As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Returning from winter break, this episode of the Cyberlaw Podcast covers a lot of ground. The story I think we’ll hear the most about in 2024 is the remarkable exploit used to compromise several generations of Apple iPhone. The question I think we’ll be asking for the next year is simple: How could an attack like this be introduced without Apple’s knowledge and support? We don’t get to this question until near the end of the episode, and I don’t claim great expertise in exploit design, but it’s very hard to see how such an elaborate compromise could be slipped past Apple’s security team. The second question is which government created the exploit. It might be a scandal if it were done by the U.S. But it would be far more of a scandal if done by any other nation. 

Jeffery Atik and I lead off the episode by covering recent AI legal developments that simply underscore the obvious: AI engines can’t get patents as “inventors.” But it’s quite possible that they’ll make a whole lot of technology “obvious” and thus unpatentable.

Paul Stephan joins us to note that National Institute of Standards and Technology (NIST) has come up with some good questions about standards for AI safety. Jeffery notes that U.S. lawmakers have finally woken up to the EU’s misuse of tech regulation to protect the continent’s failing tech sector. Even the continent’s tech sector seems unhappy with the EU’s AI Act, which was rushed to market in order to beat the competition and is therefore flawed and likely to yield unintended and disastrous consequences.  A problem that inspires this week’s Cybertoonz.

Paul covers a lawsuit blaming AI for the wrongful denial of medical insurance claims. As he points out, insurers have been able to wrongfully deny claims for decades without needing AI. Justin Sherman and I dig deep into a NYTimes article claiming to have found a privacy problem in AI. We conclude that AI may have a privacy problem, but extracting a few email addresses from ChatGPT doesn’t prove the case. 

Finally, Jeffery notes an SEC “sweep” examining the industry’s AI use.

Paul explains the competition law issues raised by app stores – and the peculiar outcome of litigation against Apple and Google. Apple skated in a case tried before a judge, but Google lost before a jury and entered into an expensive settlement with other app makers. Yet it’s hard to say that Google’s handling of its app store monopoly is more egregiously anticompetitive than Apple’s.

We do our own research in real time in addressing an FTC complaint against Rite Aid for using facial recognition to identify repeat shoplifters.  The FTC has clearly learned Paul’s dictum, “The best time to kick someone is when they’re down.” And its complaint shows a lack of care consistent with that posture.  I criticize the FTC for claiming without citation that Rite Aid ignored racial bias in its facial recognition software.  Justin and I dig into the bias data; in my view, if FTC documents could be reviewed for unfair and deceptive marketing, this one would lead to sanctions.

The FTC fares a little better in our review of its effort to toughen the internet rules on child privacy, though Paul isn’t on board with the whole package.

We move from government regulation of Silicon Valley to Silicon Valley regulation of government. Apple has decided that it will now require a judicial order to give government’s access to customers’ “push notifications.” And, giving the back of its hand to crime victims, Google decides to make geofence warrants impossible by blinding itself to the necessary location data. Finally, Apple decides to regulate India’s hacking of opposition politicians and runs into a Bharatiya Janata Party (BJP) buzzsaw. 

Paul and Jeffery decode the EU’s decision to open a DSA content moderation investigation into X.  We also dig into the welcome failure of an X effort to block California’s content moderation law.

Justin takes us through the latest developments in Cold War 2.0. China is hacking our ports and utilities with intent to disrupt (as opposed to spy on) them. The U.S. is discovering that derisking our semiconductor supply chain is going to take hard, grinding work.

Justin looks at a recent report presenting actual evidence on the question of TikTok’s standards for boosting content of interest to the Chinese government. 

