In this episode, I interview Elsa Kania, author of a Center for a New American Security report on China’s plan for military uses of artificial intelligence—a plan that seems to have been accelerated by the asymmetric impact of AlphaGo on the other side of the Pacific.

In the news, Brian Egan notes that China’s perspective on “sovereignty in cyberspace” was further elaborated at China’s World Internet Conference, and I point out that China continues its “two steps forward, one step back” process of bringing U.S. companies to heel on security issues.

Nick Weaver explains that the U.S. financial institutions’ “project doomsday” could just as easily be cast as “fire hydrant standardization.” It could be, but it won’t, at least not by headline writers.

Nick also calls out Apple for failing to follow U.S. law in responding to pen/trap and wiretap orders.

I take a victory lap, as the director of national intelligence promises to apply the Gates procedures to unmasking of transition officials. As recommended by me (well, and the House intelligence committee). No need to call them the Baker procedures, though, guys.

Bleeping Computer says Germany is planting backdoors into modern devices. Maybe so, I offer, but whether that includes encryption is not at all clear. 

Finally, Nick digs into the remarkable work that Citizen Lab and Bill Marczak continue to do on authoritarian government hacking. He says, with evidence, that efforts to control sales to untrustworthy governments are actually working.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Subscribe to The Cyberlaw Podcast here.  We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Episode 195 features an interview with Susan Hennessey of Lawfare and Andrew McCarthy of the National Review. They walk us through the “unmasking” of US identities in intelligence reports—one of the most divisive partisan issues likely to come up in the re-enactment of Section 702 of FISA. I bask momentarily in the glow of being cast as a civil liberties extremist. And Thidwick the Big-Hearted Moose offers insights into 702 reform.

In the news roundup, I try to count votes after the Supreme Court argument in Carpenter v. United States. I count at least four likely votes to require a warrant for cell phone location data and only two likely votes for the United States (and the preservation of the third party doctrine). The other justices didn’t exactly wear their votes on their sleeve, but the smart money favors a whole new ballgame for criminal discovery. The court’s biggest problem will be finding a rationale that doesn’t open up decades of litigation. Justice Gorsuch distinguishes himself with a rationale that is creative, libertarian-conservative, and, well, cockamamie.

Phil West provides the tech angle on the biggest Congressional news—tax reform and what it means for Silicon Valley

Nick Weaver and Jamil Jaffer walk us through the Justice Department’s impressive haul of indictments and guilty pleas in the world of cyberespionage. Yet another NSA exploit hoarder has been caught and pled guilty. And for the first time, Justice has the goods on cyberespionage by Boyusec, a Chinese “security” firm tied to China’s Ministry of State Security. The company has conveniently gone out of business after being outed, but the indictment does raise the question whether the US-China agreement on commercial cyberespionage was really just about which Chinese cyberspies would be allowed to steal U.S. commercial secrets.

There’s yet another flashpoint in China-US cyber relations—drones. A DHS analyst has publicly trashed the dominant drone maker, China’s DJI, as providing the Chinese government with access to data collected by its drones and as targeting sensitive US infrastructure for its sales. The DJI response is not exactly nuanced: A DJI spokesman called the report “insane.”

Meanwhile, Uber's problems seem neverending. The latest disaster focuses on the company’s use of quick-to-vanish messaging services like Wickr and Telegram. Such services are popular among “Technorati” who like to fancy themselves as targets of government surveillance. Problem is, when they are under surveillance, or just a discovery obligation, the use of evanescent messaging is often seen as a sign of guilt. This messaging movement could turn out to be extremely costly—first for Uber and then for Silicon Valley in general. I'm not sure that putting employees on the honor system not to use those services for company business is going to be enough.

Apple was in the news for giving up root access to anyone who insisted. And its attempt to rush out a patch wins the Equifax Prize for Breach Fixes That Create New Security Problems. Perhaps the security team was off providing support to Tim Cook for his keynote speech at the celebration of the Chinese internet (“We are proud to have worked alongside many of our partners in China to help build a community that will join a common future in cyberspace.”) Nick Weaver suggests as a result that we take a closer look at Facetime intercept capability.

