This is the week when the movement to reform Section 230 of the Communications Decency Act got serious. The Justice Department released a substantive report suggesting multiple reforms. I was positive about many of them (my views here). Meanwhile, Sen. Josh Hawley (R-MO) has proposed a somewhat similar set of changes in his bill, introduced this week. Nate Jones and I dig into the provisions, and both of us expect interest from Democrats as well as Republicans. 

The National Security Agency has launched a pilot program to provide secure domain name system (DNS) resolver services for US defense contractors. If that’s such a good idea, I ask, why doesn’t everybody do it, and Nick Weaver tells us they can. Phil Reitinger’s Global Cyberalliance offers Quad9 for this purpose. 

Gus Hurwitz brings us up to date on a host of European cyberlaw developments, from terror takedowns (Reuters, Tech Crunch) to competition law to the rise of a disturbingly unaccountable and self-confident judiciary. Microsoft’s Brad Smith, meanwhile, wins the prize for best marriage of business self-interest and Zeitgeist in the twenty-first century.

Hackers used LinkedIn’s private messaging feature to send documents containing malicious code which defense contractor employees were tricked into opening. Nick points out just what a boon LinkedIn is for cyberespionage (including his own), and I caution listeners not to display their tattoos on LinkedIn.

Speaking of fools who kind of have it coming, Nick tells the story of the now former eBay executives who have been charged with sustained and imaginatively-over-the-top harassment of the owners of a newsletter that had not been deferential to eBay. (Wired, DOJ)

It’s hard to like the defendants in that case, I argue, but the law they’ve been charged under is remarkably sweeping. Apparently it’s a felony to intentionally use the internet to cause substantial emotional distress. Who knew? Most of us who use Twitter thought that was its main purpose. I also discover that special protections under the law are extended not only to prevent internet threats and harassment of service animals but also horses of any kind. Other livestock are apparently left unprotected. PETA, call your office.

Child abusers cheered when Zoom buckled to criticism of its limits on end-to-end encryption, but Nick insists that the new policy offers safeguards for policing misuse of the platform. (Ars Technica, Zoom)

I take a minute to roast Republicans in Congress who have announced that no FISA reauthorization will be adopted until John Durham’s investigation of FISA abuses is done, which makes sense until you realize that the FISA provisions up for reauthorization have nothing to do with the abuses Durham is investigating. So we’re giving international terrorists a break from scrutiny simply because the President can’t keep the difference straight.

Nate notes that a story previewed in April has now been confirmed: Team Telecom is recommending the blocking of a Hong Kong-US undersea cable over national security concerns.

Gus reminds us that a bitter trade fight between the US and Europe over taxes on Silicon Valley services is coming. (Politico, Ars Technica)

Nick and I mourn the complete meltdown of mobile phone contact tracing. I argue that from here on out, some portion of coronavirus deaths should be classified as mechanogenic (caused by engineering malpractice). Nick proposes instead a naming convention built around the Therac-25. 

And we close with a quick look at the latest data dump from Distributed Denial of Secrets. Nick thinks it’s strikingly contemporaneous but also surprisingly unscandalizing.

Download the 321st Episode (mp3). 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Our interview this week is with Chris Bing, a cybersecurity reporter with Reuters, and John Scott-Railton, Senior Researcher at Citizen Lab and PhD student at UCLA. John coauthored Citizen Lab’s report last week on BellTroX and Indian hackers for hire, and Chris reported for Reuters on the same organization’s activities – and criminal exposure – in the United States. The most remarkable aspect of the story is how thoroughly normalized hacking legal and lobbying opponents seems to have become, at least in parts of the US legal and investigative ecosystem. I suggest that instead of a long extradition battle, the US give the head of BellTroX a ticket to the US and a guaranteed income for the next few years as a witness against his customers. 

In the news roundup, Nick Weaver tells the remarkable story of how Facebook funded an exploit aimed at taking down a particularly vile online abuser of young girls who was nearly invulnerable because he was using TAILS, the secure, thumb drive-based communication system (Vice, Gizmodo). This is a great story because it really doesn’t fit into any of the stilted narratives into which most internet security stories are usually jammed.