And in quick takes, 

• I celebrate the end of the Reign of Mickey Mouse in copyright law

• Paul explains why Madison Square Garden is still able to ban lawyers who have sued the Garden

• I note the new short-term FISA 702 extension

• Paul predicts that the Supreme Court will soon decide whether police can require suspects  to provide police with phone passcodes

• And Paul and I quickly debate Daphne Keller’s amicus brief for Frances Fukuyama in the Supreme Court’s content moderation cases

Download 486th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

It’s the last and probably longest Cyberlaw Podcast episode of 2023. To lead off, Megan Stifel takes us through a batch of stories about ways that AI, and especially AI trust and safety, manage to look remarkably fallible. Anthropic released a paper showing that race, gender, and age discrimination by AI models was real but could be dramatically reduced by instructing The Model to “really, really, really” avoid such discrimination. (Buried in the paper was the fact that the original, severe AI bias disfavored older white men, as did the residual bias that asking nicely didn’t eliminate.) Bottom line from Anthropic seems to be, “Our technology is a really cool toy, but don’t use if for anything that matters.”) In keeping with that theme, Google’s highly touted OpenAI competitor Gemini was release to mixed reviews when the model couldn’t correctly identify recent Oscar winners or a French word with six letters (it offered “amour”). The good news was for people who hate AI’s ham-handed political correctness; it turns out you can ask another AI model how to jailbreak your model, a request that can make the task go 25 times faster.

This could be the week that determines the fate of FISA section 702, David Kris reports. It looks as though two bills will go to the House floor, and only one will survive. Judiciary’s bill is a grudging renewal of 702 for a mere three years, full of procedures designed to cripple the program. The intelligence committee’s bill beats the FBI around the head and shoulders but preserves the core of 702. David and I explore the “queen of the hill” procedure that will allow members to vote for either bill, both, or none, and will send to the Senate the version that gets the most votes. 

Gus Hurwitz looks at the FTC’s last-ditch appeal to stop the Microsoft-Activision merger. The best case, he suspects, is that the appeal will be rejected without actually repudiating the pet theories of the FTC’s hipster antitrust lawyers.

Megan and I examine the latest HHS proposal to impose new cybersecurity requirements on hospitals. David, meanwhile, looks for possible motivations behind the FBI’s procedures for companies who want help in delaying SEC cyber incident disclosures. Then Megan and I consider the tough new UK rules for establishing the age of online porn consumers. I think they’ll hurt Pornhub’s litigation campaign against states trying to regulate children’s access to porn sites. 

The race to 5G is over, Gus notes, and it looks like even the winners lost. Faced with the threat of Chinese 5G domination and an industry sure that 5G was the key to the future, many companies and countries devoted massive investments to the technology, but it’s now widely deployed and no one sees much benefit. There is more than one lesson here for industrial policy and the unpredictable way technologies disseminate.

23andme gets some time in the barrel, with Megan and I both dissing its “lawyerly” response to a history of data breaches – namely changing its terms of service it harder for customers to sue for data breaches.

Gus reminds us that the Biden FCC only took office in that last month or two, and it is determined to catch up with the FTC in advancing foolish and doomed regulatory initiatives. This week’s example, remarkably, isn’t net neutrality. It’s worse. The Commission is building a sweeping regulatory structure on an obscure section of the 2021 infrastructure act that calls for the FCC to “facilitate equal access to broadband internet access service...”: Think we’re hyperventilating? Read Commissioner Brendan Carr’s eloquent takedown of the whole initiative. 

Senator Ron Wyden (D-OR) has a been in his bonnet over government access to smartphone notifications. Megan and I do our best to understand his concern and how seriously to take it. 

Wrapping up, Gus offers a quick take on Meta’s broadening attack on the constitutionality of the FTC’s current structure. David takes satisfaction from the Justice Department’s patient and successful pursuit of Russian Hacker Vladimir Dunaev for his role in creating TrickBot. Gus notes that South Korea’s law imposing internet costs on content providers is no match for the law of supply and demand.

Finally, in quick hits we cover: 

• The guilty plea of the founder of a cryptocurrency exchange accused of money laundering.

