This is my favorite story of the episode. David Kris covers a report from the Privacy and Civil Liberties Oversight Board on the enormous value that European governments get in fighting terrorism from the same American surveillance programs that European institutions have been fighting for twenty years to shut down.  It’s a delightful takedown of European virtue-signaling, and I hope the Biden Administration gives the PCLOB a new name and mission in honor of the report.

But we begin the news roundup with a review of the U.S.-China tech relationship and how it might change under a Biden administration. The Justice Department has issued itself a glowing report card for its contribution to decoupling—the opening of new China-related counterintelligence case every 10 hours. I wonder how long this can go on before China starts arresting American businessmen—and kicks off another round of decoupling.

Speaking of decoupling, the latest legislation aimed at prison labor in China may be getting uncomfortably close to hitting Apple, which is quietly lobbying to water down a bill that most of us expect to pass soon by overwhelming majorities. Megan Stifel and I conclude that the provision that probably scares Apple most is an obligation to make representations about whether the company’s products include parts made with prison labor. That is increasingly difficult to figure out as China has limited audits for such purposes, putting Apple in an increasingly tight spot. Sympathy for Tim Cook is in short supply.

Speaking of legacy burnishing, the Trump White House has issued its own set of guidelines for federal agencies using artificial intelligence (AI). Nick Weaver thinks it’s actually not bad—light touch on most topics—which may be the nicest thing he’s said about a product of this White House in four years. Sticking with AI, Nick comments on the prospect for putting humans in the loop of AI decision making.  He thinks that’s a recipe for lousy AI, and that campaigns to get a “Human in the Loop” for lethal systems have already lost the technology fight. At best, we can hope to have our poky old brains “on the loop” in future AI conflicts.

More good news: There is an IOT security bill that Megan and I both like (Megan more than I) and that Congress has passed and sent to the President for signature. It only sets standards for IOT that the federal government buys, but that’s a good first step.

As a former NSAer, I explain “GCHQ envy” to David, and he provides the latest reason why it must be rampant at the Fort this year, as the agency introduces a new offensive cyber unit to take on organized crime and hostile states.

David also takes on the question whether there’s a legal problem with the U.S. military buying location data from apps companies.  Short answer: Nope.

Megan explains a now-patched Facebook Messenger bug that would have allowed hackers to listen in on users. Nick tells us why the FBI needed to hire robots to retrieve sensitive files. Megan gives us some staggering statistics about the prevalence of ransomware. Hint: if you thought COVID-19 was a pandemic, you ain’t seen nothin’ yet. I give a quick summary of the TikTok and WeChat ban litigation, where the government is unlimbering a host of new technical arguments.

I give a shoutout to Sean Joyce, whose principles led him to walk away from what is probably going to be serious money when Airbnb goes public. The company’s leadership let him argue against giving data about individual users to the Chinese government before the users actually move in.  But the debate ended when one of the execs opined, “We’re not here to promote American values.” That may not be a good look for Airbnb, but it is for Joyce, who left the company within weeks over the principle.

And, finally, it turns out that the FCC is in its last weeks of Trump legacy burnishing; facing a deadline in January 2020, it had to choose between starting to write regulations about the scope of section 230 and dealing with foreign products in the 5G infrastructure.  It chose 5G.

And more.

Download the 339^th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Another week, another Trump administration initiative to hasten the decoupling from China. As with MIRV warheads, the theory seems to be that the next administration can’t shoot them all down.  Brian Egan lays out this week’s initiative, which lifts from obscurity a DoD list of Chinese military companies and excludes them from U.S. capital markets.

Our interview is with Frank Cilluffo and Mark Montgomery. Mark is a senior fellow at the Foundation for Defense of Democracies and senior advisor to the congressionally mandated Cyberspace Solarium Commission. Previously, he served as policy director for the Senate Armed Services Committee under Sen. John S. McCain—and before that served for 32 years in the U.S. Navy as a nuclear trained surface warfare officer, retiring as a rear admiral in 2017. Frank is director of Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security. He also chaired the Homeland Security Advisory Council’s subcommittee on economic security. We talk about the unexpected rise of the industrial supply chain as a national security issue. Both Frank and Mark were moving forces in two separate reports highlighting the issue, as was I. So, if we seem suspiciously agreed on important issues, it’s because we are. Still, as an introduction to one of the surprise hot issues of the year, it’s not to be missed.