Nick also notes Big Tech’s pledge to do more to stop child abuse online. I suggest that only Dr. Evil would be impressed by the amounts of money being invested in the campaign.

Well, another week, another Zoom bomb.  Now the company is taking heat because it terminated several Tiananmen Square commemorative Zoom sessions after China complained (NYT, Zoom). David Kris and I don’t think Zoom had much choice about cutting off the Chinese customers.  Terminating the US account holder who organized a session, however, was a bad move – and one that’s since been corrected by the company. 

Nate Jones and I square off again for Round 545 on content moderation, spurred this time by reports that Sen. Josh Hawley is drafting legislation inspired by the Trump Administration’s Section 230 EO. Meanwhile several Republican senators are pushing the FCC to act on the order. Nate and I find rare bipartisan common ground on the idea that Congress should require social media companies to take down foreign government online messaging – and maybe work with the US government to stop it at the source.

David reports on a fairly (and deservedly) obscure EU cloud independence project. It seems to have been embraced by Microsoft, which I accuse of going full AT&T – embracing government regulation as a competitive differentiator. As if to prove my point, Microsoft announces that it’s getting out of the business of doing facial recognition for the police – until it can persuade Congress to regulate its competitors.  

Why are spies targeting vaccine research? Nate highlights the excellent Risky Biz newsletter analysis of what drives COVID-19 cyberespionage. 

Nick flags the potential significance of ARM wrestling, as the UK chip designer ARM fights its JV partner for control of its Chinese joint venture. Nick also assigns a “moderate” threat label to the latest Universal Plug n Pwn exploit. It’s only moderate because there are so many pwned IOT devices already in a position to DDOS targets of opportunity.

In quick hits, I note that Israel has halted its controversial use of intelligence capabilities to monitor the spread of the coronavirus, but the government reserves the right to revive monitoring if a second wave shows up (JPost, Yahoo). Poor Brewster Kahle is looking like an internet hippie who fell asleep at Woodstock and woke up at Altamont. The Internet Archive is ending its program of offering free, unrestricted copies of e-books, but the publishers who sued over that program may decide to keep suing until they’ve broken his entire “digital library” model, and maybe the Internet Archive as well (NYT, Ars Technica). That would be a shame. Finally, you can have a thousand talents, but honesty may not be one of them. Charles Lieber, the Harvard University professor arrested for lying about his lucrative China contracts, has now been indicted on false statement charges. 

Download the 320th Episode (mp3). 

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Our interview with Ben Buchanan begins with his report on how artificial intelligence may influence national and cybersecurity. Ben’s quick takes: better for defense than offense, and probably even better for propaganda. The best part, in my view, is Ben’s explanation of how to poison the AI that’s trying to hack you—and the scary possibility that China is already poisoning Silicon Valley’s AI.

By popular request, we’ve revisited a story we skipped last week to do a pretty deep dive on the decision (for now) that Capital One can’t claim attorney-client work product privilege in a Mandiant intrusion response report prepared after its breach. Steptoe litigator Charles Michael and I talk about how IR firms and CISOs should respond to the decision, assuming it stands up on appeal.

Maury Shenk notes the latest of about a hundred warnings, this time from Christopher Krebs, the director of DHS’s cybersecurity agency and the head of Britain’s GCHQ, that China’s intelligence service—and every other intelligence service on the planet—seem to be targeting COVID-19 research.

Maury takes us through the week in internet copyright fights. Ideological copyright enforcement meets the world’s dumbest takedown bots as Twitter removes a Trump campaign video tribute to George Floyd due to a copyright claim. The video is still available on Trump’s YouTube channel.

We puzzle over Instagram’s failure to provide a license to users of its embedding API. The announcement could come as an unwelcome surprise to users who believed that embedding images, rather than hosting them directly, provides insulation against copyright claims.

