companies to project Russian and Chinese power into the West. Russia, having forced Apple and Google to send hostages in the form of local employees, are trying to use their leverage to control what those companies do in countries like Germany.  And Linkedin, the last Western social media company still standing in China, is trying to keep that status by asking Americans to self-censor their accounts.

At Dave’s request, we visit a story we missed last week and explore all the complex equities at work when the FBI decides whether to use ransomware keys for remediation or disruption.

Mark gives an overview of the new Federal Trade Commission, where regulatory ambition is high but practical authority weak, at least until the Senate confirms a third Democratic commissioner.

Waiting in the wings for that event is even more antitrust action, possible new online privacy rules and Commissioner Slaughter’s enthusiasm for addressing racial equity quotas under the guise of algorithmic fairness.

Dmitri offers his best guess about the recent Russian arrest of a cybersecurity executive for treason (that’s the second in five years if you’re counting) and the U.S. decision to send a Russian scammer back to Russia after bitterly fighting to extradite him from Israel (it’s the magic of time served awaiting extradition, I speculate).

 In quick hits:

• Dmitri makes a public service announcement about the ways that Two-Factor Authentication (2FA) can be subverted. 
• I celebrate some good news for the U.S.: China is planning to encourage provincial controls on the design and use of user algorithms. That’s bound to give US companies a new competitive advantage in a field where TikTok has passed them.
• Dave and I dissect the guilty plea of former Ethereum developer Virgil Griffith to violating U.S. sanctions to offer a bland speech on cryptocurrency in North Korea. 
• I give the highlights of two new and eminently contestable cyberlaw rulings:

• In U.S. v. Wilson, the Ninth Circuit decided that law enforcement needs a warrant to open files that it knows from hashes are 99.9 percent certain to be child porn. The decision would be unfortunate if it weren’t meaningless; the hash itself provides probable cause, so warrants will be quickly and routinely issued. Thanks for the make-work, EFF! 
• And a magistrate judge clearly gunning for promotion has written a Stored Communications Act opinion that would fill me with concern about the way it empowers Silicon Valley’s biased Trust and Safety operatives to de-platform people and then turn their posts over to law enforcement without the subpoena they usually demand. I would worry more about those troubling consequences if I thought the opinion would survive.  
• And, finally, Dmitri is pleased to find one field where AI is succeeding without controversy, as machine learning declares a famous Peter Paul Rubens painting, Samson and Delilah, to be a fake. But how long, I wonder, before this AI is forced by the FTC to correct its notorious anti-Flemish bias?

And more!

Download the 377th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.