Steptoe Cyberlaw Podcast (general)

This episode consists of Jamil Jaffer and me interviewing Glenn Gerstell, the general counsel of the National Security Agency. Glenn explains what it was like on the inside of the effort to reauthorize section 702 of the Foreign Intelligence Surveillance Act. Jamil and I ask him whether the Foreign Intelligence Surveillance Court has the authority to deal with material omissions in FISA applications, and he actually answers. Glenn also touches on how it feels to discover that data subject to a judicial retention order has been inadvertently deleted, his secret exercise regime, his future plans, and how the United States should respond to the cybersecurity crisis.

Download the 203rd Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Direct download: TheCyberlawPodcast-203.mp3
Category:general -- posted at: 5:09pm EST

Cyberlaw Podcast alumnus Marten Mickos was called before the Senate commerce committee to testify about HackerOne’s bug bounty program. But the unhappy star of the hearings was Uber, which was heavily criticized for having paid out a large bonus under cloudy circumstances. Sen. Richard Blumenthal and others on the Hill treated the payment as more ransom than bounty and pilloried Uber for not disclosing what they called a breach. Even Uber, under new management, was critical of its performance.

As the only cyberlaw podcast with a Davos correspondent, we ask Alan Cohn to give highlights of the event from a cybersecurity point of view. I bring the color commentary and snark.

With the Microsoft Ireland case heading to argument, the Justice Department and Big Tech are hoping to head the court off with a legislative solution. Jamil Jaffer explains what the CLOUD Act will do. I point out who’s missing from the Grand Coalition and question whether Big Privacy has the clout to stop the act.

Fancy Bear hackers seeking high-tech weapons data from U.S. defense contractors get lucky—up to 40% of their phishing links strike paydirt. Michael Mutek explains what this likely means for the Defense Department—more regulation, probably. Whether more regs and more compliance will produce more security is the question no one can answer.

A cyber-diplomacy office is back from the dead, sort of: Secretary of State Rex Tillerson now says he’ll create a bureau for cyberspace headed by an assistant secretary. And, as Jamil explains, the fight switches to which undersecretary will oversee the office.

Nick Weaver and Jamil comment on the news that the Justice Department has pulled in an impressive haul of cyber-fraudsters, bookended by doubts whether any hackers can ever be extradited from places like the UK and Ireland. Because, face it, how many can’t claim to be on the spectrum?

I close with a tribute to John Perry Barlow, who died last week. If you wanted to know how many women would fall for a combination Grateful Dead lyricist, technologist, and cowboy, John could tell you. Exactly.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 202nd Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Direct download: TheCyberlawPodcast-202.mp3
Category:general -- posted at: 2:13pm EST

The crypto wars return to The Cyberlaw Podcast in episode 201, as I interview Susan Landau about her new book on the subject, ‘Listening In: Cybersecurity in an Insecure Age.’ Susan and I have been debating each other for decades now, and this interview is no exception.

In the news roundup, Brian Egan and Nick Weaver join me for the inevitable mastication of the Nunes memo. (My take: The one clear scandal here is the way Glenn Simpson and Chris Steele treated the U.S. national security apparatus, including the national security press, as just another agency to be lobbied – and the success they had in milking it for partisan advantage and private profit.)

Meanwhile, if you needed a reminder of just how enthusiastically and ham-handedly China conducts its espionage, just ask the African Union, whose Chinese-built headquarters is pwned from top to bottom.

Brian lays out a significant Ninth Circuit Anti-Terrorism Act case absolving Twitter of liability for providing “material assistance” to ISIS by requiring a more direct relationship between Twitter’s acts and the harm suffered by the private plaintiffs. Not a surprise, but a relief for Silicon Valley.

Nick fulminates about the security threat that a sophisticated recent malvertising campaign poses and wonders when enterprises will start requiring ad-blockers on corporate internet software. In a related story, we wonder how much incentive Twitter really has to kill off its armies of fake followers.

Are the Dutch paying the price for punching above their weight in the cyberespionage game? And did American leaks kill their success? All we can do is speculate, unfortunately.

You know you’ve missed This Week in Sex Toy Security, so we bring it back to cover yet another internet-connected vibrator company trying to shake off a privacy class action. 