Finally, much as I love Brewster Kahle, I’m afraid that Kahle’s latest move marks his transition from internet hippie to “holy fool”—and maybe a broke one. His Internet Archive, the online library best known for maintaining the Internet Wayback Machine makes scanned copies of books available to the public on terms that resemble a library’s. The setup was arguably legal—and no one was suing—until Kahle decided to let people download more books than his company had paid for. Now he faces an ugly copyright lawsuit.

Speaking of ugly lawsuits, Mark MacCarthy and Paul Rosenzweig comment on the Center for Democracy and Technology’s complaint that Trump violated tech companies’ right to free speech with his executive order on section 230. (Reuters, NYT) I question whether this lawsuit will get far.

This Week in Working the Ref: Facebook and Mark Zuckerberg are facing criticism from users, competitors, civil rights organizations for failing to censor the people those groups hate. (Ars Technica, Politico). Meanwhile, Snap scores points by ending promotion of Trump’s account after concluding his tweets incited violence.

Where is Nate Jones when you need him? He would love this story: A Twitter user sacrificed a Twitter account to show that Trump is treated differently than others by the platform. Of course, the panel notes, that’s pretty much what Twitter says it does.

In quick hits, I serve notice that no one should be surprised if Justice brings an adtech antitrust suit against Google. The Israeli government announces an attack on its infrastructure so late that the press has already identified and attributed its retaliatory cyberattack on Iran’s ports. And somebody pretty good—probably not the Russians, I argue—is targeting industrial firms.

Download the 319th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This episode features an in-depth (and occasionally contentious) interview with Bart Gellman about his new book, Dark Mirror: Edward Snowden and the American Surveillance State, which can be found on his website and on Amazon. I’m tagged in the book as having been sharply critical of Gellman’s Snowden stories, and I live up to the billing in this interview. He responds to my critique in good part. Gellman offers detailed insights into Edward Snowden’s motives and relationships to foreign governments, as well as how journalism – and journalistic lawyering – is done in the Big Leagues.

Our news roundup focuses heavily on the Trump Administration’s executive order on section 230 of the Communications Decency Act (Wall Street Journal – Washington Post). I end up debating all three of my co-panelists – Nate Jones, Nick Weaver, and Evelyn Douek, rejoining us on a particularly good day, given her expertise. We agree to disagree on whether Silicon Valley applies its rules in a fashion that discriminates against conservatives. More interesting is the rough consensus that Silicon Valley’s heavy influence over our speech is worth worrying about and that transparency is one of the better ways to discipline that influence. No one but me is willing to consider the possibility that the executive order represents a good step toward transparency. 

Nate and I find much room to agree, though, on the tragicomedy emerging from the reauthorization of three relatively straightforward FISA provisions. Stay tuned for a House-Senate conference, plus heavy lobbying of the President. 

Nick explains NSA’s outing of Russian military hackers targeting mail relay software (CyberScoop – NSA). 

Nate and I cover the latest in US-China decoupling – the FCC and Justice Department enthusiasm for kicking Chinese telecom firms out of the country and, in a possible new front, heavy scrutiny being given to Chinese-built transformers. 

Evelyn tells us that, as a visa holder, she’s definitely hoping that the courts overturn US rules forcing visa applicants to disclose their social media handles. I predict that her hopes will be dashed.

Finally, Nick explains who needs a “quantum holographic catalyzer” to protect against 5G telecom emissions.  Quick answer: No one.  It’s a fake cure for fake malady. 

Download the 318th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Our interview is with Mara Hvistendahl, an investigative journalist at The Intercept and author of a new book, The Scientist and the Spy: A True Story of China, the FBI, and Industrial Espionage, as well as a deep WIRED article on the least known Chinese AI champion, iFlytek. Mara’s book raises questions about the expense and motivations of the FBI’s pursuit of commercial spying from China. 

In the News Roundup, Gus Hurwitz, Nick Weaver, and I wrestle with whether Apple’s lawsuit against Corellium is really aimed at the FBI. The answer looks to be affirmative since an Apple victory would make it harder for contractors to find hackable flaws in the iPhone.