Finally, it’s down to the wire on Section 702. Jamil Jaffer, Susan Hennessey and our other commentators think we may escape without too much damage to the intelligence program.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 195th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Our interview this week is with Rob Reid, author of “After On” and “Year Zero,” two books that manage to translate serious technology nightmares into science fiction romps. We cover a lot of ground: synbio and giving eighth graders the tools for mass human extinction, the possibility that artificial intelligence (AI) will achieve takeoff and begin to act counter to humanity’s interests in a matter of hours. Along the way, we consider the possibility that the first AI will arise from a social media behemoth and will devote its exponential power to maximizing human hookups.

In the news, we explore the massive public relations disaster that is the Uber data breach and reach the surprising conclusion that the whole thing may turn out worse in the media than in the courts. Except in the EU, Maury Shenk reminds me. Europe just hates Uber viscerally. So much so that Jim Lewis suggests the company’s EU subsidiary will soon have to be renamed Unter.

Actually, it’s not just Uber that the EU hates. It’s all things technological, at least to judge by the European Parliament’s latest plan to use export controls to cripple technology companies whose products can be misused by authoritarian governments.

I note the release of the ODNI’s report on the intelligence community’s "masking" of U.S. identities in intel reports. We talk about the temptation to weaponized unmasking during transitions, and I ask why the “Gates procedures” that provide special protection for unmasking of Congressional identities shouldn’t also be used to protect Presidential transition teams.

Jim and I discuss Russia’s imposition of constraints on Radio Free Europe that match the new restrictions on RT in the United States. Jim and I struggle toward a Universal Theory of Putin as Overrated Global Troll.

Remember those Chinese "security" cameras deployed by US agencies that we covered in the last episode? Yeah, it's worse than you thought: the Chinese are getting close to identifying everyone caught on camera using gait and facial recognition.

I note that Sen. Ron Wyden (D-OR) has another campaign underway to imply that the Justice Department is imposing decryption assistance requirements under FISA without judicial review. In fact, if there is such an effort, the company on the receiving end already has a judicial remedy. And Maury explains that the head of Germany's new cybersecurity agency is joining the German government chorus arguing for "hack back," but only by the German government.

My candidate for “Dumbest Public Policy Battle of the Season”: The complaint that someone faked a bunch of meaningless, content-free comments on net neutrality. The problem is really the idea that the policy debate should be influenced by counting votes in the World’s Skeeviest Online Poll, an idea that seems to have sparked a kind of bot arms race between supporters and opponents of the FCC’s policy.

And my candidate for Coolest Technology Story of the Season: Feeding graphene to spiders and discovering that it greatly strengthens their webs. Every fifteen-year-old science fair participant should take heart: It turns out that with great quantities of graphene comes great responsibility.

As always, The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 194th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

We celebrate the holiday season by interviewing David Ignatius, Columnist and Associate Editor at The Washington Post and the author of multiple spy thrillers, including his most recent, "The Quantum Spy." David and I discuss themes from the book, from quantum computing to ethnic and gender tensions at the Agency, while managing to avoid spoilers. It’s a fun and insightful work.

Steptoe partner Stewart Baker with David Ignatius.

In the news, I flag Twitter’s weird journey from the free speech wing of the free speech party to the censorship wing of the Censor’s Party. Twitter is now revoking the verification checks for people whose speech it disapproves of. It’s even de-checking people based on its assessment of their off-line conduct. So maybe that should be the Stasi wing of the Censor’s Party. And, not surprisingly, given Silicon Valley’s steep leftward-tilt, the censorship seems to fall far more harshly on the right than on less PC targets.

Markham Erickson and I treat Twitter’s wobbly stance as a symptom of the breakdown of the Magaziner Consensus, as both left and right for their own reasons come to view Big Tech with suspicion. Markham has shrewd observations about what it all means for the (questionable) future of social media’s section 230 immunity.

We dive into a surprising new analysis of China’s “50c Army.” Turns out that the Chinese government strategy for flooding the internet is 180 degrees off from Russia’s. Instead of a Trollfest, Chinese government-funded social media is saccharine sweet. Cheerleading and changing the subject are what its army does best.

Markham, Brian Egan, and I give broadly positive reviews to the US government’s recently announced Vulnerability Equities Process. And, in a correction to those who’ve said that other countries don’t have such a process, I point to evidence that China has one–in which all the equities seem to point to exploit, exploit, exploit.