Finally, as a sign that we’ve finally reached peak cybersecurity and peak privacy, both topics are ending up on the agendas of international trade negotiators. The EU says its privacy rules are untouchable in negotiations (although other countries’ overly protectionist data flow policies are fair game) and the NAFTA negotiators have reportedly agreed to add to NAFTA cyber security “principles” based on the NIST Cyber Security Framework.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 201st Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Direct download: TheCyberlawPodcast-201.mp3
Category:general -- posted at: 11:51am EST

Whether they call it the fitbit or the “Ohsh*t!bit,” governments are learning that the exercise internet of things is giving away their geospatial secrets at a rapid clip. Nick Weaver walks us through what most in the U.S. would call a security disaster—and how it could become an intelligence bonanza. As an example of what can be done, Jeffrey Lewis highlights Taiwan's secret cruise missile command center.

Of course, as soon as authoritarian governments learn to use fitbits to oppress their people, we can expect the European Union and the Wassenaar export control group to slap export controls on them.  Meredith Rathbone reports on the effort to persuade Europe and Wassenaar not to throw the security industry out with the intrusion software. Turns out that progress is being made on both fronts.

Nick and I talk through the latest stories on Russian cyberspying. Meduza and Buzzfeed have a persuasive and dispiriting story about how Eugene Kaspersky might have been forced to cooperate with the Russian FSB. Looking at questions being raised about U.S. firms allowing the Russians to inspect their source code, we conclude that Balkanization of cybersecurity products is a near certainty, with the only question being how many markets there will be.

Speaking of Russia, the Dutch, not prominent among hacking intelligence agencies until now, have apparently counted cybercoup on the Russians.

Meredith and I dig into the latest round in the European Court of Justice between Max Schrems and Facebook. We call it a draw, with special props to Facebook for creativity in arguing that Schrems is no longer a consumer because he’s obviously turned suing Facebook into a profession.

And, in an overdue event, jackpotting coming to an ATM near you.

Finally, in the interview, we talk to Tim Maurer, co-director of the Cyber Policy Initiative and author of the new book, “Cyber Mercenaries: The State, Hackers, and Power.” Tim tells us the hidden story behind his book’s title and then jumps into a fascinating comparative study of how different governments try (or don’t try) to control the hackers they recruit, because it turns out that they all recruit hackers, just in very different ways. Tim points out an increasing fad for having hackers from one country move to another country to ply their trade. (North Koreans to China; Chinese to Africa) and the additional deterrence options this offers the U.S. government.

As always The Cyberlaw Podcast is open to feedback.  Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 200th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

 

Direct download: TheCyberlawPodcast-200.mp3
Category:general -- posted at: 8:10am EST

In this guestless episode, Michael Vatis, Markham Erickson, and Nick Weaver join me to round up the news. I explore the final results of the intense jockeying that led to passage of S. 139, which gave Section 702 of Foreign Intelligence Surveillance Act a new lease on life. The administration did well, weathering the president’s tweets, providing a warrant process for backend searches that will likely be used once a year if that, and—almost without anyone noticing—pulling the unmasking reform provisions from the bill and substituting an Office of the Director of National Intelligence rule. My guess? This was a tactic to make it easier for Dems to support the bill; if so, it worked.

And just in time, as the days after passage brought new whiffs of scandal, from the four-page House Republican memo alleging improprieties in the FBI’s FISA application to wiretap a Trump campaign hanger-on to two cases in which the FBI and NSA destroyed evidence they were supposed to be preserving. Michael Vatis and I cross sword over whether the FISA abuse memo is worth taking seriously or just partisan flak.

Nick and I delve into the gigabytes of hacked data mislaid by another player in the phone hacking game—Lebanese intelligence. Nick wonders whether the data obtained Electronic Frontier Foundation and Lookout violated the Computer Fraud and Abuse Act. I don’t.

The first known death by SWATting has yielded charges; the egregious SWATter for hire, SWauTistic, has been charged with involuntary manslaughter.

Almost as scary is the news that electric system malware is getting remarkably sophisticated, and common.

The Supreme Court will hear argument in the Microsoft Ireland case next month, and there are dozens of amici briefs, including one by Michael Vatis, who lays out his direct appeal to Justice Neil Gorsuch’s property-based view of the fourth amendment.