• Rumors that the ALPHV ransomware site has been taken down by law enforcement

• IBM’s long-term quantum computing research milestones

• The UK’s antitrust throat-clearing about the OpenAI-Microsoft tie-up

• And Europe’s low-on-details announcement of a deal on the world’s first comprehensive AI rules 

Download 485th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

In this episode, Paul Stephan lays out the reasoning behind U.S. District Judge Donald W. Molloy’s decision enjoining Montana’s ban on TikTok. There are some plausible reasons for such an injunction, and the court adopts them. There are also less plausible and redundant grounds for an injunction, and the court adopts those as well. Asked to predict the future course of the litigation, Paul demurs. It will all depend, he thinks, on how the Supreme Court begins to sort out social media and the first amendment in the upcoming term. In the meantime, watch for bouncing rubble in the District of Montana courthouse. (Grudging credit for the graphics goes to Bing’s Image Creator, which refused to create the image until I attributed the bouncing rubble to a gas explosion. Way to discredit trust and safety, Bing!)

Jane Bambauer and Paul also help me make sense of the litigation between Meta and the FTC over children’s privacy and previous consent decrees. A recent judicial decision opened the door for the FTC to pursue modification of a prior FTC order – on the surprising ground that the order had not been incorporated into a judicial order. But that decision simply gave Meta a chance to make an existential constitutional challenge to the FTC’s fundamental organization, a challenge that Paul thinks the Supreme Court is bound to take seriously.

Maury Shenk and Paul analyze an “AI security by design” set of principles drafted by the U.K. and adopted by an ad hoc group of nations that pointedly split the EU’s membership and pulled in parts of the Global South. As diplomacy, it was a coup. As security policy, it’s mostly unsurprising. I complain that there’s little reason for special security rules to protect users of AI, since the threats are largely unformed, with Maury Pushing Back. What governments really seem to want is not security for users but  security from users, a paradigm that totally diverges from the direction of technology policy in past decades.

Maury, who requested listener comments on, his recent AI research, notes Meta’s divergent view on open source AI technology and offers his take on why the company’s path might be different from Google’s or Microsoft’s.

Jane and I are in accord in dissing California’s aggressive new AI rules, which appear to demand public notices every time a company uses spreadsheets containing personal data to make a business decision. I call it the most toxic fount of unanticipated tech liability since Illinois’s Biometric Information Privacy Act.

Maury, Jane and I explore the surprisingly complicated questions raised by Meta’s decision to offer an ad-free service for around $10 a month.

We explore what Paul calls the decline of global trade interdependence and the rise of a new mercantilism. Two cases in point: the U.S. decision not to trust the Saudis as partners in restricting China’s AI ambitions and China’s weirdly self-defeating announcement that it intends to be an unreliable source of graphite exports to the United States in future.

Jane and I puzzle over a rare and remarkable conservative victory in tech policy: the collapse of Biden administration efforts to warn social media about foreign election meddling. 

Finally, in quick hits,

• I cover the latest effort to extend section 702 of FISA, if only for a short time.

• Jane notes the difficulty faced by: Meta in trying to boot pedophiles off its platforms.

• Maury and I predict that the EU’s IoT vulnerability reporting requirements will raise the cost of IoT.

• I comment on the Canadian government’s deal with Google implementing the Online News Act

Download 484th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The OpenAI corporate drama came to a sudden end last week. So sudden, in fact, that the pundits never quite figured out What It All Means. Jim Dempsey and Michael Nelson take us through some of the possibilities. It was all about AI accelerationists v. decelerationists. Or it was all about effective altruism. Or maybe it was Sam Altman’s slippery ambition. Or perhaps a new AI breakthrough – a model that can actually do more math than the average American law student. The one thing that seems clear is that the winners include Sam Altman and Microsoft, while the losers include illusions about using corporate governance to engage in AI governance.