After our interview of a Justice Department official on how to read Schrems II narrowly, it was only a matter of time. Charles Helleputte reviews the EDPB’s effort to give more authoritative and less comfortable advice to U.S. companies that want to keep relying on the standard contractual clauses. Still, the Justice Department take on the topic manages to squeak through without a direct hit from the privacy bureaucrats.  Still, the EDPB (and the EDPS even more) makes clear that anyone following the DOJ’s lead is in for an uphill fight. For those who want more of Charles’s thinking on the topic, see this short piece.

Zoom has been allowed to settle a Federal Trade Commission (FTC) proceeding for deceptive conduct (claiming that its crypto was end to end when it wasn’t, and more). Mark MacCarthy gives us details. I rant about the FTC’s failure to ask any serious national security questions about a company that deserves some.

Brian brings us up to speed on TikTok.  Only one of the Trump administration penalties remains unenjoined. My $50 bet with Nick Weaver that CFIUS will overcome judicial skepticism that IEEPA could not is hanging by a thread. Casey Stengel makes a brief appearance to explain how TikTok might win.

Brian also reminds us that export control policymaking is even slower and less functional on the other side of the Atlantic, as Europe tries, mostly ineffectively, to adopt stricter limits on exports of surveillance tech.

Mark and I admire the new Aussie critical-infrastructure cybersecurity initiative, mostly for its clarity if not for its political appeal.

Charles explains and I decry the enthusiasm of European courts for telling Americans what they can say and read on line. Apparently, we aren’t allowed to use Facebook to call politicians “fascists”; but don’t worry about our liability.

So, in retrospect, how did we do in policing all the new cyber-ish threats to the 2020 election?  Brian gives the government credit for preventing foreign interference. I question the whole narrative of foreign interference (other than the hack and dump operation against the DNC) in 2016 and 2020, noting how conveniently it serves Democratic messaging (Hillary only lost because of the Russians! Ignore Trump’s corruption allegations because it’s more Russian interference!). Mark and I wonder what Silicon Valley thinks it’s accomplishing with its extended bans on political advertising after the election.  They’re going to find out it’s almost always election season somewhere (see, e.g., Georgia). DHS’s CISA produced a detailed rumor control site that may have corrected one too many of the President’s tweets.  Chris Krebs, familiar to Cyberlaw Podcast listeners, may be on the chopping block. That would be a shame for DHS and CISA; for Chris it’s probably a badge of honor. Frank Cilluffo and Mark Montgomery weigh in with praise for Chris as well.

And more.

Download the 338th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

This episode’s interview with Dr. Peter Pry of the EMP Commission raises an awkward question: Is it possible that North Korea has already developed nuclear weapons that could cause the deaths of hundreds of millions of Americans by permanently frying the entire electrical infrastructure with a single high-altitude blast?  And if he doesn’t, could the sun accomplish pretty much the same thing?  The common factor in both scenarios is EMP—electro-magnetic pulse. And we explore the problem in detail, from the capabilities of adversaries to the controversy that has pitted Dr. Pry and the EMP Commission against the power industry and the Energy Department, which are decidedly more confident that the U.S. would withstand a major EMP event. And, for those disinclined to trust those sources, Dr. Pry offers a few tips on how to make it more likely that your systems will survive an EMP.

In the news, that the election turned out not to be hacked and not to be violence-plagued and not to be the subject of serious disinformation. That didn’t stop Twitter and YouTube from limiting Steve Bannon’s access to the platform when he used hyperbole (“heads on pikes”) to express his unhappiness with Dr. Fauci.

In legal tech news, Michael Weiner explains what’s at stake in the Justice Department’s antitrust lawsuit challenging Visa’s $5.3 billion acquisition of Plaid. I wonder if that means the department is out of antitrust-litigating ammo.  And it might, except you can buy a lot of ammo with $1 billion worth of Silk Road bitcoins, now being claimed by the U.S. Sultan Meghji says the real question is why it took the U.S. so long to lay claim to the coins.