Matt Green (and Nick Weaver) have some questions for Apple about its moving China cloud data to a third party Chinese cloud provider. I’ve got one too. If treating Taiwan as a separate country from China leads to humiliating penalties for Western companies, does that mean Apple can’t store Taiwanese and Hong Kong users outside China?

And, for once on the podcast, a sweet life-long love story, spelled out cryptographically.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 199th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Direct download: TheCyberlawPodcast-199_1.mp3
Category:general -- posted at: 8:21am EST

It turns out that the most interesting policy story about Kaspersky software isn’t why the administration banned its products from government use; it’s why the last administration didn’t. Shane Harris is our guest for the podcast, delving into the law and politics of the Kaspersky ban. Along the way, I ask why the Foreign Sovereign Immunities Act, which allows suits against foreign governments for some torts committed in the United States, shouldn’t allow suits against foreign governments that hack computers located in the United States.

In the news, the House comfortably adopts a bill to reauthorized 702 surveillance; the Senate is expected to act today as well. While the House bill makes some changes to the law, it endorses the most moderate of the reform proposals.

In case you haven’t heard, Apple is handing off its iCloud operations to a local cloud storage company – with none of the histrionic civil liberties posturing the company displays in the United States. Whose data is being transferred to the tender mercies of Chinese authorities? Who knows? Not Apple, which can’t even send out notices to its customers without getting confused about who’s covered by the new policy.

It’s a “three-peat” for state authority to make online companies collect sales tax from their customers. The Supreme Court has agreed to reconsider a dormant commerce clause doctrine that it has already affirmed twice.

I apologize to Uber for snarking on their “bounty” payment of $100,000 to a hacker who exposes a serious security flaw and gained access to large amounts of personal data. A good New York Times article demonstrates that the decision to pay up was at least plausibly justified. But as if to demonstrate why the company never gets the benefit of the doubt, Bloomberg reports on Uber’s latest scofflaw-ware scandal. Luckily for journalists everywhere, Uber continues to adopt colorfully damaging nicknames for its scofflaware. In this case their product locked or deleted data sought by local law enforcement with the touch of a panic button. It was named, of course, after Sigourney Weaver’s character, Ripley, who declared that the only way to deal with an alien-infested installation was to “nuke it from orbit.”

Sheila Jackson-Lee gets an admiring mention for winning House passage of a cyber vulnerability disclosure bill that is probably nuanced enough to be adopted by the Senate as well.

And Deputy Attorney General Rosenstein makes a short pitch for “responsible” encryption that actually manages to move the debate forward a step.

Talk about 21st century warfare. Russia is claiming it fought off swarms of drones with cyberweapons. As Nick Weaver points out, that’s just the beginning.

Brian assesses the state of CFIUS reform legislation and the claim that Sen. Cornyn’s bill would result in CFIUS’s regulation of technology transfers that would be better addressed through export controls.

Finally, having already critiqued Apple and Uber, I feel obliged to offer equal time to Twitter, which remarkably can’t even identify advertisements that invite users to log on to fake Twitter sites and steal their credentials. If you want to understand the worst of Silicon Valley, I argue, you shouldn’t look to the big rich companies; it’s the struggling would-be unicorns who show what the Valley really cares about. And security ain’t it. Speaking of which, where is that Ad Transparency Center that Twitter promised any day now back in the fall of 2017?

 

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 198th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

 

Direct download: TheCyberlawPodcast-198.mp3
Category:general -- posted at: 9:50pm EST

While the U.S. was transfixed by posturing over the Trump presidency, China has been building the future. Chances are you’ll find one part of that future–social credit scoring–both appalling in principle and irresistible in practice. That at least is the lesson I draw from our interview of Mara Hvistendahl, National Fellow at New America and author of the definitive article on the allure, defects and mechanics of China’s emerging social credit system.

In the news roundup, Nick Weaver dives deep on the Spectre and Meltdown security vulnerabilities while I try to draw policy and litigation implications from the debacle. TL;DR -this is bad, but the class actions will settle for pennies. Oh, and xkcd has all you need to know.

I note that U.S. Customs and Border Protection under Trump has imposed new limitations on border searches of electronic devices. So naturally the press is all “Trump has stepped up border searches aggressively.” No good deed unpunished, as they say.