All of which ought to turn the story of US agencies using Chinese “security” cameras from disquieting to positively frightening. Speaking of which, the Chinese company that made your drone has provided a case study on how not to do a bug bounty program. Read it and weep.

On a lighter note, we talk backflipping robots and a surprising peril of traveling with your family this holiday season–thumbprint phone security failure followed by titanic spousal air rage. Where is Tim Cook’s privacy schtick when we really need it?

Download the 193rd Episode (mp3).

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

With the Texas church shooting having put encryption back on the front burner, I claim that Apple is becoming the FBI's crazy ex-girlfriend in Silicon Valley—and offer the tapes to prove it. When Nick Weaver rises to Apple's defense, I point out that Apple responded to a Chinese government man-in-the-middle attack on iCloud users with spineless obfuscation rather than a brave defense of user privacy. Nick asks for a citation. Here it is: https://support.apple.com/en-us/HT203126 (Careful:  don't click without a chiropractor standing by.)

Nick provides actual news to supplement the New York Times' largely news-free front page storyabout leak and mole fears at NSA.

I gloat, briefly, over hackback's new respectability, as the Active Cyber Defense Certainty Act acquires new cosponsors, including Trey Gowdy, and hacking back acquires new respectability. But not everywhere.

Michael Sulmeyer finally gets a word in edgewise as the conversation shifts to the National Defense Authorization Act. He discusses the Modernizing Government Technology Act, the growing Armed Services Committee oversight of cyberoperations, and the decision to lift—and perhaps separate—Cyber Command from National Security Agency. I take issue with any decision that requires that a three-star NSA director to argue intelligence equities with a four-star combatant commander

We end with Michael Sulmeyer and I walking through the challenges for the Pentagon in deterring cyberattacks. We both end up expressing skepticism about the current path. 

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 192nd Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Episode 191 is our long-awaited election security podcast before a live, and lively, audience. Our panel consists of Chris Krebs, formerly of Microsoft and now the top cybersecurity official at DHS (with the longest title in the federal government as proof), and Ed Felten, formerly the deputy chief technology officer of the federal government and currently Princeton professor focused on cybersecurity and policy. We walk through the many stages of election machinery and the many ways that digitizing those stages has introduced new insecurities into our election results.

When all is said and done, however, the entire panel ends up more or less in one place: Election security is not to be taken for granted; it will be hard to achieve, but it’s not impossible, or even unaffordable. With sufficient will and focus, and perhaps a touch of Ned Ludd, we may be able to overcome the risk of foreign hackers interfering in our elections. At least outside of New Jersey.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 191st Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

In our 190th episode, Stewart Baker has a chance to interview Sen. Sheldon Whitehouse (D-RI), who has a long history of engagement with technology and security issues. In this episode, we spend a remarkably detailed half-hour with him, covering the cybersecurity waterfront, from the FBI’s problems accessing the Texas church shooter’s phone, and what Silicon Valley should do about that, to Vladimir Putin’s electoral adventurism and how to combat it. Along the way, we touch (skeptically) on the NIST Cybersecurity Framework and more enthusiastically on allowing private citizens to leave their networks to track the hackers who’ve attacked them.  Plus: botnet cures, praise for Microsoft, a cybersecurity inspector general (or, maybe, bug bounties), DHS’s role in civilian cybersecurity, and how much bigger Rhode Island really is at low tide!

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 190th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

In our 189th episode Stewart Baker has a chance to interview United States Representative Tom Graves, co-sponsor of the Active Cyber Defense Certainty (ACDC) Act, which allows those whose networks are under persistent attack to leave their network to conduct investigative action.  Representative Graves offers a measured but deeply felt defense of the proposal and is optimistic about its reception.  And, with the hard-hitting investigative approach The Cyberlaw Podcast is known for, I ask the tough question:  “Is this bill a tribute to AC/DC – and if so, which song?”  (Hint in the title of the blog post.)

Mark your calendars for November 7th when we will gather for a live taping of a special episode on Election Cybersecurity at our Dupont Circle offices here in DC. To register please visit the Events page of our website at steptoe.com.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 189th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

In this episode, Brian Egan and I deconstruct the endlessly proliferating “FISA 702 Reform” bills, from the irresponsible House Judiciary bill to the “I’ll see your irresponsible and raise you crazy” bipartisan extremist bill beloved of Sens. Wyden and Paul (and talk about truth in advertising: what else would you call a bill that takes us back to the pre-9/11 status quo but S.1997?). Even the relatively restrained Senate Intelligence bill takes fire for its, ahem, “creative” approach to FBI searches of 702 data. Brian does not share my distaste for all of the options, but agrees that the cornucopia of 702 proposals makes it even more unlikely that anything other than a straight-up short-term reauthorization can be passed before the end of the year.