Just when private companies have come up with plans to comply with California’s privacy law, the voters change everything. Well, maybe not everything. It looks, Dan Podair suggests, as though compliance with the new CPRA will mostly involve complying with the old CCPA plus a whole bunch more. I’m fascinated by the idea that the initiatives say, “Oh, and by the way, this law can’t be amended except to make it more privacy friendly.”

We bring Michael back to the conversation to brief us on the FTC’s plan to bring an antitrust case against Facebook using internal hearing procedure. Michael admits that some might call that a kangaroo court hearing; I suggest that LabMD’s Mike Dougherty be called as an expert witness.

Sultan and I note the ongoing failure of media and rights groups to toxify facial recognition; now it’s being used on “mostly peaceful” protestors. And it’s hard to argue with using face recognition when it confirms a picture ID left behind in Lafayette Square.

Next, Sultan and I take on Toxification II, the argument to make people believe that racist—as opposed to poorly trained—artificial intelligence is a thing.

Charles Helleputte analyzes the latest rumor that the EU is planning to prohibit end-to-end crypto. He notes that the EU is also pursuing more infrastructure security and wonders whether the two initiatives can be sustained together.

It turns out that other people on Zoom can, in theory and under the right conditions, guess what you’re typing.  It’s one more reason to be careful about webcams and security. I make the sort of cheap joke you’ve come to expect from me.

And more.

Download the 337th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Our interview this week is a deep dive into the mess created by the EU Court of Justice in Schrems II—and some pretty good ideas for how companies might avoid the mess as proposed in a U.S. Government white paper. I interview Brad Wiegmann, Senior Counselor for the National Security Division at the U.S. Department of Justice. We cover a host of arguments and new facts that may help companies navigate the wreckage of Privacy Shield and preserve the standard corporate clauses they’ve relied on for trans-Atlantic data transfers. And, yes, the phrase “hypocritical European imperialism” does cross my lips.

In the news, we can’t let election eve pass without a look at all the election security threats and countermeasures now being deployed.  I argue that the election security threat is the second coming of Y2K – a threat that is almost certainly an overhyped bogeyman, but one we can’t afford to ignore.  Jamil Jaffer and Pete Jeydel push back. Silicon Valley’s effort to ensure that no one questions the legitimacy of a Biden victory also comes in for some criticism on my end—and is defended by Nate Jones. My candidate for flakiest Silicon Valley technonostrum is banning post-election political ads. That just guarantees that speech about the election will default to the biggest “organic” voices on the internet and to the speech police at each platform.

Confused about all the TikTok and WeChat litigation? The cheat sheet guide is that the U.S. hasn’t won a single case, and it’s gone down hard in three separate opinions, the latest by U.S. District Judge Beetlestone of Philadelphia. This could be Trump Derangement at work, but the fact is that the Chinese platforms have a plausible argument that Congress prohibited IEEPA bans that indirectly regulate distribution of speech. Banning a social platform might seem to fit that exception, but the result is crazy: it implies that TikTok could replay all the Russian election interference memes from 2016, and the government would be helpless to stop it. On appeal, we may see the courts taking a broader view of the equities. Or they may be tempted to say, “Well, Congress screwed this up, let Congress unscrew it.” If Joe Biden wins the election, I can’t imagine an issue he’d most want to keep off his plate.

Nate and I try to sum up what we learned from the social media speech suppression hearing on the Hill. Nate sees no common ground emerging despite wide unhappiness with Silicon Valley’s role in regulating speech. I am more optimistic that a Congress looking to make progress could agree on first steps toward transparency in speech suppression practices on the platforms. The companies themselves seem to have decided that this is table stakes as they strive to avoid worse.

Nate gives us a quick view of the platform speech debate in Europe.  My summary: Silicon Valley is already incentivized by EU law to over-suppress; now they’re asking for immunity when they over-suppress, which means, of course, even less speech.

In quick hits, Pete talks about the ransomware threat to US health care. Nate explains the tensions between law enforcement and intelligence in Canada. And Pete tells us why fertility clinics are the latest national security concern for CFIUS.

And more!

Download the 336^th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.