Germany’s top court ruled that German intelligence can no longer freely spy on foreigners – or share intelligence with other western countries. The court seems to be trying to leave the door open to something that looks like intelligence collection, but the hurdles are many. Which reminds me that I somehow missed the 100th anniversary of the Weimar Republic.

There’s Trouble Right Here in Takedown City. Gus lays out all the screwy and maybe even dangerous takedown decisions that came to light last week. YouTube censored epidemiologist Knut Wittkowski for opposing lockdown. It suspended and then reinstated a popular Android podcast app for the crime of cataloging COVID-19 content. We learned that anyone can engage in a self-help right to be forgotten with a bit of backdating and a plagiarism claim. Classical musicians are taking it on the chin in their battle with aggressive copyright enforcement bots and a sluggish Silicon Valley response.

In that climate, who can blame the Supreme Court for ducking cases asking for a ruling on the scope of Section 230? They’ve dodged one already, and we predict the same outcome in the next one. 

Finally, Gus unpacks the recent report on the DMCA from the Copyright Lobbying Office – er, the Copyright Office.

With relief, we turn to Matthew Heiman for more cyber and less law. It sure looks like Israel launched a disruptive cyberattack on Iranian port facility. It was probably a response to Iranian cybe-rmeddling with Israeli water systems.

Nick covers Bizarro-world cybersecurity: It turns out malware authors now can hire their own black-market security pentesters. 

I ask about open-source security and am met with derisive laughter, which certainly seems fair after flaws were found in dozens of applications. 

I also cover new developments in AI. And the news from AI speech imitation is that Presidents Trump and Obama have fake-endorsed Lyrebird. 

Gus reminds us that most of privacy law is about unintended consequences, like telling Grandma she’s violating GDPR by posting her grandchildren's photos without their parents' consent.

Beerint at last makes its appearance, as it turns out that military and intelligence personnel can be tracked with a beer enthusiast app. 

Finally, in the wake of Joe Rogan’s deal with Spotify, I offer assurances that the Cyberlaw Podcast is not going to sell out for $100 million. 

Download the 317th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Peter Singer continues his excursion into what he calls “useful fiction” – thrillers that explore real-world implications of emerging technologies – with Burn-In: A Novel of the Real Robotic Revolution, to be released May 26, 2020. This interview explores a thoroughly researched (and footnoted!) host of new technologies, many already in production or on the horizon, all packed inside a plot-driven novel. The book is a painless way to understand what these technologies make possible and their impact on actual human beings. And the interview ranges widely over the policy implications, plus a few plot spoilers.

In the News Roundup, David Kris covers the latest Congressional FISA Follies, leading me into a rant on the utter irresponsibility of subjecting national security authorities to regular expiration – and regular ransom demands from the least responsible elements of Congress. Speaking of FISA, it turns out that the December Pensacola shootings were hatched by al-Qaeda’s Yemen franchise. Why are we only learning this in May? Because the evidence comes from an iPhone whose security Apple refused to find a way around. The FBI’s self-help solution worked in the end, but not until the trail had gone cold. 

Decoupling is in overdrive this week. Nick Weaver talks about the move by the Trump Administration to achieve semiconductor self-sufficiency – and the not-coincidental announcements that TSMC will build a chip factory in Arizona and that the Commerce Department has drafted a new export rule aimed at making it much harder for TSMC to build chips for Huawei. In response, China is preparing a list of unreliable US suppliers of technology. I wonder whether putting companies on the list for diversifying their supply chain out of China will have the long-term effect of making companies more reluctant to open new supply relationships with Chinese companies.

David and I note that recent U.S. accusations of Chinese and Iranian cyber intrusions on COVID-19 research may be more than just the usual imprecations. 

And Nick explains why so many US professors are going to jail for undisclosed China ties. The key word is “undisclosed.”