The Google antitrust trial is over – kind of. Michael Weiner tells us that all the testimony and evidence has been gathered on whether Google is monopolizing search, but briefs and argument will take months more – followed by years more fighting about remedy if Google is found to have violated the antitrust laws. He sums up the issues in dispute and makes a bold prediction about the outcome, all in about ten minutes.

Returning to AI, Jim and Michael Nelson dissect the latest position statement from Germany, France, and Italy. They see it as a repudiation of the increasingly kludgey AI Act pinballing its way through Brussels, and a big step in the direction of the “light touch” AI regulation that is mostly being adopted elsewhere around the globe. I suggest that the AI Act be redesignated the OBE Act in recognition of how thoroughly and frequently it’s been overtaken by events.

Meanwhile, cyberwar is posing an increasing threat to civil aviation. Michael Ellis covers the surprising ways in which GPS spoofing has begun to render even redundant air navigation tools unreliable. Iran and Israel come in for scrutiny. And it won’t be long before Russia and Ukraine develop similarly disruptive drone and counterdrone technology. It turns out, Michael Ellis reports, that Russia is likely ahead of the U.S. in this war-changing technology. 

Jim brings us up to date on the latest cybersecurity amendments from New York’s department of financial services. On the whole, they look incremental and mostly sensible.

Senator Ron Wyden (D-OR) is digging deep into his Golden Oldies collection, sending a letter to the White House expressing shock to have discovered a law enforcement data collection that the New York Times (and the rest of us) discovered in 2013. The program in question allows law enforcement to get call data but not content from AT&T with a subpoena. The only surprise is that AT&T has kept this data for much more than the industry-standard two or three years and that federal funds have helped pay for the storage.

Michael Nelson, on his way to India for cyber policy talks, touts that nation’s creative approach to the field, as highlighted in Carnegie’s series on India and technology. He’s less impressed by the UK’s enthusiasm for massive new legislative initiatives on technology. I think this is Prime Minister Rishi Sunak trying to show that Brexit really did give the UK new running room to the right of Brussels on data protection and law enforcement authority.

Download 483rd Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Paul Rosenzweig brings us up to date on the debate over renewing section 702, highlighting the introduction of the first credible “renew and reform” measure by the House Intelligence Committee. I’m hopeful that a similarly responsible bill will come soon from Senate Intelligence and that some version of the two will be adopted. Paul is less sanguine. And we all recognize that the wild card will be House Judiciary, which is drafting a bill that could change the renewal debate dramatically.

Jordan Schneider reviews the results of the Xi-Biden meeting in San Francisco and speculates on China’s diplomatic strategy in the global debate over AI regulation. No one disagrees that it makes sense for the U.S. and China to talk about the risks of letting AI run nuclear command and control; perhaps more interesting (and puzzling) is China’s interest in talking about AI and military drones.

Speaking of AI, Paul reports on Sam Altman’s defenestration from OpenAI and soft landing at Microsoft. Appropriately, Bing Image Creator provides the artwork for the defenestration but not the soft landing.  

Nick Weaver covers Meta’s not-so-new policy on political ads claiming that past elections were rigged. I cover the flap over TikTok videos promoting Osama Bin Laden’s letter justifying the 9/11 attack.

Jordan and I discuss reports that Applied Materials is facing a criminal probe over shipments to China's SMIC. 

Nick reports on the most creative ransomware tactic to date: compromising a corporate network and then filing an SEC complaint when the victim doesn’t disclose it within four days. This particular gang may have jumped the gun, he reports, but we’ll see more such reports in the future, and the SEC will have to decide whether it wants to foster this business model. 

I cover the effort to disclose a bitcoin wallet security flaw without helping criminals exploit it.

And Paul recommends the week’s long read: The Mirai Confession – a detailed and engaging story of the kids who invented Mirai, foisted it on the world, and then worked for the FBI for years, eventually avoiding jail, probably thanks to an FBI agent with a paternal streak.

Download 482nd Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [email protected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.