Maury Shenk explains President Emmanuel Macron’s latest plans to regulate cyberspace in the name of fighting Russian electoral interference and fake news. The Germans, meanwhile, have begun implementing their plan to fight hate speech on the internet. Predictably, it looks as though hate speech is winning.

In the litigation outrage of the month, a company called Keeper, a password manager developer, got caught distributing software with a security flaw. So they did what any security-conscious company would–they sued the website that publicized the flaw for libel. It’s a crappy suit, and we should all hope they end up assessed with costs and fees. But the real question is this: Google found and disclosed the flaw, while Microsoft distributed Keeper to its users. When will they file as amici to say that no company with a mature security model files STFU libel suits against people who point out legitimate security problems? TL;DR–Keeper: Loser.

Finally, Hal Martin pleads guilty to one of twenty-plus counts and takes a ten-year sentence. So far, so ordinary in the world of plea bargaining. But as Nick points out, this wasn’t a bargain. Martin can still be tried and sentenced on all the other counts. And it effectively stipulates the maximum sentence for the one count he’s pleading guilty to. There must be a strategy here, but we can’t say for sure what it is.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 197th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Direct download: TheCyberlawPodcast-197.mp3
Category:general -- posted at: 4:51pm EST

In this episode, I interview Elsa Kania, author of a Center for a New American Security report on China’s plan for military uses of artificial intelligence—a plan that seems to have been accelerated by the asymmetric impact of AlphaGo on the other side of the Pacific.

In the news, Brian Egan notes that China’s perspective on “sovereignty in cyberspace” was further elaborated at China’s World Internet Conference, and I point out that China continues its “two steps forward, one step back” process of bringing U.S. companies to heel on security issues.

Nick Weaver explains that the U.S. financial institutions’ “project doomsday” could just as easily be cast as “fire hydrant standardization.” It could be, but it won’t, at least not by headline writers.

Nick also calls out Apple for failing to follow U.S. law in responding to pen/trap and wiretap orders.

I take a victory lap, as the director of national intelligence promises to apply the Gates procedures to unmasking of transition officials. As recommended by me (well, and the House intelligence committee). No need to call them the Baker procedures, though, guys.

Bleeping Computer says Germany is planting backdoors into modern devices. Maybe so, I offer, but whether that includes encryption is not at all clear. 

Finally, Nick digs into the remarkable work that Citizen Lab and Bill Marczak continue to do on authoritarian government hacking. He says, with evidence, that efforts to control sales to untrustworthy governments are actually working.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Subscribe to The Cyberlaw Podcast here.  We are also on iTunesPocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Direct download: TheCyberlawPodcast-196.mp3
Category:general -- posted at: 8:04am EST

Episode 195 features an interview with Susan Hennessey of Lawfare and Andrew McCarthy of the National Review. They walk us through the “unmasking” of US identities in intelligence reports—one of the most divisive partisan issues likely to come up in the re-enactment of Section 702 of FISA. I bask momentarily in the glow of being cast as a civil liberties extremist. And Thidwick the Big-Hearted Moose offers insights into 702 reform.

In the news roundup, I try to count votes after the Supreme Court argument in Carpenter v. United States. I count at least four likely votes to require a warrant for cell phone location data and only two likely votes for the United States (and the preservation of the third party doctrine). The other justices didn’t exactly wear their votes on their sleeve, but the smart money favors a whole new ballgame for criminal discovery. The court’s biggest problem will be finding a rationale that doesn’t open up decades of litigation. Justice Gorsuch distinguishes himself with a rationale that is creative, libertarian-conservative, and, well, cockamamie.

Phil West provides the tech angle on the biggest Congressional news—tax reform and what it means for Silicon Valley

Nick Weaver and Jamil Jaffer walk us through the Justice Department’s impressive haul of indictments and guilty pleas in the world of cyberespionage. Yet another NSA exploit hoarder has been caught and pled guilty. And for the first time, Justice has the goods on cyberespionage by Boyusec, a Chinese “security” firm tied to China’s Ministry of State Security. The company has conveniently gone out of business after being outed, but the indictment does raise the question whether the US-China agreement on commercial cyberespionage was really just about which Chinese cyberspies would be allowed to steal U.S. commercial secrets.