Mark MacCarthy previews France’s (and Germany’s and the EU’s and the UK’s) increasingly tough sanctions for US social media firms that fail to remove "hate speech" and other bad content within 24 hours (or sometimes one hour). More and more, it seems, Section 230 immunity is just a local U.S. ordinance.

Mark and Nick review the latest trial balloon from Europe’s technocrats: How about a Chinese firewall for Europe?  Some apparently respectable policy thinkers working for the European Parliament seem interested in such an idea. 

David and Nick find themselves agreeing with the latest release from DHS’s CISA pouring cold water on online voting. 

In quick hits, David notes the Trump administration’s now routine extension of the "telecom national security" Executive Order, Nick brings us This Week in NSO Bashing, I touch on a ransomware and doxing threat that has tripped up a celebrity law firm, and Nick and I muse on why cell phone contact tracing seems about to jump the shark.

We close with a surprising catfishing story.

Download the 316th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

J.P. Morgan once responded to President Teddy Roosevelt’s charge that he’d violated federal antitrust law by saying, “If we have done anything wrong, send your man to see my man, and we’ll fix it up.” That used to be the gold standard for monopolist arrogance in dealing with government, but Google and Apple have put J.P. Morgan in the shade with their latest instruction to the governments of the world: You can’t use our app to trace COVID-19 infections unless you promise not to use it for quarantine or law enforcement purposes. They are only able to do this because the two companies have more or less 99 percent of the phone OS market. That’s more control than Morgan had of U.S. railways, and their dominance apparently allows them to say, “If you think we’ve done something wrong, don’t bother to send your man; ours is too busy to meet.” Nate Jones and I discuss the question of Silicon Valley overreach in this episode. (In that vein, I apologize unreservedly to John D. Rockefeller, to whom I mistakenly attributed the quote.) The sad result is that a promising technological adjunct to contact tracing has been delayed and muddled by ideological engineers to the point where it isn’t likely to be deployed and used in a timely way.

Another lesson we draw in today’s episode is for authoritarian governments: Worry less about Cyber Command and more about NGOs. Citizen Lab has released a great paper making the case that WeChat monitors its users outside China, not to suppress their speech but to flag documents and images for later suppression inside China. Ironically, Matthew Heiman notes, Western users of WeChat who circulate human rights material are giving China’s censors the ability to hash and block that material as soon as it crosses the Great Firewall.

Meanwhile, Nate points out, Bellingcat has done for Russia’s GRU what Citizen Lab did for China. Perhaps inspired by Germany’s indictment of Dmitry Badin for hacking the Bundestag, Bellingcat doxes him to a fare-thee-well, finding his phone number, car registration, GRU office address and preposterously bad password.

David Kris explains the intersection of export control law and the Law of Unintended Consequences, as the U.S. Commerce Department finds that its efforts to isolate Huawei may be excluding U.S. firms from some standards bodies.

Anthony Anscombe joins us from Steptoe’s class action practice to unpack the recent Seventh Circuit decision on Article III standing and Illinois’s Biometric Information Privacy Act.

Israel’s passive-aggressive Supreme Court, meanwhile, has found a second way to say, “Meh,” to the Israeli government’s use of intelligence tools to do contact tracing.

Matthew lays out what’s at stake as the Senate tries again to pass its FISA bill. That may happen as early as today.

In short hits, everybody’s government hackers are adding COVID-19 to their targets, going after everyone from the WHO to coronavirus researchers. I make an effort to explain why Apple has brought a DMCA copyright lawsuit against Corellium. It’s all about the “chilling effect” on security research. And maybe one particular Five Eyes researcher. I make the case for Justice Department intervention on Corellium’s behalf—or at least Azimuth’s. Banjo’s CEO steps down. And where is Jean-Paul Sartre when you need him? He’s the only one who can resolve the odd dispute over “authenticity” between Twitter and the U.S. State Department.

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families or pets.

We begin with a new US measure to secure its supply chain for a critical infrastructure – the bulk power grid. David Kris unpacks a new Executive Order restricting purchases of foreign equipment for the grid.