In other legislative news, CFIUS reform is also in the air, and Sen. Cornyn's carefully scripted rollout has begun. In her podcast debut, Alexis Early unpacks this complex bill. Need a one-word explanation? China. The bill tries to block all of the avenues China is believed to have traveled in its pursuit of US technology over the last decade. We also discuss how the bill would remove the veneer of “voluntariness” from at least part of the CFIUS process, which could impact a range of filers – particularly US technology companies seeking foreign investment.

Meanwhile, if you’re looking for confirmation that privacy is really just another word for protecting privilege, Twitter is apparently eager to provide it. Even as criticism and warnings about Russian misuse of Twitter to divide Americans and “diss” Hillary Clinton were rolling in last summer, the Russians were busily deleting their phony posts, and Twitter was right there to help. The company told even independent researchers who had saved Russian posts that the researchers had to delete any post that Twitter was deleting (which seems to be anything that the Russians deleted). This of course made it hard to criticize Twitter’s policies on foreign government trolling, since the evidence was gone, but the justification that Twitter offered was, naturally, privacy. Maybe the company’s privacy policy should come with a slogan: “Privacy: Good for you. Better for us.”

Of course, Twitter claims that it has to force the deletion of inconvenient tweets because of EU data protection policy. And indeed, European exceptionalism on the privacy front was front and center last week, with the European Parliament’s approval of a draft ePrivacy directive that law enforcement will hate, an unfavorable opinion on how many data protection authorities can regulate Facebook (clue: all of them), and an absolutely undecipherable explanation from the Article 29 working party of European restrictions on automated decision-making (my translation: “If you use AI in your business and we don’t like you, you’re toast.”). Maury Shenk provides a less jaundiced summary of these developments.

We do quick hits on Kaspersky’s defense, which looks more like it was designed to embarrass the US than to exonerate the company, on Microsoft’s eagerness to drop its gag order lawsuit in response to a change in DOJ policy, and on the FBI’s claim that encryption is now defeating half of the phone searches it tries to do. 

Our interview is with Chris Painter, the State Department’s top cyber diplomat under President Obama. He offers candid views about the Tillerson reorganization, which pushes his old office deeper into “deep State” (the State bureaucracy). He also assesses what went right and wrong for cyber diplomacy on his watch, and what the US should be doing going forward. Brian Egan referees as Chris and I have what the State Department might call a “frank and candid exchange of views.”

Mark your calendars for November 7th when we will gather for a live taping of a special episode on Election Cybersecurity at our Dupont Circle offices here in DC. To register please visit the Events page of our website at steptoe.com.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 188th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

I had a chance to talk to Tom Bossert, President Trump’s Homeland Security Adviser, on the record, and we’re releasing the conversation as a bonus episode of the Cyberlaw Podcast. The talk ranges from Peggy Noonan’s observations on White House staff work to the vast improvement in the West Wing’s carpeting before turning to our main topic – the looming deadline for renewing authority for FISA section 702. Tom is deeply familiar with the issues in the debate over 702. He stands by the administration’s position that 702 should be renewed without amendment and without a sunset but he discusses with nuance the many legislative proposals for changing the program as well. Finally, we talk about the executive order that unleashed a flood of internal reports on empowering DHS to protect the US government’s systems, measures to protect critical infrastructure, and the administration’s hunt for a new cyberspace deterrence strategy.

Mark your calendars for November 7th when we will gather for a live taping of a special episode on Election Cybersecurity at our Dupont Circle offices here in DC. To register please visit the Events page of our website at steptoe.com.

As always The Cyberlaw Podcast is open to feedback. Send your questions, suggestions for interview candidates or topics to CyberlawPodcast@steptoe.com or leave a message at +1 202 862 5785.

Download the 187th Episode (mp3).

Subscribe to The Cyberlaw Podcast here. We are also on iTunes, Pocket Casts, and Google Play (available for Android and Google Chrome)!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.