There’s yet another flashpoint in China-US cyber relations—drones. A DHS analyst has publicly trashed the dominant drone maker, China’s DJI, as providing the Chinese government with access to data collected by its drones and as targeting sensitive US infrastructure for its sales. The DJI response is not exactly nuanced: A DJI spokesman called the report “insane.”

Meanwhile, Uber's problems seem neverending. The latest disaster focuses on the company’s use of quick-to-vanish messaging services like Wickr and Telegram. Such services are popular among “Technorati” who like to fancy themselves as targets of government surveillance. Problem is, when they are under surveillance, or just a discovery obligation, the use of evanescent messaging is often seen as a sign of guilt. This messaging movement could turn out to be extremely costly—first for Uber and then for Silicon Valley in general. I'm not sure that putting employees on the honor system not to use those services for company business is going to be enough.

Apple was in the news for giving up root access to anyone who insisted. And its attempt to rush out a patch wins the Equifax Prize for Breach Fixes That Create New Security Problems. Perhaps the security team was off providing support to Tim Cook for his keynote speech at the celebration of the Chinese internet (“We are proud to have worked alongside many of our partners in China to help build a community that will join a common future in cyberspace.”) Nick Weaver suggests as a result that we take a closer look at Facetime intercept capability.

Finally, it’s down to the wire on Section 702. Jamil Jaffer, Susan Hennessey and our other commentators think we may escape without too much damage to the intelligence program.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 195th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunesPocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Direct download: TheCyberlawPodcast-195.mp3
Category:general -- posted at: 11:09am EST

Our interview this week is with Rob Reid, author of “After On” and “Year Zero,” two books that manage to translate serious technology nightmares into science fiction romps. We cover a lot of ground: synbio and giving eighth graders the tools for mass human extinction, the possibility that artificial intelligence (AI) will achieve takeoff and begin to act counter to humanity’s interests in a matter of hours. Along the way, we consider the possibility that the first AI will arise from a social media behemoth and will devote its exponential power to maximizing human hookups.

In the news, we explore the massive public relations disaster that is the Uber data breach and reach the surprising conclusion that the whole thing may turn out worse in the media than in the courts. Except in the EU, Maury Shenk reminds me. Europe just hates Uber viscerally. So much so that Jim Lewis suggests the company’s EU subsidiary will soon have to be renamed Unter.

Actually, it’s not just Uber that the EU hates. It’s all things technological, at least to judge by the European Parliament’s latest plan to use export controls to cripple technology companies whose products can be misused by authoritarian governments.

I note the release of the ODNI’s report on the intelligence community’s "masking" of U.S. identities in intel reports. We talk about the temptation to weaponized unmasking during transitions, and I ask why the “Gates procedures” that provide special protection for unmasking of Congressional identities shouldn’t also be used to protect Presidential transition teams.

Jim and I discuss Russia’s imposition of constraints on Radio Free Europe that match the new restrictions on RT in the United States. Jim and I struggle toward a Universal Theory of Putin as Overrated Global Troll.

Remember those Chinese "security" cameras deployed by US agencies that we covered in the last episode? Yeah, it's worse than you thought: the Chinese are getting close to identifying everyone caught on camera using gait and facial recognition.

I note that Sen. Ron Wyden (D-OR) has another campaign underway to imply that the Justice Department is imposing decryption assistance requirements under FISA without judicial review. In fact, if there is such an effort, the company on the receiving end already has a judicial remedy. And Maury explains that the head of Germany's new cybersecurity agency is joining the German government chorus arguing for "hack back," but only by the German government.

My candidate for “Dumbest Public Policy Battle of the Season”: The complaint that someone faked a bunch of meaningless, content-free comments on net neutrality. The problem is really the idea that the policy debate should be influenced by counting votes in the World’s Skeeviest Online Poll, an idea that seems to have sparked a kind of bot arms race between supporters and opponents of the FCC’s policy.

And my candidate for Coolest Technology Story of the Season: Feeding graphene to spiders and discovering that it greatly strengthens their webs. Every fifteen-year-old science fair participant should take heart: It turns out that with great quantities of graphene comes great responsibility.

As always, The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 194th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunesPocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Direct download: TheCyberlawPodcast-194.mp3
Category:general -- posted at: 7:27pm EST