Nick Weaver, meanwhile, explains the remarkable extent of surveillance built into Xiaomi phones and questions the company’s claim that it was merely acquiring pseudonymous ad-related data like others in the industry.

It wouldn’t be the Cyberlaw Podcast if we didn’t wrangle over mobile phones and the coronavirus. Mark MacCarthy says that several countries – Australia, the UK, and perhaps France – are deviating from the Gapple model for using phones for infection tracing. Several have bought in. India, meanwhile, is planning a much more government-driven approach to using phone apps to combat the pandemic.

Mark ventures into even more contested territory in response to an article in The Atlantic by Jack Goldsmith and Andrew Woods, who argue that China has won the debate with John Perry Barlow over whether the Internet will be a force for free speech. Mark and I more or less agree, which sends me off on a rant about the growing self-confidence and ham-handedness of Big Tech as they get comfortable in their role as Guardians of What You Can’t Say on the Internet. Things you can’t say include plausible arguments about the still highly unsettled question of how best to deal with COVID-19 and descriptions of treatment options that have been entertained by President Trump without establishment approval, not to mention “unverified” statements (not, notably, false ones) that could cause social unrest. Just reading such things, it turns out, will lead at least Facebook to track you down and tell you that it noticed and wants to correct your flirtation with thoughtcrime – a practice that earned it praise from Rep. Adam Schiff.

Nick and I note the difficulty Facebook is having getting out of FOSTA cases in Texas, and I ask why FOSTA hasn’t already spelled doom for end-to-end encryption since it basically does what the EARN IT Act does, and all right-thinking Americans have been told that EARN IT is The End of End-to-End Encryption.

David explains why Amazon is facing tough new scrutiny from both parties: A Wall Street Journal article that questioned the accuracy of Amazon testimony before Congress has turned into claims of perjury, a demand that Jeff Bezos testify, and suggestions that the administration open a criminal antitrust probe.

“You can’t decouple from me! I’m decoupling from you!” That’s the sentiment from China anyway as they push forward with their own remarkably familiar supply chain security regulations. David explains that while the rules are similar to those in the United States, they’re tougher and more likely to be implemented in a slow, inexorable way.

Download the 314th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

In today’s interview, I spar with Harriet Moynihan over the application of international law to cyberattacks, a topic on which she has written with clarity and in detail. We disagree politely but profoundly. I make the case that international law is distinct from what works in cyberspace and is inconsistent with either clarity or effectiveness in deterring cyberattacks. Harriet argues that international law has been a central principle of the post-1945 international system and one that has helped to keep a kind of peace among nations. It’s a good exchange.

In the News Roundup, David Kris and I discuss the state of Team Telecom, which is taking unwonted (but probably welcome) fire for not being tough enough on state-owned Chinese telecom firms. Predictably, Team Telecom is going with the flow and reportedly seeking to knock four such firms out of the US market.

Maury Shenk reports that Vietnam is suspected of hacking Chinese health authorities. In response to the accusations, the Vietnamese released what looks to me like a word-for-word clone of Chinese cyber espionage boilerplate denials.

Gapple’s design for a COVID-19 tracing app isn’t the best way to track infections, I claim, but it’s all that Google and Apple are willing to let governments do because of their exquisitely refined and self-evidently superior sense of privacy. Nick Weaver disagrees, arguing that the Gapple system preserves privacy and allows health authorities all the information that they really need. Governments are mostly falling in line, either because they buy Nick’s argument or because they have decided that their Silicon Valley overlords have the ability to wreck any more centralized system. France is still fighting for its vision of contact tracing. But Australia seems to be adopting a lightly tweaked version of the Gapple model to add some centralization. And Germany seems to be surrendering as well.

Several senators want Cyber Command and the Cybersecurity and Infrastructure Security Agency (CISA) to do more to deter coronavirus hackers, David reports. More importantly, he points out that sending a military organization to attack a civilian criminal gang will raise a host of legal issues that should be sorted out before rather than after the attack begins.

Failure to protect your client from Chinese government hackers might be malpractice, a DC court rules. But as Maury points out, there’s a long road from winning a motion to dismiss and winning at trial, so the lesson to be drawn from this case won’t be certain for some time.

Three years later, the Shadow Brokers leak is making news, and still providing challenges for private security researchers. Nick reports on how a three-year-old leak led to the latest revelation of an unknown advanced persistent threat (APT) group.

Nick and I touch on the confused reporting about the latest filing in the mud fight between Facebook and NSO Group over NSO’s hacks of WhatsApp customers. NSO, Facebook says, has used a lot of US servers in those attacks. That matters for the technical question of whether NSO can be sued in the United States, but the volume (several hundred instances) also suggests to Nick that NSO did more than throw exploits over the wall to its customers – it was arguably offering espionage as a service.

David dings IBM for its handling of a researcher’s disclosure of four zero-days – and that leads to a dive into what a good bug bounty program can and can’t do.

Maury notes that Amazon is getting new scrutiny for its handling of third-party sales data, including suspicions on Congress’s part that it may have been lied to. This isn’t the last we’ll hear of this story.

In quick hits, I am nonplussed by Vimeo’s willingness to outsource its definition of “hate group” to the controversial Southern Poverty Law Center.

Nick celebrates the end to Crown Sterling’s “defamation” lawsuit against BlackHat, which has finally been settled.

And Nick and I mark the surprising ouster of Marc Rotenberg, EPIC’s long-time director, after Rotenberg continued to go to work and failed to notify staffers after he was diagnosed with COVID-19.

Download the 313th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

In this episode, I interview Thomas Rid about his illuminating study of Russian disinformation, Active Measures: The Secret History of Disinformation and Political Warfare. It lays out a century of Soviet, East European, and Russian disinformation, beginning with an elaborate and successful operation against the White Russian expatriate resistance to Bolshevik rule in the 1920s. Rid has dug into recently declassified material using digital tools that enable him to tell previously untold tales – the Soviets’ remarkable success in turning opposition to US nuclear missiles in Europe into a mass movement (and the potential shadow it casts on the legendary Adm. Hyman Rickover, father of the US nuclear navy), the unimpressive record of US disinformation compared to the ruthless Soviet version, and the fake American lobbyist (and real German agent) who persuaded a German conservative legislator to save Willy Brandt’s leftist government. We close with two very different predictions about the kind of disinformation we’ll see in the 2020 campaign.

In the news, David Kris, Nick Weaver, and I trade perspectives on the Supreme Court’s grant of certiorari on the question when it’s a crime to access a computer “in excess of authority.” I predict that the Justice Department’s reading of the Computer Fraud and Abuse Act will lose, but it’s far from clear what will replace the Justice Department’s interpretation.

Remember when the House left town without acting on FISA renewal? That’s looking like a worse and worse decision, as Congress goes weeks without returning and Justice is left unable to use utterly uncontroversial capabilities in more and more cases. Matthew Heiman explains.

In Justice Department briefs, all the most damaging admissions are down in the footnotes, and it looks like that’s true for the inspector general’s report on the Carter Page FISA. Recently declassified footnotes from the report make the FBI’s pursuit of the FISA order look even worse, in my view. But at the end of the day, the footnotes don’t add much to suspicions of a partisan motivation in the imbroglio.

Speaking of IG reports, the DOD inspector general manages to raise the possibility of political skullduggery in the big DOD cloud computing award and then to offer a way to stick it to Amazon anyway. Meanwhile, the judge overseeing the bid protest gives the Pentagon a chance for a do-over. 

Matthew covers intel warnings about China-linked ‘Electric Panda’ hackers and that the Syrian government is spreading surveillance malware via coronavirus apps. And David notes that a Zoom zero-day is being offered for $500,000.Nick and I mix it up, first over the Gapple infection tracing plan and their fight with the UK National Health Service and then over Facebook’s decision to suppress posts about demonstrations that protest the lockdown by violating the lockdown.

Download the 312th Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.